Adding upstream version 86.0.1.upstream/86.0.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

138 files changed, 44179 insertions, 0 deletions

diff --git a/tools/profiler/core/EHABIStackWalk.cpp b/tools/profiler/core/EHABIStackWalk.cpp
new file mode 100644
index 0000000000..ee3e824e23
--- /dev/null
+++ b/tools/profiler/core/EHABIStackWalk.cpp
@@ -0,0 +1,589 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * This is an implementation of stack unwinding according to a subset
+ * of the ARM Exception Handling ABI, as described in:
+ *   http://infocenter.arm.com/help/topic/com.arm.doc.ihi0038a/IHI0038A_ehabi.pdf
+ *
+ * This handles only the ARM-defined "personality routines" (chapter
+ * 9), and don't track the value of FP registers, because profiling
+ * needs only chain of PC/SP values.
+ *
+ * Because the exception handling info may not be accurate for all
+ * possible places where an async signal could occur (e.g., in a
+ * prologue or epilogue), this bounds-checks all stack accesses.
+ *
+ * This file uses "struct" for structures in the exception tables and
+ * "class" otherwise.  We should avoid violating the C++11
+ * standard-layout rules in the former.
+ */
+
+#include "EHABIStackWalk.h"
+
+#include "shared-libraries.h"
+#include "platform.h"
+
+#include "mozilla/Atomics.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/DebugOnly.h"
+#include "mozilla/EndianUtils.h"
+
+#include <algorithm>
+#include <elf.h>
+#include <stdint.h>
+#include <vector>
+#include <string>
+
+#ifndef PT_ARM_EXIDX
+#  define PT_ARM_EXIDX 0x70000001
+#endif
+
+namespace mozilla {
+
+struct PRel31 {
+  uint32_t mBits;
+  bool topBit() const { return mBits & 0x80000000; }
+  uint32_t value() const { return mBits & 0x7fffffff; }
+  int32_t offset() const { return (static_cast<int32_t>(mBits) << 1) >> 1; }
+  const void* compute() const {
+    return reinterpret_cast<const char*>(this) + offset();
+  }
+
+ private:
+  PRel31(const PRel31& copied) = delete;
+  PRel31() = delete;
+};
+
+struct EHEntry {
+  PRel31 startPC;
+  PRel31 exidx;
+
+ private:
+  EHEntry(const EHEntry& copied) = delete;
+  EHEntry() = delete;
+};
+
+class EHState {
+  // Note that any core register can be used as a "frame pointer" to
+  // influence the unwinding process, so this must track all of them.
+  uint32_t mRegs[16];
+
+ public:
+  bool unwind(const EHEntry* aEntry, const void* stackBase);
+  uint32_t& operator[](int i) { return mRegs[i]; }
+  const uint32_t& operator[](int i) const { return mRegs[i]; }
+  explicit EHState(const mcontext_t&);
+};
+
+enum { R_SP = 13, R_LR = 14, R_PC = 15 };
+
+class EHTable {
+  uint32_t mStartPC;
+  uint32_t mEndPC;
+  uint32_t mBaseAddress;
+  const EHEntry* mEntriesBegin;
+  const EHEntry* mEntriesEnd;
+  std::string mName;
+
+ public:
+  EHTable(const void* aELF, size_t aSize, const std::string& aName);
+  const EHEntry* lookup(uint32_t aPC) const;
+  bool isValid() const { return mEntriesEnd != mEntriesBegin; }
+  const std::string& name() const { return mName; }
+  uint32_t startPC() const { return mStartPC; }
+  uint32_t endPC() const { return mEndPC; }
+  uint32_t baseAddress() const { return mBaseAddress; }
+};
+
+class EHAddrSpace {
+  std::vector<uint32_t> mStarts;
+  std::vector<EHTable> mTables;
+  static mozilla::Atomic<const EHAddrSpace*> sCurrent;
+
+ public:
+  explicit EHAddrSpace(const std::vector<EHTable>& aTables);
+  const EHTable* lookup(uint32_t aPC) const;
+  static void Update();
+  static const EHAddrSpace* Get();
+};
+
+void EHABIStackWalkInit() { EHAddrSpace::Update(); }
+
+size_t EHABIStackWalk(const mcontext_t& aContext, void* stackBase, void** aSPs,
+                      void** aPCs, const size_t aNumFrames) {
+  const EHAddrSpace* space = EHAddrSpace::Get();
+  EHState state(aContext);
+  size_t count = 0;
+
+  while (count < aNumFrames) {
+    uint32_t pc = state[R_PC], sp = state[R_SP];
+    aPCs[count] = reinterpret_cast<void*>(pc);
+    aSPs[count] = reinterpret_cast<void*>(sp);
+    count++;
+
+    if (!space) break;
+    // TODO: cache these lookups.  Binary-searching libxul is
+    // expensive (possibly more expensive than doing the actual
+    // unwind), and even a small cache should help.
+    const EHTable* table = space->lookup(pc);
+    if (!table) break;
+    const EHEntry* entry = table->lookup(pc);
+    if (!entry) break;
+    if (!state.unwind(entry, stackBase)) break;
+  }
+
+  return count;
+}
+
+class EHInterp {
+ public:
+  // Note that stackLimit is exclusive and stackBase is inclusive
+  // (i.e, stackLimit < SP <= stackBase), following the convention
+  // set by the AAPCS spec.
+  EHInterp(EHState& aState, const EHEntry* aEntry, uint32_t aStackLimit,
+           uint32_t aStackBase)
+      : mState(aState),
+        mStackLimit(aStackLimit),
+        mStackBase(aStackBase),
+        mNextWord(0),
+        mWordsLeft(0),
+        mFailed(false) {
+    const PRel31& exidx = aEntry->exidx;
+    uint32_t firstWord;
+
+    if (exidx.mBits == 1) {  // EXIDX_CANTUNWIND
+      mFailed = true;
+      return;
+    }
+    if (exidx.topBit()) {
+      firstWord = exidx.mBits;
+    } else {
+      mNextWord = reinterpret_cast<const uint32_t*>(exidx.compute());
+      firstWord = *mNextWord++;
+    }
+
+    switch (firstWord >> 24) {
+      case 0x80:  // short
+        mWord = firstWord << 8;
+        mBytesLeft = 3;
+        break;
+      case 0x81:
+      case 0x82:  // long; catch descriptor size ignored
+        mWord = firstWord << 16;
+        mBytesLeft = 2;
+        mWordsLeft = (firstWord >> 16) & 0xff;
+        break;
+      default:
+        // unknown personality
+        mFailed = true;
+    }
+  }
+
+  bool unwind();
+
+ private:
+  // TODO: GCC has been observed not CSEing repeated reads of
+  // mState[R_SP] with writes to mFailed between them, suggesting that
+  // it hasn't determined that they can't alias and is thus missing
+  // optimization opportunities.  So, we may want to flatten EHState
+  // into this class; this may also make the code simpler.
+  EHState& mState;
+  uint32_t mStackLimit;
+  uint32_t mStackBase;
+  const uint32_t* mNextWord;
+  uint32_t mWord;
+  uint8_t mWordsLeft;
+  uint8_t mBytesLeft;
+  bool mFailed;
+
+  enum {
+    I_ADDSP = 0x00,  // 0sxxxxxx (subtract if s)
+    M_ADDSP = 0x80,
+    I_POPMASK = 0x80,  // 1000iiii iiiiiiii (if any i set)
+    M_POPMASK = 0xf0,
+    I_MOVSP = 0x90,  // 1001nnnn
+    M_MOVSP = 0xf0,
+    I_POPN = 0xa0,  // 1010lnnn
+    M_POPN = 0xf0,
+    I_FINISH = 0xb0,    // 10110000
+    I_POPLO = 0xb1,     // 10110001 0000iiii (if any i set)
+    I_ADDSPBIG = 0xb2,  // 10110010 uleb128
+    I_POPFDX = 0xb3,    // 10110011 sssscccc
+    I_POPFDX8 = 0xb8,   // 10111nnn
+    M_POPFDX8 = 0xf8,
+    // "Intel Wireless MMX" extensions omitted.
+    I_POPFDD = 0xc8,  // 1100100h sssscccc
+    M_POPFDD = 0xfe,
+    I_POPFDD8 = 0xd0,  // 11010nnn
+    M_POPFDD8 = 0xf8
+  };
+
+  uint8_t next() {
+    if (mBytesLeft == 0) {
+      if (mWordsLeft == 0) {
+        return I_FINISH;
+      }
+      mWordsLeft--;
+      mWord = *mNextWord++;
+      mBytesLeft = 4;
+    }
+    mBytesLeft--;
+    mWord = (mWord << 8) | (mWord >> 24);  // rotate
+    return mWord;
+  }
+
+  uint32_t& vSP() { return mState[R_SP]; }
+  uint32_t* ptrSP() { return reinterpret_cast<uint32_t*>(vSP()); }
+
+  void checkStackBase() {
+    if (vSP() > mStackBase) mFailed = true;
+  }
+  void checkStackLimit() {
+    if (vSP() <= mStackLimit) mFailed = true;
+  }
+  void checkStackAlign() {
+    if ((vSP() & 3) != 0) mFailed = true;
+  }
+  void checkStack() {
+    checkStackBase();
+    checkStackLimit();
+    checkStackAlign();
+  }
+
+  void popRange(uint8_t first, uint8_t last, uint16_t mask) {
+    bool hasSP = false;
+    uint32_t tmpSP;
+    if (mask == 0) mFailed = true;
+    for (uint8_t r = first; r <= last; ++r) {
+      if (mask & 1) {
+        if (r == R_SP) {
+          hasSP = true;
+          tmpSP = *ptrSP();
+        } else
+          mState[r] = *ptrSP();
+        vSP() += 4;
+        checkStackBase();
+        if (mFailed) return;
+      }
+      mask >>= 1;
+    }
+    if (hasSP) {
+      vSP() = tmpSP;
+      checkStack();
+    }
+  }
+};
+
+bool EHState::unwind(const EHEntry* aEntry, const void* stackBasePtr) {
+  // The unwinding program cannot set SP to less than the initial value.
+  uint32_t stackLimit = mRegs[R_SP] - 4;
+  uint32_t stackBase = reinterpret_cast<uint32_t>(stackBasePtr);
+  EHInterp interp(*this, aEntry, stackLimit, stackBase);
+  return interp.unwind();
+}
+
+bool EHInterp::unwind() {
+  mState[R_PC] = 0;
+  checkStack();
+  while (!mFailed) {
+    uint8_t insn = next();
+#if DEBUG_EHABI_UNWIND
+    LOG("unwind insn = %02x", (unsigned)insn);
+#endif
+    // Try to put the common cases first.
+
+    // 00xxxxxx: vsp = vsp + (xxxxxx << 2) + 4
+    // 01xxxxxx: vsp = vsp - (xxxxxx << 2) - 4
+    if ((insn & M_ADDSP) == I_ADDSP) {
+      uint32_t offset = ((insn & 0x3f) << 2) + 4;
+      if (insn & 0x40) {
+        vSP() -= offset;
+        checkStackLimit();
+      } else {
+        vSP() += offset;
+        checkStackBase();
+      }
+      continue;
+    }
+
+    // 10100nnn: Pop r4-r[4+nnn]
+    // 10101nnn: Pop r4-r[4+nnn], r14
+    if ((insn & M_POPN) == I_POPN) {
+      uint8_t n = (insn & 0x07) + 1;
+      bool lr = insn & 0x08;
+      uint32_t* ptr = ptrSP();
+      vSP() += (n + (lr ? 1 : 0)) * 4;
+      checkStackBase();
+      for (uint8_t r = 4; r < 4 + n; ++r) mState[r] = *ptr++;
+      if (lr) mState[R_LR] = *ptr++;
+      continue;
+    }
+
+    // 1011000: Finish
+    if (insn == I_FINISH) {
+      if (mState[R_PC] == 0) {
+        mState[R_PC] = mState[R_LR];
+        // Non-standard change (bug 916106): Prevent the caller from
+        // re-using LR.  Since the caller is by definition not a leaf
+        // routine, it will have to restore LR from somewhere to
+        // return to its own caller, so we can safely zero it here.
+        // This makes a difference only if an error in unwinding
+        // (e.g., caused by starting from within a prologue/epilogue)
+        // causes us to load a pointer to a leaf routine as LR; if we
+        // don't do something, we'll go into an infinite loop of
+        // "returning" to that same function.
+        mState[R_LR] = 0;
+      }
+      return true;
+    }
+
+    // 1001nnnn: Set vsp = r[nnnn]
+    if ((insn & M_MOVSP) == I_MOVSP) {
+      vSP() = mState[insn & 0x0f];
+      checkStack();
+      continue;
+    }
+
+    // 11001000 sssscccc: Pop VFP regs D[16+ssss]-D[16+ssss+cccc] (as FLDMFDD)
+    // 11001001 sssscccc: Pop VFP regs D[ssss]-D[ssss+cccc] (as FLDMFDD)
+    if ((insn & M_POPFDD) == I_POPFDD) {
+      uint8_t n = (next() & 0x0f) + 1;
+      // Note: if the 16+ssss+cccc > 31, the encoding is reserved.
+      // As the space is currently unused, we don't try to check.
+      vSP() += 8 * n;
+      checkStackBase();
+      continue;
+    }
+
+    // 11010nnn: Pop VFP regs D[8]-D[8+nnn] (as FLDMFDD)
+    if ((insn & M_POPFDD8) == I_POPFDD8) {
+      uint8_t n = (insn & 0x07) + 1;
+      vSP() += 8 * n;
+      checkStackBase();
+      continue;
+    }
+
+    // 10110010 uleb128: vsp = vsp + 0x204 + (uleb128 << 2)
+    if (insn == I_ADDSPBIG) {
+      uint32_t acc = 0;
+      uint8_t shift = 0;
+      uint8_t byte;
+      do {
+        if (shift >= 32) return false;
+        byte = next();
+        acc |= (byte & 0x7f) << shift;
+        shift += 7;
+      } while (byte & 0x80);
+      uint32_t offset = 0x204 + (acc << 2);
+      // The calculations above could have overflowed.
+      // But the one we care about is this:
+      if (vSP() + offset < vSP()) mFailed = true;
+      vSP() += offset;
+      // ...so that this is the only other check needed:
+      checkStackBase();
+      continue;
+    }
+
+    // 1000iiii iiiiiiii (i not all 0): Pop under masks {r15-r12}, {r11-r4}
+    if ((insn & M_POPMASK) == I_POPMASK) {
+      popRange(4, 15, ((insn & 0x0f) << 8) | next());
+      continue;
+    }
+
+    // 1011001 0000iiii (i not all 0): Pop under mask {r3-r0}
+    if (insn == I_POPLO) {
+      popRange(0, 3, next() & 0x0f);
+      continue;
+    }
+
+    // 10110011 sssscccc: Pop VFP regs D[ssss]-D[ssss+cccc] (as FLDMFDX)
+    if (insn == I_POPFDX) {
+      uint8_t n = (next() & 0x0f) + 1;
+      vSP() += 8 * n + 4;
+      checkStackBase();
+      continue;
+    }
+
+    // 10111nnn: Pop VFP regs D[8]-D[8+nnn] (as FLDMFDX)
+    if ((insn & M_POPFDX8) == I_POPFDX8) {
+      uint8_t n = (insn & 0x07) + 1;
+      vSP() += 8 * n + 4;
+      checkStackBase();
+      continue;
+    }
+
+    // unhandled instruction
+#ifdef DEBUG_EHABI_UNWIND
+    LOG("Unhandled EHABI instruction 0x%02x", insn);
+#endif
+    mFailed = true;
+  }
+  return false;
+}
+
+bool operator<(const EHTable& lhs, const EHTable& rhs) {
+  return lhs.startPC() < rhs.startPC();
+}
+
+// Async signal unsafe.
+EHAddrSpace::EHAddrSpace(const std::vector<EHTable>& aTables)
+    : mTables(aTables) {
+  std::sort(mTables.begin(), mTables.end());
+  DebugOnly<uint32_t> lastEnd = 0;
+  for (std::vector<EHTable>::iterator i = mTables.begin(); i != mTables.end();
+       ++i) {
+    MOZ_ASSERT(i->startPC() >= lastEnd);
+    mStarts.push_back(i->startPC());
+    lastEnd = i->endPC();
+  }
+}
+
+const EHTable* EHAddrSpace::lookup(uint32_t aPC) const {
+  ptrdiff_t i = (std::upper_bound(mStarts.begin(), mStarts.end(), aPC) -
+                 mStarts.begin()) -
+                1;
+
+  if (i < 0 || aPC >= mTables[i].endPC()) return 0;
+  return &mTables[i];
+}
+
+const EHEntry* EHTable::lookup(uint32_t aPC) const {
+  MOZ_ASSERT(aPC >= mStartPC);
+  if (aPC >= mEndPC) return nullptr;
+
+  const EHEntry* begin = mEntriesBegin;
+  const EHEntry* end = mEntriesEnd;
+  MOZ_ASSERT(begin < end);
+  if (aPC < reinterpret_cast<uint32_t>(begin->startPC.compute()))
+    return nullptr;
+
+  while (end - begin > 1) {
+#ifdef EHABI_UNWIND_MORE_ASSERTS
+    if ((end - 1)->startPC.compute() < begin->startPC.compute()) {
+      MOZ_CRASH("unsorted exidx");
+    }
+#endif
+    const EHEntry* mid = begin + (end - begin) / 2;
+    if (aPC < reinterpret_cast<uint32_t>(mid->startPC.compute()))
+      end = mid;
+    else
+      begin = mid;
+  }
+  return begin;
+}
+
+#if MOZ_LITTLE_ENDIAN()
+static const unsigned char hostEndian = ELFDATA2LSB;
+#elif MOZ_BIG_ENDIAN()
+static const unsigned char hostEndian = ELFDATA2MSB;
+#else
+#  error "No endian?"
+#endif
+
+// Async signal unsafe: std::vector::reserve, std::string copy ctor.
+EHTable::EHTable(const void* aELF, size_t aSize, const std::string& aName)
+    : mStartPC(~0),  // largest uint32_t
+      mEndPC(0),
+      mEntriesBegin(nullptr),
+      mEntriesEnd(nullptr),
+      mName(aName) {
+  const uint32_t fileHeaderAddr = reinterpret_cast<uint32_t>(aELF);
+
+  if (aSize < sizeof(Elf32_Ehdr)) return;
+
+  const Elf32_Ehdr& file = *(reinterpret_cast<Elf32_Ehdr*>(fileHeaderAddr));
+  if (memcmp(&file.e_ident[EI_MAG0], ELFMAG, SELFMAG) != 0 ||
+      file.e_ident[EI_CLASS] != ELFCLASS32 ||
+      file.e_ident[EI_DATA] != hostEndian ||
+      file.e_ident[EI_VERSION] != EV_CURRENT || file.e_machine != EM_ARM ||
+      file.e_version != EV_CURRENT)
+    // e_flags?
+    return;
+
+  MOZ_ASSERT(file.e_phoff + file.e_phnum * file.e_phentsize <= aSize);
+  const Elf32_Phdr *exidxHdr = 0, *zeroHdr = 0;
+  for (unsigned i = 0; i < file.e_phnum; ++i) {
+    const Elf32_Phdr& phdr = *(reinterpret_cast<Elf32_Phdr*>(
+        fileHeaderAddr + file.e_phoff + i * file.e_phentsize));
+    if (phdr.p_type == PT_ARM_EXIDX) {
+      exidxHdr = &phdr;
+    } else if (phdr.p_type == PT_LOAD) {
+      if (phdr.p_offset == 0) {
+        zeroHdr = &phdr;
+      }
+      if (phdr.p_flags & PF_X) {
+        mStartPC = std::min(mStartPC, phdr.p_vaddr);
+        mEndPC = std::max(mEndPC, phdr.p_vaddr + phdr.p_memsz);
+      }
+    }
+  }
+  if (!exidxHdr) return;
+  if (!zeroHdr) return;
+  mBaseAddress = fileHeaderAddr - zeroHdr->p_vaddr;
+  mStartPC += mBaseAddress;
+  mEndPC += mBaseAddress;
+  mEntriesBegin =
+      reinterpret_cast<const EHEntry*>(mBaseAddress + exidxHdr->p_vaddr);
+  mEntriesEnd = reinterpret_cast<const EHEntry*>(
+      mBaseAddress + exidxHdr->p_vaddr + exidxHdr->p_memsz);
+}
+
+mozilla::Atomic<const EHAddrSpace*> EHAddrSpace::sCurrent(nullptr);
+
+// Async signal safe; can fail if Update() hasn't returned yet.
+const EHAddrSpace* EHAddrSpace::Get() { return sCurrent; }
+
+// Collect unwinding information from loaded objects.  Calls after the
+// first have no effect.  Async signal unsafe.
+void EHAddrSpace::Update() {
+  const EHAddrSpace* space = sCurrent;
+  if (space) return;
+
+  SharedLibraryInfo info = SharedLibraryInfo::GetInfoForSelf();
+  std::vector<EHTable> tables;
+
+  for (size_t i = 0; i < info.GetSize(); ++i) {
+    const SharedLibrary& lib = info.GetEntry(i);
+    // FIXME: This isn't correct if the start address isn't p_offset 0, because
+    // the start address will not point at the file header. But this is worked
+    // around by magic number checks in the EHTable constructor.
+    EHTable tab(reinterpret_cast<const void*>(lib.GetStart()),
+                lib.GetEnd() - lib.GetStart(), lib.GetNativeDebugPath());
+    if (tab.isValid()) tables.push_back(tab);
+  }
+  space = new EHAddrSpace(tables);
+
+  if (!sCurrent.compareExchange(nullptr, space)) {
+    delete space;
+    space = sCurrent;
+  }
+}
+
+EHState::EHState(const mcontext_t& context) {
+#ifdef linux
+  mRegs[0] = context.arm_r0;
+  mRegs[1] = context.arm_r1;
+  mRegs[2] = context.arm_r2;
+  mRegs[3] = context.arm_r3;
+  mRegs[4] = context.arm_r4;
+  mRegs[5] = context.arm_r5;
+  mRegs[6] = context.arm_r6;
+  mRegs[7] = context.arm_r7;
+  mRegs[8] = context.arm_r8;
+  mRegs[9] = context.arm_r9;
+  mRegs[10] = context.arm_r10;
+  mRegs[11] = context.arm_fp;
+  mRegs[12] = context.arm_ip;
+  mRegs[13] = context.arm_sp;
+  mRegs[14] = context.arm_lr;
+  mRegs[15] = context.arm_pc;
+#else
+#  error "Unhandled OS for ARM EHABI unwinding"
+#endif
+}
+
+}  // namespace mozilla
diff --git a/tools/profiler/core/EHABIStackWalk.h b/tools/profiler/core/EHABIStackWalk.h
new file mode 100644
index 0000000000..61286290b8
--- /dev/null
+++ b/tools/profiler/core/EHABIStackWalk.h
@@ -0,0 +1,28 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * This is an implementation of stack unwinding according to a subset
+ * of the ARM Exception Handling ABI; see the comment at the top of
+ * the .cpp file for details.
+ */
+
+#ifndef mozilla_EHABIStackWalk_h__
+#define mozilla_EHABIStackWalk_h__
+
+#include <stddef.h>
+#include <ucontext.h>
+
+namespace mozilla {
+
+void EHABIStackWalkInit();
+
+size_t EHABIStackWalk(const mcontext_t& aContext, void* stackBase, void** aSPs,
+                      void** aPCs, size_t aNumFrames);
+
+}  // namespace mozilla
+
+#endif
diff --git a/tools/profiler/core/PageInformation.cpp b/tools/profiler/core/PageInformation.cpp
new file mode 100644
index 0000000000..b4ba33f6be
--- /dev/null
+++ b/tools/profiler/core/PageInformation.cpp
@@ -0,0 +1,41 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "PageInformation.h"
+
+#include "mozilla/ProfileJSONWriter.h"
+
+PageInformation::PageInformation(uint64_t aBrowsingContextID,
+                                 uint64_t aInnerWindowID, const nsCString& aUrl,
+                                 uint64_t aEmbedderInnerWindowID)
+    : mBrowsingContextID(aBrowsingContextID),
+      mInnerWindowID(aInnerWindowID),
+      mUrl(aUrl),
+      mEmbedderInnerWindowID(aEmbedderInnerWindowID) {}
+
+bool PageInformation::Equals(PageInformation* aOtherPageInfo) const {
+  // It's enough to check inner window IDs because they are unique for each
+  // page. Therefore, we don't have to check browsing context ID or url.
+  return InnerWindowID() == aOtherPageInfo->InnerWindowID();
+}
+
+void PageInformation::StreamJSON(SpliceableJSONWriter& aWriter) const {
+  // Here, we are converting uint64_t to double. Both Browsing Context and Inner
+  // Window IDs are creating using `nsContentUtils::GenerateProcessSpecificId`,
+  // which is specifically designed to only use 53 of the 64 bits to be lossless
+  // when passed into and out of JS as a double.
+  aWriter.StartObjectElement();
+  aWriter.DoubleProperty("browsingContextID", BrowsingContextID());
+  aWriter.DoubleProperty("innerWindowID", InnerWindowID());
+  aWriter.StringProperty("url", Url());
+  aWriter.DoubleProperty("embedderInnerWindowID", EmbedderInnerWindowID());
+  aWriter.EndObject();
+}
+
+size_t PageInformation::SizeOfIncludingThis(
+    mozilla::MallocSizeOf aMallocSizeOf) const {
+  return aMallocSizeOf(this);
+}
diff --git a/tools/profiler/core/PageInformation.h b/tools/profiler/core/PageInformation.h
new file mode 100644
index 0000000000..0f10c6e99d
--- /dev/null
+++ b/tools/profiler/core/PageInformation.h
@@ -0,0 +1,65 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef PageInformation_h
+#define PageInformation_h
+
+#include "mozilla/Maybe.h"
+#include "mozilla/MemoryReporting.h"
+#include "nsISupportsImpl.h"
+#include "nsString.h"
+
+namespace mozilla {
+namespace baseprofiler {
+class SpliceableJSONWriter;
+}  // namespace baseprofiler
+}  // namespace mozilla
+
+// This class contains information that's relevant to a single page only
+// while the page information is important and registered with the profiler,
+// but regardless of whether the profiler is running. All accesses to it are
+// protected by the profiler state lock.
+// When the page gets unregistered, we keep the profiler buffer position
+// to determine if we are still using this page. If not, we unregister
+// it in the next page registration.
+class PageInformation final {
+ public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(PageInformation)
+  PageInformation(uint64_t aBrowsingContextID, uint64_t aInnerWindowID,
+                  const nsCString& aUrl, uint64_t aEmbedderInnerWindowID);
+
+  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+  bool Equals(PageInformation* aOtherPageInfo) const;
+  void StreamJSON(mozilla::baseprofiler::SpliceableJSONWriter& aWriter) const;
+
+  uint64_t InnerWindowID() const { return mInnerWindowID; }
+  uint64_t BrowsingContextID() const { return mBrowsingContextID; }
+  const nsCString& Url() const { return mUrl; }
+  uint64_t EmbedderInnerWindowID() const { return mEmbedderInnerWindowID; }
+
+  mozilla::Maybe<uint64_t> BufferPositionWhenUnregistered() const {
+    return mBufferPositionWhenUnregistered;
+  }
+
+  void NotifyUnregistered(uint64_t aBufferPosition) {
+    mBufferPositionWhenUnregistered = mozilla::Some(aBufferPosition);
+  }
+
+ private:
+  const uint64_t mBrowsingContextID;
+  const uint64_t mInnerWindowID;
+  const nsCString mUrl;
+  const uint64_t mEmbedderInnerWindowID;
+
+  // Holds the buffer position when page is unregistered.
+  // It's used to determine if we still use this page in the profiler or
+  // not.
+  mozilla::Maybe<uint64_t> mBufferPositionWhenUnregistered;
+
+  virtual ~PageInformation() = default;
+};
+
+#endif  // PageInformation_h
diff --git a/tools/profiler/core/PlatformMacros.h b/tools/profiler/core/PlatformMacros.h
new file mode 100644
index 0000000000..c72e94c128
--- /dev/null
+++ b/tools/profiler/core/PlatformMacros.h
@@ -0,0 +1,130 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef PLATFORM_MACROS_H
+#define PLATFORM_MACROS_H
+
+// Define platform selection macros in a consistent way. Don't add anything
+// else to this file, so it can remain freestanding. The primary factorisation
+// is on (ARCH,OS) pairs ("PLATforms") but ARCH_ and OS_ macros are defined
+// too, since they are sometimes convenient.
+//
+// Note: "GP" is short for "Gecko Profiler".
+
+#undef GP_PLAT_x86_android
+#undef GP_PLAT_amd64_android
+#undef GP_PLAT_arm_android
+#undef GP_PLAT_arm64_android
+#undef GP_PLAT_x86_linux
+#undef GP_PLAT_amd64_linux
+#undef GP_PLAT_arm_linux
+#undef GP_PLAT_mips64_linux
+#undef GP_PLAT_amd64_darwin
+#undef GP_PLAT_arm64_darwin
+#undef GP_PLAT_x86_windows
+#undef GP_PLAT_amd64_windows
+#undef GP_PLAT_arm64_windows
+
+#undef GP_ARCH_x86
+#undef GP_ARCH_amd64
+#undef GP_ARCH_arm
+#undef GP_ARCH_arm64
+#undef GP_ARCH_mips64
+
+#undef GP_OS_android
+#undef GP_OS_linux
+#undef GP_OS_darwin
+#undef GP_OS_windows
+
+// We test __ANDROID__ before __linux__ because __linux__ is defined on both
+// Android and Linux, whereas GP_OS_android is not defined on vanilla Linux.
+
+#if defined(__ANDROID__) && defined(__i386__)
+#  define GP_PLAT_x86_android 1
+#  define GP_ARCH_x86 1
+#  define GP_OS_android 1
+
+#elif defined(__ANDROID__) && defined(__x86_64__)
+#  define GP_PLAT_amd64_android 1
+#  define GP_ARCH_amd64 1
+#  define GP_OS_android 1
+
+#elif defined(__ANDROID__) && defined(__arm__)
+#  define GP_PLAT_arm_android 1
+#  define GP_ARCH_arm 1
+#  define GP_OS_android 1
+
+#elif defined(__ANDROID__) && defined(__aarch64__)
+#  define GP_PLAT_arm64_android 1
+#  define GP_ARCH_arm64 1
+#  define GP_OS_android 1
+
+#elif defined(__linux__) && defined(__i386__)
+#  define GP_PLAT_x86_linux 1
+#  define GP_ARCH_x86 1
+#  define GP_OS_linux 1
+
+#elif defined(__linux__) && defined(__x86_64__)
+#  define GP_PLAT_amd64_linux 1
+#  define GP_ARCH_amd64 1
+#  define GP_OS_linux 1
+
+#elif defined(__linux__) && defined(__arm__)
+#  define GP_PLAT_arm_linux 1
+#  define GP_ARCH_arm 1
+#  define GP_OS_linux 1
+
+#elif defined(__linux__) && defined(__aarch64__)
+#  define GP_PLAT_arm64_linux 1
+#  define GP_ARCH_arm64 1
+#  define GP_OS_linux 1
+
+#elif defined(__linux__) && defined(__mips64)
+#  define GP_PLAT_mips64_linux 1
+#  define GP_ARCH_mips64 1
+#  define GP_OS_linux 1
+
+#elif defined(__APPLE__) && defined(__aarch64__)
+#  define GP_PLAT_arm64_darwin 1
+#  define GP_ARCH_arm64 1
+#  define GP_OS_darwin 1
+
+#elif defined(__APPLE__) && defined(__x86_64__)
+#  define GP_PLAT_amd64_darwin 1
+#  define GP_ARCH_amd64 1
+#  define GP_OS_darwin 1
+
+#elif defined(__FreeBSD__) && defined(__x86_64__)
+#  define GP_PLAT_amd64_freebsd 1
+#  define GP_ARCH_amd64 1
+#  define GP_OS_freebsd 1
+
+#elif defined(__FreeBSD__) && defined(__aarch64__)
+#  define GP_PLAT_arm64_freebsd 1
+#  define GP_ARCH_arm64 1
+#  define GP_OS_freebsd 1
+
+#elif (defined(_MSC_VER) || defined(__MINGW32__)) && \
+    (defined(_M_IX86) || defined(__i386__))
+#  define GP_PLAT_x86_windows 1
+#  define GP_ARCH_x86 1
+#  define GP_OS_windows 1
+
+#elif (defined(_MSC_VER) || defined(__MINGW32__)) && \
+    (defined(_M_X64) || defined(__x86_64__))
+#  define GP_PLAT_amd64_windows 1
+#  define GP_ARCH_amd64 1
+#  define GP_OS_windows 1
+
+#elif defined(_MSC_VER) && defined(_M_ARM64)
+#  define GP_PLAT_arm64_windows 1
+#  define GP_ARCH_arm64 1
+#  define GP_OS_windows 1
+
+#else
+#  error "Unsupported platform"
+#endif
+
+#endif /* ndef PLATFORM_MACROS_H */
diff --git a/tools/profiler/core/ProfileBuffer.cpp b/tools/profiler/core/ProfileBuffer.cpp
new file mode 100644
index 0000000000..887e7cc70a
--- /dev/null
+++ b/tools/profiler/core/ProfileBuffer.cpp
@@ -0,0 +1,236 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProfileBuffer.h"
+
+#include "BaseProfiler.h"
+#include "js/GCAPI.h"
+#include "jsfriendapi.h"
+#include "mozilla/MathAlgorithms.h"
+#include "nsJSPrincipals.h"
+#include "nsScriptSecurityManager.h"
+
+using namespace mozilla;
+
+ProfileBuffer::ProfileBuffer(ProfileChunkedBuffer& aBuffer)
+    : mEntries(aBuffer) {
+  // Assume the given buffer is in-session.
+  MOZ_ASSERT(mEntries.IsInSession());
+}
+
+/* static */
+ProfileBufferBlockIndex ProfileBuffer::AddEntry(
+    ProfileChunkedBuffer& aProfileChunkedBuffer,
+    const ProfileBufferEntry& aEntry) {
+  switch (aEntry.GetKind()) {
+#define SWITCH_KIND(KIND, TYPE, SIZE)                          \
+  case ProfileBufferEntry::Kind::KIND: {                       \
+    return aProfileChunkedBuffer.PutFrom(&aEntry, 1 + (SIZE)); \
+  }
+
+    FOR_EACH_PROFILE_BUFFER_ENTRY_KIND(SWITCH_KIND)
+
+#undef SWITCH_KIND
+    default:
+      MOZ_ASSERT(false, "Unhandled ProfilerBuffer entry KIND");
+      return ProfileBufferBlockIndex{};
+  }
+}
+
+// Called from signal, call only reentrant functions
+uint64_t ProfileBuffer::AddEntry(const ProfileBufferEntry& aEntry) {
+  return AddEntry(mEntries, aEntry).ConvertToProfileBufferIndex();
+}
+
+/* static */
+ProfileBufferBlockIndex ProfileBuffer::AddThreadIdEntry(
+    ProfileChunkedBuffer& aProfileChunkedBuffer, int aThreadId) {
+  return AddEntry(aProfileChunkedBuffer,
+                  ProfileBufferEntry::ThreadId(aThreadId));
+}
+
+uint64_t ProfileBuffer::AddThreadIdEntry(int aThreadId) {
+  return AddThreadIdEntry(mEntries, aThreadId).ConvertToProfileBufferIndex();
+}
+
+void ProfileBuffer::CollectCodeLocation(
+    const char* aLabel, const char* aStr, uint32_t aFrameFlags,
+    uint64_t aInnerWindowID, const Maybe<uint32_t>& aLineNumber,
+    const Maybe<uint32_t>& aColumnNumber,
+    const Maybe<JS::ProfilingCategoryPair>& aCategoryPair) {
+  AddEntry(ProfileBufferEntry::Label(aLabel));
+  AddEntry(ProfileBufferEntry::FrameFlags(uint64_t(aFrameFlags)));
+
+  if (aStr) {
+    // Store the string using one or more DynamicStringFragment entries.
+    size_t strLen = strlen(aStr) + 1;  // +1 for the null terminator
+    // If larger than the prescribed limit, we will cut the string and end it
+    // with an ellipsis.
+    const bool tooBig = strLen > kMaxFrameKeyLength;
+    if (tooBig) {
+      strLen = kMaxFrameKeyLength;
+    }
+    char chars[ProfileBufferEntry::kNumChars];
+    for (size_t j = 0;; j += ProfileBufferEntry::kNumChars) {
+      // Store up to kNumChars characters in the entry.
+      size_t len = ProfileBufferEntry::kNumChars;
+      const bool last = j + len >= strLen;
+      if (last) {
+        // Only the last entry may be smaller than kNumChars.
+        len = strLen - j;
+        if (tooBig) {
+          // That last entry is part of a too-big string, replace the end
+          // characters with an ellipsis "...".
+          len = std::max(len, size_t(4));
+          chars[len - 4] = '.';
+          chars[len - 3] = '.';
+          chars[len - 2] = '.';
+          chars[len - 1] = '\0';
+          // Make sure the memcpy will not overwrite our ellipsis!
+          len -= 4;
+        }
+      }
+      memcpy(chars, &aStr[j], len);
+      AddEntry(ProfileBufferEntry::DynamicStringFragment(chars));
+      if (last) {
+        break;
+      }
+    }
+  }
+
+  if (aInnerWindowID) {
+    AddEntry(ProfileBufferEntry::InnerWindowID(aInnerWindowID));
+  }
+
+  if (aLineNumber) {
+    AddEntry(ProfileBufferEntry::LineNumber(*aLineNumber));
+  }
+
+  if (aColumnNumber) {
+    AddEntry(ProfileBufferEntry::ColumnNumber(*aColumnNumber));
+  }
+
+  if (aCategoryPair.isSome()) {
+    AddEntry(ProfileBufferEntry::CategoryPair(int(*aCategoryPair)));
+  }
+}
+
+size_t ProfileBuffer::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const {
+  // Measurement of the following members may be added later if DMD finds it
+  // is worthwhile:
+  // - memory pointed to by the elements within mEntries
+  return mEntries.SizeOfExcludingThis(aMallocSizeOf);
+}
+
+size_t ProfileBuffer::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const {
+  return aMallocSizeOf(this) + SizeOfExcludingThis(aMallocSizeOf);
+}
+
+void ProfileBuffer::CollectOverheadStats(double aSamplingTimeMs,
+                                         TimeDuration aLocking,
+                                         TimeDuration aCleaning,
+                                         TimeDuration aCounters,
+                                         TimeDuration aThreads) {
+  double timeUs = aSamplingTimeMs * 1000.0;
+  if (mFirstSamplingTimeUs == 0.0) {
+    mFirstSamplingTimeUs = timeUs;
+  } else {
+    // Note that we'll have 1 fewer interval than other numbers (because
+    // we need both ends of an interval to know its duration). The final
+    // difference should be insignificant over the expected many thousands
+    // of iterations.
+    mIntervalsUs.Count(timeUs - mLastSamplingTimeUs);
+  }
+  mLastSamplingTimeUs = timeUs;
+  double locking = aLocking.ToMilliseconds() * 1000.0;
+  double cleaning = aCleaning.ToMilliseconds() * 1000.0;
+  double counters = aCounters.ToMilliseconds() * 1000.0;
+  double threads = aThreads.ToMilliseconds() * 1000.0;
+
+  mOverheadsUs.Count(locking + cleaning + counters + threads);
+  mLockingsUs.Count(locking);
+  mCleaningsUs.Count(cleaning);
+  mCountersUs.Count(counters);
+  mThreadsUs.Count(threads);
+
+  AddEntry(ProfileBufferEntry::ProfilerOverheadTime(aSamplingTimeMs));
+  AddEntry(ProfileBufferEntry::ProfilerOverheadDuration(locking));
+  AddEntry(ProfileBufferEntry::ProfilerOverheadDuration(cleaning));
+  AddEntry(ProfileBufferEntry::ProfilerOverheadDuration(counters));
+  AddEntry(ProfileBufferEntry::ProfilerOverheadDuration(threads));
+}
+
+ProfilerBufferInfo ProfileBuffer::GetProfilerBufferInfo() const {
+  return {BufferRangeStart(),
+          BufferRangeEnd(),
+          static_cast<uint32_t>(*mEntries.BufferLength() /
+                                8),  // 8 bytes per entry.
+          mIntervalsUs,
+          mOverheadsUs,
+          mLockingsUs,
+          mCleaningsUs,
+          mCountersUs,
+          mThreadsUs};
+}
+
+/* ProfileBufferCollector */
+
+void ProfileBufferCollector::CollectNativeLeafAddr(void* aAddr) {
+  mBuf.AddEntry(ProfileBufferEntry::NativeLeafAddr(aAddr));
+}
+
+void ProfileBufferCollector::CollectJitReturnAddr(void* aAddr) {
+  mBuf.AddEntry(ProfileBufferEntry::JitReturnAddr(aAddr));
+}
+
+void ProfileBufferCollector::CollectWasmFrame(const char* aLabel) {
+  mBuf.CollectCodeLocation("", aLabel, 0, 0, Nothing(), Nothing(), Nothing());
+}
+
+void ProfileBufferCollector::CollectProfilingStackFrame(
+    const js::ProfilingStackFrame& aFrame) {
+  // WARNING: this function runs within the profiler's "critical section".
+
+  MOZ_ASSERT(aFrame.isLabelFrame() ||
+             (aFrame.isJsFrame() && !aFrame.isOSRFrame()));
+
+  const char* label = aFrame.label();
+  const char* dynamicString = aFrame.dynamicString();
+  Maybe<uint32_t> line;
+  Maybe<uint32_t> column;
+
+  if (aFrame.isJsFrame()) {
+    // There are two kinds of JS frames that get pushed onto the ProfilingStack.
+    //
+    // - label = "", dynamic string = <something>
+    // - label = "js::RunScript", dynamic string = nullptr
+    //
+    // The line number is only interesting in the first case.
+
+    if (label[0] == '\0') {
+      MOZ_ASSERT(dynamicString);
+
+      // We call aFrame.script() repeatedly -- rather than storing the result in
+      // a local variable in order -- to avoid rooting hazards.
+      if (aFrame.script()) {
+        if (aFrame.pc()) {
+          unsigned col = 0;
+          line = Some(JS_PCToLineNumber(aFrame.script(), aFrame.pc(), &col));
+          column = Some(col);
+        }
+      }
+
+    } else {
+      MOZ_ASSERT(strcmp(label, "js::RunScript") == 0 && !dynamicString);
+    }
+  } else {
+    MOZ_ASSERT(aFrame.isLabelFrame());
+  }
+
+  mBuf.CollectCodeLocation(label, dynamicString, aFrame.flags(),
+                           aFrame.realmID(), line, column,
+                           Some(aFrame.categoryPair()));
+}
diff --git a/tools/profiler/core/ProfileBuffer.h b/tools/profiler/core/ProfileBuffer.h
new file mode 100644
index 0000000000..e172577566
--- /dev/null
+++ b/tools/profiler/core/ProfileBuffer.h
@@ -0,0 +1,215 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZ_PROFILE_BUFFER_H
+#define MOZ_PROFILE_BUFFER_H
+
+#include "GeckoProfiler.h"
+#include "ProfileBufferEntry.h"
+
+#include "mozilla/Maybe.h"
+#include "mozilla/PowerOfTwo.h"
+#include "mozilla/ProfileBufferChunkManagerSingle.h"
+#include "mozilla/ProfileChunkedBuffer.h"
+
+class RunningTimes;
+
+// Class storing most profiling data in a ProfileChunkedBuffer.
+//
+// This class is used as a queue of entries which, after construction, never
+// allocates. This makes it safe to use in the profiler's "critical section".
+class ProfileBuffer final {
+ public:
+  // ProfileBuffer constructor
+  // @param aBuffer The in-session ProfileChunkedBuffer to use as buffer
+  // manager.
+  explicit ProfileBuffer(mozilla::ProfileChunkedBuffer& aBuffer);
+
+  mozilla::ProfileChunkedBuffer& UnderlyingChunkedBuffer() const {
+    return mEntries;
+  }
+
+  bool IsThreadSafe() const { return mEntries.IsThreadSafe(); }
+
+  // Add |aEntry| to the buffer, ignoring what kind of entry it is.
+  uint64_t AddEntry(const ProfileBufferEntry& aEntry);
+
+  // Add to the buffer a sample start (ThreadId) entry for aThreadId.
+  // Returns the position of the entry.
+  uint64_t AddThreadIdEntry(int aThreadId);
+
+  void CollectCodeLocation(
+      const char* aLabel, const char* aStr, uint32_t aFrameFlags,
+      uint64_t aInnerWindowID, const mozilla::Maybe<uint32_t>& aLineNumber,
+      const mozilla::Maybe<uint32_t>& aColumnNumber,
+      const mozilla::Maybe<JS::ProfilingCategoryPair>& aCategoryPair);
+
+  // Maximum size of a frameKey string that we'll handle.
+  static const size_t kMaxFrameKeyLength = 512;
+
+  // Add JIT frame information to aJITFrameInfo for any JitReturnAddr entries
+  // that are currently in the buffer at or after aRangeStart, in samples
+  // for the given thread.
+  void AddJITInfoForRange(uint64_t aRangeStart, int aThreadId,
+                          JSContext* aContext,
+                          JITFrameInfo& aJITFrameInfo) const;
+
+  // Stream JSON for samples in the buffer to aWriter, using the supplied
+  // UniqueStacks object.
+  // Only streams samples for the given thread ID and which were taken at or
+  // after aSinceTime. If ID is 0, ignore the stored thread ID; this should only
+  // be used when the buffer contains only one sample.
+  // aUniqueStacks needs to contain information about any JIT frames that we
+  // might encounter in the buffer, before this method is called. In other
+  // words, you need to have called AddJITInfoForRange for every range that
+  // might contain JIT frame information before calling this method.
+  // Return the thread ID of the streamed sample(s), or 0.
+  int StreamSamplesToJSON(SpliceableJSONWriter& aWriter, int aThreadId,
+                          double aSinceTime, UniqueStacks& aUniqueStacks) const;
+
+  void StreamMarkersToJSON(SpliceableJSONWriter& aWriter, int aThreadId,
+                           const mozilla::TimeStamp& aProcessStartTime,
+                           double aSinceTime,
+                           UniqueStacks& aUniqueStacks) const;
+  void StreamPausedRangesToJSON(SpliceableJSONWriter& aWriter,
+                                double aSinceTime) const;
+  void StreamProfilerOverheadToJSON(SpliceableJSONWriter& aWriter,
+                                    const mozilla::TimeStamp& aProcessStartTime,
+                                    double aSinceTime) const;
+  void StreamCountersToJSON(SpliceableJSONWriter& aWriter,
+                            const mozilla::TimeStamp& aProcessStartTime,
+                            double aSinceTime) const;
+
+  // Find (via |aLastSample|) the most recent sample for the thread denoted by
+  // |aThreadId| and clone it, patching in the current time as appropriate.
+  // Mutate |aLastSample| to point to the newly inserted sample.
+  // Returns whether duplication was successful.
+  bool DuplicateLastSample(int aThreadId, double aSampleTimeMs,
+                           mozilla::Maybe<uint64_t>& aLastSample,
+                           const RunningTimes& aRunningTimes);
+
+  void DiscardSamplesBeforeTime(double aTime);
+
+  // Read an entry in the buffer.
+  ProfileBufferEntry GetEntry(uint64_t aPosition) const {
+    return mEntries.ReadAt(
+        mozilla::ProfileBufferBlockIndex::CreateFromProfileBufferIndex(
+            aPosition),
+        [&](mozilla::Maybe<mozilla::ProfileBufferEntryReader>&& aMER) {
+          ProfileBufferEntry entry;
+          if (aMER.isSome()) {
+            if (aMER->CurrentBlockIndex().ConvertToProfileBufferIndex() ==
+                aPosition) {
+              // If we're here, it means `aPosition` pointed at a valid block.
+              MOZ_RELEASE_ASSERT(aMER->RemainingBytes() <= sizeof(entry));
+              aMER->ReadBytes(&entry, aMER->RemainingBytes());
+            } else {
+              // EntryReader at the wrong position, pretend to have read
+              // everything.
+              aMER->SetRemainingBytes(0);
+            }
+          }
+          return entry;
+        });
+  }
+
+  size_t SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+
+  void CollectOverheadStats(double aSamplingTimeMs,
+                            mozilla::TimeDuration aLocking,
+                            mozilla::TimeDuration aCleaning,
+                            mozilla::TimeDuration aCounters,
+                            mozilla::TimeDuration aThreads);
+
+  ProfilerBufferInfo GetProfilerBufferInfo() const;
+
+ private:
+  // Add |aEntry| to the provided ProfileChunkedBuffer.
+  // `static` because it may be used to add an entry to a `ProfileChunkedBuffer`
+  // that is not attached to a `ProfileBuffer`.
+  static mozilla::ProfileBufferBlockIndex AddEntry(
+      mozilla::ProfileChunkedBuffer& aProfileChunkedBuffer,
+      const ProfileBufferEntry& aEntry);
+
+  // Add a sample start (ThreadId) entry for aThreadId to the provided
+  // ProfileChunkedBuffer. Returns the position of the entry.
+  // `static` because it may be used to add an entry to a `ProfileChunkedBuffer`
+  // that is not attached to a `ProfileBuffer`.
+  static mozilla::ProfileBufferBlockIndex AddThreadIdEntry(
+      mozilla::ProfileChunkedBuffer& aProfileChunkedBuffer, int aThreadId);
+
+  // The storage in which this ProfileBuffer stores its entries.
+  mozilla::ProfileChunkedBuffer& mEntries;
+
+ public:
+  // `BufferRangeStart()` and `BufferRangeEnd()` return `uint64_t` values
+  // corresponding to the first entry and past the last entry stored in
+  // `mEntries`.
+  //
+  // The returned values are not guaranteed to be stable, because other threads
+  // may also be accessing the buffer concurrently. But they will always
+  // increase, and can therefore give an indication of how far these values have
+  // *at least* reached. In particular:
+  // - Entries whose index is strictly less that `BufferRangeStart()` have been
+  //   discarded by now, so any related data may also be safely discarded.
+  // - It is safe to try and read entries at any index strictly less than
+  //   `BufferRangeEnd()` -- but note that these reads may fail by the time you
+  //   request them, as old entries get overwritten by new ones.
+  uint64_t BufferRangeStart() const { return mEntries.GetState().mRangeStart; }
+  uint64_t BufferRangeEnd() const { return mEntries.GetState().mRangeEnd; }
+
+ private:
+  // Single pre-allocated chunk (to avoid spurious mallocs), used when:
+  // - Duplicating sleeping stacks (hence scExpectedMaximumStackSize).
+  // - Adding JIT info.
+  // - Streaming stacks to JSON.
+  // Mutable because it's accessed from non-multithreaded const methods.
+  mutable mozilla::ProfileBufferChunkManagerSingle mWorkerChunkManager{
+      mozilla::ProfileBufferChunk::Create(
+          mozilla::ProfileBufferChunk::SizeofChunkMetadata() +
+          mozilla::ProfileBufferChunkManager::scExpectedMaximumStackSize)};
+
+  double mFirstSamplingTimeUs = 0.0;
+  double mLastSamplingTimeUs = 0.0;
+  ProfilerStats mIntervalsUs;
+  ProfilerStats mOverheadsUs;
+  ProfilerStats mLockingsUs;
+  ProfilerStats mCleaningsUs;
+  ProfilerStats mCountersUs;
+  ProfilerStats mThreadsUs;
+};
+
+/**
+ * Helper type used to implement ProfilerStackCollector. This type is used as
+ * the collector for MergeStacks by ProfileBuffer. It holds a reference to the
+ * buffer, as well as additional feature flags which are needed to control the
+ * data collection strategy
+ */
+class ProfileBufferCollector final : public ProfilerStackCollector {
+ public:
+  ProfileBufferCollector(ProfileBuffer& aBuf, uint64_t aSamplePos)
+      : mBuf(aBuf), mSamplePositionInBuffer(aSamplePos) {}
+
+  mozilla::Maybe<uint64_t> SamplePositionInBuffer() override {
+    return mozilla::Some(mSamplePositionInBuffer);
+  }
+
+  mozilla::Maybe<uint64_t> BufferRangeStart() override {
+    return mozilla::Some(mBuf.BufferRangeStart());
+  }
+
+  virtual void CollectNativeLeafAddr(void* aAddr) override;
+  virtual void CollectJitReturnAddr(void* aAddr) override;
+  virtual void CollectWasmFrame(const char* aLabel) override;
+  virtual void CollectProfilingStackFrame(
+      const js::ProfilingStackFrame& aFrame) override;
+
+ private:
+  ProfileBuffer& mBuf;
+  uint64_t mSamplePositionInBuffer;
+};
+
+#endif
diff --git a/tools/profiler/core/ProfileBufferEntry.cpp b/tools/profiler/core/ProfileBufferEntry.cpp
new file mode 100644
index 0000000000..000f9dfbd7
--- /dev/null
+++ b/tools/profiler/core/ProfileBufferEntry.cpp
@@ -0,0 +1,1778 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProfileBufferEntry.h"
+
+#include "mozilla/ProfilerMarkers.h"
+#include "platform.h"
+#include "ProfileBuffer.h"
+#include "ProfilerBacktrace.h"
+
+#include "js/ProfilingFrameIterator.h"
+#include "jsapi.h"
+#include "jsfriendapi.h"
+#include "mozilla/Logging.h"
+#include "mozilla/ScopeExit.h"
+#include "mozilla/Sprintf.h"
+#include "mozilla/StackWalk.h"
+#include "nsThreadUtils.h"
+#include "nsXULAppAPI.h"
+#include "ProfilerCodeAddressService.h"
+
+#include <ostream>
+#include <type_traits>
+
+using namespace mozilla;
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN ProfileBufferEntry
+
+ProfileBufferEntry::ProfileBufferEntry()
+    : mKind(Kind::INVALID), mStorage{0, 0, 0, 0, 0, 0, 0, 0} {}
+
+// aString must be a static string.
+ProfileBufferEntry::ProfileBufferEntry(Kind aKind, const char* aString)
+    : mKind(aKind) {
+  MOZ_ASSERT(aKind == Kind::Label);
+  memcpy(mStorage, &aString, sizeof(aString));
+}
+
+ProfileBufferEntry::ProfileBufferEntry(Kind aKind, char aChars[kNumChars])
+    : mKind(aKind) {
+  MOZ_ASSERT(aKind == Kind::DynamicStringFragment);
+  memcpy(mStorage, aChars, kNumChars);
+}
+
+ProfileBufferEntry::ProfileBufferEntry(Kind aKind, void* aPtr) : mKind(aKind) {
+  memcpy(mStorage, &aPtr, sizeof(aPtr));
+}
+
+ProfileBufferEntry::ProfileBufferEntry(Kind aKind, double aDouble)
+    : mKind(aKind) {
+  memcpy(mStorage, &aDouble, sizeof(aDouble));
+}
+
+ProfileBufferEntry::ProfileBufferEntry(Kind aKind, int aInt) : mKind(aKind) {
+  memcpy(mStorage, &aInt, sizeof(aInt));
+}
+
+ProfileBufferEntry::ProfileBufferEntry(Kind aKind, int64_t aInt64)
+    : mKind(aKind) {
+  memcpy(mStorage, &aInt64, sizeof(aInt64));
+}
+
+ProfileBufferEntry::ProfileBufferEntry(Kind aKind, uint64_t aUint64)
+    : mKind(aKind) {
+  memcpy(mStorage, &aUint64, sizeof(aUint64));
+}
+
+const char* ProfileBufferEntry::GetString() const {
+  const char* result;
+  memcpy(&result, mStorage, sizeof(result));
+  return result;
+}
+
+void* ProfileBufferEntry::GetPtr() const {
+  void* result;
+  memcpy(&result, mStorage, sizeof(result));
+  return result;
+}
+
+double ProfileBufferEntry::GetDouble() const {
+  double result;
+  memcpy(&result, mStorage, sizeof(result));
+  return result;
+}
+
+int ProfileBufferEntry::GetInt() const {
+  int result;
+  memcpy(&result, mStorage, sizeof(result));
+  return result;
+}
+
+int64_t ProfileBufferEntry::GetInt64() const {
+  int64_t result;
+  memcpy(&result, mStorage, sizeof(result));
+  return result;
+}
+
+uint64_t ProfileBufferEntry::GetUint64() const {
+  uint64_t result;
+  memcpy(&result, mStorage, sizeof(result));
+  return result;
+}
+
+void ProfileBufferEntry::CopyCharsInto(char (&aOutArray)[kNumChars]) const {
+  memcpy(aOutArray, mStorage, kNumChars);
+}
+
+// END ProfileBufferEntry
+////////////////////////////////////////////////////////////////////////
+
+struct TypeInfo {
+  Maybe<nsCString> mKeyedBy;
+  Maybe<nsCString> mName;
+  Maybe<nsCString> mLocation;
+  Maybe<unsigned> mLineNumber;
+};
+
+// As mentioned in ProfileBufferEntry.h, the JSON format contains many
+// arrays whose elements are laid out according to various schemas to help
+// de-duplication. This RAII class helps write these arrays by keeping track of
+// the last non-null element written and adding the appropriate number of null
+// elements when writing new non-null elements. It also automatically opens and
+// closes an array element on the given JSON writer.
+//
+// You grant the AutoArraySchemaWriter exclusive access to the JSONWriter and
+// the UniqueJSONStrings objects for the lifetime of AutoArraySchemaWriter. Do
+// not access them independently while the AutoArraySchemaWriter is alive.
+// If you need to add complex objects, call FreeFormElement(), which will give
+// you temporary access to the writer.
+//
+// Example usage:
+//
+//     // Define the schema of elements in this type of array: [FOO, BAR, BAZ]
+//     enum Schema : uint32_t {
+//       FOO = 0,
+//       BAR = 1,
+//       BAZ = 2
+//     };
+//
+//     AutoArraySchemaWriter writer(someJsonWriter, someUniqueStrings);
+//     if (shouldWriteFoo) {
+//       writer.IntElement(FOO, getFoo());
+//     }
+//     ... etc ...
+//
+//     The elements need to be added in-order.
+class MOZ_RAII AutoArraySchemaWriter {
+ public:
+  explicit AutoArraySchemaWriter(SpliceableJSONWriter& aWriter)
+      : mJSONWriter(aWriter), mNextFreeIndex(0) {
+    mJSONWriter.StartArrayElement(SpliceableJSONWriter::SingleLineStyle);
+  }
+
+  ~AutoArraySchemaWriter() { mJSONWriter.EndArray(); }
+
+  template <typename T>
+  void IntElement(uint32_t aIndex, T aValue) {
+    static_assert(!std::is_same_v<T, uint64_t>,
+                  "Narrowing uint64 -> int64 conversion not allowed");
+    FillUpTo(aIndex);
+    mJSONWriter.IntElement(static_cast<int64_t>(aValue));
+  }
+
+  void DoubleElement(uint32_t aIndex, double aValue) {
+    FillUpTo(aIndex);
+    mJSONWriter.DoubleElement(aValue);
+  }
+
+  void BoolElement(uint32_t aIndex, bool aValue) {
+    FillUpTo(aIndex);
+    mJSONWriter.BoolElement(aValue);
+  }
+
+ protected:
+  SpliceableJSONWriter& Writer() { return mJSONWriter; }
+
+  void FillUpTo(uint32_t aIndex) {
+    MOZ_ASSERT(aIndex >= mNextFreeIndex);
+    mJSONWriter.NullElements(aIndex - mNextFreeIndex);
+    mNextFreeIndex = aIndex + 1;
+  }
+
+ private:
+  SpliceableJSONWriter& mJSONWriter;
+  uint32_t mNextFreeIndex;
+};
+
+// Same as AutoArraySchemaWriter, but this can also write strings (output as
+// indexes into the table of unique strings).
+class MOZ_RAII AutoArraySchemaWithStringsWriter : public AutoArraySchemaWriter {
+ public:
+  AutoArraySchemaWithStringsWriter(SpliceableJSONWriter& aWriter,
+                                   UniqueJSONStrings& aStrings)
+      : AutoArraySchemaWriter(aWriter), mStrings(aStrings) {}
+
+  void StringElement(uint32_t aIndex, const Span<const char>& aValue) {
+    FillUpTo(aIndex);
+    mStrings.WriteElement(Writer(), aValue);
+  }
+
+ private:
+  UniqueJSONStrings& mStrings;
+};
+
+UniqueStacks::StackKey UniqueStacks::BeginStack(const FrameKey& aFrame) {
+  return StackKey(GetOrAddFrameIndex(aFrame));
+}
+
+UniqueStacks::StackKey UniqueStacks::AppendFrame(const StackKey& aStack,
+                                                 const FrameKey& aFrame) {
+  return StackKey(aStack, GetOrAddStackIndex(aStack),
+                  GetOrAddFrameIndex(aFrame));
+}
+
+JITFrameInfoForBufferRange JITFrameInfoForBufferRange::Clone() const {
+  JITFrameInfoForBufferRange::JITAddressToJITFramesMap jitAddressToJITFramesMap;
+  MOZ_RELEASE_ASSERT(
+      jitAddressToJITFramesMap.reserve(mJITAddressToJITFramesMap.count()));
+  for (auto iter = mJITAddressToJITFramesMap.iter(); !iter.done();
+       iter.next()) {
+    const mozilla::Vector<JITFrameKey>& srcKeys = iter.get().value();
+    mozilla::Vector<JITFrameKey> destKeys;
+    MOZ_RELEASE_ASSERT(destKeys.appendAll(srcKeys));
+    jitAddressToJITFramesMap.putNewInfallible(iter.get().key(),
+                                              std::move(destKeys));
+  }
+
+  JITFrameInfoForBufferRange::JITFrameToFrameJSONMap jitFrameToFrameJSONMap;
+  MOZ_RELEASE_ASSERT(
+      jitFrameToFrameJSONMap.reserve(mJITFrameToFrameJSONMap.count()));
+  for (auto iter = mJITFrameToFrameJSONMap.iter(); !iter.done(); iter.next()) {
+    jitFrameToFrameJSONMap.putNewInfallible(iter.get().key(),
+                                            iter.get().value());
+  }
+
+  return JITFrameInfoForBufferRange{mRangeStart, mRangeEnd,
+                                    std::move(jitAddressToJITFramesMap),
+                                    std::move(jitFrameToFrameJSONMap)};
+}
+
+JITFrameInfo::JITFrameInfo(const JITFrameInfo& aOther)
+    : mUniqueStrings(MakeUnique<UniqueJSONStrings>(*aOther.mUniqueStrings)) {
+  for (const JITFrameInfoForBufferRange& range : aOther.mRanges) {
+    MOZ_RELEASE_ASSERT(mRanges.append(range.Clone()));
+  }
+}
+
+bool UniqueStacks::FrameKey::NormalFrameData::operator==(
+    const NormalFrameData& aOther) const {
+  return mLocation == aOther.mLocation &&
+         mRelevantForJS == aOther.mRelevantForJS &&
+         mBaselineInterp == aOther.mBaselineInterp &&
+         mInnerWindowID == aOther.mInnerWindowID && mLine == aOther.mLine &&
+         mColumn == aOther.mColumn && mCategoryPair == aOther.mCategoryPair;
+}
+
+bool UniqueStacks::FrameKey::JITFrameData::operator==(
+    const JITFrameData& aOther) const {
+  return mCanonicalAddress == aOther.mCanonicalAddress &&
+         mDepth == aOther.mDepth && mRangeIndex == aOther.mRangeIndex;
+}
+
+// Consume aJITFrameInfo by stealing its string table and its JIT frame info
+// ranges. The JIT frame info contains JSON which refers to strings from the
+// JIT frame info's string table, so our string table needs to have the same
+// strings at the same indices.
+UniqueStacks::UniqueStacks(JITFrameInfo&& aJITFrameInfo)
+    : mUniqueStrings(std::move(aJITFrameInfo.mUniqueStrings)),
+      mJITInfoRanges(std::move(aJITFrameInfo.mRanges)) {
+  mFrameTableWriter.StartBareList();
+  mStackTableWriter.StartBareList();
+}
+
+uint32_t UniqueStacks::GetOrAddStackIndex(const StackKey& aStack) {
+  uint32_t count = mStackToIndexMap.count();
+  auto entry = mStackToIndexMap.lookupForAdd(aStack);
+  if (entry) {
+    MOZ_ASSERT(entry->value() < count);
+    return entry->value();
+  }
+
+  MOZ_RELEASE_ASSERT(mStackToIndexMap.add(entry, aStack, count));
+  StreamStack(aStack);
+  return count;
+}
+
+Maybe<Vector<UniqueStacks::FrameKey>>
+UniqueStacks::LookupFramesForJITAddressFromBufferPos(void* aJITAddress,
+                                                     uint64_t aBufferPos) {
+  JITFrameInfoForBufferRange* rangeIter =
+      std::lower_bound(mJITInfoRanges.begin(), mJITInfoRanges.end(), aBufferPos,
+                       [](const JITFrameInfoForBufferRange& aRange,
+                          uint64_t aPos) { return aRange.mRangeEnd < aPos; });
+  MOZ_RELEASE_ASSERT(
+      rangeIter != mJITInfoRanges.end() &&
+          rangeIter->mRangeStart <= aBufferPos &&
+          aBufferPos < rangeIter->mRangeEnd,
+      "Buffer position of jit address needs to be in one of the ranges");
+
+  using JITFrameKey = JITFrameInfoForBufferRange::JITFrameKey;
+
+  const JITFrameInfoForBufferRange& jitFrameInfoRange = *rangeIter;
+  auto jitFrameKeys =
+      jitFrameInfoRange.mJITAddressToJITFramesMap.lookup(aJITAddress);
+  if (!jitFrameKeys) {
+    return Nothing();
+  }
+
+  // Map the array of JITFrameKeys to an array of FrameKeys, and ensure that
+  // each of the FrameKeys exists in mFrameToIndexMap.
+  Vector<FrameKey> frameKeys;
+  MOZ_RELEASE_ASSERT(frameKeys.initCapacity(jitFrameKeys->value().length()));
+  for (const JITFrameKey& jitFrameKey : jitFrameKeys->value()) {
+    FrameKey frameKey(jitFrameKey.mCanonicalAddress, jitFrameKey.mDepth,
+                      rangeIter - mJITInfoRanges.begin());
+    uint32_t index = mFrameToIndexMap.count();
+    auto entry = mFrameToIndexMap.lookupForAdd(frameKey);
+    if (!entry) {
+      // We need to add this frame to our frame table. The JSON for this frame
+      // already exists in jitFrameInfoRange, we just need to splice it into
+      // the frame table and give it an index.
+      auto frameJSON =
+          jitFrameInfoRange.mJITFrameToFrameJSONMap.lookup(jitFrameKey);
+      MOZ_RELEASE_ASSERT(frameJSON, "Should have cached JSON for this frame");
+      mFrameTableWriter.Splice(frameJSON->value());
+      MOZ_RELEASE_ASSERT(mFrameToIndexMap.add(entry, frameKey, index));
+    }
+    MOZ_RELEASE_ASSERT(frameKeys.append(std::move(frameKey)));
+  }
+  return Some(std::move(frameKeys));
+}
+
+uint32_t UniqueStacks::GetOrAddFrameIndex(const FrameKey& aFrame) {
+  uint32_t count = mFrameToIndexMap.count();
+  auto entry = mFrameToIndexMap.lookupForAdd(aFrame);
+  if (entry) {
+    MOZ_ASSERT(entry->value() < count);
+    return entry->value();
+  }
+
+  MOZ_RELEASE_ASSERT(mFrameToIndexMap.add(entry, aFrame, count));
+  StreamNonJITFrame(aFrame);
+  return count;
+}
+
+void UniqueStacks::SpliceFrameTableElements(SpliceableJSONWriter& aWriter) {
+  mFrameTableWriter.EndBareList();
+  aWriter.TakeAndSplice(mFrameTableWriter.TakeChunkedWriteFunc());
+}
+
+void UniqueStacks::SpliceStackTableElements(SpliceableJSONWriter& aWriter) {
+  mStackTableWriter.EndBareList();
+  aWriter.TakeAndSplice(mStackTableWriter.TakeChunkedWriteFunc());
+}
+
+void UniqueStacks::StreamStack(const StackKey& aStack) {
+  enum Schema : uint32_t { PREFIX = 0, FRAME = 1 };
+
+  AutoArraySchemaWriter writer(mStackTableWriter);
+  if (aStack.mPrefixStackIndex.isSome()) {
+    writer.IntElement(PREFIX, *aStack.mPrefixStackIndex);
+  }
+  writer.IntElement(FRAME, aStack.mFrameIndex);
+}
+
+void UniqueStacks::StreamNonJITFrame(const FrameKey& aFrame) {
+  using NormalFrameData = FrameKey::NormalFrameData;
+
+  enum Schema : uint32_t {
+    LOCATION = 0,
+    RELEVANT_FOR_JS = 1,
+    INNER_WINDOW_ID = 2,
+    IMPLEMENTATION = 3,
+    OPTIMIZATIONS = 4,
+    LINE = 5,
+    COLUMN = 6,
+    CATEGORY = 7,
+    SUBCATEGORY = 8
+  };
+
+  AutoArraySchemaWithStringsWriter writer(mFrameTableWriter, *mUniqueStrings);
+
+  const NormalFrameData& data = aFrame.mData.as<NormalFrameData>();
+  writer.StringElement(LOCATION, data.mLocation);
+  writer.BoolElement(RELEVANT_FOR_JS, data.mRelevantForJS);
+
+  // It's okay to convert uint64_t to double here because DOM always creates IDs
+  // that are convertible to double.
+  writer.DoubleElement(INNER_WINDOW_ID, data.mInnerWindowID);
+
+  // The C++ interpreter is the default implementation so we only emit element
+  // for Baseline Interpreter frames.
+  if (data.mBaselineInterp) {
+    writer.StringElement(IMPLEMENTATION, MakeStringSpan("blinterp"));
+  }
+
+  if (data.mLine.isSome()) {
+    writer.IntElement(LINE, *data.mLine);
+  }
+  if (data.mColumn.isSome()) {
+    writer.IntElement(COLUMN, *data.mColumn);
+  }
+  if (data.mCategoryPair.isSome()) {
+    const JS::ProfilingCategoryPairInfo& info =
+        JS::GetProfilingCategoryPairInfo(*data.mCategoryPair);
+    writer.IntElement(CATEGORY, uint32_t(info.mCategory));
+    writer.IntElement(SUBCATEGORY, info.mSubcategoryIndex);
+  }
+}
+
+static void StreamJITFrame(JSContext* aContext, SpliceableJSONWriter& aWriter,
+                           UniqueJSONStrings& aUniqueStrings,
+                           const JS::ProfiledFrameHandle& aJITFrame) {
+  enum Schema : uint32_t {
+    LOCATION = 0,
+    RELEVANT_FOR_JS = 1,
+    INNER_WINDOW_ID = 2,
+    IMPLEMENTATION = 3,
+    OPTIMIZATIONS = 4,
+    LINE = 5,
+    COLUMN = 6,
+    CATEGORY = 7,
+    SUBCATEGORY = 8
+  };
+
+  AutoArraySchemaWithStringsWriter writer(aWriter, aUniqueStrings);
+
+  writer.StringElement(LOCATION, MakeStringSpan(aJITFrame.label()));
+  writer.BoolElement(RELEVANT_FOR_JS, false);
+
+  // It's okay to convert uint64_t to double here because DOM always creates IDs
+  // that are convertible to double.
+  // Realm ID is the name of innerWindowID inside JS code.
+  writer.DoubleElement(INNER_WINDOW_ID, aJITFrame.realmID());
+
+  JS::ProfilingFrameIterator::FrameKind frameKind = aJITFrame.frameKind();
+  MOZ_ASSERT(frameKind == JS::ProfilingFrameIterator::Frame_Ion ||
+             frameKind == JS::ProfilingFrameIterator::Frame_Baseline);
+  writer.StringElement(IMPLEMENTATION,
+                       frameKind == JS::ProfilingFrameIterator::Frame_Ion
+                           ? MakeStringSpan("ion")
+                           : MakeStringSpan("baseline"));
+
+  const JS::ProfilingCategoryPairInfo& info = JS::GetProfilingCategoryPairInfo(
+      frameKind == JS::ProfilingFrameIterator::Frame_Ion
+          ? JS::ProfilingCategoryPair::JS_IonMonkey
+          : JS::ProfilingCategoryPair::JS_Baseline);
+  writer.IntElement(CATEGORY, uint32_t(info.mCategory));
+  writer.IntElement(SUBCATEGORY, info.mSubcategoryIndex);
+}
+
+struct CStringWriteFunc : public JSONWriteFunc {
+  nsACString& mBuffer;  // The struct must not outlive this buffer
+  explicit CStringWriteFunc(nsACString& aBuffer) : mBuffer(aBuffer) {}
+
+  void Write(const Span<const char>& aStr) override { mBuffer.Append(aStr); }
+};
+
+static nsCString JSONForJITFrame(JSContext* aContext,
+                                 const JS::ProfiledFrameHandle& aJITFrame,
+                                 UniqueJSONStrings& aUniqueStrings) {
+  nsCString json;
+  SpliceableJSONWriter writer(MakeUnique<CStringWriteFunc>(json));
+  StreamJITFrame(aContext, writer, aUniqueStrings, aJITFrame);
+  return json;
+}
+
+void JITFrameInfo::AddInfoForRange(
+    uint64_t aRangeStart, uint64_t aRangeEnd, JSContext* aCx,
+    const std::function<void(const std::function<void(void*)>&)>&
+        aJITAddressProvider) {
+  if (aRangeStart == aRangeEnd) {
+    return;
+  }
+
+  MOZ_RELEASE_ASSERT(aRangeStart < aRangeEnd);
+
+  if (!mRanges.empty()) {
+    const JITFrameInfoForBufferRange& prevRange = mRanges.back();
+    MOZ_RELEASE_ASSERT(prevRange.mRangeEnd <= aRangeStart,
+                       "Ranges must be non-overlapping and added in-order.");
+  }
+
+  using JITFrameKey = JITFrameInfoForBufferRange::JITFrameKey;
+
+  JITFrameInfoForBufferRange::JITAddressToJITFramesMap jitAddressToJITFrameMap;
+  JITFrameInfoForBufferRange::JITFrameToFrameJSONMap jitFrameToFrameJSONMap;
+
+  aJITAddressProvider([&](void* aJITAddress) {
+    // Make sure that we have cached data for aJITAddress.
+    auto addressEntry = jitAddressToJITFrameMap.lookupForAdd(aJITAddress);
+    if (!addressEntry) {
+      Vector<JITFrameKey> jitFrameKeys;
+      for (JS::ProfiledFrameHandle handle :
+           JS::GetProfiledFrames(aCx, aJITAddress)) {
+        uint32_t depth = jitFrameKeys.length();
+        JITFrameKey jitFrameKey{handle.canonicalAddress(), depth};
+        auto frameEntry = jitFrameToFrameJSONMap.lookupForAdd(jitFrameKey);
+        if (!frameEntry) {
+          MOZ_RELEASE_ASSERT(jitFrameToFrameJSONMap.add(
+              frameEntry, jitFrameKey,
+              JSONForJITFrame(aCx, handle, *mUniqueStrings)));
+        }
+        MOZ_RELEASE_ASSERT(jitFrameKeys.append(jitFrameKey));
+      }
+      MOZ_RELEASE_ASSERT(jitAddressToJITFrameMap.add(addressEntry, aJITAddress,
+                                                     std::move(jitFrameKeys)));
+    }
+  });
+
+  MOZ_RELEASE_ASSERT(mRanges.append(JITFrameInfoForBufferRange{
+      aRangeStart, aRangeEnd, std::move(jitAddressToJITFrameMap),
+      std::move(jitFrameToFrameJSONMap)}));
+}
+
+struct ProfileSample {
+  uint32_t mStack;
+  double mTime;
+  Maybe<double> mResponsiveness;
+  RunningTimes mRunningTimes;
+};
+
+// Write CPU measurements with "Delta" unit, which is some amount of work that
+// happened since the previous sample.
+static void WriteDelta(AutoArraySchemaWriter& aSchemaWriter, uint32_t aProperty,
+                       uint64_t aDelta) {
+  aSchemaWriter.IntElement(aProperty, int64_t(aDelta));
+}
+
+static void WriteSample(SpliceableJSONWriter& aWriter,
+                        const ProfileSample& aSample) {
+  enum Schema : uint32_t {
+    STACK = 0,
+    TIME = 1,
+    EVENT_DELAY = 2
+#define RUNNING_TIME_SCHEMA(index, name, unit, jsonProperty) , name
+    PROFILER_FOR_EACH_RUNNING_TIME(RUNNING_TIME_SCHEMA)
+#undef RUNNING_TIME_SCHEMA
+  };
+
+  AutoArraySchemaWriter writer(aWriter);
+
+  writer.IntElement(STACK, aSample.mStack);
+
+  writer.DoubleElement(TIME, aSample.mTime);
+
+  if (aSample.mResponsiveness.isSome()) {
+    writer.DoubleElement(EVENT_DELAY, *aSample.mResponsiveness);
+  }
+
+#define RUNNING_TIME_STREAM(index, name, unit, jsonProperty) \
+  aSample.mRunningTimes.Get##name##unit().apply(             \
+      [&writer](const uint64_t& aValue) {                    \
+        Write##unit(writer, name, aValue);                   \
+      });
+
+  PROFILER_FOR_EACH_RUNNING_TIME(RUNNING_TIME_STREAM)
+
+#undef RUNNING_TIME_STREAM
+}
+
+class EntryGetter {
+ public:
+  explicit EntryGetter(ProfileChunkedBuffer::Reader& aReader,
+                       uint64_t aInitialReadPos = 0)
+      : mBlockIt(
+            aReader.At(ProfileBufferBlockIndex::CreateFromProfileBufferIndex(
+                aInitialReadPos))),
+        mBlockItEnd(aReader.end()) {
+    if (!ReadLegacyOrEnd()) {
+      // Find and read the next non-legacy entry.
+      Next();
+    }
+  }
+
+  bool Has() const { return mBlockIt != mBlockItEnd; }
+
+  const ProfileBufferEntry& Get() const {
+    MOZ_ASSERT(Has(), "Caller should have checked `Has()` before `Get()`");
+    return mEntry;
+  }
+
+  void Next() {
+    MOZ_ASSERT(Has(), "Caller should have checked `Has()` before `Get()`");
+    for (;;) {
+      ++mBlockIt;
+      if (ReadLegacyOrEnd()) {
+        // Either we're at the end, or we could read a legacy entry -> Done.
+        break;
+      }
+      // Otherwise loop around until we hit a legacy entry or the end.
+    }
+  }
+
+  ProfileChunkedBuffer::BlockIterator Iterator() const { return mBlockIt; }
+
+  ProfileBufferBlockIndex CurBlockIndex() const {
+    return mBlockIt.CurrentBlockIndex();
+  }
+
+  uint64_t CurPos() const {
+    return CurBlockIndex().ConvertToProfileBufferIndex();
+  }
+
+ private:
+  // Try to read the entry at the current `mBlockIt` position.
+  // * If we're at the end of the buffer, just return `true`.
+  // * If there is a "legacy" entry (containing a real `ProfileBufferEntry`),
+  //   read it into `mEntry`, and return `true` as well.
+  // * Otherwise the entry contains a "modern" type that cannot be read into
+  // `mEntry`, return `false` (so `EntryGetter` can skip to another entry).
+  bool ReadLegacyOrEnd() {
+    if (!Has()) {
+      return true;
+    }
+    // Read the entry "kind", which is always at the start of all entries.
+    ProfileBufferEntryReader er = *mBlockIt;
+    auto type = static_cast<ProfileBufferEntry::Kind>(
+        er.ReadObject<ProfileBufferEntry::KindUnderlyingType>());
+    MOZ_ASSERT(static_cast<ProfileBufferEntry::KindUnderlyingType>(type) <
+               static_cast<ProfileBufferEntry::KindUnderlyingType>(
+                   ProfileBufferEntry::Kind::MODERN_LIMIT));
+    if (type >= ProfileBufferEntry::Kind::LEGACY_LIMIT) {
+      er.SetRemainingBytes(0);
+      return false;
+    }
+    // Here, we have a legacy item, we need to read it from the start.
+    // Because the above `ReadObject` moved the reader, we ned to reset it to
+    // the start of the entry before reading the whole entry.
+    er = *mBlockIt;
+    er.ReadBytes(&mEntry, er.RemainingBytes());
+    return true;
+  }
+
+  ProfileBufferEntry mEntry;
+  ProfileChunkedBuffer::BlockIterator mBlockIt;
+  const ProfileChunkedBuffer::BlockIterator mBlockItEnd;
+};
+
+// The following grammar shows legal sequences of profile buffer entries.
+// The sequences beginning with a ThreadId entry are known as "samples".
+//
+// (
+//   ( /* Samples */
+//     ThreadId
+//     TimeBeforeCompactStack
+//     UnresponsivenessDurationMs?
+//     CompactStack
+//         /* internally including:
+//           ( NativeLeafAddr
+//           | Label FrameFlags? DynamicStringFragment*
+//             LineNumber? CategoryPair?
+//           | JitReturnAddr
+//           )+
+//         */
+//   )
+//   | Marker
+//   | ( /* Counters */
+//       CounterId
+//       Time
+//       (
+//         CounterKey
+//         Count
+//         Number?
+//       )*
+//     )
+//   | CollectionStart
+//   | CollectionEnd
+//   | Pause
+//   | Resume
+//   | ( ProfilerOverheadTime /* Sampling start timestamp */
+//       ProfilerOverheadDuration /* Lock acquisition */
+//       ProfilerOverheadDuration /* Expired markers cleaning */
+//       ProfilerOverheadDuration /* Counters */
+//       ProfilerOverheadDuration /* Threads */
+//     )
+// )*
+//
+// The most complicated part is the stack entry sequence that begins with
+// Label. Here are some examples.
+//
+// - ProfilingStack frames without a dynamic string:
+//
+//     Label("js::RunScript")
+//     CategoryPair(JS::ProfilingCategoryPair::JS)
+//
+//     Label("XREMain::XRE_main")
+//     LineNumber(4660)
+//     CategoryPair(JS::ProfilingCategoryPair::OTHER)
+//
+//     Label("ElementRestyler::ComputeStyleChangeFor")
+//     LineNumber(3003)
+//     CategoryPair(JS::ProfilingCategoryPair::CSS)
+//
+// - ProfilingStack frames with a dynamic string:
+//
+//     Label("nsObserverService::NotifyObservers")
+//     FrameFlags(uint64_t(ProfilingStackFrame::Flags::IS_LABEL_FRAME))
+//     DynamicStringFragment("domwindo")
+//     DynamicStringFragment("wopened")
+//     LineNumber(291)
+//     CategoryPair(JS::ProfilingCategoryPair::OTHER)
+//
+//     Label("")
+//     FrameFlags(uint64_t(ProfilingStackFrame::Flags::IS_JS_FRAME))
+//     DynamicStringFragment("closeWin")
+//     DynamicStringFragment("dow (chr")
+//     DynamicStringFragment("ome://gl")
+//     DynamicStringFragment("obal/con")
+//     DynamicStringFragment("tent/glo")
+//     DynamicStringFragment("balOverl")
+//     DynamicStringFragment("ay.js:5)")
+//     DynamicStringFragment("")          # this string holds the closing '\0'
+//     LineNumber(25)
+//     CategoryPair(JS::ProfilingCategoryPair::JS)
+//
+//     Label("")
+//     FrameFlags(uint64_t(ProfilingStackFrame::Flags::IS_JS_FRAME))
+//     DynamicStringFragment("bound (s")
+//     DynamicStringFragment("elf-host")
+//     DynamicStringFragment("ed:914)")
+//     LineNumber(945)
+//     CategoryPair(JS::ProfilingCategoryPair::JS)
+//
+// - A profiling stack frame with an overly long dynamic string:
+//
+//     Label("")
+//     FrameFlags(uint64_t(ProfilingStackFrame::Flags::IS_LABEL_FRAME))
+//     DynamicStringFragment("(too lon")
+//     DynamicStringFragment("g)")
+//     LineNumber(100)
+//     CategoryPair(JS::ProfilingCategoryPair::NETWORK)
+//
+// - A wasm JIT frame:
+//
+//     Label("")
+//     FrameFlags(uint64_t(0))
+//     DynamicStringFragment("wasm-fun")
+//     DynamicStringFragment("ction[87")
+//     DynamicStringFragment("36] (blo")
+//     DynamicStringFragment("b:http:/")
+//     DynamicStringFragment("/webasse")
+//     DynamicStringFragment("mbly.org")
+//     DynamicStringFragment("/3dc5759")
+//     DynamicStringFragment("4-ce58-4")
+//     DynamicStringFragment("626-975b")
+//     DynamicStringFragment("-08ad116")
+//     DynamicStringFragment("30bc1:38")
+//     DynamicStringFragment("29856)")
+//
+// - A JS frame in a synchronous sample:
+//
+//     Label("")
+//     FrameFlags(uint64_t(ProfilingStackFrame::Flags::IS_LABEL_FRAME))
+//     DynamicStringFragment("u (https")
+//     DynamicStringFragment("://perf-")
+//     DynamicStringFragment("html.io/")
+//     DynamicStringFragment("ac0da204")
+//     DynamicStringFragment("aaa44d75")
+//     DynamicStringFragment("a800.bun")
+//     DynamicStringFragment("dle.js:2")
+//     DynamicStringFragment("5)")
+
+// Because this is a format entirely internal to the Profiler, any parsing
+// error indicates a bug in the ProfileBuffer writing or the parser itself,
+// or possibly flaky hardware.
+#define ERROR_AND_CONTINUE(msg)                            \
+  {                                                        \
+    fprintf(stderr, "ProfileBuffer parse error: %s", msg); \
+    MOZ_ASSERT(false, msg);                                \
+    continue;                                              \
+  }
+
+int ProfileBuffer::StreamSamplesToJSON(SpliceableJSONWriter& aWriter,
+                                       int aThreadId, double aSinceTime,
+                                       UniqueStacks& aUniqueStacks) const {
+  UniquePtr<char[]> dynStrBuf = MakeUnique<char[]>(kMaxFrameKeyLength);
+
+  return mEntries.Read([&](ProfileChunkedBuffer::Reader* aReader) {
+    MOZ_ASSERT(aReader,
+               "ProfileChunkedBuffer cannot be out-of-session when sampler is "
+               "running");
+
+    int processedThreadId = 0;
+
+    EntryGetter e(*aReader);
+
+    for (;;) {
+      // This block skips entries until we find the start of the next sample.
+      // This is useful in three situations.
+      //
+      // - The circular buffer overwrites old entries, so when we start parsing
+      //   we might be in the middle of a sample, and we must skip forward to
+      //   the start of the next sample.
+      //
+      // - We skip samples that don't have an appropriate ThreadId or Time.
+      //
+      // - We skip range Pause, Resume, CollectionStart, Marker, Counter
+      //   and CollectionEnd entries between samples.
+      while (e.Has()) {
+        if (e.Get().IsThreadId()) {
+          break;
+        }
+        e.Next();
+      }
+
+      if (!e.Has()) {
+        break;
+      }
+
+      // Due to the skip_to_next_sample block above, if we have an entry here it
+      // must be a ThreadId entry.
+      MOZ_ASSERT(e.Get().IsThreadId());
+
+      int threadId = e.Get().GetInt();
+      e.Next();
+
+      // Ignore samples that are for the wrong thread.
+      if (threadId != aThreadId && aThreadId != 0) {
+        continue;
+      }
+
+      MOZ_ASSERT(aThreadId != 0 || processedThreadId == 0,
+                 "aThreadId==0 should only be used with 1-sample buffer");
+
+      ProfileSample sample;
+
+      auto ReadStack = [&](EntryGetter& e, uint64_t entryPosition,
+                           const Maybe<double>& unresponsiveDuration,
+                           const RunningTimes& aRunningTimes) {
+        UniqueStacks::StackKey stack =
+            aUniqueStacks.BeginStack(UniqueStacks::FrameKey("(root)"));
+
+        int numFrames = 0;
+        while (e.Has()) {
+          if (e.Get().IsNativeLeafAddr()) {
+            numFrames++;
+
+            void* pc = e.Get().GetPtr();
+            e.Next();
+
+            nsAutoCString buf;
+
+            if (!aUniqueStacks.mCodeAddressService ||
+                !aUniqueStacks.mCodeAddressService->GetFunction(pc, buf) ||
+                buf.IsEmpty()) {
+              buf.AppendASCII("0x");
+              // `AppendInt` only knows `uint32_t` or `uint64_t`, but because
+              // these are just aliases for *two* of (`unsigned`, `unsigned
+              // long`, and `unsigned long long`), a call with `uintptr_t` could
+              // use the third type and therefore would be ambiguous.
+              // So we want to force using exactly `uint32_t` or `uint64_t`,
+              // whichever matches the size of `uintptr_t`.
+              // (The outer cast to `uint` should then be a no-op.)
+              using uint =
+                  std::conditional_t<sizeof(uintptr_t) <= sizeof(uint32_t),
+                                     uint32_t, uint64_t>;
+              buf.AppendInt(static_cast<uint>(reinterpret_cast<uintptr_t>(pc)),
+                            16);
+            }
+
+            stack = aUniqueStacks.AppendFrame(
+                stack, UniqueStacks::FrameKey(buf.get()));
+
+          } else if (e.Get().IsLabel()) {
+            numFrames++;
+
+            const char* label = e.Get().GetString();
+            e.Next();
+
+            using FrameFlags = js::ProfilingStackFrame::Flags;
+            uint32_t frameFlags = 0;
+            if (e.Has() && e.Get().IsFrameFlags()) {
+              frameFlags = uint32_t(e.Get().GetUint64());
+              e.Next();
+            }
+
+            bool relevantForJS =
+                frameFlags & uint32_t(FrameFlags::RELEVANT_FOR_JS);
+
+            bool isBaselineInterp =
+                frameFlags & uint32_t(FrameFlags::IS_BLINTERP_FRAME);
+
+            // Copy potential dynamic string fragments into dynStrBuf, so that
+            // dynStrBuf will then contain the entire dynamic string.
+            size_t i = 0;
+            dynStrBuf[0] = '\0';
+            while (e.Has()) {
+              if (e.Get().IsDynamicStringFragment()) {
+                char chars[ProfileBufferEntry::kNumChars];
+                e.Get().CopyCharsInto(chars);
+                for (char c : chars) {
+                  if (i < kMaxFrameKeyLength) {
+                    dynStrBuf[i] = c;
+                    i++;
+                  }
+                }
+                e.Next();
+              } else {
+                break;
+              }
+            }
+            dynStrBuf[kMaxFrameKeyLength - 1] = '\0';
+            bool hasDynamicString = (i != 0);
+
+            nsAutoCStringN<1024> frameLabel;
+            if (label[0] != '\0' && hasDynamicString) {
+              if (frameFlags & uint32_t(FrameFlags::STRING_TEMPLATE_METHOD)) {
+                frameLabel.AppendPrintf("%s.%s", label, dynStrBuf.get());
+              } else if (frameFlags &
+                         uint32_t(FrameFlags::STRING_TEMPLATE_GETTER)) {
+                frameLabel.AppendPrintf("get %s.%s", label, dynStrBuf.get());
+              } else if (frameFlags &
+                         uint32_t(FrameFlags::STRING_TEMPLATE_SETTER)) {
+                frameLabel.AppendPrintf("set %s.%s", label, dynStrBuf.get());
+              } else {
+                frameLabel.AppendPrintf("%s %s", label, dynStrBuf.get());
+              }
+            } else if (hasDynamicString) {
+              frameLabel.Append(dynStrBuf.get());
+            } else {
+              frameLabel.Append(label);
+            }
+
+            uint64_t innerWindowID = 0;
+            if (e.Has() && e.Get().IsInnerWindowID()) {
+              innerWindowID = uint64_t(e.Get().GetUint64());
+              e.Next();
+            }
+
+            Maybe<unsigned> line;
+            if (e.Has() && e.Get().IsLineNumber()) {
+              line = Some(unsigned(e.Get().GetInt()));
+              e.Next();
+            }
+
+            Maybe<unsigned> column;
+            if (e.Has() && e.Get().IsColumnNumber()) {
+              column = Some(unsigned(e.Get().GetInt()));
+              e.Next();
+            }
+
+            Maybe<JS::ProfilingCategoryPair> categoryPair;
+            if (e.Has() && e.Get().IsCategoryPair()) {
+              categoryPair =
+                  Some(JS::ProfilingCategoryPair(uint32_t(e.Get().GetInt())));
+              e.Next();
+            }
+
+            stack = aUniqueStacks.AppendFrame(
+                stack,
+                UniqueStacks::FrameKey(std::move(frameLabel), relevantForJS,
+                                       isBaselineInterp, innerWindowID, line,
+                                       column, categoryPair));
+
+          } else if (e.Get().IsJitReturnAddr()) {
+            numFrames++;
+
+            // A JIT frame may expand to multiple frames due to inlining.
+            void* pc = e.Get().GetPtr();
+            const Maybe<Vector<UniqueStacks::FrameKey>>& frameKeys =
+                aUniqueStacks.LookupFramesForJITAddressFromBufferPos(
+                    pc, entryPosition ? entryPosition : e.CurPos());
+            MOZ_RELEASE_ASSERT(
+                frameKeys,
+                "Attempting to stream samples for a buffer range "
+                "for which we don't have JITFrameInfo?");
+            for (const UniqueStacks::FrameKey& frameKey : *frameKeys) {
+              stack = aUniqueStacks.AppendFrame(stack, frameKey);
+            }
+
+            e.Next();
+
+          } else {
+            break;
+          }
+        }
+
+        if (numFrames == 0) {
+          // It is possible to have empty stacks if native stackwalking is
+          // disabled. Skip samples with empty stacks. (See Bug 1497985).
+          // Thus, don't use ERROR_AND_CONTINUE, but just continue by returning
+          // from this lambda.
+          return;
+        }
+
+        sample.mStack = aUniqueStacks.GetOrAddStackIndex(stack);
+
+        if (unresponsiveDuration.isSome()) {
+          sample.mResponsiveness = unresponsiveDuration;
+        }
+
+        sample.mRunningTimes = aRunningTimes;
+
+        WriteSample(aWriter, sample);
+
+        processedThreadId = threadId;
+      };  // End of `ReadStack(EntryGetter&)` lambda.
+
+      if (e.Has() && e.Get().IsTime()) {
+        sample.mTime = e.Get().GetDouble();
+        e.Next();
+
+        // Ignore samples that are too old.
+        if (sample.mTime < aSinceTime) {
+          continue;
+        }
+
+        ReadStack(e, 0, Nothing{}, RunningTimes{});
+      } else if (e.Has() && e.Get().IsTimeBeforeCompactStack()) {
+        sample.mTime = e.Get().GetDouble();
+
+        // Ignore samples that are too old.
+        if (sample.mTime < aSinceTime) {
+          e.Next();
+          continue;
+        }
+
+        RunningTimes runningTimes;
+        Maybe<double> unresponsiveDuration;
+
+        ProfileChunkedBuffer::BlockIterator it = e.Iterator();
+        for (;;) {
+          ++it;
+          if (it.IsAtEnd()) {
+            break;
+          }
+          ProfileBufferEntryReader er = *it;
+          ProfileBufferEntry::Kind kind =
+              er.ReadObject<ProfileBufferEntry::Kind>();
+
+          // There may be running times before the CompactStack.
+          if (kind == ProfileBufferEntry::Kind::RunningTimes) {
+            er.ReadIntoObject(runningTimes);
+            continue;
+          }
+
+          // There may be an UnresponsiveDurationMs before the CompactStack.
+          if (kind == ProfileBufferEntry::Kind::UnresponsiveDurationMs) {
+            unresponsiveDuration = Some(er.ReadObject<double>());
+            continue;
+          }
+
+          if (kind == ProfileBufferEntry::Kind::CompactStack) {
+            ProfileChunkedBuffer tempBuffer(
+                ProfileChunkedBuffer::ThreadSafety::WithoutMutex,
+                mWorkerChunkManager);
+            er.ReadIntoObject(tempBuffer);
+            tempBuffer.Read([&](ProfileChunkedBuffer::Reader* aReader) {
+              MOZ_ASSERT(aReader,
+                         "Local ProfileChunkedBuffer cannot be out-of-session");
+              EntryGetter stackEntryGetter(*aReader);
+              if (stackEntryGetter.Has()) {
+                ReadStack(stackEntryGetter,
+                          it.CurrentBlockIndex().ConvertToProfileBufferIndex(),
+                          unresponsiveDuration, runningTimes);
+              }
+            });
+            mWorkerChunkManager.Reset(tempBuffer.GetAllChunks());
+            break;
+          }
+
+          MOZ_ASSERT(kind >= ProfileBufferEntry::Kind::LEGACY_LIMIT,
+                     "There should be no legacy entries between "
+                     "TimeBeforeCompactStack and CompactStack");
+          er.SetRemainingBytes(0);
+        }
+
+        e.Next();
+      } else {
+        ERROR_AND_CONTINUE("expected a Time entry");
+      }
+    }
+
+    return processedThreadId;
+  });
+}
+
+void ProfileBuffer::AddJITInfoForRange(uint64_t aRangeStart, int aThreadId,
+                                       JSContext* aContext,
+                                       JITFrameInfo& aJITFrameInfo) const {
+  // We can only process JitReturnAddr entries if we have a JSContext.
+  MOZ_RELEASE_ASSERT(aContext);
+
+  aRangeStart = std::max(aRangeStart, BufferRangeStart());
+  aJITFrameInfo.AddInfoForRange(
+      aRangeStart, BufferRangeEnd(), aContext,
+      [&](const std::function<void(void*)>& aJITAddressConsumer) {
+        // Find all JitReturnAddr entries in the given range for the given
+        // thread, and call aJITAddressConsumer with those addresses.
+
+        mEntries.Read([&](ProfileChunkedBuffer::Reader* aReader) {
+          MOZ_ASSERT(aReader,
+                     "ProfileChunkedBuffer cannot be out-of-session when "
+                     "sampler is running");
+
+          EntryGetter e(*aReader, aRangeStart);
+
+          while (true) {
+            // Advance to the next ThreadId entry.
+            while (e.Has() && !e.Get().IsThreadId()) {
+              e.Next();
+            }
+            if (!e.Has()) {
+              break;
+            }
+
+            MOZ_ASSERT(e.Get().IsThreadId());
+            int threadId = e.Get().GetInt();
+            e.Next();
+
+            // Ignore samples that are for a different thread.
+            if (threadId != aThreadId) {
+              continue;
+            }
+
+            if (e.Has() && e.Get().IsTime()) {
+              // Legacy stack.
+              e.Next();
+              while (e.Has() && !e.Get().IsThreadId()) {
+                if (e.Get().IsJitReturnAddr()) {
+                  aJITAddressConsumer(e.Get().GetPtr());
+                }
+                e.Next();
+              }
+            } else if (e.Has() && e.Get().IsTimeBeforeCompactStack()) {
+              // Compact stack.
+              ProfileChunkedBuffer::BlockIterator it = e.Iterator();
+              for (;;) {
+                ++it;
+                if (it.IsAtEnd()) {
+                  break;
+                }
+                ProfileBufferEntryReader er = *it;
+                ProfileBufferEntry::Kind kind =
+                    er.ReadObject<ProfileBufferEntry::Kind>();
+                if (kind == ProfileBufferEntry::Kind::CompactStack) {
+                  ProfileChunkedBuffer tempBuffer(
+                      ProfileChunkedBuffer::ThreadSafety::WithoutMutex,
+                      mWorkerChunkManager);
+                  er.ReadIntoObject(tempBuffer);
+                  tempBuffer.Read([&](ProfileChunkedBuffer::Reader* aReader) {
+                    MOZ_ASSERT(
+                        aReader,
+                        "Local ProfileChunkedBuffer cannot be out-of-session");
+                    EntryGetter stackEntryGetter(*aReader);
+                    while (stackEntryGetter.Has()) {
+                      if (stackEntryGetter.Get().IsJitReturnAddr()) {
+                        aJITAddressConsumer(stackEntryGetter.Get().GetPtr());
+                      }
+                      stackEntryGetter.Next();
+                    }
+                  });
+                  mWorkerChunkManager.Reset(tempBuffer.GetAllChunks());
+                  break;
+                }
+
+                MOZ_ASSERT(kind >= ProfileBufferEntry::Kind::LEGACY_LIMIT,
+                           "There should be no legacy entries between "
+                           "TimeBeforeCompactStack and CompactStack");
+                er.SetRemainingBytes(0);
+              }
+
+              e.Next();
+            } else {
+              ERROR_AND_CONTINUE("expected a Time entry");
+            }
+          }
+        });
+      });
+}
+
+void ProfileBuffer::StreamMarkersToJSON(SpliceableJSONWriter& aWriter,
+                                        int aThreadId,
+                                        const TimeStamp& aProcessStartTime,
+                                        double aSinceTime,
+                                        UniqueStacks& aUniqueStacks) const {
+  mEntries.ReadEach([&](ProfileBufferEntryReader& aER) {
+    auto type = static_cast<ProfileBufferEntry::Kind>(
+        aER.ReadObject<ProfileBufferEntry::KindUnderlyingType>());
+    MOZ_ASSERT(static_cast<ProfileBufferEntry::KindUnderlyingType>(type) <
+               static_cast<ProfileBufferEntry::KindUnderlyingType>(
+                   ProfileBufferEntry::Kind::MODERN_LIMIT));
+    bool entryWasFullyRead = false;
+
+    if (type == ProfileBufferEntry::Kind::Marker) {
+      entryWasFullyRead =
+          mozilla::base_profiler_markers_detail::DeserializeAfterKindAndStream(
+              aER, aWriter, aThreadId,
+              [&](ProfileChunkedBuffer& aChunkedBuffer) {
+                ProfilerBacktrace backtrace("", &aChunkedBuffer);
+                backtrace.StreamJSON(aWriter, aProcessStartTime, aUniqueStacks);
+              });
+    }
+
+    if (!entryWasFullyRead) {
+      // The entry was not a marker, or it was a marker for another thread.
+      // We probably didn't read the whole entry, so we need to skip to the end.
+      aER.SetRemainingBytes(0);
+    }
+  });
+}
+
+void ProfileBuffer::StreamProfilerOverheadToJSON(
+    SpliceableJSONWriter& aWriter, const TimeStamp& aProcessStartTime,
+    double aSinceTime) const {
+  mEntries.Read([&](ProfileChunkedBuffer::Reader* aReader) {
+    MOZ_ASSERT(aReader,
+               "ProfileChunkedBuffer cannot be out-of-session when sampler is "
+               "running");
+
+    EntryGetter e(*aReader);
+
+    enum Schema : uint32_t {
+      TIME = 0,
+      LOCKING = 1,
+      MARKER_CLEANING = 2,
+      COUNTERS = 3,
+      THREADS = 4
+    };
+
+    aWriter.StartObjectProperty("profilerOverhead");
+    aWriter.StartObjectProperty("samples");
+    // Stream all sampling overhead data. We skip other entries, because we
+    // process them in StreamSamplesToJSON()/etc.
+    {
+      JSONSchemaWriter schema(aWriter);
+      schema.WriteField("time");
+      schema.WriteField("locking");
+      schema.WriteField("expiredMarkerCleaning");
+      schema.WriteField("counters");
+      schema.WriteField("threads");
+    }
+
+    aWriter.StartArrayProperty("data");
+    double firstTime = 0.0;
+    double lastTime = 0.0;
+    ProfilerStats intervals, overheads, lockings, cleanings, counters, threads;
+    while (e.Has()) {
+      // valid sequence: ProfilerOverheadTime, ProfilerOverheadDuration * 4
+      if (e.Get().IsProfilerOverheadTime()) {
+        double time = e.Get().GetDouble();
+        if (time >= aSinceTime) {
+          e.Next();
+          if (!e.Has() || !e.Get().IsProfilerOverheadDuration()) {
+            ERROR_AND_CONTINUE(
+                "expected a ProfilerOverheadDuration entry after "
+                "ProfilerOverheadTime");
+          }
+          double locking = e.Get().GetDouble();
+          e.Next();
+          if (!e.Has() || !e.Get().IsProfilerOverheadDuration()) {
+            ERROR_AND_CONTINUE(
+                "expected a ProfilerOverheadDuration entry after "
+                "ProfilerOverheadTime,ProfilerOverheadDuration");
+          }
+          double cleaning = e.Get().GetDouble();
+          e.Next();
+          if (!e.Has() || !e.Get().IsProfilerOverheadDuration()) {
+            ERROR_AND_CONTINUE(
+                "expected a ProfilerOverheadDuration entry after "
+                "ProfilerOverheadTime,ProfilerOverheadDuration*2");
+          }
+          double counter = e.Get().GetDouble();
+          e.Next();
+          if (!e.Has() || !e.Get().IsProfilerOverheadDuration()) {
+            ERROR_AND_CONTINUE(
+                "expected a ProfilerOverheadDuration entry after "
+                "ProfilerOverheadTime,ProfilerOverheadDuration*3");
+          }
+          double thread = e.Get().GetDouble();
+
+          if (firstTime == 0.0) {
+            firstTime = time;
+          } else {
+            // Note that we'll have 1 fewer interval than other numbers (because
+            // we need both ends of an interval to know its duration). The final
+            // difference should be insignificant over the expected many
+            // thousands of iterations.
+            intervals.Count(time - lastTime);
+          }
+          lastTime = time;
+          overheads.Count(locking + cleaning + counter + thread);
+          lockings.Count(locking);
+          cleanings.Count(cleaning);
+          counters.Count(counter);
+          threads.Count(thread);
+
+          AutoArraySchemaWriter writer(aWriter);
+          writer.DoubleElement(TIME, time);
+          writer.DoubleElement(LOCKING, locking);
+          writer.DoubleElement(MARKER_CLEANING, cleaning);
+          writer.DoubleElement(COUNTERS, counter);
+          writer.DoubleElement(THREADS, thread);
+        }
+      }
+      e.Next();
+    }
+    aWriter.EndArray();   // data
+    aWriter.EndObject();  // samples
+
+    // Only output statistics if there is at least one full interval (and
+    // therefore at least two samplings.)
+    if (intervals.n > 0) {
+      aWriter.StartObjectProperty("statistics");
+      aWriter.DoubleProperty("profiledDuration", lastTime - firstTime);
+      aWriter.IntProperty("samplingCount", overheads.n);
+      aWriter.DoubleProperty("overheadDurations", overheads.sum);
+      aWriter.DoubleProperty("overheadPercentage",
+                             overheads.sum / (lastTime - firstTime));
+#define PROFILER_STATS(name, var)                           \
+  aWriter.DoubleProperty("mean" name, (var).sum / (var).n); \
+  aWriter.DoubleProperty("min" name, (var).min);            \
+  aWriter.DoubleProperty("max" name, (var).max);
+      PROFILER_STATS("Interval", intervals);
+      PROFILER_STATS("Overhead", overheads);
+      PROFILER_STATS("Lockings", lockings);
+      PROFILER_STATS("Cleaning", cleanings);
+      PROFILER_STATS("Counter", counters);
+      PROFILER_STATS("Thread", threads);
+#undef PROFILER_STATS
+      aWriter.EndObject();  // statistics
+    }
+    aWriter.EndObject();  // profilerOverhead
+  });
+}
+
+struct CounterKeyedSample {
+  double mTime;
+  uint64_t mNumber;
+  int64_t mCount;
+};
+
+using CounterKeyedSamples = Vector<CounterKeyedSample>;
+
+static LazyLogModule sFuzzyfoxLog("Fuzzyfox");
+
+using CounterMap = HashMap<uint64_t, CounterKeyedSamples>;
+
+// HashMap lookup, if not found, a default value is inserted.
+// Returns reference to (existing or new) value inside the HashMap.
+template <typename HashM, typename Key>
+static auto& LookupOrAdd(HashM& aMap, Key&& aKey) {
+  auto addPtr = aMap.lookupForAdd(aKey);
+  if (!addPtr) {
+    MOZ_RELEASE_ASSERT(aMap.add(addPtr, std::forward<Key>(aKey),
+                                typename HashM::Entry::ValueType{}));
+    MOZ_ASSERT(!!addPtr);
+  }
+  return addPtr->value();
+}
+
+void ProfileBuffer::StreamCountersToJSON(SpliceableJSONWriter& aWriter,
+                                         const TimeStamp& aProcessStartTime,
+                                         double aSinceTime) const {
+  // Because this is a format entirely internal to the Profiler, any parsing
+  // error indicates a bug in the ProfileBuffer writing or the parser itself,
+  // or possibly flaky hardware.
+
+  mEntries.Read([&](ProfileChunkedBuffer::Reader* aReader) {
+    MOZ_ASSERT(aReader,
+               "ProfileChunkedBuffer cannot be out-of-session when sampler is "
+               "running");
+
+    EntryGetter e(*aReader);
+
+    enum Schema : uint32_t { TIME = 0, NUMBER = 1, COUNT = 2 };
+
+    // Stream all counters. We skip other entries, because we process them in
+    // StreamSamplesToJSON()/etc.
+    //
+    // Valid sequence in the buffer:
+    // CounterID
+    // Time
+    // ( CounterKey Count Number? )*
+    //
+    // And the JSON (example):
+    // "counters": {
+    //  "name": "malloc",
+    //  "category": "Memory",
+    //  "description": "Amount of allocated memory",
+    //  "sample_groups": {
+    //   "id": 0,
+    //   "samples": {
+    //    "schema": {"time": 0, "number": 1, "count": 2},
+    //    "data": [
+    //     [
+    //      16117.033968000002,
+    //      2446216,
+    //      6801320
+    //     ],
+    //     [
+    //      16118.037638,
+    //      2446216,
+    //      6801320
+    //     ],
+    //    ],
+    //   }
+    //  }
+    // },
+
+    // Build the map of counters and populate it
+    HashMap<void*, CounterMap> counters;
+
+    while (e.Has()) {
+      // skip all non-Counters, including if we start in the middle of a counter
+      if (e.Get().IsCounterId()) {
+        void* id = e.Get().GetPtr();
+        CounterMap& counter = LookupOrAdd(counters, id);
+        e.Next();
+        if (!e.Has() || !e.Get().IsTime()) {
+          ERROR_AND_CONTINUE("expected a Time entry");
+        }
+        double time = e.Get().GetDouble();
+        if (time >= aSinceTime) {
+          e.Next();
+          while (e.Has() && e.Get().IsCounterKey()) {
+            uint64_t key = e.Get().GetUint64();
+            CounterKeyedSamples& data = LookupOrAdd(counter, key);
+            e.Next();
+            if (!e.Has() || !e.Get().IsCount()) {
+              ERROR_AND_CONTINUE("expected a Count entry");
+            }
+            int64_t count = e.Get().GetUint64();
+            e.Next();
+            uint64_t number;
+            if (!e.Has() || !e.Get().IsNumber()) {
+              number = 0;
+            } else {
+              number = e.Get().GetInt64();
+            }
+            CounterKeyedSample sample = {time, number, count};
+            MOZ_RELEASE_ASSERT(data.append(sample));
+          }
+        } else {
+          // skip counter sample - only need to skip the initial counter
+          // id, then let the loop at the top skip the rest
+        }
+      }
+      e.Next();
+    }
+    // we have a map of a map of counter entries; dump them to JSON
+    if (counters.count() == 0) {
+      return;
+    }
+
+    aWriter.StartArrayProperty("counters");
+    for (auto iter = counters.iter(); !iter.done(); iter.next()) {
+      CounterMap& counter = iter.get().value();
+      const BaseProfilerCount* base_counter =
+          static_cast<const BaseProfilerCount*>(iter.get().key());
+
+      aWriter.Start();
+      aWriter.StringProperty("name", MakeStringSpan(base_counter->mLabel));
+      aWriter.StringProperty("category",
+                             MakeStringSpan(base_counter->mCategory));
+      aWriter.StringProperty("description",
+                             MakeStringSpan(base_counter->mDescription));
+
+      aWriter.StartArrayProperty("sample_groups");
+      for (auto counter_iter = counter.iter(); !counter_iter.done();
+           counter_iter.next()) {
+        CounterKeyedSamples& samples = counter_iter.get().value();
+        uint64_t key = counter_iter.get().key();
+
+        size_t size = samples.length();
+        if (size == 0) {
+          continue;
+        }
+
+        aWriter.StartObjectElement();
+        {
+          aWriter.IntProperty("id", static_cast<int64_t>(key));
+          aWriter.StartObjectProperty("samples");
+          {
+            // XXX Can we assume a missing count means 0?
+            JSONSchemaWriter schema(aWriter);
+            schema.WriteField("time");
+            schema.WriteField("number");
+            schema.WriteField("count");
+          }
+
+          aWriter.StartArrayProperty("data");
+          uint64_t previousNumber = 0;
+          int64_t previousCount = 0;
+          for (size_t i = 0; i < size; i++) {
+            // Encode as deltas, and only encode if different than the last
+            // sample
+            if (i == 0 || samples[i].mNumber != previousNumber ||
+                samples[i].mCount != previousCount) {
+              if (i != 0 && samples[i].mTime >= samples[i - 1].mTime) {
+                MOZ_LOG(sFuzzyfoxLog, mozilla::LogLevel::Error,
+                        ("Fuzzyfox Profiler Assertion: %f >= %f",
+                         samples[i].mTime, samples[i - 1].mTime));
+              }
+              MOZ_ASSERT(i == 0 || samples[i].mTime >= samples[i - 1].mTime);
+              MOZ_ASSERT(samples[i].mNumber >= previousNumber);
+              MOZ_ASSERT(samples[i].mNumber - previousNumber <=
+                         uint64_t(std::numeric_limits<int64_t>::max()));
+
+              AutoArraySchemaWriter writer(aWriter);
+              writer.DoubleElement(TIME, samples[i].mTime);
+              writer.IntElement(
+                  NUMBER,
+                  static_cast<int64_t>(samples[i].mNumber - previousNumber));
+              writer.IntElement(COUNT, samples[i].mCount - previousCount);
+              previousNumber = samples[i].mNumber;
+              previousCount = samples[i].mCount;
+            }
+          }
+          aWriter.EndArray();   // data
+          aWriter.EndObject();  // samples
+        }
+        aWriter.EndObject();  // sample_groups item
+      }
+      aWriter.EndArray();  // sample groups
+      aWriter.End();       // for each counter
+    }
+    aWriter.EndArray();  // counters
+  });
+}
+
+#undef ERROR_AND_CONTINUE
+
+static void AddPausedRange(SpliceableJSONWriter& aWriter, const char* aReason,
+                           const Maybe<double>& aStartTime,
+                           const Maybe<double>& aEndTime) {
+  aWriter.Start();
+  if (aStartTime) {
+    aWriter.DoubleProperty("startTime", *aStartTime);
+  } else {
+    aWriter.NullProperty("startTime");
+  }
+  if (aEndTime) {
+    aWriter.DoubleProperty("endTime", *aEndTime);
+  } else {
+    aWriter.NullProperty("endTime");
+  }
+  aWriter.StringProperty("reason", MakeStringSpan(aReason));
+  aWriter.End();
+}
+
+void ProfileBuffer::StreamPausedRangesToJSON(SpliceableJSONWriter& aWriter,
+                                             double aSinceTime) const {
+  mEntries.Read([&](ProfileChunkedBuffer::Reader* aReader) {
+    MOZ_ASSERT(aReader,
+               "ProfileChunkedBuffer cannot be out-of-session when sampler is "
+               "running");
+
+    EntryGetter e(*aReader);
+
+    Maybe<double> currentPauseStartTime;
+    Maybe<double> currentCollectionStartTime;
+
+    while (e.Has()) {
+      if (e.Get().IsPause()) {
+        currentPauseStartTime = Some(e.Get().GetDouble());
+      } else if (e.Get().IsResume()) {
+        AddPausedRange(aWriter, "profiler-paused", currentPauseStartTime,
+                       Some(e.Get().GetDouble()));
+        currentPauseStartTime = Nothing();
+      } else if (e.Get().IsCollectionStart()) {
+        currentCollectionStartTime = Some(e.Get().GetDouble());
+      } else if (e.Get().IsCollectionEnd()) {
+        AddPausedRange(aWriter, "collecting", currentCollectionStartTime,
+                       Some(e.Get().GetDouble()));
+        currentCollectionStartTime = Nothing();
+      }
+      e.Next();
+    }
+
+    if (currentPauseStartTime) {
+      AddPausedRange(aWriter, "profiler-paused", currentPauseStartTime,
+                     Nothing());
+    }
+    if (currentCollectionStartTime) {
+      AddPausedRange(aWriter, "collecting", currentCollectionStartTime,
+                     Nothing());
+    }
+  });
+}
+
+bool ProfileBuffer::DuplicateLastSample(int aThreadId, double aSampleTimeMs,
+                                        Maybe<uint64_t>& aLastSample,
+                                        const RunningTimes& aRunningTimes) {
+  if (!aLastSample) {
+    return false;
+  }
+
+  ProfileChunkedBuffer tempBuffer(
+      ProfileChunkedBuffer::ThreadSafety::WithoutMutex, mWorkerChunkManager);
+
+  auto retrieveWorkerChunk = MakeScopeExit(
+      [&]() { mWorkerChunkManager.Reset(tempBuffer.GetAllChunks()); });
+
+  const bool ok = mEntries.Read([&](ProfileChunkedBuffer::Reader* aReader) {
+    MOZ_ASSERT(aReader,
+               "ProfileChunkedBuffer cannot be out-of-session when sampler is "
+               "running");
+
+    EntryGetter e(*aReader, *aLastSample);
+
+    if (e.CurPos() != *aLastSample) {
+      // The last sample is no longer within the buffer range, so we cannot
+      // use it. Reset the stored buffer position to Nothing().
+      aLastSample.reset();
+      return false;
+    }
+
+    MOZ_RELEASE_ASSERT(e.Has() && e.Get().IsThreadId() &&
+                       e.Get().GetInt() == aThreadId);
+
+    e.Next();
+
+    // Go through the whole entry and duplicate it, until we find the next
+    // one.
+    while (e.Has()) {
+      switch (e.Get().GetKind()) {
+        case ProfileBufferEntry::Kind::Pause:
+        case ProfileBufferEntry::Kind::Resume:
+        case ProfileBufferEntry::Kind::PauseSampling:
+        case ProfileBufferEntry::Kind::ResumeSampling:
+        case ProfileBufferEntry::Kind::CollectionStart:
+        case ProfileBufferEntry::Kind::CollectionEnd:
+        case ProfileBufferEntry::Kind::ThreadId:
+          // We're done.
+          return true;
+        case ProfileBufferEntry::Kind::Time:
+          // Copy with new time
+          AddEntry(tempBuffer, ProfileBufferEntry::Time(aSampleTimeMs));
+          break;
+        case ProfileBufferEntry::Kind::TimeBeforeCompactStack: {
+          // Copy with new time, followed by a compact stack.
+          AddEntry(tempBuffer,
+                   ProfileBufferEntry::TimeBeforeCompactStack(aSampleTimeMs));
+
+          // Add running times if they have data.
+          if (!aRunningTimes.IsEmpty()) {
+            tempBuffer.PutObjects(ProfileBufferEntry::Kind::RunningTimes,
+                                  aRunningTimes);
+          }
+
+          // The `CompactStack` *must* be present afterwards, but may not
+          // immediately follow `TimeBeforeCompactStack` (e.g., some markers
+          // could be written in-between), so we need to look for it in the
+          // following entries.
+          ProfileChunkedBuffer::BlockIterator it = e.Iterator();
+          for (;;) {
+            ++it;
+            if (it.IsAtEnd()) {
+              break;
+            }
+            ProfileBufferEntryReader er = *it;
+            auto kind = static_cast<ProfileBufferEntry::Kind>(
+                er.ReadObject<ProfileBufferEntry::KindUnderlyingType>());
+            MOZ_ASSERT(
+                static_cast<ProfileBufferEntry::KindUnderlyingType>(kind) <
+                static_cast<ProfileBufferEntry::KindUnderlyingType>(
+                    ProfileBufferEntry::Kind::MODERN_LIMIT));
+            if (kind == ProfileBufferEntry::Kind::CompactStack) {
+              // Found our CompactStack, just make a copy of the whole entry.
+              er = *it;
+              auto bytes = er.RemainingBytes();
+              MOZ_ASSERT(bytes <
+                         ProfileBufferChunkManager::scExpectedMaximumStackSize);
+              tempBuffer.Put(bytes, [&](Maybe<ProfileBufferEntryWriter>& aEW) {
+                MOZ_ASSERT(aEW.isSome(), "tempBuffer cannot be out-of-session");
+                aEW->WriteFromReader(er, bytes);
+              });
+              // CompactStack marks the end, we're done.
+              break;
+            }
+
+            MOZ_ASSERT(kind >= ProfileBufferEntry::Kind::LEGACY_LIMIT,
+                       "There should be no legacy entries between "
+                       "TimeBeforeCompactStack and CompactStack");
+            er.SetRemainingBytes(0);
+            // Here, we have encountered a non-legacy entry that was not the
+            // CompactStack we're looking for; just continue the search...
+          }
+          // We're done.
+          return true;
+        }
+        case ProfileBufferEntry::Kind::CounterKey:
+        case ProfileBufferEntry::Kind::Number:
+        case ProfileBufferEntry::Kind::Count:
+          // Don't copy anything not part of a thread's stack sample
+          break;
+        case ProfileBufferEntry::Kind::CounterId:
+          // CounterId is normally followed by Time - if so, we'd like
+          // to skip it.  If we duplicate Time, it won't hurt anything, just
+          // waste buffer space (and this can happen if the CounterId has
+          // fallen off the end of the buffer, but Time (and Number/Count)
+          // are still in the buffer).
+          e.Next();
+          if (e.Has() && e.Get().GetKind() != ProfileBufferEntry::Kind::Time) {
+            // this would only happen if there was an invalid sequence
+            // in the buffer.  Don't skip it.
+            continue;
+          }
+          // we've skipped Time
+          break;
+        case ProfileBufferEntry::Kind::ProfilerOverheadTime:
+          // ProfilerOverheadTime is normally followed by
+          // ProfilerOverheadDuration*4 - if so, we'd like to skip it. Don't
+          // duplicate, as we are in the middle of a sampling and will soon
+          // capture its own overhead.
+          e.Next();
+          // A missing Time would only happen if there was an invalid
+          // sequence in the buffer. Don't skip unexpected entry.
+          if (e.Has() &&
+              e.Get().GetKind() !=
+                  ProfileBufferEntry::Kind::ProfilerOverheadDuration) {
+            continue;
+          }
+          e.Next();
+          if (e.Has() &&
+              e.Get().GetKind() !=
+                  ProfileBufferEntry::Kind::ProfilerOverheadDuration) {
+            continue;
+          }
+          e.Next();
+          if (e.Has() &&
+              e.Get().GetKind() !=
+                  ProfileBufferEntry::Kind::ProfilerOverheadDuration) {
+            continue;
+          }
+          e.Next();
+          if (e.Has() &&
+              e.Get().GetKind() !=
+                  ProfileBufferEntry::Kind::ProfilerOverheadDuration) {
+            continue;
+          }
+          // we've skipped ProfilerOverheadTime and
+          // ProfilerOverheadDuration*4.
+          break;
+        default: {
+          // Copy anything else we don't know about.
+          AddEntry(tempBuffer, e.Get());
+          break;
+        }
+      }
+      e.Next();
+    }
+    return true;
+  });
+
+  if (!ok) {
+    return false;
+  }
+
+  // If the buffer was big enough, there won't be any cleared blocks.
+  if (tempBuffer.GetState().mClearedBlockCount != 0) {
+    // No need to try to read stack again as it won't fit. Reset the stored
+    // buffer position to Nothing().
+    aLastSample.reset();
+    return false;
+  }
+
+  aLastSample = Some(AddThreadIdEntry(aThreadId));
+
+  mEntries.AppendContents(tempBuffer);
+
+  return true;
+}
+
+void ProfileBuffer::DiscardSamplesBeforeTime(double aTime) {
+  // This function does nothing!
+  // The duration limit will be removed from Firefox, see bug 1632365.
+  Unused << aTime;
+}
+
+// END ProfileBuffer
+////////////////////////////////////////////////////////////////////////
diff --git a/tools/profiler/core/ProfileBufferEntry.h b/tools/profiler/core/ProfileBufferEntry.h
new file mode 100644
index 0000000000..3ce35e6b85
--- /dev/null
+++ b/tools/profiler/core/ProfileBufferEntry.h
@@ -0,0 +1,489 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProfileBufferEntry_h
+#define ProfileBufferEntry_h
+
+#include <cstdint>
+#include <cstdlib>
+#include <functional>
+#include <utility>
+#include "gtest/MozGtestFriend.h"
+#include "js/ProfilingCategory.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/HashFunctions.h"
+#include "mozilla/HashTable.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/ProfileBufferEntryKinds.h"
+#include "mozilla/ProfileJSONWriter.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Variant.h"
+#include "mozilla/Vector.h"
+#include "nsString.h"
+
+class ProfilerCodeAddressService;
+struct JSContext;
+
+class ProfileBufferEntry {
+ public:
+  using KindUnderlyingType = mozilla::ProfileBufferEntryKindUnderlyingType;
+  using Kind = mozilla::ProfileBufferEntryKind;
+
+  ProfileBufferEntry();
+
+  static constexpr size_t kNumChars = mozilla::ProfileBufferEntryNumChars;
+
+ private:
+  // aString must be a static string.
+  ProfileBufferEntry(Kind aKind, const char* aString);
+  ProfileBufferEntry(Kind aKind, char aChars[kNumChars]);
+  ProfileBufferEntry(Kind aKind, void* aPtr);
+  ProfileBufferEntry(Kind aKind, double aDouble);
+  ProfileBufferEntry(Kind aKind, int64_t aInt64);
+  ProfileBufferEntry(Kind aKind, uint64_t aUint64);
+  ProfileBufferEntry(Kind aKind, int aInt);
+
+ public:
+#define CTOR(KIND, TYPE, SIZE)                   \
+  static ProfileBufferEntry KIND(TYPE aVal) {    \
+    return ProfileBufferEntry(Kind::KIND, aVal); \
+  }
+  FOR_EACH_PROFILE_BUFFER_ENTRY_KIND(CTOR)
+#undef CTOR
+
+  Kind GetKind() const { return mKind; }
+
+#define IS_KIND(KIND, TYPE, SIZE) \
+  bool Is##KIND() const { return mKind == Kind::KIND; }
+  FOR_EACH_PROFILE_BUFFER_ENTRY_KIND(IS_KIND)
+#undef IS_KIND
+
+ private:
+  FRIEND_TEST(ThreadProfile, InsertOneEntry);
+  FRIEND_TEST(ThreadProfile, InsertOneEntryWithTinyBuffer);
+  FRIEND_TEST(ThreadProfile, InsertEntriesNoWrap);
+  FRIEND_TEST(ThreadProfile, InsertEntriesWrap);
+  FRIEND_TEST(ThreadProfile, MemoryMeasure);
+  friend class ProfileBuffer;
+
+  Kind mKind;
+  uint8_t mStorage[kNumChars];
+
+  const char* GetString() const;
+  void* GetPtr() const;
+  double GetDouble() const;
+  int GetInt() const;
+  int64_t GetInt64() const;
+  uint64_t GetUint64() const;
+  void CopyCharsInto(char (&aOutArray)[kNumChars]) const;
+};
+
+// Packed layout: 1 byte for the tag + 8 bytes for the value.
+static_assert(sizeof(ProfileBufferEntry) == 9, "bad ProfileBufferEntry size");
+
+// Contains all the information about JIT frames that is needed to stream stack
+// frames for JitReturnAddr entries in the profiler buffer.
+// Every return address (void*) is mapped to one or more JITFrameKeys, and
+// every JITFrameKey is mapped to a JSON string for that frame.
+// mRangeStart and mRangeEnd describe the range in the buffer for which this
+// mapping is valid. Only JitReturnAddr entries within that buffer range can be
+// processed using this JITFrameInfoForBufferRange object.
+struct JITFrameInfoForBufferRange final {
+  JITFrameInfoForBufferRange Clone() const;
+
+  uint64_t mRangeStart;
+  uint64_t mRangeEnd;  // mRangeEnd marks the first invalid index.
+
+  struct JITFrameKey {
+    bool operator==(const JITFrameKey& aOther) const {
+      return mCanonicalAddress == aOther.mCanonicalAddress &&
+             mDepth == aOther.mDepth;
+    }
+    bool operator!=(const JITFrameKey& aOther) const {
+      return !(*this == aOther);
+    }
+
+    void* mCanonicalAddress;
+    uint32_t mDepth;
+  };
+  struct JITFrameKeyHasher {
+    using Lookup = JITFrameKey;
+
+    static mozilla::HashNumber hash(const JITFrameKey& aLookup) {
+      mozilla::HashNumber hash = 0;
+      hash = mozilla::AddToHash(hash, aLookup.mCanonicalAddress);
+      hash = mozilla::AddToHash(hash, aLookup.mDepth);
+      return hash;
+    }
+
+    static bool match(const JITFrameKey& aKey, const JITFrameKey& aLookup) {
+      return aKey == aLookup;
+    }
+
+    static void rekey(JITFrameKey& aKey, const JITFrameKey& aNewKey) {
+      aKey = aNewKey;
+    }
+  };
+
+  using JITAddressToJITFramesMap =
+      mozilla::HashMap<void*, mozilla::Vector<JITFrameKey>>;
+  JITAddressToJITFramesMap mJITAddressToJITFramesMap;
+  using JITFrameToFrameJSONMap =
+      mozilla::HashMap<JITFrameKey, nsCString, JITFrameKeyHasher>;
+  JITFrameToFrameJSONMap mJITFrameToFrameJSONMap;
+};
+
+// Contains JITFrameInfoForBufferRange objects for multiple profiler buffer
+// ranges.
+struct JITFrameInfo final {
+  JITFrameInfo() : mUniqueStrings(mozilla::MakeUnique<UniqueJSONStrings>()) {}
+
+  MOZ_IMPLICIT JITFrameInfo(const JITFrameInfo& aOther);
+
+  // Creates a new JITFrameInfoForBufferRange object in mRanges by looking up
+  // information about the provided JIT return addresses using aCx.
+  // Addresses are provided like this:
+  // The caller of AddInfoForRange supplies a function in aJITAddressProvider.
+  // This function will be called once, synchronously, with an
+  // aJITAddressConsumer argument, which is a function that needs to be called
+  // for every address. That function can be called multiple times for the same
+  // address.
+  void AddInfoForRange(
+      uint64_t aRangeStart, uint64_t aRangeEnd, JSContext* aCx,
+      const std::function<void(const std::function<void(void*)>&)>&
+          aJITAddressProvider);
+
+  // Returns whether the information stored in this object is still relevant
+  // for any entries in the buffer.
+  bool HasExpired(uint64_t aCurrentBufferRangeStart) const {
+    if (mRanges.empty()) {
+      // No information means no relevant information. Allow this object to be
+      // discarded.
+      return true;
+    }
+    return mRanges.back().mRangeEnd <= aCurrentBufferRangeStart;
+  }
+
+  // The array of ranges of JIT frame information, sorted by buffer position.
+  // Ranges are non-overlapping.
+  // The JSON of the cached frames can contain string indexes, which refer
+  // to strings in mUniqueStrings.
+  mozilla::Vector<JITFrameInfoForBufferRange> mRanges;
+
+  // The string table which contains strings used in the frame JSON that's
+  // cached in mRanges.
+  mozilla::UniquePtr<UniqueJSONStrings> mUniqueStrings;
+};
+
+class UniqueStacks {
+ public:
+  struct FrameKey {
+    explicit FrameKey(const char* aLocation)
+        : mData(NormalFrameData{nsCString(aLocation), false, false, 0,
+                                mozilla::Nothing(), mozilla::Nothing()}) {}
+
+    FrameKey(nsCString&& aLocation, bool aRelevantForJS, bool aBaselineInterp,
+             uint64_t aInnerWindowID, const mozilla::Maybe<unsigned>& aLine,
+             const mozilla::Maybe<unsigned>& aColumn,
+             const mozilla::Maybe<JS::ProfilingCategoryPair>& aCategoryPair)
+        : mData(NormalFrameData{aLocation, aRelevantForJS, aBaselineInterp,
+                                aInnerWindowID, aLine, aColumn,
+                                aCategoryPair}) {}
+
+    FrameKey(void* aJITAddress, uint32_t aJITDepth, uint32_t aRangeIndex)
+        : mData(JITFrameData{aJITAddress, aJITDepth, aRangeIndex}) {}
+
+    FrameKey(const FrameKey& aToCopy) = default;
+
+    uint32_t Hash() const;
+    bool operator==(const FrameKey& aOther) const {
+      return mData == aOther.mData;
+    }
+
+    struct NormalFrameData {
+      bool operator==(const NormalFrameData& aOther) const;
+
+      nsCString mLocation;
+      bool mRelevantForJS;
+      bool mBaselineInterp;
+      uint64_t mInnerWindowID;
+      mozilla::Maybe<unsigned> mLine;
+      mozilla::Maybe<unsigned> mColumn;
+      mozilla::Maybe<JS::ProfilingCategoryPair> mCategoryPair;
+    };
+    struct JITFrameData {
+      bool operator==(const JITFrameData& aOther) const;
+
+      void* mCanonicalAddress;
+      uint32_t mDepth;
+      uint32_t mRangeIndex;
+    };
+    mozilla::Variant<NormalFrameData, JITFrameData> mData;
+  };
+
+  struct FrameKeyHasher {
+    using Lookup = FrameKey;
+
+    static mozilla::HashNumber hash(const FrameKey& aLookup) {
+      mozilla::HashNumber hash = 0;
+      if (aLookup.mData.is<FrameKey::NormalFrameData>()) {
+        const FrameKey::NormalFrameData& data =
+            aLookup.mData.as<FrameKey::NormalFrameData>();
+        if (!data.mLocation.IsEmpty()) {
+          hash = mozilla::AddToHash(hash,
+                                    mozilla::HashString(data.mLocation.get()));
+        }
+        hash = mozilla::AddToHash(hash, data.mRelevantForJS);
+        hash = mozilla::AddToHash(hash, data.mBaselineInterp);
+        hash = mozilla::AddToHash(hash, data.mInnerWindowID);
+        if (data.mLine.isSome()) {
+          hash = mozilla::AddToHash(hash, *data.mLine);
+        }
+        if (data.mColumn.isSome()) {
+          hash = mozilla::AddToHash(hash, *data.mColumn);
+        }
+        if (data.mCategoryPair.isSome()) {
+          hash = mozilla::AddToHash(hash,
+                                    static_cast<uint32_t>(*data.mCategoryPair));
+        }
+      } else {
+        const FrameKey::JITFrameData& data =
+            aLookup.mData.as<FrameKey::JITFrameData>();
+        hash = mozilla::AddToHash(hash, data.mCanonicalAddress);
+        hash = mozilla::AddToHash(hash, data.mDepth);
+        hash = mozilla::AddToHash(hash, data.mRangeIndex);
+      }
+      return hash;
+    }
+
+    static bool match(const FrameKey& aKey, const FrameKey& aLookup) {
+      return aKey == aLookup;
+    }
+
+    static void rekey(FrameKey& aKey, const FrameKey& aNewKey) {
+      aKey = aNewKey;
+    }
+  };
+
+  struct StackKey {
+    mozilla::Maybe<uint32_t> mPrefixStackIndex;
+    uint32_t mFrameIndex;
+
+    explicit StackKey(uint32_t aFrame)
+        : mFrameIndex(aFrame), mHash(mozilla::HashGeneric(aFrame)) {}
+
+    StackKey(const StackKey& aPrefix, uint32_t aPrefixStackIndex,
+             uint32_t aFrame)
+        : mPrefixStackIndex(mozilla::Some(aPrefixStackIndex)),
+          mFrameIndex(aFrame),
+          mHash(mozilla::AddToHash(aPrefix.mHash, aFrame)) {}
+
+    mozilla::HashNumber Hash() const { return mHash; }
+
+    bool operator==(const StackKey& aOther) const {
+      return mPrefixStackIndex == aOther.mPrefixStackIndex &&
+             mFrameIndex == aOther.mFrameIndex;
+    }
+
+   private:
+    mozilla::HashNumber mHash;
+  };
+
+  struct StackKeyHasher {
+    using Lookup = StackKey;
+
+    static mozilla::HashNumber hash(const StackKey& aLookup) {
+      return aLookup.Hash();
+    }
+
+    static bool match(const StackKey& aKey, const StackKey& aLookup) {
+      return aKey == aLookup;
+    }
+
+    static void rekey(StackKey& aKey, const StackKey& aNewKey) {
+      aKey = aNewKey;
+    }
+  };
+
+  explicit UniqueStacks(JITFrameInfo&& aJITFrameInfo);
+
+  // Return a StackKey for aFrame as the stack's root frame (no prefix).
+  [[nodiscard]] StackKey BeginStack(const FrameKey& aFrame);
+
+  // Return a new StackKey that is obtained by appending aFrame to aStack.
+  [[nodiscard]] StackKey AppendFrame(const StackKey& aStack,
+                                     const FrameKey& aFrame);
+
+  // Look up frame keys for the given JIT address, and ensure that our frame
+  // table has entries for the returned frame keys. The JSON for these frames
+  // is taken from mJITInfoRanges.
+  // aBufferPosition is needed in order to look up the correct JIT frame info
+  // object in mJITInfoRanges.
+  [[nodiscard]] mozilla::Maybe<mozilla::Vector<UniqueStacks::FrameKey>>
+  LookupFramesForJITAddressFromBufferPos(void* aJITAddress,
+                                         uint64_t aBufferPosition);
+
+  [[nodiscard]] uint32_t GetOrAddFrameIndex(const FrameKey& aFrame);
+  [[nodiscard]] uint32_t GetOrAddStackIndex(const StackKey& aStack);
+
+  void SpliceFrameTableElements(SpliceableJSONWriter& aWriter);
+  void SpliceStackTableElements(SpliceableJSONWriter& aWriter);
+
+ private:
+  void StreamNonJITFrame(const FrameKey& aFrame);
+  void StreamStack(const StackKey& aStack);
+
+ public:
+  mozilla::UniquePtr<UniqueJSONStrings> mUniqueStrings;
+
+  ProfilerCodeAddressService* mCodeAddressService = nullptr;
+
+ private:
+  SpliceableChunkedJSONWriter mFrameTableWriter;
+  mozilla::HashMap<FrameKey, uint32_t, FrameKeyHasher> mFrameToIndexMap;
+
+  SpliceableChunkedJSONWriter mStackTableWriter;
+  mozilla::HashMap<StackKey, uint32_t, StackKeyHasher> mStackToIndexMap;
+
+  mozilla::Vector<JITFrameInfoForBufferRange> mJITInfoRanges;
+};
+
+//
+// Thread profile JSON Format
+// --------------------------
+//
+// The profile contains much duplicate information. The output JSON of the
+// profile attempts to deduplicate strings, frames, and stack prefixes, to cut
+// down on size and to increase JSON streaming speed. Deduplicated values are
+// streamed as indices into their respective tables.
+//
+// Further, arrays of objects with the same set of properties (e.g., samples,
+// frames) are output as arrays according to a schema instead of an object
+// with property names. A property that is not present is represented in the
+// array as null or undefined.
+//
+// The format of the thread profile JSON is shown by the following example
+// with 1 sample and 1 marker:
+//
+// {
+//   "name": "Foo",
+//   "tid": 42,
+//   "samples":
+//   {
+//     "schema":
+//     {
+//       "stack": 0,          /* index into stackTable */
+//       "time": 1,           /* number */
+//       "eventDelay": 2,     /* number */
+//       "ThreadCPUDelta": 3, /* optional number */
+//     },
+//     "data":
+//     [
+//       [ 1, 0.0, 0.0 ]      /* { stack: 1, time: 0.0, eventDelay: 0.0 } */
+//     ]
+//   },
+//
+//   "markers":
+//   {
+//     "schema":
+//     {
+//       "name": 0,           /* index into stringTable */
+//       "time": 1,           /* number */
+//       "data": 2            /* arbitrary JSON */
+//     },
+//     "data":
+//     [
+//       [ 3, 0.1 ]           /* { name: 'example marker', time: 0.1 } */
+//     ]
+//   },
+//
+//   "stackTable":
+//   {
+//     "schema":
+//     {
+//       "prefix": 0,         /* index into stackTable */
+//       "frame": 1           /* index into frameTable */
+//     },
+//     "data":
+//     [
+//       [ null, 0 ],         /* (root) */
+//       [ 0,    1 ]          /* (root) > foo.js */
+//     ]
+//   },
+//
+//   "frameTable":
+//   {
+//     "schema":
+//     {
+//       "location": 0,       /* index into stringTable */
+//       "relevantForJS": 1,  /* bool */
+//       "innerWindowID": 2,  /* inner window ID of global JS `window` object */
+//       "implementation": 3, /* index into stringTable */
+//       "optimizations": 4,  /* arbitrary JSON */
+//       "line": 5,           /* number */
+//       "column": 6,         /* number */
+//       "category": 7,       /* index into profile.meta.categories */
+//       "subcategory": 8     /* index into
+//       profile.meta.categories[category].subcategories */
+//     },
+//     "data":
+//     [
+//       [ 0 ],               /* { location: '(root)' } */
+//       [ 1, null, null, 2 ] /* { location: 'foo.js',
+//                                 implementation: 'baseline' } */
+//     ]
+//   },
+//
+//   "stringTable":
+//   [
+//     "(root)",
+//     "foo.js",
+//     "baseline",
+//     "example marker"
+//   ]
+// }
+//
+// Process:
+// {
+//   "name": "Bar",
+//   "pid": 24,
+//   "threads":
+//   [
+//     <0-N threads from above>
+//   ],
+//   "counters": /* includes the memory counter */
+//   [
+//     {
+//       "name": "qwerty",
+//       "category": "uiop",
+//       "description": "this is qwerty uiop",
+//       "sample_groups:
+//       [
+//         {
+//           "id": 42, /* number (thread id, or object identifier (tab), etc) */
+//           "samples:
+//           {
+//             "schema":
+//             {
+//               "time": 1,   /* number */
+//               "number": 2, /* number (of times the counter was touched) */
+//               "count": 3   /* number (total for the counter) */
+//             },
+//             "data":
+//             [
+//               [ 0.1, 1824,
+//                 454622 ]   /* { time: 0.1, number: 1824, count: 454622 } */
+//             ]
+//           },
+//         },
+//         /* more sample-group objects with different id's */
+//       ]
+//     },
+//     /* more counters */
+//   ],
+// }
+//
+#endif /* ndef ProfileBufferEntry_h */
diff --git a/tools/profiler/core/ProfiledThreadData.cpp b/tools/profiler/core/ProfiledThreadData.cpp
new file mode 100644
index 0000000000..772a9fba1f
--- /dev/null
+++ b/tools/profiler/core/ProfiledThreadData.cpp
@@ -0,0 +1,327 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProfiledThreadData.h"
+
+#include "platform.h"
+#include "ProfileBuffer.h"
+
+#include "js/TraceLoggerAPI.h"
+#include "mozilla/ProfileJSONWriter.h"
+#include "mozilla/Span.h"
+#include "nsXULAppAPI.h"
+
+#if defined(GP_OS_darwin)
+#  include <pthread.h>
+#endif
+
+ProfiledThreadData::ProfiledThreadData(ThreadInfo* aThreadInfo,
+                                       nsIEventTarget* aEventTarget)
+    : mThreadInfo(aThreadInfo) {
+  MOZ_COUNT_CTOR(ProfiledThreadData);
+}
+
+ProfiledThreadData::~ProfiledThreadData() {
+  MOZ_COUNT_DTOR(ProfiledThreadData);
+}
+
+void ProfiledThreadData::StreamJSON(
+    const ProfileBuffer& aBuffer, JSContext* aCx, SpliceableJSONWriter& aWriter,
+    const nsACString& aProcessName, const nsACString& aETLDplus1,
+    const mozilla::TimeStamp& aProcessStartTime, double aSinceTime,
+    bool JSTracerEnabled, ProfilerCodeAddressService* aService) {
+  if (mJITFrameInfoForPreviousJSContexts &&
+      mJITFrameInfoForPreviousJSContexts->HasExpired(
+          aBuffer.BufferRangeStart())) {
+    mJITFrameInfoForPreviousJSContexts = nullptr;
+  }
+
+  // If we have an existing JITFrameInfo in mJITFrameInfoForPreviousJSContexts,
+  // copy the data from it.
+  JITFrameInfo jitFrameInfo =
+      mJITFrameInfoForPreviousJSContexts
+          ? JITFrameInfo(*mJITFrameInfoForPreviousJSContexts)
+          : JITFrameInfo();
+
+  if (aCx && mBufferPositionWhenReceivedJSContext) {
+    aBuffer.AddJITInfoForRange(*mBufferPositionWhenReceivedJSContext,
+                               mThreadInfo->ThreadId(), aCx, jitFrameInfo);
+  }
+
+  UniqueStacks uniqueStacks(std::move(jitFrameInfo));
+  uniqueStacks.mCodeAddressService = aService;
+
+  MOZ_ASSERT(uniqueStacks.mUniqueStrings);
+  aWriter.SetUniqueStrings(*uniqueStacks.mUniqueStrings);
+
+  aWriter.Start();
+  {
+    StreamSamplesAndMarkers(mThreadInfo->Name(), mThreadInfo->ThreadId(),
+                            aBuffer, aWriter, aProcessName, aETLDplus1,
+                            aProcessStartTime, mThreadInfo->RegisterTime(),
+                            mUnregisterTime, aSinceTime, uniqueStacks);
+
+    aWriter.StartObjectProperty("stackTable");
+    {
+      {
+        JSONSchemaWriter schema(aWriter);
+        schema.WriteField("prefix");
+        schema.WriteField("frame");
+      }
+
+      aWriter.StartArrayProperty("data");
+      { uniqueStacks.SpliceStackTableElements(aWriter); }
+      aWriter.EndArray();
+    }
+    aWriter.EndObject();
+
+    aWriter.StartObjectProperty("frameTable");
+    {
+      {
+        JSONSchemaWriter schema(aWriter);
+        schema.WriteField("location");
+        schema.WriteField("relevantForJS");
+        schema.WriteField("innerWindowID");
+        schema.WriteField("implementation");
+        schema.WriteField("optimizations");
+        schema.WriteField("line");
+        schema.WriteField("column");
+        schema.WriteField("category");
+        schema.WriteField("subcategory");
+      }
+
+      aWriter.StartArrayProperty("data");
+      { uniqueStacks.SpliceFrameTableElements(aWriter); }
+      aWriter.EndArray();
+    }
+    aWriter.EndObject();
+
+    aWriter.StartArrayProperty("stringTable");
+    {
+      std::move(*uniqueStacks.mUniqueStrings)
+          .SpliceStringTableElements(aWriter);
+    }
+    aWriter.EndArray();
+  }
+
+  if (aCx && JSTracerEnabled) {
+    StreamTraceLoggerJSON(aCx, aWriter, aProcessStartTime);
+  }
+
+  aWriter.End();
+
+  aWriter.ResetUniqueStrings();
+}
+
+void ProfiledThreadData::StreamTraceLoggerJSON(
+    JSContext* aCx, SpliceableJSONWriter& aWriter,
+    const mozilla::TimeStamp& aProcessStartTime) {
+  aWriter.StartObjectProperty("jsTracerEvents");
+  {
+    JS::AutoTraceLoggerLockGuard lockGuard;
+    JS::SpewTraceLoggerThread(aCx);
+
+    uint32_t length = 0;
+
+    // Collect Event Ids
+    aWriter.StartArrayProperty("events", mozilla::JSONWriter::SingleLineStyle);
+    {
+      JS::TraceLoggerIdBuffer collectionBuffer(lockGuard, aCx);
+      while (collectionBuffer.NextChunk()) {
+        for (uint32_t val : collectionBuffer) {
+          aWriter.IntElement(val);
+          length++;
+        }
+      }
+    }
+    aWriter.EndArray();
+
+    // Collect Event Timestamps
+    aWriter.StartArrayProperty("timestamps",
+                               mozilla::JSONWriter::SingleLineStyle);
+    {
+      JS::TraceLoggerTimeStampBuffer collectionBuffer(lockGuard, aCx);
+      while (collectionBuffer.NextChunk()) {
+        for (mozilla::TimeStamp val : collectionBuffer) {
+          aWriter.DoubleElement((val - aProcessStartTime).ToMicroseconds());
+        }
+      }
+    }
+    aWriter.EndArray();
+
+    // Collect Event Durations
+    aWriter.StartArrayProperty("durations",
+                               mozilla::JSONWriter::SingleLineStyle);
+    {
+      JS::TraceLoggerDurationBuffer collectionBuffer(lockGuard, aCx);
+      while (collectionBuffer.NextChunk()) {
+        for (double val : collectionBuffer) {
+          if (val == -1) {
+            aWriter.NullElement();
+          } else {
+            aWriter.DoubleElement(val);
+          }
+        }
+      }
+    }
+    aWriter.EndArray();
+
+    // Collect Event LineNo
+    aWriter.StartArrayProperty("line", mozilla::JSONWriter::SingleLineStyle);
+    {
+      JS::TraceLoggerLineNoBuffer collectionBuffer(lockGuard, aCx);
+      while (collectionBuffer.NextChunk()) {
+        for (int32_t val : collectionBuffer) {
+          if (val == -1) {
+            aWriter.NullElement();
+          } else {
+            aWriter.IntElement(val);
+          }
+        }
+      }
+    }
+    aWriter.EndArray();
+
+    // Collect Event ColNo
+    aWriter.StartArrayProperty("column", mozilla::JSONWriter::SingleLineStyle);
+    {
+      JS::TraceLoggerColNoBuffer collectionBuffer(lockGuard, aCx);
+      while (collectionBuffer.NextChunk()) {
+        for (int32_t val : collectionBuffer) {
+          if (val == -1) {
+            aWriter.NullElement();
+          } else {
+            aWriter.IntElement(val);
+          }
+        }
+      }
+    }
+    aWriter.EndArray();
+
+    aWriter.IntProperty("length", length);
+  }
+  aWriter.EndObject();
+}
+
+int StreamSamplesAndMarkers(const char* aName, int aThreadId,
+                            const ProfileBuffer& aBuffer,
+                            SpliceableJSONWriter& aWriter,
+                            const nsACString& aProcessName,
+                            const nsACString& aETLDplus1,
+                            const mozilla::TimeStamp& aProcessStartTime,
+                            const mozilla::TimeStamp& aRegisterTime,
+                            const mozilla::TimeStamp& aUnregisterTime,
+                            double aSinceTime, UniqueStacks& aUniqueStacks) {
+  int processedThreadId = 0;
+
+  aWriter.StringProperty("processType",
+                         mozilla::MakeStringSpan(XRE_GetProcessTypeString()));
+
+  aWriter.StringProperty("name", mozilla::MakeStringSpan(aName));
+
+  // Use given process name (if any), unless we're the parent process.
+  if (XRE_IsParentProcess()) {
+    aWriter.StringProperty("processName", "Parent Process");
+  } else if (!aProcessName.IsEmpty()) {
+    aWriter.StringProperty("processName", aProcessName);
+  }
+  if (!aETLDplus1.IsEmpty()) {
+    aWriter.StringProperty("eTLD+1", aETLDplus1);
+  }
+
+  if (aRegisterTime) {
+    aWriter.DoubleProperty(
+        "registerTime", (aRegisterTime - aProcessStartTime).ToMilliseconds());
+  } else {
+    aWriter.NullProperty("registerTime");
+  }
+
+  if (aUnregisterTime) {
+    aWriter.DoubleProperty(
+        "unregisterTime",
+        (aUnregisterTime - aProcessStartTime).ToMilliseconds());
+  } else {
+    aWriter.NullProperty("unregisterTime");
+  }
+
+  aWriter.StartObjectProperty("samples");
+  {
+    {
+      JSONSchemaWriter schema(aWriter);
+      schema.WriteField("stack");
+      schema.WriteField("time");
+      schema.WriteField("eventDelay");
+#define RUNNING_TIME_FIELD(index, name, unit, jsonProperty) \
+  schema.WriteField(#jsonProperty);
+      PROFILER_FOR_EACH_RUNNING_TIME(RUNNING_TIME_FIELD)
+#undef RUNNING_TIME_FIELD
+    }
+
+    aWriter.StartArrayProperty("data");
+    {
+      processedThreadId = aBuffer.StreamSamplesToJSON(
+          aWriter, aThreadId, aSinceTime, aUniqueStacks);
+    }
+    aWriter.EndArray();
+  }
+  aWriter.EndObject();
+
+  aWriter.StartObjectProperty("markers");
+  {
+    {
+      JSONSchemaWriter schema(aWriter);
+      schema.WriteField("name");
+      schema.WriteField("startTime");
+      schema.WriteField("endTime");
+      schema.WriteField("phase");
+      schema.WriteField("category");
+      schema.WriteField("data");
+    }
+
+    aWriter.StartArrayProperty("data");
+    {
+      aBuffer.StreamMarkersToJSON(aWriter, aThreadId, aProcessStartTime,
+                                  aSinceTime, aUniqueStacks);
+    }
+    aWriter.EndArray();
+  }
+  aWriter.EndObject();
+
+  aWriter.IntProperty("pid",
+                      static_cast<int64_t>(profiler_current_process_id()));
+  aWriter.IntProperty(
+      "tid",
+      static_cast<int64_t>(aThreadId != 0 ? aThreadId : processedThreadId));
+
+  return processedThreadId;
+}
+
+void ProfiledThreadData::NotifyAboutToLoseJSContext(
+    JSContext* aContext, const mozilla::TimeStamp& aProcessStartTime,
+    ProfileBuffer& aBuffer) {
+  if (!mBufferPositionWhenReceivedJSContext) {
+    return;
+  }
+
+  MOZ_RELEASE_ASSERT(aContext);
+
+  if (mJITFrameInfoForPreviousJSContexts &&
+      mJITFrameInfoForPreviousJSContexts->HasExpired(
+          aBuffer.BufferRangeStart())) {
+    mJITFrameInfoForPreviousJSContexts = nullptr;
+  }
+
+  mozilla::UniquePtr<JITFrameInfo> jitFrameInfo =
+      mJITFrameInfoForPreviousJSContexts
+          ? std::move(mJITFrameInfoForPreviousJSContexts)
+          : mozilla::MakeUnique<JITFrameInfo>();
+
+  aBuffer.AddJITInfoForRange(*mBufferPositionWhenReceivedJSContext,
+                             mThreadInfo->ThreadId(), aContext, *jitFrameInfo);
+
+  mJITFrameInfoForPreviousJSContexts = std::move(jitFrameInfo);
+  mBufferPositionWhenReceivedJSContext = mozilla::Nothing();
+}
diff --git a/tools/profiler/core/ProfiledThreadData.h b/tools/profiler/core/ProfiledThreadData.h
new file mode 100644
index 0000000000..2ef4a62e98
--- /dev/null
+++ b/tools/profiler/core/ProfiledThreadData.h
@@ -0,0 +1,140 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProfiledThreadData_h
+#define ProfiledThreadData_h
+
+#include "ThreadInfo.h"
+
+#include "mozilla/Maybe.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/RefPtr.h"
+#include "nsStringFwd.h"
+
+class ProfileBuffer;
+class ProfilerCodeAddressService;
+class UniqueStacks;
+class nsIEventTarget;
+struct JITFrameInfo;
+struct JSContext;
+
+namespace mozilla::baseprofiler {
+class SpliceableJSONWriter;
+}
+
+// This class contains information about a thread that is only relevant while
+// the profiler is running, for any threads (both alive and dead) whose thread
+// name matches the "thread filter" in the current profiler run.
+// ProfiledThreadData objects may be kept alive even after the thread is
+// unregistered, as long as there is still data for that thread in the profiler
+// buffer.
+//
+// Accesses to this class are protected by the profiler state lock.
+//
+// Created as soon as the following are true for the thread:
+//  - The profiler is running, and
+//  - the thread matches the profiler's thread filter, and
+//  - the thread is registered with the profiler.
+// So it gets created in response to either (1) the profiler being started (for
+// an existing registered thread) or (2) the thread being registered (if the
+// profiler is already running).
+//
+// The thread may be unregistered during the lifetime of ProfiledThreadData.
+// If that happens, NotifyUnregistered() is called.
+//
+// This class is the right place to store buffer positions. Profiler buffer
+// positions become invalid if the profiler buffer is destroyed, which happens
+// when the profiler is stopped.
+class ProfiledThreadData final {
+ public:
+  ProfiledThreadData(ThreadInfo* aThreadInfo, nsIEventTarget* aEventTarget);
+  ~ProfiledThreadData();
+
+  void NotifyUnregistered(uint64_t aBufferPosition) {
+    mLastSample = mozilla::Nothing();
+    MOZ_ASSERT(!mBufferPositionWhenReceivedJSContext,
+               "JSContext should have been cleared before the thread was "
+               "unregistered");
+    mUnregisterTime = mozilla::TimeStamp::NowUnfuzzed();
+    mBufferPositionWhenUnregistered = mozilla::Some(aBufferPosition);
+  }
+  mozilla::Maybe<uint64_t> BufferPositionWhenUnregistered() {
+    return mBufferPositionWhenUnregistered;
+  }
+
+  mozilla::Maybe<uint64_t>& LastSample() { return mLastSample; }
+
+  void StreamJSON(const ProfileBuffer& aBuffer, JSContext* aCx,
+                  mozilla::baseprofiler::SpliceableJSONWriter& aWriter,
+                  const nsACString& aProcessName, const nsACString& aETLDplus1,
+                  const mozilla::TimeStamp& aProcessStartTime,
+                  double aSinceTime, bool aJSTracerEnabled,
+                  ProfilerCodeAddressService* aService);
+
+  void StreamTraceLoggerJSON(
+      JSContext* aCx, mozilla::baseprofiler::SpliceableJSONWriter& aWriter,
+      const mozilla::TimeStamp& aProcessStartTime);
+
+  const RefPtr<ThreadInfo> Info() const { return mThreadInfo; }
+
+  void NotifyReceivedJSContext(uint64_t aCurrentBufferPosition) {
+    mBufferPositionWhenReceivedJSContext =
+        mozilla::Some(aCurrentBufferPosition);
+  }
+
+  // Call this method when the JS entries inside the buffer are about to
+  // become invalid, i.e., just before JS shutdown.
+  void NotifyAboutToLoseJSContext(JSContext* aCx,
+                                  const mozilla::TimeStamp& aProcessStartTime,
+                                  ProfileBuffer& aBuffer);
+
+ private:
+  // Group A:
+  // The following fields are interesting for the entire lifetime of a
+  // ProfiledThreadData object.
+
+  // This thread's thread info.
+  const RefPtr<ThreadInfo> mThreadInfo;
+
+  // Contains JSON for JIT frames from any JSContexts that were used for this
+  // thread in the past.
+  // Null if this thread has never lost a JSContext or if all samples from
+  // previous JSContexts have been evicted from the profiler buffer.
+  mozilla::UniquePtr<JITFrameInfo> mJITFrameInfoForPreviousJSContexts;
+
+  // Group B:
+  // The following fields are only used while this thread is alive and
+  // registered. They become Nothing() once the thread is unregistered.
+
+  // When sampling, this holds the position in ActivePS::mBuffer of the most
+  // recent sample for this thread, or Nothing() if there is no sample for this
+  // thread in the buffer.
+  mozilla::Maybe<uint64_t> mLastSample;
+
+  // Only non-Nothing() if the thread currently has a JSContext.
+  mozilla::Maybe<uint64_t> mBufferPositionWhenReceivedJSContext;
+
+  // Group C:
+  // The following fields are only used once this thread has been unregistered.
+
+  mozilla::Maybe<uint64_t> mBufferPositionWhenUnregistered;
+  mozilla::TimeStamp mUnregisterTime;
+};
+
+// Stream all samples and markers from aBuffer with the given aThreadId (or 0
+// for everything, which is assumed to be a single backtrace sample.)
+// Returns the thread id of the output sample(s), or 0 if none was present.
+int StreamSamplesAndMarkers(
+    const char* aName, int aThreadId, const ProfileBuffer& aBuffer,
+    mozilla::baseprofiler::SpliceableJSONWriter& aWriter,
+    const nsACString& aProcessName, const nsACString& aETLDplus1,
+    const mozilla::TimeStamp& aProcessStartTime,
+    const mozilla::TimeStamp& aRegisterTime,
+    const mozilla::TimeStamp& aUnregisterTime, double aSinceTime,
+    UniqueStacks& aUniqueStacks);
+
+#endif  // ProfiledThreadData_h
diff --git a/tools/profiler/core/ProfilerBacktrace.cpp b/tools/profiler/core/ProfilerBacktrace.cpp
new file mode 100644
index 0000000000..02adb4e38f
--- /dev/null
+++ b/tools/profiler/core/ProfilerBacktrace.cpp
@@ -0,0 +1,102 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProfilerBacktrace.h"
+
+#include "ProfileBuffer.h"
+#include "ProfiledThreadData.h"
+#include "ThreadInfo.h"
+
+#include "mozilla/ProfileJSONWriter.h"
+
+ProfilerBacktrace::ProfilerBacktrace(
+    const char* aName,
+    mozilla::UniquePtr<mozilla::ProfileChunkedBuffer>
+        aProfileChunkedBufferStorage,
+    mozilla::UniquePtr<ProfileBuffer>
+        aProfileBufferStorageOrNull /* = nullptr */)
+    : mName(aName),
+      mOptionalProfileChunkedBufferStorage(
+          std::move(aProfileChunkedBufferStorage)),
+      mProfileChunkedBuffer(mOptionalProfileChunkedBufferStorage.get()),
+      mOptionalProfileBufferStorage(std::move(aProfileBufferStorageOrNull)),
+      mProfileBuffer(mOptionalProfileBufferStorage.get()) {
+  MOZ_COUNT_CTOR(ProfilerBacktrace);
+  if (mProfileBuffer) {
+    MOZ_RELEASE_ASSERT(mProfileChunkedBuffer,
+                       "If we take ownership of a ProfileBuffer, we must also "
+                       "receive ownership of a ProfileChunkedBuffer");
+    MOZ_RELEASE_ASSERT(
+        mProfileChunkedBuffer == &mProfileBuffer->UnderlyingChunkedBuffer(),
+        "If we take ownership of a ProfileBuffer, we must also receive "
+        "ownership of its ProfileChunkedBuffer");
+  }
+  MOZ_ASSERT(
+      !mProfileChunkedBuffer || !mProfileChunkedBuffer->IsThreadSafe(),
+      "ProfilerBacktrace only takes a non-thread-safe ProfileChunkedBuffer");
+}
+
+ProfilerBacktrace::ProfilerBacktrace(
+    const char* aName,
+    mozilla::ProfileChunkedBuffer* aExternalProfileChunkedBuffer,
+    ProfileBuffer* aExternalProfileBuffer)
+    : mName(aName),
+      mProfileChunkedBuffer(aExternalProfileChunkedBuffer),
+      mProfileBuffer(aExternalProfileBuffer) {
+  MOZ_COUNT_CTOR(ProfilerBacktrace);
+  if (!mProfileChunkedBuffer) {
+    if (mProfileBuffer) {
+      // We don't have a ProfileChunkedBuffer but we have a ProfileBuffer, use
+      // the latter's ProfileChunkedBuffer.
+      mProfileChunkedBuffer = &mProfileBuffer->UnderlyingChunkedBuffer();
+      MOZ_ASSERT(!mProfileChunkedBuffer->IsThreadSafe(),
+                 "ProfilerBacktrace only takes a non-thread-safe "
+                 "ProfileChunkedBuffer");
+    }
+  } else {
+    if (mProfileBuffer) {
+      MOZ_RELEASE_ASSERT(
+          mProfileChunkedBuffer == &mProfileBuffer->UnderlyingChunkedBuffer(),
+          "If we reference both ProfileChunkedBuffer and ProfileBuffer, they "
+          "must already be connected");
+    }
+    MOZ_ASSERT(!mProfileChunkedBuffer->IsThreadSafe(),
+               "ProfilerBacktrace only takes a non-thread-safe "
+               "ProfileChunkedBuffer");
+  }
+}
+
+ProfilerBacktrace::~ProfilerBacktrace() { MOZ_COUNT_DTOR(ProfilerBacktrace); }
+
+int ProfilerBacktrace::StreamJSON(SpliceableJSONWriter& aWriter,
+                                  const mozilla::TimeStamp& aProcessStartTime,
+                                  UniqueStacks& aUniqueStacks) {
+  int processedThreadId = 0;
+
+  // Unlike ProfiledThreadData::StreamJSON, we don't need to call
+  // ProfileBuffer::AddJITInfoForRange because ProfileBuffer does not contain
+  // any JitReturnAddr entries. For synchronous samples, JIT frames get expanded
+  // at sample time.
+  if (mProfileBuffer) {
+    processedThreadId =
+        StreamSamplesAndMarkers(mName.c_str(), 0, *mProfileBuffer, aWriter,
+                                ""_ns, ""_ns, aProcessStartTime,
+                                /* aRegisterTime */ mozilla::TimeStamp(),
+                                /* aUnregisterTime */ mozilla::TimeStamp(),
+                                /* aSinceTime */ 0, aUniqueStacks);
+  } else if (mProfileChunkedBuffer) {
+    ProfileBuffer profileBuffer(*mProfileChunkedBuffer);
+    processedThreadId =
+        StreamSamplesAndMarkers(mName.c_str(), 0, profileBuffer, aWriter, ""_ns,
+                                ""_ns, aProcessStartTime,
+                                /* aRegisterTime */ mozilla::TimeStamp(),
+                                /* aUnregisterTime */ mozilla::TimeStamp(),
+                                /* aSinceTime */ 0, aUniqueStacks);
+  }
+  // If there are no buffers, the backtrace is empty and nothing is streamed.
+
+  return processedThreadId;
+}
diff --git a/tools/profiler/core/ProfilerBacktrace.h b/tools/profiler/core/ProfilerBacktrace.h
new file mode 100644
index 0000000000..b6c099438b
--- /dev/null
+++ b/tools/profiler/core/ProfilerBacktrace.h
@@ -0,0 +1,184 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef __PROFILER_BACKTRACE_H
+#define __PROFILER_BACKTRACE_H
+
+#include "ProfileBuffer.h"
+
+#include "mozilla/ProfileBufferEntrySerialization.h"
+#include "mozilla/UniquePtrExtensions.h"
+
+#include <string>
+
+class ProfileBuffer;
+class ProfilerCodeAddressService;
+class ThreadInfo;
+class UniqueStacks;
+
+namespace mozilla {
+class ProfileChunkedBuffer;
+class TimeStamp;
+namespace baseprofiler {
+class SpliceableJSONWriter;
+}  // namespace baseprofiler
+}  // namespace mozilla
+
+// ProfilerBacktrace encapsulates a synchronous sample.
+// It can work with a ProfileBuffer and/or a ProfileChunkedBuffer (if both, they
+// must already be linked together). The ProfileChunkedBuffer contains all the
+// data; the ProfileBuffer is not strictly needed, only provide it if it is
+// already available at the call site.
+// And these buffers can either be:
+// - owned here, so that the ProfilerBacktrace object can be kept for later
+//   use), OR
+// - referenced through pointers (in cases where the backtrace is immediately
+//   streamed out, so we only need temporary references to external buffers);
+//   these pointers may be null for empty backtraces.
+class ProfilerBacktrace {
+ public:
+  // Take ownership of external buffers and use them to keep, and to stream a
+  // backtrace. If a ProfileBuffer is given, its underlying chunked buffer must
+  // be provided as well.
+  explicit ProfilerBacktrace(
+      const char* aName,
+      mozilla::UniquePtr<mozilla::ProfileChunkedBuffer>
+          aProfileChunkedBufferStorage,
+      mozilla::UniquePtr<ProfileBuffer> aProfileBufferStorageOrNull = nullptr);
+
+  // Take pointers to external buffers and use them to stream a backtrace.
+  // If null, the backtrace is effectively empty.
+  // If both are provided, they must already be connected.
+  explicit ProfilerBacktrace(
+      const char* aName,
+      mozilla::ProfileChunkedBuffer* aExternalProfileChunkedBufferOrNull =
+          nullptr,
+      ProfileBuffer* aExternalProfileBufferOrNull = nullptr);
+
+  ~ProfilerBacktrace();
+
+  [[nodiscard]] bool IsEmpty() const {
+    return !mProfileChunkedBuffer ||
+           mozilla::ProfileBufferEntryWriter::Serializer<
+               mozilla::ProfileChunkedBuffer>::Bytes(*mProfileChunkedBuffer) <=
+               mozilla::ULEB128Size(0u);
+  }
+
+  // ProfilerBacktraces' stacks are deduplicated in the context of the
+  // profile that contains the backtrace as a marker payload.
+  //
+  // That is, markers that contain backtraces should not need their own stack,
+  // frame, and string tables. They should instead reuse their parent
+  // profile's tables.
+  int StreamJSON(mozilla::baseprofiler::SpliceableJSONWriter& aWriter,
+                 const mozilla::TimeStamp& aProcessStartTime,
+                 UniqueStacks& aUniqueStacks);
+
+ private:
+  // Used to serialize a ProfilerBacktrace.
+  friend struct mozilla::ProfileBufferEntryWriter::Serializer<
+      ProfilerBacktrace>;
+  friend struct mozilla::ProfileBufferEntryReader::Deserializer<
+      ProfilerBacktrace>;
+
+  std::string mName;
+
+  // `ProfileChunkedBuffer` in which `mProfileBuffer` stores its data; must be
+  // located before `mProfileBuffer` so that it's destroyed after.
+  mozilla::UniquePtr<mozilla::ProfileChunkedBuffer>
+      mOptionalProfileChunkedBufferStorage;
+  // If null, there is no need to check mProfileBuffer's (if present) underlying
+  // buffer because this is done when constructed.
+  mozilla::ProfileChunkedBuffer* mProfileChunkedBuffer;
+
+  mozilla::UniquePtr<ProfileBuffer> mOptionalProfileBufferStorage;
+  ProfileBuffer* mProfileBuffer;
+};
+
+namespace mozilla {
+
+// Format: [ UniquePtr<BlockRingsBuffer> | name ]
+// Initial len==0 marks a nullptr or empty backtrace.
+template <>
+struct mozilla::ProfileBufferEntryWriter::Serializer<ProfilerBacktrace> {
+  static Length Bytes(const ProfilerBacktrace& aBacktrace) {
+    if (!aBacktrace.mProfileChunkedBuffer) {
+      // No buffer.
+      return ULEB128Size(0u);
+    }
+    auto bufferBytes = SumBytes(*aBacktrace.mProfileChunkedBuffer);
+    if (bufferBytes <= ULEB128Size(0u)) {
+      // Empty buffer.
+      return ULEB128Size(0u);
+    }
+    return bufferBytes + SumBytes(aBacktrace.mName);
+  }
+
+  static void Write(mozilla::ProfileBufferEntryWriter& aEW,
+                    const ProfilerBacktrace& aBacktrace) {
+    if (!aBacktrace.mProfileChunkedBuffer ||
+        SumBytes(*aBacktrace.mProfileChunkedBuffer) <= ULEB128Size(0u)) {
+      // No buffer, or empty buffer.
+      aEW.WriteULEB128(0u);
+      return;
+    }
+    aEW.WriteObject(*aBacktrace.mProfileChunkedBuffer);
+    aEW.WriteObject(aBacktrace.mName);
+  }
+};
+
+template <typename Destructor>
+struct mozilla::ProfileBufferEntryWriter::Serializer<
+    mozilla::UniquePtr<ProfilerBacktrace, Destructor>> {
+  static Length Bytes(
+      const mozilla::UniquePtr<ProfilerBacktrace, Destructor>& aBacktrace) {
+    if (!aBacktrace) {
+      // Null backtrace pointer (treated like an empty backtrace).
+      return ULEB128Size(0u);
+    }
+    return SumBytes(*aBacktrace);
+  }
+
+  static void Write(
+      mozilla::ProfileBufferEntryWriter& aEW,
+      const mozilla::UniquePtr<ProfilerBacktrace, Destructor>& aBacktrace) {
+    if (!aBacktrace) {
+      // Null backtrace pointer (treated like an empty backtrace).
+      aEW.WriteULEB128(0u);
+      return;
+    }
+    aEW.WriteObject(*aBacktrace);
+  }
+};
+
+template <typename Destructor>
+struct mozilla::ProfileBufferEntryReader::Deserializer<
+    mozilla::UniquePtr<ProfilerBacktrace, Destructor>> {
+  static void ReadInto(
+      mozilla::ProfileBufferEntryReader& aER,
+      mozilla::UniquePtr<ProfilerBacktrace, Destructor>& aBacktrace) {
+    aBacktrace = Read(aER);
+  }
+
+  static mozilla::UniquePtr<ProfilerBacktrace, Destructor> Read(
+      mozilla::ProfileBufferEntryReader& aER) {
+    auto profileChunkedBuffer =
+        aER.ReadObject<UniquePtr<ProfileChunkedBuffer>>();
+    if (!profileChunkedBuffer) {
+      return nullptr;
+    }
+    MOZ_ASSERT(
+        !profileChunkedBuffer->IsThreadSafe(),
+        "ProfilerBacktrace only stores non-thread-safe ProfileChunkedBuffers");
+    std::string name = aER.ReadObject<std::string>();
+    return UniquePtr<ProfilerBacktrace, Destructor>{
+        new ProfilerBacktrace(name.c_str(), std::move(profileChunkedBuffer))};
+  }
+};
+
+}  // namespace mozilla
+
+#endif  // __PROFILER_BACKTRACE_H
diff --git a/tools/profiler/core/ProfilerCodeAddressService.cpp b/tools/profiler/core/ProfilerCodeAddressService.cpp
new file mode 100644
index 0000000000..5a65e06379
--- /dev/null
+++ b/tools/profiler/core/ProfilerCodeAddressService.cpp
@@ -0,0 +1,75 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProfilerCodeAddressService.h"
+
+#include "platform.h"
+#include "mozilla/StackWalk.h"
+
+using namespace mozilla;
+
+#if defined(XP_LINUX) || defined(XP_FREEBSD)
+static char* SearchSymbolTable(SymbolTable& aTable, uint32_t aOffset) {
+  size_t index;
+  bool exact =
+      BinarySearch(aTable.mAddrs, 0, aTable.mAddrs.Length(), aOffset, &index);
+
+  if (index == 0 && !exact) {
+    // Our offset is before the first symbol in the table; no result.
+    return nullptr;
+  }
+
+  // Extract the (mangled) symbol name out of the string table.
+  auto strings = reinterpret_cast<char*>(aTable.mBuffer.Elements());
+  nsCString symbol;
+  symbol.Append(strings + aTable.mIndex[index - 1],
+                aTable.mIndex[index] - aTable.mIndex[index - 1]);
+
+  // First try demangling as a Rust identifier.
+  char demangled[1024];
+  if (!profiler_demangle_rust(symbol.get(), demangled,
+                              ArrayLength(demangled))) {
+    // Then as a C++ identifier.
+    DemangleSymbol(symbol.get(), demangled, ArrayLength(demangled));
+  }
+  demangled[ArrayLength(demangled) - 1] = '\0';
+
+  // Use the mangled name if we didn't successfully demangle.
+  return strdup(demangled[0] != '\0' ? demangled : symbol.get());
+}
+#endif
+
+bool ProfilerCodeAddressService::GetFunction(const void* aPc,
+                                             nsACString& aResult) {
+  Entry& entry = GetEntry(aPc);
+
+#if defined(XP_LINUX) || defined(XP_FREEBSD)
+  // On Linux, most symbols will not be found by the MozDescribeCodeAddress call
+  // that GetEntry does.  So we read the symbol table directly from the ELF
+  // image.
+
+  // SymbolTable currently assumes library offsets will not be larger than
+  // 4 GiB.
+  if (entry.mLOffset <= 0xFFFFFFFF && !entry.mFunction) {
+    auto p = mSymbolTables.lookupForAdd(entry.mLibrary);
+    if (!p) {
+      if (!mSymbolTables.add(p, entry.mLibrary, SymbolTable())) {
+        MOZ_CRASH("ProfilerCodeAddressService OOM");
+      }
+      profiler_get_symbol_table(entry.mLibrary, nullptr, &p->value());
+    }
+    entry.mFunction =
+        SearchSymbolTable(p->value(), static_cast<uint32_t>(entry.mLOffset));
+  }
+#endif
+
+  if (!entry.mFunction || entry.mFunction[0] == '\0') {
+    return false;
+  }
+
+  aResult = nsDependentCString(entry.mFunction);
+  return true;
+}
diff --git a/tools/profiler/core/ProfilerMarkers.cpp b/tools/profiler/core/ProfilerMarkers.cpp
new file mode 100644
index 0000000000..7c299678d1
--- /dev/null
+++ b/tools/profiler/core/ProfilerMarkers.cpp
@@ -0,0 +1,32 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/ProfilerMarkers.h"
+
+template mozilla::ProfileBufferBlockIndex AddMarkerToBuffer(
+    mozilla::ProfileChunkedBuffer&, const mozilla::ProfilerString8View&,
+    const mozilla::MarkerCategory&, mozilla::MarkerOptions&&,
+    mozilla::baseprofiler::markers::NoPayload);
+
+template mozilla::ProfileBufferBlockIndex AddMarkerToBuffer(
+    mozilla::ProfileChunkedBuffer&, const mozilla::ProfilerString8View&,
+    const mozilla::MarkerCategory&, mozilla::MarkerOptions&&,
+    mozilla::baseprofiler::markers::TextMarker, const std::string&);
+
+template mozilla::ProfileBufferBlockIndex profiler_add_marker(
+    const mozilla::ProfilerString8View&, const mozilla::MarkerCategory&,
+    mozilla::MarkerOptions&&, mozilla::baseprofiler::markers::TextMarker,
+    const std::string&);
+
+template mozilla::ProfileBufferBlockIndex profiler_add_marker(
+    const mozilla::ProfilerString8View&, const mozilla::MarkerCategory&,
+    mozilla::MarkerOptions&&, mozilla::baseprofiler::markers::TextMarker,
+    const nsCString&);
+
+template mozilla::ProfileBufferBlockIndex profiler_add_marker(
+    const mozilla::ProfilerString8View&, const mozilla::MarkerCategory&,
+    mozilla::MarkerOptions&&, mozilla::baseprofiler::markers::Tracing,
+    const mozilla::ProfilerString8View&);
diff --git a/tools/profiler/core/RegisteredThread.cpp b/tools/profiler/core/RegisteredThread.cpp
new file mode 100644
index 0000000000..ffbeb782da
--- /dev/null
+++ b/tools/profiler/core/RegisteredThread.cpp
@@ -0,0 +1,129 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "RegisteredThread.h"
+
+#include "js/AllocationRecording.h"
+#include "js/ProfilingStack.h"
+#include "js/TraceLoggerAPI.h"
+
+RacyRegisteredThread::RacyRegisteredThread(int aThreadId)
+    : mProfilingStackOwner(
+          mozilla::MakeNotNull<RefPtr<mozilla::ProfilingStackOwner>>()),
+      mThreadId(aThreadId),
+      mSleep(AWAKE),
+      mIsBeingProfiled(false) {
+  MOZ_COUNT_CTOR(RacyRegisteredThread);
+}
+
+RegisteredThread::RegisteredThread(ThreadInfo* aInfo, nsIThread* aThread,
+                                   void* aStackTop)
+    : mRacyRegisteredThread(aInfo->ThreadId()),
+      mPlatformData(AllocPlatformData(aInfo->ThreadId())),
+      mStackTop(aStackTop),
+      mThreadInfo(aInfo),
+      mThread(aThread),
+      mContext(nullptr),
+      mJSSampling(INACTIVE),
+      mJSFlags(0) {
+  MOZ_COUNT_CTOR(RegisteredThread);
+
+  // NOTE: aThread can be null for the first thread, before the ThreadManager
+  // is initialized.
+
+  // We don't have to guess on mac
+#if defined(GP_OS_darwin)
+  pthread_t self = pthread_self();
+  mStackTop = pthread_get_stackaddr_np(self);
+#endif
+}
+
+RegisteredThread::~RegisteredThread() { MOZ_COUNT_DTOR(RegisteredThread); }
+
+size_t RegisteredThread::SizeOfIncludingThis(
+    mozilla::MallocSizeOf aMallocSizeOf) const {
+  size_t n = aMallocSizeOf(this);
+
+  // Measurement of the following members may be added later if DMD finds it
+  // is worthwhile:
+  // - mPlatformData
+  //
+  // The following members are not measured:
+  // - mThreadInfo: because it is non-owning
+
+  return n;
+}
+
+void RegisteredThread::GetRunningEventDelay(const mozilla::TimeStamp& aNow,
+                                            mozilla::TimeDuration& aDelay,
+                                            mozilla::TimeDuration& aRunning) {
+  if (mThread) {  // can be null right at the start of a process
+    mozilla::TimeStamp start;
+    mThread->GetRunningEventDelay(&aDelay, &start);
+    if (!start.IsNull()) {
+      // Note: the timestamp used here will be from when we started to
+      // suspend and sample the thread; which is also the timestamp
+      // associated with the sample.
+      aRunning = aNow - start;
+      return;
+    }
+  }
+  aDelay = mozilla::TimeDuration();
+  aRunning = mozilla::TimeDuration();
+}
+
+void RegisteredThread::SetJSContext(JSContext* aContext) {
+  // This function runs on-thread.
+
+  MOZ_ASSERT(aContext && !mContext);
+
+  mContext = aContext;
+
+  // We give the JS engine a non-owning reference to the ProfilingStack. It's
+  // important that the JS engine doesn't touch this once the thread dies.
+  js::SetContextProfilingStack(aContext,
+                               &RacyRegisteredThread().ProfilingStack());
+}
+
+void RegisteredThread::PollJSSampling() {
+  // This function runs on-thread.
+
+  // We can't start/stop profiling until we have the thread's JSContext.
+  if (mContext) {
+    // It is possible for mJSSampling to go through the following sequences.
+    //
+    // - INACTIVE, ACTIVE_REQUESTED, INACTIVE_REQUESTED, INACTIVE
+    //
+    // - ACTIVE, INACTIVE_REQUESTED, ACTIVE_REQUESTED, ACTIVE
+    //
+    // Therefore, the if and else branches here aren't always interleaved.
+    // This is ok because the JS engine can handle that.
+    //
+    if (mJSSampling == ACTIVE_REQUESTED) {
+      mJSSampling = ACTIVE;
+      js::EnableContextProfilingStack(mContext, true);
+      if (JSTracerEnabled()) {
+        JS::StartTraceLogger(mContext);
+      }
+      if (JSAllocationsEnabled()) {
+        // TODO - This probability should not be hardcoded. See Bug 1547284.
+        JS::EnableRecordingAllocations(mContext,
+                                       profiler_add_js_allocation_marker, 0.01);
+      }
+      js::RegisterContextProfilingEventMarker(mContext, profiler_add_js_marker);
+
+    } else if (mJSSampling == INACTIVE_REQUESTED) {
+      mJSSampling = INACTIVE;
+      js::EnableContextProfilingStack(mContext, false);
+      if (JSTracerEnabled()) {
+        JS::StopTraceLogger(mContext);
+      }
+      if (JSAllocationsEnabled()) {
+        JS::DisableRecordingAllocations(mContext);
+      }
+    }
+  }
+}
diff --git a/tools/profiler/core/RegisteredThread.h b/tools/profiler/core/RegisteredThread.h
new file mode 100644
index 0000000000..bc569c5ae5
--- /dev/null
+++ b/tools/profiler/core/RegisteredThread.h
@@ -0,0 +1,283 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef RegisteredThread_h
+#define RegisteredThread_h
+
+#include "platform.h"
+#include "ThreadInfo.h"
+
+#include "mozilla/NotNull.h"
+#include "mozilla/RefPtr.h"
+#include "nsIEventTarget.h"
+#include "nsIThread.h"
+
+namespace mozilla {
+class ProfilingStackOwner;
+}
+
+// This class contains the state for a single thread that is accessible without
+// protection from gPSMutex in platform.cpp. Because there is no external
+// protection against data races, it must provide internal protection. Hence
+// the "Racy" prefix.
+//
+class RacyRegisteredThread final {
+ public:
+  explicit RacyRegisteredThread(int aThreadId);
+
+  MOZ_COUNTED_DTOR(RacyRegisteredThread)
+
+  void SetIsBeingProfiled(bool aIsBeingProfiled) {
+    mIsBeingProfiled = aIsBeingProfiled;
+  }
+
+  bool IsBeingProfiled() const { return mIsBeingProfiled; }
+
+  // This is called on every profiler restart. Put things that should happen at
+  // that time here.
+  void ReinitializeOnResume() {
+    // This is needed to cause an initial sample to be taken from sleeping
+    // threads that had been observed prior to the profiler stopping and
+    // restarting. Otherwise sleeping threads would not have any samples to
+    // copy forward while sleeping.
+    (void)mSleep.compareExchange(SLEEPING_OBSERVED, SLEEPING_NOT_OBSERVED);
+  }
+
+  // This returns true for the second and subsequent calls in each sleep cycle.
+  bool CanDuplicateLastSampleDueToSleep() {
+    if (mSleep == AWAKE) {
+      return false;
+    }
+
+    if (mSleep.compareExchange(SLEEPING_NOT_OBSERVED, SLEEPING_OBSERVED)) {
+      return false;
+    }
+
+    return true;
+  }
+
+  // Call this whenever the current thread sleeps. Calling it twice in a row
+  // without an intervening setAwake() call is an error.
+  void SetSleeping() {
+    MOZ_ASSERT(mSleep == AWAKE);
+    mSleep = SLEEPING_NOT_OBSERVED;
+  }
+
+  // Call this whenever the current thread wakes. Calling it twice in a row
+  // without an intervening setSleeping() call is an error.
+  void SetAwake() {
+    MOZ_ASSERT(mSleep != AWAKE);
+    mSleep = AWAKE;
+  }
+
+  bool IsSleeping() { return mSleep != AWAKE; }
+
+  int ThreadId() const { return mThreadId; }
+
+  class ProfilingStack& ProfilingStack() {
+    return mProfilingStackOwner->ProfilingStack();
+  }
+  const class ProfilingStack& ProfilingStack() const {
+    return mProfilingStackOwner->ProfilingStack();
+  }
+
+  mozilla::ProfilingStackOwner& ProfilingStackOwner() {
+    return *mProfilingStackOwner;
+  }
+
+ private:
+  mozilla::NotNull<RefPtr<mozilla::ProfilingStackOwner>> mProfilingStackOwner;
+
+  // mThreadId contains the thread ID of the current thread. It is safe to read
+  // this from multiple threads concurrently, as it will never be mutated.
+  const int mThreadId;
+
+  // mSleep tracks whether the thread is sleeping, and if so, whether it has
+  // been previously observed. This is used for an optimization: in some cases,
+  // when a thread is asleep, we duplicate the previous sample, which is
+  // cheaper than taking a new sample.
+  //
+  // mSleep is atomic because it is accessed from multiple threads.
+  //
+  // - It is written only by this thread, via setSleeping() and setAwake().
+  //
+  // - It is read by SamplerThread::Run().
+  //
+  // There are two cases where racing between threads can cause an issue.
+  //
+  // - If CanDuplicateLastSampleDueToSleep() returns false but that result is
+  //   invalidated before being acted upon, we will take a full sample
+  //   unnecessarily. This is additional work but won't cause any correctness
+  //   issues. (In actual fact, this case is impossible. In order to go from
+  //   CanDuplicateLastSampleDueToSleep() returning false to it returning true
+  //   requires an intermediate call to it in order for mSleep to go from
+  //   SLEEPING_NOT_OBSERVED to SLEEPING_OBSERVED.)
+  //
+  // - If CanDuplicateLastSampleDueToSleep() returns true but that result is
+  //   invalidated before being acted upon -- i.e. the thread wakes up before
+  //   DuplicateLastSample() is called -- we will duplicate the previous
+  //   sample. This is inaccurate, but only slightly... we will effectively
+  //   treat the thread as having slept a tiny bit longer than it really did.
+  //
+  // This latter inaccuracy could be avoided by moving the
+  // CanDuplicateLastSampleDueToSleep() check within the thread-freezing code,
+  // e.g. the section where Tick() is called. But that would reduce the
+  // effectiveness of the optimization because more code would have to be run
+  // before we can tell that duplication is allowed.
+  //
+  static const int AWAKE = 0;
+  static const int SLEEPING_NOT_OBSERVED = 1;
+  static const int SLEEPING_OBSERVED = 2;
+  mozilla::Atomic<int> mSleep;
+
+  // Is this thread being profiled? (e.g., should markers be recorded?)
+  mozilla::Atomic<bool, mozilla::MemoryOrdering::Relaxed> mIsBeingProfiled;
+};
+
+// This class contains information that's relevant to a single thread only
+// while that thread is running and registered with the profiler, but
+// regardless of whether the profiler is running. All accesses to it are
+// protected by the profiler state lock.
+class RegisteredThread final {
+ public:
+  RegisteredThread(ThreadInfo* aInfo, nsIThread* aThread, void* aStackTop);
+  ~RegisteredThread();
+
+  class RacyRegisteredThread& RacyRegisteredThread() {
+    return mRacyRegisteredThread;
+  }
+  const class RacyRegisteredThread& RacyRegisteredThread() const {
+    return mRacyRegisteredThread;
+  }
+
+  PlatformData* GetPlatformData() const { return mPlatformData.get(); }
+  const void* StackTop() const { return mStackTop; }
+
+  // aDelay is the time the event that is currently running on the thread
+  // was queued before starting to run (if a PrioritizedEventQueue
+  // (i.e. MainThread), this will be 0 for any event at a lower priority
+  // than Input).
+  // aRunning is the time the event has been running.  If no event is
+  // running these will both be TimeDuration() (i.e. 0).  Both are out
+  // params, and are always set.  Their initial value is discarded.
+  void GetRunningEventDelay(const mozilla::TimeStamp& aNow,
+                            mozilla::TimeDuration& aDelay,
+                            mozilla::TimeDuration& aRunning);
+
+  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+
+  // Set the JSContext of the thread to be sampled. Sampling cannot begin until
+  // this has been set.
+  void SetJSContext(JSContext* aContext);
+
+  void ClearJSContext() {
+    // This function runs on-thread.
+    mContext = nullptr;
+  }
+
+  JSContext* GetJSContext() const { return mContext; }
+
+  const RefPtr<ThreadInfo> Info() const { return mThreadInfo; }
+  const nsCOMPtr<nsIEventTarget> GetEventTarget() const { return mThread; }
+  void ResetMainThread(nsIThread* aThread) { mThread = aThread; }
+
+  // Request that this thread start JS sampling. JS sampling won't actually
+  // start until a subsequent PollJSSampling() call occurs *and* mContext has
+  // been set.
+  void StartJSSampling(uint32_t aJSFlags) {
+    // This function runs on-thread or off-thread.
+
+    MOZ_RELEASE_ASSERT(mJSSampling == INACTIVE ||
+                       mJSSampling == INACTIVE_REQUESTED);
+    mJSSampling = ACTIVE_REQUESTED;
+    mJSFlags = aJSFlags;
+  }
+
+  // Request that this thread stop JS sampling. JS sampling won't actually stop
+  // until a subsequent PollJSSampling() call occurs.
+  void StopJSSampling() {
+    // This function runs on-thread or off-thread.
+
+    MOZ_RELEASE_ASSERT(mJSSampling == ACTIVE ||
+                       mJSSampling == ACTIVE_REQUESTED);
+    mJSSampling = INACTIVE_REQUESTED;
+  }
+
+  // Poll to see if JS sampling should be started/stopped.
+  void PollJSSampling();
+
+ private:
+  class RacyRegisteredThread mRacyRegisteredThread;
+
+  const UniquePlatformData mPlatformData;
+  const void* mStackTop;
+
+  const RefPtr<ThreadInfo> mThreadInfo;
+  nsCOMPtr<nsIThread> mThread;
+
+  // If this is a JS thread, this is its JSContext, which is required for any
+  // JS sampling.
+  JSContext* mContext;
+
+  // The profiler needs to start and stop JS sampling of JS threads at various
+  // times. However, the JS engine can only do the required actions on the
+  // JS thread itself ("on-thread"), not from another thread ("off-thread").
+  // Therefore, we have the following two-step process.
+  //
+  // - The profiler requests (on-thread or off-thread) that the JS sampling be
+  //   started/stopped, by changing mJSSampling to the appropriate REQUESTED
+  //   state.
+  //
+  // - The relevant JS thread polls (on-thread) for changes to mJSSampling.
+  //   When it sees a REQUESTED state, it performs the appropriate actions to
+  //   actually start/stop JS sampling, and changes mJSSampling out of the
+  //   REQUESTED state.
+  //
+  // The state machine is as follows.
+  //
+  //             INACTIVE --> ACTIVE_REQUESTED
+  //                  ^       ^ |
+  //                  |     _/  |
+  //                  |   _/    |
+  //                  |  /      |
+  //                  | v       v
+  //   INACTIVE_REQUESTED <-- ACTIVE
+  //
+  // The polling is done in the following two ways.
+  //
+  // - Via the interrupt callback mechanism; the JS thread must call
+  //   profiler_js_interrupt_callback() from its own interrupt callback.
+  //   This is how sampling must be started/stopped for threads where the
+  //   request was made off-thread.
+  //
+  // - When {Start,Stop}JSSampling() is called on-thread, we can immediately
+  //   follow it with a PollJSSampling() call to avoid the delay between the
+  //   two steps. Likewise, setJSContext() calls PollJSSampling().
+  //
+  // One non-obvious thing about all this: these JS sampling requests are made
+  // on all threads, even non-JS threads. mContext needs to also be set (via
+  // setJSContext(), which can only happen for JS threads) for any JS sampling
+  // to actually happen.
+  //
+  enum {
+    INACTIVE = 0,
+    ACTIVE_REQUESTED = 1,
+    ACTIVE = 2,
+    INACTIVE_REQUESTED = 3,
+  } mJSSampling;
+
+  uint32_t mJSFlags;
+
+  bool JSTracerEnabled() {
+    return mJSFlags & uint32_t(JSInstrumentationFlags::TraceLogging);
+  }
+
+  bool JSAllocationsEnabled() {
+    return mJSFlags & uint32_t(JSInstrumentationFlags::Allocations);
+  }
+};
+
+#endif  // RegisteredThread_h
diff --git a/tools/profiler/core/ThreadInfo.h b/tools/profiler/core/ThreadInfo.h
new file mode 100644
index 0000000000..e698bad765
--- /dev/null
+++ b/tools/profiler/core/ThreadInfo.h
@@ -0,0 +1,48 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ThreadInfo_h
+#define ThreadInfo_h
+
+#include "mozilla/TimeStamp.h"
+#include "nsISupportsImpl.h"
+#include "nsString.h"
+
+// This class contains information about a thread which needs to be stored
+// across restarts of the profiler and which can be useful even after the
+// thread has stopped running.
+// It uses threadsafe refcounting and only contains immutable data.
+class ThreadInfo final {
+ public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(ThreadInfo)
+
+  ThreadInfo(const char* aName, int aThreadId, bool aIsMainThread,
+             const mozilla::TimeStamp& aRegisterTime =
+                 mozilla::TimeStamp::NowUnfuzzed())
+      : mName(aName),
+        mRegisterTime(aRegisterTime),
+        mThreadId(aThreadId),
+        mIsMainThread(aIsMainThread) {
+    // I don't know if we can assert this. But we should warn.
+    MOZ_ASSERT(aThreadId >= 0, "native thread ID is < 0");
+    MOZ_ASSERT(aThreadId <= INT32_MAX, "native thread ID is > INT32_MAX");
+  }
+
+  const char* Name() const { return mName.get(); }
+  mozilla::TimeStamp RegisterTime() const { return mRegisterTime; }
+  int ThreadId() const { return mThreadId; }
+  bool IsMainThread() const { return mIsMainThread; }
+
+ private:
+  ~ThreadInfo() {}
+
+  const nsCString mName;
+  const mozilla::TimeStamp mRegisterTime;
+  const int mThreadId;
+  const bool mIsMainThread;
+};
+
+#endif  // ThreadInfo_h
diff --git a/tools/profiler/core/VTuneProfiler.cpp b/tools/profiler/core/VTuneProfiler.cpp
new file mode 100644
index 0000000000..58a39c51ee
--- /dev/null
+++ b/tools/profiler/core/VTuneProfiler.cpp
@@ -0,0 +1,80 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifdef XP_WIN
+#  undef UNICODE
+#  undef _UNICODE
+#endif
+
+#include "VTuneProfiler.h"
+#include "mozilla/Bootstrap.h"
+#include <memory>
+
+VTuneProfiler* VTuneProfiler::mInstance = nullptr;
+
+void VTuneProfiler::Initialize() {
+  // This is just a 'dirty trick' to find out if the ittnotify DLL was found.
+  // If it wasn't this function always returns 0, otherwise it returns
+  // incrementing numbers, if the library was found this wastes 2 events but
+  // that should be okay.
+  __itt_event testEvent =
+      __itt_event_create("Test event", strlen("Test event"));
+  testEvent = __itt_event_create("Test event 2", strlen("Test event 2"));
+
+  if (testEvent) {
+    mInstance = new VTuneProfiler();
+  }
+}
+
+void VTuneProfiler::Shutdown() {}
+
+void VTuneProfiler::TraceInternal(const char* aName, TracingKind aKind) {
+  std::string str(aName);
+
+  auto iter = mStrings.find(str);
+
+  __itt_event event;
+  if (iter != mStrings.end()) {
+    event = iter->second;
+  } else {
+    event = __itt_event_create(aName, str.length());
+    mStrings.insert({str, event});
+  }
+
+  if (aKind == TRACING_INTERVAL_START || aKind == TRACING_EVENT) {
+    // VTune will consider starts not matched with an end to be single point in
+    // time events.
+    __itt_event_start(event);
+  } else {
+    __itt_event_end(event);
+  }
+}
+
+void VTuneProfiler::RegisterThreadInternal(const char* aName) {
+  std::string str(aName);
+
+  if (!str.compare("GeckoMain")) {
+    // Process main thread.
+    switch (XRE_GetProcessType()) {
+      case GeckoProcessType::GeckoProcessType_Default:
+        __itt_thread_set_name("Main Process");
+        break;
+      case GeckoProcessType::GeckoProcessType_Content:
+        __itt_thread_set_name("Content Process");
+        break;
+      case GeckoProcessType::GeckoProcessType_GMPlugin:
+        __itt_thread_set_name("Plugin Process");
+        break;
+      case GeckoProcessType::GeckoProcessType_GPU:
+        __itt_thread_set_name("GPU Process");
+        break;
+      default:
+        __itt_thread_set_name("Unknown Process");
+    }
+    return;
+  }
+  __itt_thread_set_name(aName);
+}
diff --git a/tools/profiler/core/VTuneProfiler.h b/tools/profiler/core/VTuneProfiler.h
new file mode 100644
index 0000000000..d5304653e4
--- /dev/null
+++ b/tools/profiler/core/VTuneProfiler.h
@@ -0,0 +1,72 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef VTuneProfiler_h
+#define VTuneProfiler_h
+
+// The intent here is to add 0 overhead for regular users. In order to build
+// the VTune profiler code at all --enable-vtune-instrumentation needs to be
+// set as a build option. Even then, when none of the environment variables
+// is specified that allow us to find the ittnotify DLL, these functions
+// should be minimal overhead. When starting Firefox under VTune, these
+// env vars will be automatically defined, otherwise INTEL_LIBITTNOTIFY32/64
+// should be set to point at the ittnotify DLL.
+#ifndef MOZ_VTUNE_INSTRUMENTATION
+
+#  define VTUNE_INIT()
+#  define VTUNE_SHUTDOWN()
+
+#  define VTUNE_TRACING(name, kind)
+#  define VTUNE_REGISTER_THREAD(name)
+
+#else
+
+#  include "GeckoProfiler.h"
+
+// This is the regular Intel header, these functions are actually defined for
+// us inside js/src/vtune by an intel C file which actually dynamically resolves
+// them to the correct DLL. Through libxul these will 'magically' resolve.
+#  include "vtune/ittnotify.h"
+
+#  include <stddef.h>
+#  include <unordered_map>
+#  include <string>
+
+class VTuneProfiler {
+ public:
+  static void Initialize();
+  static void Shutdown();
+
+  static void Trace(const char* aName, TracingKind aKind) {
+    if (mInstance) {
+      mInstance->TraceInternal(aName, aKind);
+    }
+  }
+  static void RegisterThread(const char* aName) {
+    if (mInstance) {
+      mInstance->RegisterThreadInternal(aName);
+    }
+  }
+
+ private:
+  void TraceInternal(const char* aName, TracingKind aKind);
+  void RegisterThreadInternal(const char* aName);
+
+  // This is null when the ittnotify DLL could not be found.
+  static VTuneProfiler* mInstance;
+
+  std::unordered_map<std::string, __itt_event> mStrings;
+};
+
+#  define VTUNE_INIT() VTuneProfiler::Initialize()
+#  define VTUNE_SHUTDOWN() VTuneProfiler::Shutdown()
+
+#  define VTUNE_TRACING(name, kind) VTuneProfiler::Trace(name, kind)
+#  define VTUNE_REGISTER_THREAD(name) VTuneProfiler::RegisterThread(name)
+
+#endif
+
+#endif /* VTuneProfiler_h */
diff --git a/tools/profiler/core/memory_hooks.cpp b/tools/profiler/core/memory_hooks.cpp
new file mode 100644
index 0000000000..51f6425ba8
--- /dev/null
+++ b/tools/profiler/core/memory_hooks.cpp
@@ -0,0 +1,598 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "memory_hooks.h"
+
+#include "nscore.h"
+
+#include "mozilla/Assertions.h"
+#include "mozilla/Atomics.h"
+#include "mozilla/FastBernoulliTrial.h"
+#include "mozilla/IntegerPrintfMacros.h"
+#include "mozilla/JSONWriter.h"
+#include "mozilla/MemoryReporting.h"
+#include "mozilla/PlatformMutex.h"
+#include "mozilla/ProfilerCounts.h"
+#include "mozilla/ThreadLocal.h"
+
+#include "GeckoProfiler.h"
+#include "prenv.h"
+#include "replace_malloc.h"
+
+#include <ctype.h>
+#include <errno.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#ifdef XP_WIN
+#  include <windows.h>
+#  include <process.h>
+#else
+#  include <pthread.h>
+#  include <sys/types.h>
+#  include <unistd.h>
+#endif
+
+#ifdef ANDROID
+#  include <android/log.h>
+#endif
+
+// The counters start out as a nullptr, and then get initialized only once. They
+// are never destroyed, as it would cause race conditions for the memory hooks
+// that use the counters. This helps guard against potentially expensive
+// operations like using a mutex.
+//
+// In addition, this is a raw pointer and not a UniquePtr, as the counter
+// machinery will try and de-register itself from the profiler. This could
+// happen after the profiler and its PSMutex was already destroyed, resulting in
+// a crash.
+static ProfilerCounterTotal* sCounter;
+
+// The gBernoulli value starts out as a nullptr, and only gets initialized once.
+// It then lives for the entire lifetime of the process. It cannot be deleted
+// without additional multi-threaded protections, since if we deleted it during
+// profiler_stop then there could be a race between threads already in a
+// memory hook that might try to access the value after or during deletion.
+static mozilla::FastBernoulliTrial* gBernoulli;
+
+namespace mozilla::profiler {
+
+//---------------------------------------------------------------------------
+// Utilities
+//---------------------------------------------------------------------------
+
+static malloc_table_t gMallocTable;
+
+// This is only needed because of the |const void*| vs |void*| arg mismatch.
+static size_t MallocSizeOf(const void* aPtr) {
+  return gMallocTable.malloc_usable_size(const_cast<void*>(aPtr));
+}
+
+// The values for the Bernoulli trial are taken from DMD. According to DMD:
+//
+//   In testing, a probability of 0.003 resulted in ~25% of heap blocks getting
+//   a stack trace and ~80% of heap bytes getting a stack trace. (This is
+//   possible because big heap blocks are more likely to get a stack trace.)
+//
+//   The random number seeds are arbitrary and were obtained from random.org.
+//
+// However this value resulted in a lot of slowdown since the profiler stacks
+// are pretty heavy to collect. The value was lowered to 10% of the original to
+// 0.0003.
+static void EnsureBernoulliIsInstalled() {
+  if (!gBernoulli) {
+    // This is only installed once. See the gBernoulli definition for more
+    // information.
+    gBernoulli =
+        new FastBernoulliTrial(0.0003, 0x8e26eeee166bc8ca, 0x56820f304a9c9ae0);
+  }
+}
+
+// This class provides infallible allocations (they abort on OOM) like
+// mozalloc's InfallibleAllocPolicy, except that memory hooks are bypassed. This
+// policy is used by the HashSet.
+class InfallibleAllocWithoutHooksPolicy {
+  static void ExitOnFailure(const void* aP) {
+    if (!aP) {
+      MOZ_CRASH("Profiler memory hooks out of memory; aborting");
+    }
+  }
+
+ public:
+  template <typename T>
+  static T* maybe_pod_malloc(size_t aNumElems) {
+    if (aNumElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value) {
+      return nullptr;
+    }
+    return (T*)gMallocTable.malloc(aNumElems * sizeof(T));
+  }
+
+  template <typename T>
+  static T* maybe_pod_calloc(size_t aNumElems) {
+    return (T*)gMallocTable.calloc(aNumElems, sizeof(T));
+  }
+
+  template <typename T>
+  static T* maybe_pod_realloc(T* aPtr, size_t aOldSize, size_t aNewSize) {
+    if (aNewSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value) {
+      return nullptr;
+    }
+    return (T*)gMallocTable.realloc(aPtr, aNewSize * sizeof(T));
+  }
+
+  template <typename T>
+  static T* pod_malloc(size_t aNumElems) {
+    T* p = maybe_pod_malloc<T>(aNumElems);
+    ExitOnFailure(p);
+    return p;
+  }
+
+  template <typename T>
+  static T* pod_calloc(size_t aNumElems) {
+    T* p = maybe_pod_calloc<T>(aNumElems);
+    ExitOnFailure(p);
+    return p;
+  }
+
+  template <typename T>
+  static T* pod_realloc(T* aPtr, size_t aOldSize, size_t aNewSize) {
+    T* p = maybe_pod_realloc(aPtr, aOldSize, aNewSize);
+    ExitOnFailure(p);
+    return p;
+  }
+
+  template <typename T>
+  static void free_(T* aPtr, size_t aSize = 0) {
+    gMallocTable.free(aPtr);
+  }
+
+  static void reportAllocOverflow() { ExitOnFailure(nullptr); }
+  bool checkSimulatedOOM() const { return true; }
+};
+
+// We can't use mozilla::Mutex because it causes re-entry into the memory hooks.
+// Define a custom implementation here.
+class Mutex : private ::mozilla::detail::MutexImpl {
+ public:
+  Mutex() : ::mozilla::detail::MutexImpl() {}
+
+  void Lock() { ::mozilla::detail::MutexImpl::lock(); }
+  void Unlock() { ::mozilla::detail::MutexImpl::unlock(); }
+};
+
+class MutexAutoLock {
+  MutexAutoLock(const MutexAutoLock&) = delete;
+  void operator=(const MutexAutoLock&) = delete;
+
+  Mutex& mMutex;
+
+ public:
+  explicit MutexAutoLock(Mutex& aMutex) : mMutex(aMutex) { mMutex.Lock(); }
+  ~MutexAutoLock() { mMutex.Unlock(); }
+};
+
+//---------------------------------------------------------------------------
+// Tracked allocations
+//---------------------------------------------------------------------------
+
+// The allocation tracker is shared between multiple threads, and is the
+// coordinator for knowing when allocations have been tracked. The mutable
+// internal state is protected by a mutex, and managed by the methods.
+//
+// The tracker knows about all the allocations that we have added to the
+// profiler. This way, whenever any given piece of memory is freed, we can see
+// if it was previously tracked, and we can track its deallocation.
+
+class AllocationTracker {
+  // This type tracks all of the allocations that we have captured. This way, we
+  // can see if a deallocation is inside of this set. We want to provide a
+  // balanced view into the allocations and deallocations.
+  typedef mozilla::HashSet<const void*, mozilla::DefaultHasher<const void*>,
+                           InfallibleAllocWithoutHooksPolicy>
+      AllocationSet;
+
+ public:
+  AllocationTracker() : mAllocations(), mMutex() {}
+
+  void AddMemoryAddress(const void* memoryAddress) {
+    MutexAutoLock lock(mMutex);
+    if (!mAllocations.put(memoryAddress)) {
+      MOZ_CRASH("Out of memory while tracking native allocations.");
+    };
+  }
+
+  void Reset() {
+    MutexAutoLock lock(mMutex);
+    mAllocations.clearAndCompact();
+  }
+
+  // Returns true when the memory address is found and removed, otherwise that
+  // memory address is not being tracked and it returns false.
+  bool RemoveMemoryAddressIfFound(const void* memoryAddress) {
+    MutexAutoLock lock(mMutex);
+
+    auto ptr = mAllocations.lookup(memoryAddress);
+    if (ptr) {
+      // The memory was present. It no longer needs to be tracked.
+      mAllocations.remove(ptr);
+      return true;
+    }
+
+    return false;
+  }
+
+ private:
+  AllocationSet mAllocations;
+  Mutex mMutex;
+};
+
+static AllocationTracker* gAllocationTracker;
+
+static void EnsureAllocationTrackerIsInstalled() {
+  if (!gAllocationTracker) {
+    // This is only installed once.
+    gAllocationTracker = new AllocationTracker();
+  }
+}
+
+//---------------------------------------------------------------------------
+// Per-thread blocking of intercepts
+//---------------------------------------------------------------------------
+
+// On MacOS, and Linux the first __thread/thread_local access calls malloc,
+// which leads to an infinite loop. So we use pthread-based TLS instead, which
+// somehow doesn't have this problem.
+#if !defined(XP_DARWIN) && !defined(XP_LINUX)
+#  define PROFILER_THREAD_LOCAL(T) MOZ_THREAD_LOCAL(T)
+#else
+#  define PROFILER_THREAD_LOCAL(T) \
+    ::mozilla::detail::ThreadLocal<T, ::mozilla::detail::ThreadLocalKeyStorage>
+#endif
+
+class ThreadIntercept {
+  // When set to true, malloc does not intercept additional allocations. This is
+  // needed because collecting stacks creates new allocations. When blocked,
+  // these allocations are then ignored by the memory hook.
+  static PROFILER_THREAD_LOCAL(bool) tlsIsBlocked;
+
+  // This is a quick flag to check and see if the allocations feature is enabled
+  // or disabled.
+  static mozilla::Atomic<bool, mozilla::Relaxed> sAllocationsFeatureEnabled;
+
+  ThreadIntercept() = default;
+
+  // Only allow consumers to access this information if they run
+  // ThreadIntercept::MaybeGet and ask through the non-static version.
+  static bool IsBlocked_() {
+    // When the native allocations feature is turned on, memory hooks run on
+    // every single allocation. For a subset of these allocations, the stack
+    // gets sampled by running profiler_get_backtrace(), which locks the
+    // profiler mutex.
+    //
+    // An issue arises when allocating while the profiler is locked FOR THE
+    // CURRENT THREAD. In this situation, if profiler_get_backtrace() were to be
+    // run, it would try to re-acquire this lock and deadlock. In order to guard
+    // against this deadlock, we check to see if the mutex is already locked by
+    // this thread.
+    return tlsIsBlocked.get() || profiler_is_locked_on_current_thread();
+  }
+
+ public:
+  static void Init() { tlsIsBlocked.infallibleInit(); }
+
+  // The ThreadIntercept object can only be created through this method, the
+  // constructor is private. This is so that we only check to see if the native
+  // allocations are turned on once, and not multiple times through the calls.
+  // The feature maybe be toggled between different stages of the memory hook.
+  static Maybe<ThreadIntercept> MaybeGet() {
+    if (sAllocationsFeatureEnabled && !ThreadIntercept::IsBlocked_()) {
+      // Only return thread intercepts when the native allocations feature is
+      // enabled and we aren't blocked.
+      return Some(ThreadIntercept());
+    }
+    return Nothing();
+  }
+
+  void Block() {
+    MOZ_ASSERT(!tlsIsBlocked.get());
+    tlsIsBlocked.set(true);
+  }
+
+  void Unblock() {
+    MOZ_ASSERT(tlsIsBlocked.get());
+    tlsIsBlocked.set(false);
+  }
+
+  bool IsBlocked() const { return ThreadIntercept::IsBlocked_(); }
+
+  static void EnableAllocationFeature() { sAllocationsFeatureEnabled = true; }
+
+  static void DisableAllocationFeature() { sAllocationsFeatureEnabled = false; }
+};
+
+PROFILER_THREAD_LOCAL(bool) ThreadIntercept::tlsIsBlocked;
+
+mozilla::Atomic<bool, mozilla::Relaxed>
+    ThreadIntercept::sAllocationsFeatureEnabled(false);
+
+// An object of this class must be created (on the stack) before running any
+// code that might allocate.
+class AutoBlockIntercepts {
+  ThreadIntercept& mThreadIntercept;
+
+ public:
+  // Disallow copy and assign.
+  AutoBlockIntercepts(const AutoBlockIntercepts&) = delete;
+  void operator=(const AutoBlockIntercepts&) = delete;
+
+  explicit AutoBlockIntercepts(ThreadIntercept& aThreadIntercept)
+      : mThreadIntercept(aThreadIntercept) {
+    mThreadIntercept.Block();
+  }
+  ~AutoBlockIntercepts() {
+    MOZ_ASSERT(mThreadIntercept.IsBlocked());
+    mThreadIntercept.Unblock();
+  }
+};
+
+//---------------------------------------------------------------------------
+// malloc/free callbacks
+//---------------------------------------------------------------------------
+
+static void AllocCallback(void* aPtr, size_t aReqSize) {
+  if (!aPtr) {
+    return;
+  }
+
+  // The first part of this function does not allocate.
+  size_t actualSize = gMallocTable.malloc_usable_size(aPtr);
+  if (actualSize > 0) {
+    sCounter->Add(actualSize);
+  }
+
+  auto threadIntercept = ThreadIntercept::MaybeGet();
+  if (threadIntercept.isNothing()) {
+    // Either the native allocations feature is not turned on, or we  may be
+    // recursing into a memory hook, return. We'll still collect counter
+    // information about this allocation, but no stack.
+    return;
+  }
+
+  // The next part of the function requires allocations, so block the memory
+  // hooks from recursing on any new allocations coming in.
+  AutoBlockIntercepts block(threadIntercept.ref());
+
+  // Perform a bernoulli trial, which will return true or false based on its
+  // configured probability. It takes into account the byte size so that
+  // larger allocations are weighted heavier than smaller allocations.
+  MOZ_ASSERT(gBernoulli,
+             "gBernoulli must be properly installed for the memory hooks.");
+  if (
+      // First perform the Bernoulli trial.
+      gBernoulli->trial(actualSize) &&
+      // Second, attempt to add a marker if the Bernoulli trial passed.
+      profiler_add_native_allocation_marker(
+          static_cast<int64_t>(actualSize),
+          reinterpret_cast<uintptr_t>(aPtr))) {
+    MOZ_ASSERT(gAllocationTracker,
+               "gAllocationTracker must be properly installed for the memory "
+               "hooks.");
+    // Only track the memory if the allocation marker was actually added to the
+    // profiler.
+    gAllocationTracker->AddMemoryAddress(aPtr);
+  }
+
+  // We're ignoring aReqSize here
+}
+
+static void FreeCallback(void* aPtr) {
+  if (!aPtr) {
+    return;
+  }
+
+  // The first part of this function does not allocate.
+  size_t unsignedSize = MallocSizeOf(aPtr);
+  int64_t signedSize = -(static_cast<int64_t>(unsignedSize));
+  sCounter->Add(signedSize);
+
+  auto threadIntercept = ThreadIntercept::MaybeGet();
+  if (threadIntercept.isNothing()) {
+    // Either the native allocations feature is not turned on, or we  may be
+    // recursing into a memory hook, return. We'll still collect counter
+    // information about this allocation, but no stack.
+    return;
+  }
+
+  // The next part of the function requires allocations, so block the memory
+  // hooks from recursing on any new allocations coming in.
+  AutoBlockIntercepts block(threadIntercept.ref());
+
+  // Perform a bernoulli trial, which will return true or false based on its
+  // configured probability. It takes into account the byte size so that
+  // larger allocations are weighted heavier than smaller allocations.
+  MOZ_ASSERT(
+      gAllocationTracker,
+      "gAllocationTracker must be properly installed for the memory hooks.");
+  if (gAllocationTracker->RemoveMemoryAddressIfFound(aPtr)) {
+    // This size here is negative, indicating a deallocation.
+    profiler_add_native_allocation_marker(signedSize,
+                                          reinterpret_cast<uintptr_t>(aPtr));
+  }
+}
+
+}  // namespace mozilla::profiler
+
+//---------------------------------------------------------------------------
+// malloc/free interception
+//---------------------------------------------------------------------------
+
+using namespace mozilla::profiler;
+
+static void* replace_malloc(size_t aSize) {
+  // This must be a call to malloc from outside.  Intercept it.
+  void* ptr = gMallocTable.malloc(aSize);
+  AllocCallback(ptr, aSize);
+  return ptr;
+}
+
+static void* replace_calloc(size_t aCount, size_t aSize) {
+  void* ptr = gMallocTable.calloc(aCount, aSize);
+  AllocCallback(ptr, aCount * aSize);
+  return ptr;
+}
+
+static void* replace_realloc(void* aOldPtr, size_t aSize) {
+  // If |aOldPtr| is nullptr, the call is equivalent to |malloc(aSize)|.
+  if (!aOldPtr) {
+    return replace_malloc(aSize);
+  }
+
+  FreeCallback(aOldPtr);
+  void* ptr = gMallocTable.realloc(aOldPtr, aSize);
+  if (ptr) {
+    AllocCallback(ptr, aSize);
+  } else {
+    // If realloc fails, we undo the prior operations by re-inserting the old
+    // pointer into the live block table. We don't have to do anything with the
+    // dead block list because the dead block hasn't yet been inserted. The
+    // block will end up looking like it was allocated for the first time here,
+    // which is untrue, and the slop bytes will be zero, which may be untrue.
+    // But this case is rare and doing better isn't worth the effort.
+    AllocCallback(aOldPtr, gMallocTable.malloc_usable_size(aOldPtr));
+  }
+  return ptr;
+}
+
+static void* replace_memalign(size_t aAlignment, size_t aSize) {
+  void* ptr = gMallocTable.memalign(aAlignment, aSize);
+  AllocCallback(ptr, aSize);
+  return ptr;
+}
+
+static void replace_free(void* aPtr) {
+  FreeCallback(aPtr);
+  gMallocTable.free(aPtr);
+}
+
+static void* replace_moz_arena_malloc(arena_id_t aArena, size_t aSize) {
+  void* ptr = gMallocTable.moz_arena_malloc(aArena, aSize);
+  AllocCallback(ptr, aSize);
+  return ptr;
+}
+
+static void* replace_moz_arena_calloc(arena_id_t aArena, size_t aCount,
+                                      size_t aSize) {
+  void* ptr = gMallocTable.moz_arena_calloc(aArena, aCount, aSize);
+  AllocCallback(ptr, aCount * aSize);
+  return ptr;
+}
+
+static void* replace_moz_arena_realloc(arena_id_t aArena, void* aPtr,
+                                       size_t aSize) {
+  void* ptr = gMallocTable.moz_arena_realloc(aArena, aPtr, aSize);
+  AllocCallback(ptr, aSize);
+  return ptr;
+}
+
+static void replace_moz_arena_free(arena_id_t aArena, void* aPtr) {
+  FreeCallback(aPtr);
+  gMallocTable.moz_arena_free(aArena, aPtr);
+}
+
+static void* replace_moz_arena_memalign(arena_id_t aArena, size_t aAlignment,
+                                        size_t aSize) {
+  void* ptr = gMallocTable.moz_arena_memalign(aArena, aAlignment, aSize);
+  AllocCallback(ptr, aSize);
+  return ptr;
+}
+
+// we have to replace these or jemalloc will assume we don't implement any
+// of the arena replacements!
+static arena_id_t replace_moz_create_arena_with_params(
+    arena_params_t* aParams) {
+  return gMallocTable.moz_create_arena_with_params(aParams);
+}
+
+static void replace_moz_dispose_arena(arena_id_t aArenaId) {
+  return gMallocTable.moz_dispose_arena(aArenaId);
+}
+
+// Must come after all the replace_* funcs
+void replace_init(malloc_table_t* aMallocTable, ReplaceMallocBridge** aBridge) {
+  gMallocTable = *aMallocTable;
+#define MALLOC_FUNCS (MALLOC_FUNCS_MALLOC_BASE | MALLOC_FUNCS_ARENA)
+#define MALLOC_DECL(name, ...) aMallocTable->name = replace_##name;
+#include "malloc_decls.h"
+}
+
+void profiler_replace_remove() {}
+
+namespace mozilla::profiler {
+//---------------------------------------------------------------------------
+// Initialization
+//---------------------------------------------------------------------------
+
+void install_memory_hooks() {
+  if (!sCounter) {
+    sCounter = new ProfilerCounterTotal("malloc", "Memory",
+                                        "Amount of allocated memory");
+    // Also initialize the ThreadIntercept, even if native allocation tracking
+    // won't be turned on. This way the TLS will be initialized.
+    ThreadIntercept::Init();
+  }
+  jemalloc_replace_dynamic(replace_init);
+}
+
+// Remove the hooks, but leave the sCounter machinery. Deleting the counter
+// would race with any existing memory hooks that are currently running. Rather
+// than adding overhead here of mutexes it's cheaper for the performance to just
+// leak these values.
+void remove_memory_hooks() { jemalloc_replace_dynamic(nullptr); }
+
+void enable_native_allocations() {
+  // The bloat log tracks allocations and deallocations. This can conflict
+  // with the memory hook machinery, as the bloat log creates its own
+  // allocations. This means we can re-enter inside the bloat log machinery. At
+  // this time, the bloat log does not know about cannot handle the native
+  // allocation feature.
+  //
+  // At the time of this writing, we hit this assertion:
+  // IsIdle(oldState) || IsRead(oldState) in Checker::StartReadOp()
+  //
+  //    #01: GetBloatEntry(char const*, unsigned int)
+  //    #02: NS_LogCtor
+  //    #03: profiler_get_backtrace()
+  //    #04: profiler_add_native_allocation_marker(long long)
+  //    #05: mozilla::profiler::AllocCallback(void*, unsigned long)
+  //    #06: replace_calloc(unsigned long, unsigned long)
+  //    #07: PLDHashTable::ChangeTable(int)
+  //    #08: PLDHashTable::Add(void const*, std::nothrow_t const&)
+  //    #09: nsBaseHashtable<nsDepCharHashKey, nsAutoPtr<BloatEntry>, ...
+  //    #10: GetBloatEntry(char const*, unsigned int)
+  //    #11: NS_LogCtor
+  //    #12: profiler_get_backtrace()
+  //    ...
+  MOZ_ASSERT(!PR_GetEnv("XPCOM_MEM_BLOAT_LOG"),
+             "The bloat log feature is not compatible with the native "
+             "allocations instrumentation.");
+
+  EnsureBernoulliIsInstalled();
+  EnsureAllocationTrackerIsInstalled();
+  ThreadIntercept::EnableAllocationFeature();
+}
+
+// This is safe to call even if native allocations hasn't been enabled.
+void disable_native_allocations() {
+  ThreadIntercept::DisableAllocationFeature();
+  if (gAllocationTracker) {
+    gAllocationTracker->Reset();
+  }
+}
+
+}  // namespace mozilla::profiler
diff --git a/tools/profiler/core/memory_hooks.h b/tools/profiler/core/memory_hooks.h
new file mode 100644
index 0000000000..7a117ec15a
--- /dev/null
+++ b/tools/profiler/core/memory_hooks.h
@@ -0,0 +1,23 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef memory_hooks_h
+#define memory_hooks_h
+
+#if defined(MOZ_REPLACE_MALLOC) && defined(MOZ_PROFILER_MEMORY)
+namespace mozilla {
+namespace profiler {
+
+void install_memory_hooks();
+void remove_memory_hooks();
+void enable_native_allocations();
+void disable_native_allocations();
+
+}  // namespace profiler
+}  // namespace mozilla
+#endif
+
+#endif
diff --git a/tools/profiler/core/platform-linux-android.cpp b/tools/profiler/core/platform-linux-android.cpp
new file mode 100644
index 0000000000..28561932af
--- /dev/null
+++ b/tools/profiler/core/platform-linux-android.cpp
@@ -0,0 +1,609 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2011 The Chromium Authors. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+//  * Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+//  * Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in
+//    the documentation and/or other materials provided with the
+//    distribution.
+//  * Neither the name of Google, Inc. nor the names of its contributors
+//    may be used to endorse or promote products derived from this
+//    software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+// COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+// INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+// BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+// OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+// AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+// OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+// SUCH DAMAGE.
+
+// This file is used for both Linux and Android as well as FreeBSD.
+
+#include <stdio.h>
+#include <math.h>
+
+#include <pthread.h>
+#if defined(GP_OS_freebsd)
+#  include <sys/thr.h>
+#endif
+#include <semaphore.h>
+#include <signal.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <stdlib.h>
+#include <sched.h>
+#include <ucontext.h>
+// Ubuntu Dapper requires memory pages to be marked as
+// executable. Otherwise, OS raises an exception when executing code
+// in that page.
+#include <sys/types.h>  // mmap & munmap
+#include <sys/mman.h>   // mmap & munmap
+#include <sys/stat.h>   // open
+#include <fcntl.h>      // open
+#include <unistd.h>     // sysconf
+#include <semaphore.h>
+#ifdef __GLIBC__
+#  include <execinfo.h>  // backtrace, backtrace_symbols
+#endif                   // def __GLIBC__
+#include <strings.h>     // index
+#include <errno.h>
+#include <stdarg.h>
+
+#include "prenv.h"
+#include "mozilla/PodOperations.h"
+#include "mozilla/DebugOnly.h"
+#if defined(GP_OS_linux) || defined(GP_OS_android)
+#  include "common/linux/breakpad_getcontext.h"
+#endif
+
+#include <string.h>
+#include <list>
+
+using namespace mozilla;
+
+int profiler_current_process_id() { return getpid(); }
+
+int profiler_current_thread_id() {
+#if defined(GP_OS_linux) || defined(GP_OS_android)
+  // glibc doesn't provide a wrapper for gettid().
+  return static_cast<int>(static_cast<pid_t>(syscall(SYS_gettid)));
+#elif defined(GP_OS_freebsd)
+  long id;
+  (void)thr_self(&id);
+  return static_cast<int>(id);
+#else
+#  error "bad platform"
+#endif
+}
+
+void* GetStackTop(void* aGuess) { return aGuess; }
+
+static void PopulateRegsFromContext(Registers& aRegs, ucontext_t* aContext) {
+  aRegs.mContext = aContext;
+  mcontext_t& mcontext = aContext->uc_mcontext;
+
+  // Extracting the sample from the context is extremely machine dependent.
+#if defined(GP_PLAT_x86_linux) || defined(GP_PLAT_x86_android)
+  aRegs.mPC = reinterpret_cast<Address>(mcontext.gregs[REG_EIP]);
+  aRegs.mSP = reinterpret_cast<Address>(mcontext.gregs[REG_ESP]);
+  aRegs.mFP = reinterpret_cast<Address>(mcontext.gregs[REG_EBP]);
+  aRegs.mLR = 0;
+#elif defined(GP_PLAT_amd64_linux) || defined(GP_PLAT_amd64_android)
+  aRegs.mPC = reinterpret_cast<Address>(mcontext.gregs[REG_RIP]);
+  aRegs.mSP = reinterpret_cast<Address>(mcontext.gregs[REG_RSP]);
+  aRegs.mFP = reinterpret_cast<Address>(mcontext.gregs[REG_RBP]);
+  aRegs.mLR = 0;
+#elif defined(GP_PLAT_amd64_freebsd)
+  aRegs.mPC = reinterpret_cast<Address>(mcontext.mc_rip);
+  aRegs.mSP = reinterpret_cast<Address>(mcontext.mc_rsp);
+  aRegs.mFP = reinterpret_cast<Address>(mcontext.mc_rbp);
+  aRegs.mLR = 0;
+#elif defined(GP_PLAT_arm_linux) || defined(GP_PLAT_arm_android)
+  aRegs.mPC = reinterpret_cast<Address>(mcontext.arm_pc);
+  aRegs.mSP = reinterpret_cast<Address>(mcontext.arm_sp);
+  aRegs.mFP = reinterpret_cast<Address>(mcontext.arm_fp);
+  aRegs.mLR = reinterpret_cast<Address>(mcontext.arm_lr);
+#elif defined(GP_PLAT_arm64_linux) || defined(GP_PLAT_arm64_android)
+  aRegs.mPC = reinterpret_cast<Address>(mcontext.pc);
+  aRegs.mSP = reinterpret_cast<Address>(mcontext.sp);
+  aRegs.mFP = reinterpret_cast<Address>(mcontext.regs[29]);
+  aRegs.mLR = reinterpret_cast<Address>(mcontext.regs[30]);
+#elif defined(GP_PLAT_arm64_freebsd)
+  aRegs.mPC = reinterpret_cast<Address>(mcontext.mc_gpregs.gp_elr);
+  aRegs.mSP = reinterpret_cast<Address>(mcontext.mc_gpregs.gp_sp);
+  aRegs.mFP = reinterpret_cast<Address>(mcontext.mc_gpregs.gp_x[29]);
+  aRegs.mLR = reinterpret_cast<Address>(mcontext.mc_gpregs.gp_lr);
+#elif defined(GP_PLAT_mips64_linux) || defined(GP_PLAT_mips64_android)
+  aRegs.mPC = reinterpret_cast<Address>(mcontext.pc);
+  aRegs.mSP = reinterpret_cast<Address>(mcontext.gregs[29]);
+  aRegs.mFP = reinterpret_cast<Address>(mcontext.gregs[30]);
+
+#else
+#  error "bad platform"
+#endif
+}
+
+#if defined(GP_OS_android)
+#  define SYS_tgkill __NR_tgkill
+#endif
+
+#if defined(GP_OS_linux) || defined(GP_OS_android)
+int tgkill(pid_t tgid, pid_t tid, int signalno) {
+  return syscall(SYS_tgkill, tgid, tid, signalno);
+}
+#endif
+
+#if defined(GP_OS_freebsd)
+#  define tgkill thr_kill2
+#endif
+
+class PlatformData {
+ public:
+  explicit PlatformData(int aThreadId) {
+    MOZ_ASSERT(aThreadId == profiler_current_thread_id());
+    MOZ_COUNT_CTOR(PlatformData);
+    if (clockid_t clockid;
+        pthread_getcpuclockid(pthread_self(), &clockid) == 0) {
+      mClockId = Some(clockid);
+    }
+  }
+
+  MOZ_COUNTED_DTOR(PlatformData)
+
+  // Clock Id for this profiled thread. `Nothing` if `pthread_getcpuclockid`
+  // failed (e.g., if the system doesn't support per-thread clocks).
+  Maybe<clockid_t> GetClockId() const { return mClockId; }
+
+  RunningTimes& PreviousThreadRunningTimesRef() {
+    return mPreviousThreadRunningTimes;
+  }
+
+ private:
+  Maybe<clockid_t> mClockId;
+  RunningTimes mPreviousThreadRunningTimes;
+};
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN Sampler target specifics
+
+// The only way to reliably interrupt a Linux thread and inspect its register
+// and stack state is by sending a signal to it, and doing the work inside the
+// signal handler.  But we don't want to run much code inside the signal
+// handler, since POSIX severely restricts what we can do in signal handlers.
+// So we use a system of semaphores to suspend the thread and allow the
+// sampler thread to do all the work of unwinding and copying out whatever
+// data it wants.
+//
+// A four-message protocol is used to reliably suspend and later resume the
+// thread to be sampled (the samplee):
+//
+// Sampler (signal sender) thread              Samplee (thread to be sampled)
+//
+// Prepare the SigHandlerCoordinator
+// and point sSigHandlerCoordinator at it
+//
+// send SIGPROF to samplee ------- MSG 1 ----> (enter signal handler)
+// wait(mMessage2)                             Copy register state
+//                                               into sSigHandlerCoordinator
+//                         <------ MSG 2 ----- post(mMessage2)
+// Samplee is now suspended.                   wait(mMessage3)
+//   Examine its stack/register
+//   state at leisure
+//
+// Release samplee:
+//   post(mMessage3)       ------- MSG 3 ----->
+// wait(mMessage4)                              Samplee now resumes.  Tell
+//                                                the sampler that we are done.
+//                         <------ MSG 4 ------ post(mMessage4)
+// Now we know the samplee's signal             (leave signal handler)
+//   handler has finished using
+//   sSigHandlerCoordinator.  We can
+//   safely reuse it for some other thread.
+//
+
+// A type used to coordinate between the sampler (signal sending) thread and
+// the thread currently being sampled (the samplee, which receives the
+// signals).
+//
+// The first message is sent using a SIGPROF signal delivery.  The subsequent
+// three are sent using sem_wait/sem_post pairs.  They are named accordingly
+// in the following struct.
+struct SigHandlerCoordinator {
+  SigHandlerCoordinator() {
+    PodZero(&mUContext);
+    int r = sem_init(&mMessage2, /* pshared */ 0, 0);
+    r |= sem_init(&mMessage3, /* pshared */ 0, 0);
+    r |= sem_init(&mMessage4, /* pshared */ 0, 0);
+    MOZ_ASSERT(r == 0);
+  }
+
+  ~SigHandlerCoordinator() {
+    int r = sem_destroy(&mMessage2);
+    r |= sem_destroy(&mMessage3);
+    r |= sem_destroy(&mMessage4);
+    MOZ_ASSERT(r == 0);
+  }
+
+  sem_t mMessage2;       // To sampler: "context is in sSigHandlerCoordinator"
+  sem_t mMessage3;       // To samplee: "resume"
+  sem_t mMessage4;       // To sampler: "finished with sSigHandlerCoordinator"
+  ucontext_t mUContext;  // Context at signal
+};
+
+struct SigHandlerCoordinator* Sampler::sSigHandlerCoordinator = nullptr;
+
+static void SigprofHandler(int aSignal, siginfo_t* aInfo, void* aContext) {
+  // Avoid TSan warning about clobbering errno.
+  int savedErrno = errno;
+
+  MOZ_ASSERT(aSignal == SIGPROF);
+  MOZ_ASSERT(Sampler::sSigHandlerCoordinator);
+
+  // By sending us this signal, the sampler thread has sent us message 1 in
+  // the comment above, with the meaning "|sSigHandlerCoordinator| is ready
+  // for use, please copy your register context into it."
+  Sampler::sSigHandlerCoordinator->mUContext =
+      *static_cast<ucontext_t*>(aContext);
+
+  // Send message 2: tell the sampler thread that the context has been copied
+  // into |sSigHandlerCoordinator->mUContext|.  sem_post can never fail by
+  // being interrupted by a signal, so there's no loop around this call.
+  int r = sem_post(&Sampler::sSigHandlerCoordinator->mMessage2);
+  MOZ_ASSERT(r == 0);
+
+  // At this point, the sampler thread assumes we are suspended, so we must
+  // not touch any global state here.
+
+  // Wait for message 3: the sampler thread tells us to resume.
+  while (true) {
+    r = sem_wait(&Sampler::sSigHandlerCoordinator->mMessage3);
+    if (r == -1 && errno == EINTR) {
+      // Interrupted by a signal.  Try again.
+      continue;
+    }
+    // We don't expect any other kind of failure
+    MOZ_ASSERT(r == 0);
+    break;
+  }
+
+  // Send message 4: tell the sampler thread that we are finished accessing
+  // |sSigHandlerCoordinator|.  After this point it is not safe to touch
+  // |sSigHandlerCoordinator|.
+  r = sem_post(&Sampler::sSigHandlerCoordinator->mMessage4);
+  MOZ_ASSERT(r == 0);
+
+  errno = savedErrno;
+}
+
+Sampler::Sampler(PSLockRef aLock)
+    : mMyPid(profiler_current_process_id())
+      // We don't know what the sampler thread's ID will be until it runs, so
+      // set mSamplerTid to a dummy value and fill it in for real in
+      // SuspendAndSampleAndResumeThread().
+      ,
+      mSamplerTid(-1) {
+#if defined(USE_EHABI_STACKWALK)
+  mozilla::EHABIStackWalkInit();
+#endif
+
+  // NOTE: We don't initialize LUL here, instead initializing it in
+  // SamplerThread's constructor. This is because with the
+  // profiler_suspend_and_sample_thread entry point, we want to be able to
+  // sample without waiting for LUL to be initialized.
+
+  // Request profiling signals.
+  struct sigaction sa;
+  sa.sa_sigaction = SigprofHandler;
+  sigemptyset(&sa.sa_mask);
+  sa.sa_flags = SA_RESTART | SA_SIGINFO;
+  if (sigaction(SIGPROF, &sa, &mOldSigprofHandler) != 0) {
+    MOZ_CRASH("Error installing SIGPROF handler in the profiler");
+  }
+}
+
+void Sampler::Disable(PSLockRef aLock) {
+  // Restore old signal handler. This is global state so it's important that
+  // we do it now, while gPSMutex is locked.
+  sigaction(SIGPROF, &mOldSigprofHandler, 0);
+}
+
+static void StreamMetaPlatformSampleUnits(PSLockRef aLock,
+                                          SpliceableJSONWriter& aWriter) {
+  aWriter.StringProperty("threadCPUDelta", "ns");
+}
+
+static RunningTimes GetThreadRunningTimesDiff(
+    PSLockRef aLock, const RegisteredThread& aRegisteredThread) {
+  AUTO_PROFILER_STATS(GetRunningTimes_clock_gettime_thread);
+
+  PlatformData* platformData = aRegisteredThread.GetPlatformData();
+  MOZ_RELEASE_ASSERT(platformData);
+  Maybe<clockid_t> maybeCid = platformData->GetClockId();
+
+  if (MOZ_UNLIKELY(!maybeCid)) {
+    // No clock id -> Nothing to measure apart from the timestamp.
+    RunningTimes emptyRunningTimes;
+    emptyRunningTimes.SetPostMeasurementTimeStamp(TimeStamp::NowUnfuzzed());
+    return emptyRunningTimes;
+  }
+
+  const RunningTimes newRunningTimes = GetRunningTimesWithTightTimestamp(
+      [cid = *maybeCid](RunningTimes& aRunningTimes) {
+        AUTO_PROFILER_STATS(GetRunningTimes_clock_gettime);
+        if (timespec ts; clock_gettime(cid, &ts) == 0) {
+          aRunningTimes.ResetThreadCPUDelta(
+              uint64_t(ts.tv_sec) * 1'000'000'000u + uint64_t(ts.tv_nsec));
+        } else {
+          aRunningTimes.ClearThreadCPUDelta();
+        }
+      });
+
+  const RunningTimes diff =
+      newRunningTimes - platformData->PreviousThreadRunningTimesRef();
+  platformData->PreviousThreadRunningTimesRef() = newRunningTimes;
+  return diff;
+}
+
+template <typename Func>
+void Sampler::SuspendAndSampleAndResumeThread(
+    PSLockRef aLock, const RegisteredThread& aRegisteredThread,
+    const TimeStamp& aNow, const Func& aProcessRegs) {
+  // Only one sampler thread can be sampling at once.  So we expect to have
+  // complete control over |sSigHandlerCoordinator|.
+  MOZ_ASSERT(!sSigHandlerCoordinator);
+
+  if (mSamplerTid == -1) {
+    mSamplerTid = profiler_current_thread_id();
+  }
+  int sampleeTid = aRegisteredThread.Info()->ThreadId();
+  MOZ_RELEASE_ASSERT(sampleeTid != mSamplerTid);
+
+  //----------------------------------------------------------------//
+  // Suspend the samplee thread and get its context.
+
+  SigHandlerCoordinator coord;  // on sampler thread's stack
+  sSigHandlerCoordinator = &coord;
+
+  // Send message 1 to the samplee (the thread to be sampled), by
+  // signalling at it.
+  // This could fail if the thread doesn't exist anymore.
+  int r = tgkill(mMyPid, sampleeTid, SIGPROF);
+  if (r == 0) {
+    // Wait for message 2 from the samplee, indicating that the context
+    // is available and that the thread is suspended.
+    while (true) {
+      r = sem_wait(&sSigHandlerCoordinator->mMessage2);
+      if (r == -1 && errno == EINTR) {
+        // Interrupted by a signal.  Try again.
+        continue;
+      }
+      // We don't expect any other kind of failure.
+      MOZ_ASSERT(r == 0);
+      break;
+    }
+
+    //----------------------------------------------------------------//
+    // Sample the target thread.
+
+    // WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
+    //
+    // The profiler's "critical section" begins here.  In the critical section,
+    // we must not do any dynamic memory allocation, nor try to acquire any lock
+    // or any other unshareable resource.  This is because the thread to be
+    // sampled has been suspended at some entirely arbitrary point, and we have
+    // no idea which unsharable resources (locks, essentially) it holds.  So any
+    // attempt to acquire any lock, including the implied locks used by the
+    // malloc implementation, risks deadlock.  This includes TimeStamp::Now(),
+    // which gets a lock on Windows.
+
+    // The samplee thread is now frozen and sSigHandlerCoordinator->mUContext is
+    // valid.  We can poke around in it and unwind its stack as we like.
+
+    // Extract the current register values.
+    Registers regs;
+    PopulateRegsFromContext(regs, &sSigHandlerCoordinator->mUContext);
+    aProcessRegs(regs, aNow);
+
+    //----------------------------------------------------------------//
+    // Resume the target thread.
+
+    // Send message 3 to the samplee, which tells it to resume.
+    r = sem_post(&sSigHandlerCoordinator->mMessage3);
+    MOZ_ASSERT(r == 0);
+
+    // Wait for message 4 from the samplee, which tells us that it has
+    // finished with |sSigHandlerCoordinator|.
+    while (true) {
+      r = sem_wait(&sSigHandlerCoordinator->mMessage4);
+      if (r == -1 && errno == EINTR) {
+        continue;
+      }
+      MOZ_ASSERT(r == 0);
+      break;
+    }
+
+    // The profiler's critical section ends here.  After this point, none of the
+    // critical section limitations documented above apply.
+    //
+    // WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
+  }
+
+  // This isn't strictly necessary, but doing so does help pick up anomalies
+  // in which the signal handler is running when it shouldn't be.
+  sSigHandlerCoordinator = nullptr;
+}
+
+// END Sampler target specifics
+////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN SamplerThread target specifics
+
+static void* ThreadEntry(void* aArg) {
+  auto thread = static_cast<SamplerThread*>(aArg);
+  thread->Run();
+  return nullptr;
+}
+
+SamplerThread::SamplerThread(PSLockRef aLock, uint32_t aActivityGeneration,
+                             double aIntervalMilliseconds)
+    : mSampler(aLock),
+      mActivityGeneration(aActivityGeneration),
+      mIntervalMicroseconds(
+          std::max(1, int(floor(aIntervalMilliseconds * 1000 + 0.5)))) {
+#if defined(USE_LUL_STACKWALK)
+  lul::LUL* lul = CorePS::Lul(aLock);
+  if (!lul) {
+    CorePS::SetLul(aLock, MakeUnique<lul::LUL>(logging_sink_for_LUL));
+    // Read all the unwind info currently available.
+    lul = CorePS::Lul(aLock);
+    read_procmaps(lul);
+
+    // Switch into unwind mode. After this point, we can't add or remove any
+    // unwind info to/from this LUL instance. The only thing we can do with
+    // it is Unwind() calls.
+    lul->EnableUnwinding();
+
+    // Has a test been requested?
+    if (PR_GetEnv("MOZ_PROFILER_LUL_TEST")) {
+      int nTests = 0, nTestsPassed = 0;
+      RunLulUnitTests(&nTests, &nTestsPassed, lul);
+    }
+  }
+#endif
+
+  // Start the sampling thread. It repeatedly sends a SIGPROF signal. Sending
+  // the signal ourselves instead of relying on itimer provides much better
+  // accuracy.
+  //
+  // At least 350 KiB of stack space are needed when built with TSAN. This
+  // includes lul::N_STACK_BYTES plus whatever else is needed for the sampler
+  // thread. Set the stack size to 800 KiB to keep a safe margin above that.
+  pthread_attr_t attr;
+  if (pthread_attr_init(&attr) != 0 ||
+      pthread_attr_setstacksize(&attr, 800 * 1024) != 0 ||
+      pthread_create(&mThread, &attr, ThreadEntry, this) != 0) {
+    MOZ_CRASH("pthread_create failed");
+  }
+  pthread_attr_destroy(&attr);
+}
+
+SamplerThread::~SamplerThread() {
+  pthread_join(mThread, nullptr);
+  // Just in the unlikely case some callbacks were added between the end of the
+  // thread and now.
+  InvokePostSamplingCallbacks(std::move(mPostSamplingCallbackList),
+                              SamplingState::JustStopped);
+}
+
+void SamplerThread::SleepMicro(uint32_t aMicroseconds) {
+  if (aMicroseconds >= 1000000) {
+    // Use usleep for larger intervals, because the nanosleep
+    // code below only supports intervals < 1 second.
+    MOZ_ALWAYS_TRUE(!::usleep(aMicroseconds));
+    return;
+  }
+
+  struct timespec ts;
+  ts.tv_sec = 0;
+  ts.tv_nsec = aMicroseconds * 1000UL;
+
+  int rv = ::nanosleep(&ts, &ts);
+
+  while (rv != 0 && errno == EINTR) {
+    // Keep waiting in case of interrupt.
+    // nanosleep puts the remaining time back into ts.
+    rv = ::nanosleep(&ts, &ts);
+  }
+
+  MOZ_ASSERT(!rv, "nanosleep call failed");
+}
+
+void SamplerThread::Stop(PSLockRef aLock) {
+  // Restore old signal handler. This is global state so it's important that
+  // we do it now, while gPSMutex is locked. It's safe to do this now even
+  // though this SamplerThread is still alive, because the next time the main
+  // loop of Run() iterates it won't get past the mActivityGeneration check,
+  // and so won't send any signals.
+  mSampler.Disable(aLock);
+}
+
+// END SamplerThread target specifics
+////////////////////////////////////////////////////////////////////////
+
+#if defined(GP_OS_linux) || defined(GP_OS_freebsd)
+
+// We use pthread_atfork() to temporarily disable signal delivery during any
+// fork() call. Without that, fork() can be repeatedly interrupted by signal
+// delivery, requiring it to be repeatedly restarted, which can lead to *long*
+// delays. See bug 837390.
+//
+// We provide no paf_child() function to run in the child after forking. This
+// is fine because we always immediately exec() after fork(), and exec()
+// clobbers all process state. (At one point we did have a paf_child()
+// function, but it caused problems related to locking gPSMutex. See bug
+// 1348374.)
+//
+// Unfortunately all this is only doable on non-Android because Bionic doesn't
+// have pthread_atfork.
+
+// In the parent, before the fork, record IsSamplingPaused, and then pause.
+static void paf_prepare() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  if (ActivePS::Exists(lock)) {
+    ActivePS::SetWasSamplingPaused(lock, ActivePS::IsSamplingPaused(lock));
+    ActivePS::SetIsSamplingPaused(lock, true);
+  }
+}
+
+// In the parent, after the fork, return IsSamplingPaused to the pre-fork state.
+static void paf_parent() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  if (ActivePS::Exists(lock)) {
+    ActivePS::SetIsSamplingPaused(lock, ActivePS::WasSamplingPaused(lock));
+    ActivePS::SetWasSamplingPaused(lock, false);
+  }
+}
+
+static void PlatformInit(PSLockRef aLock) {
+  // Set up the fork handlers.
+  pthread_atfork(paf_prepare, paf_parent, nullptr);
+}
+
+#else
+
+static void PlatformInit(PSLockRef aLock) {}
+
+#endif
+
+#if defined(HAVE_NATIVE_UNWIND)
+// Context used by synchronous samples. It's safe to have a single one because
+// only one synchronous sample can be taken at a time (due to
+// profiler_get_backtrace()'s PSAutoLock).
+ucontext_t sSyncUContext;
+
+void Registers::SyncPopulate() {
+  if (!getcontext(&sSyncUContext)) {
+    PopulateRegsFromContext(*this, &sSyncUContext);
+  }
+}
+#endif
diff --git a/tools/profiler/core/platform-macos.cpp b/tools/profiler/core/platform-macos.cpp
new file mode 100644
index 0000000000..d0b44076c3
--- /dev/null
+++ b/tools/profiler/core/platform-macos.cpp
@@ -0,0 +1,279 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <unistd.h>
+#include <sys/mman.h>
+#include <mach/mach_init.h>
+#include <mach-o/getsect.h>
+
+#include <AvailabilityMacros.h>
+
+#include <pthread.h>
+#include <semaphore.h>
+#include <signal.h>
+#include <libkern/OSAtomic.h>
+#include <libproc.h>
+#include <mach/mach.h>
+#include <mach/semaphore.h>
+#include <mach/task.h>
+#include <mach/thread_act.h>
+#include <mach/vm_statistics.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <sys/sysctl.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <math.h>
+
+// this port is based off of v8 svn revision 9837
+
+int profiler_current_process_id() { return getpid(); }
+
+int profiler_current_thread_id() {
+  return static_cast<int>(static_cast<pid_t>(syscall(SYS_thread_selfid)));
+}
+
+void* GetStackTop(void* aGuess) {
+  pthread_t thread = pthread_self();
+  return pthread_get_stackaddr_np(thread);
+}
+
+class PlatformData {
+ public:
+  explicit PlatformData(int aThreadId) : mProfiledThread(mach_thread_self()) {
+    MOZ_COUNT_CTOR(PlatformData);
+  }
+
+  ~PlatformData() {
+    // Deallocate Mach port for thread.
+    mach_port_deallocate(mach_task_self(), mProfiledThread);
+
+    MOZ_COUNT_DTOR(PlatformData);
+  }
+
+  thread_act_t ProfiledThread() const { return mProfiledThread; }
+
+  RunningTimes& PreviousThreadRunningTimesRef() {
+    return mPreviousThreadRunningTimes;
+  }
+
+ private:
+  // Note: for mProfiledThread Mach primitives are used instead of pthread's
+  // because the latter doesn't provide thread manipulation primitives required.
+  // For details, consult "Mac OS X Internals" book, Section 7.3.
+  thread_act_t mProfiledThread;
+  RunningTimes mPreviousThreadRunningTimes;
+};
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN Sampler target specifics
+
+Sampler::Sampler(PSLockRef aLock) {}
+
+void Sampler::Disable(PSLockRef aLock) {}
+
+static void StreamMetaPlatformSampleUnits(PSLockRef aLock,
+                                          SpliceableJSONWriter& aWriter) {
+  // Microseconds.
+  aWriter.StringProperty("threadCPUDelta", "\u00B5s");
+}
+
+static RunningTimes GetThreadRunningTimesDiff(
+    PSLockRef aLock, const RegisteredThread& aRegisteredThread) {
+  AUTO_PROFILER_STATS(GetRunningTimes);
+
+  PlatformData* platformData = aRegisteredThread.GetPlatformData();
+  MOZ_RELEASE_ASSERT(platformData);
+
+  const RunningTimes newRunningTimes = GetRunningTimesWithTightTimestamp(
+      [platformData](RunningTimes& aRunningTimes) {
+        AUTO_PROFILER_STATS(GetRunningTimes_thread_info);
+        thread_basic_info_data_t threadBasicInfo;
+        mach_msg_type_number_t basicCount = THREAD_BASIC_INFO_COUNT;
+        if (thread_info(platformData->ProfiledThread(), THREAD_BASIC_INFO,
+                        reinterpret_cast<thread_info_t>(&threadBasicInfo),
+                        &basicCount) == KERN_SUCCESS &&
+            basicCount == THREAD_BASIC_INFO_COUNT) {
+          uint64_t userTimeUs =
+              uint64_t(threadBasicInfo.user_time.seconds) *
+                  uint64_t(USEC_PER_SEC) +
+              uint64_t(threadBasicInfo.user_time.microseconds);
+          uint64_t systemTimeUs =
+              uint64_t(threadBasicInfo.system_time.seconds) *
+                  uint64_t(USEC_PER_SEC) +
+              uint64_t(threadBasicInfo.system_time.microseconds);
+          aRunningTimes.ResetThreadCPUDelta(userTimeUs + systemTimeUs);
+        } else {
+          aRunningTimes.ClearThreadCPUDelta();
+        }
+      });
+
+  const RunningTimes diff =
+      newRunningTimes - platformData->PreviousThreadRunningTimesRef();
+  platformData->PreviousThreadRunningTimesRef() = newRunningTimes;
+  return diff;
+}
+
+template <typename Func>
+void Sampler::SuspendAndSampleAndResumeThread(
+    PSLockRef aLock, const RegisteredThread& aRegisteredThread,
+    const TimeStamp& aNow, const Func& aProcessRegs) {
+  thread_act_t samplee_thread =
+      aRegisteredThread.GetPlatformData()->ProfiledThread();
+
+  //----------------------------------------------------------------//
+  // Suspend the samplee thread and get its context.
+
+  // We're using thread_suspend on OS X because pthread_kill (which is what we
+  // at one time used on Linux) has less consistent performance and causes
+  // strange crashes, see bug 1166778 and bug 1166808.  thread_suspend
+  // is also just a lot simpler to use.
+
+  if (KERN_SUCCESS != thread_suspend(samplee_thread)) {
+    return;
+  }
+
+  //----------------------------------------------------------------//
+  // Sample the target thread.
+
+  // WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
+  //
+  // The profiler's "critical section" begins here.  We must be very careful
+  // what we do here, or risk deadlock.  See the corresponding comment in
+  // platform-linux-android.cpp for details.
+
+#if defined(__x86_64__)
+  thread_state_flavor_t flavor = x86_THREAD_STATE64;
+  x86_thread_state64_t state;
+  mach_msg_type_number_t count = x86_THREAD_STATE64_COUNT;
+#  if __DARWIN_UNIX03
+#    define REGISTER_FIELD(name) __r##name
+#  else
+#    define REGISTER_FIELD(name) r##name
+#  endif  // __DARWIN_UNIX03
+#elif defined(__aarch64__)
+  thread_state_flavor_t flavor = ARM_THREAD_STATE64;
+  arm_thread_state64_t state;
+  mach_msg_type_number_t count = ARM_THREAD_STATE64_COUNT;
+#  if __DARWIN_UNIX03
+#    define REGISTER_FIELD(name) __##name
+#  else
+#    define REGISTER_FIELD(name) name
+#  endif  // __DARWIN_UNIX03
+#else
+#  error "unknown architecture"
+#endif
+
+  if (thread_get_state(samplee_thread, flavor,
+                       reinterpret_cast<natural_t*>(&state),
+                       &count) == KERN_SUCCESS) {
+    Registers regs;
+#if defined(__x86_64__)
+    regs.mPC = reinterpret_cast<Address>(state.REGISTER_FIELD(ip));
+    regs.mSP = reinterpret_cast<Address>(state.REGISTER_FIELD(sp));
+    regs.mFP = reinterpret_cast<Address>(state.REGISTER_FIELD(bp));
+#elif defined(__aarch64__)
+    regs.mPC = reinterpret_cast<Address>(state.REGISTER_FIELD(pc));
+    regs.mSP = reinterpret_cast<Address>(state.REGISTER_FIELD(sp));
+    regs.mFP = reinterpret_cast<Address>(state.REGISTER_FIELD(fp));
+#else
+#  error "unknown architecture"
+#endif
+    regs.mLR = 0;
+
+    aProcessRegs(regs, aNow);
+  }
+
+#undef REGISTER_FIELD
+
+  //----------------------------------------------------------------//
+  // Resume the target thread.
+
+  thread_resume(samplee_thread);
+
+  // The profiler's critical section ends here.
+  //
+  // WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
+}
+
+// END Sampler target specifics
+////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN SamplerThread target specifics
+
+static void* ThreadEntry(void* aArg) {
+  auto thread = static_cast<SamplerThread*>(aArg);
+  thread->Run();
+  return nullptr;
+}
+
+SamplerThread::SamplerThread(PSLockRef aLock, uint32_t aActivityGeneration,
+                             double aIntervalMilliseconds)
+    : mSampler(aLock),
+      mActivityGeneration(aActivityGeneration),
+      mIntervalMicroseconds(
+          std::max(1, int(floor(aIntervalMilliseconds * 1000 + 0.5)))),
+      mThread{nullptr} {
+  pthread_attr_t* attr_ptr = nullptr;
+  if (pthread_create(&mThread, attr_ptr, ThreadEntry, this) != 0) {
+    MOZ_CRASH("pthread_create failed");
+  }
+}
+
+SamplerThread::~SamplerThread() {
+  pthread_join(mThread, nullptr);
+  // Just in the unlikely case some callbacks were added between the end of the
+  // thread and now.
+  InvokePostSamplingCallbacks(std::move(mPostSamplingCallbackList),
+                              SamplingState::JustStopped);
+}
+
+void SamplerThread::SleepMicro(uint32_t aMicroseconds) {
+  usleep(aMicroseconds);
+  // FIXME: the OSX 10.12 page for usleep says "The usleep() function is
+  // obsolescent.  Use nanosleep(2) instead."  This implementation could be
+  // merged with the linux-android version.  Also, this doesn't handle the
+  // case where the usleep call is interrupted by a signal.
+}
+
+void SamplerThread::Stop(PSLockRef aLock) { mSampler.Disable(aLock); }
+
+// END SamplerThread target specifics
+////////////////////////////////////////////////////////////////////////
+
+static void PlatformInit(PSLockRef aLock) {}
+
+#if defined(HAVE_NATIVE_UNWIND)
+void Registers::SyncPopulate() {
+#  if defined(__x86_64__)
+  asm(
+      // Compute caller's %rsp by adding to %rbp:
+      // 8 bytes for previous %rbp, 8 bytes for return address
+      "leaq 0x10(%%rbp), %0\n\t"
+      // Dereference %rbp to get previous %rbp
+      "movq (%%rbp), %1\n\t"
+      : "=r"(mSP), "=r"(mFP));
+#  elif defined(__aarch64__)
+  asm(
+      // Compute caller's sp by adding to fp:
+      // 8 bytes for previous fp, 8 bytes for return address
+      "add %0, x29, #0x10\n\t"
+      // Dereference fp to get previous fp
+      "ldr %1, [x29]\n\t"
+      : "=r"(mSP), "=r"(mFP));
+#  else
+#    error "unknown architecture"
+#  endif
+  mPC = reinterpret_cast<Address>(
+      __builtin_extract_return_addr(__builtin_return_address(0)));
+  mLR = 0;
+}
+#endif
diff --git a/tools/profiler/core/platform-win32.cpp b/tools/profiler/core/platform-win32.cpp
new file mode 100644
index 0000000000..5b0b72aa59
--- /dev/null
+++ b/tools/profiler/core/platform-win32.cpp
@@ -0,0 +1,336 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2011 The Chromium Authors. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+//  * Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+//  * Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in
+//    the documentation and/or other materials provided with the
+//    distribution.
+//  * Neither the name of Google, Inc. nor the names of its contributors
+//    may be used to endorse or promote products derived from this
+//    software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+// COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+// INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+// BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+// OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+// AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+// OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+// SUCH DAMAGE.
+
+#include <windows.h>
+#include <mmsystem.h>
+#include <process.h>
+
+#include "nsWindowsDllInterceptor.h"
+#include "mozilla/StackWalk_windows.h"
+#include "mozilla/WindowsVersion.h"
+
+int profiler_current_process_id() { return _getpid(); }
+
+int profiler_current_thread_id() {
+  DWORD threadId = GetCurrentThreadId();
+  MOZ_ASSERT(threadId <= INT32_MAX, "native thread ID is > INT32_MAX");
+  return int(threadId);
+}
+
+void* GetStackTop(void* aGuess) {
+  PNT_TIB pTib = reinterpret_cast<PNT_TIB>(NtCurrentTeb());
+  return reinterpret_cast<void*>(pTib->StackBase);
+}
+
+static void PopulateRegsFromContext(Registers& aRegs, CONTEXT* aContext) {
+#if defined(GP_ARCH_amd64)
+  aRegs.mPC = reinterpret_cast<Address>(aContext->Rip);
+  aRegs.mSP = reinterpret_cast<Address>(aContext->Rsp);
+  aRegs.mFP = reinterpret_cast<Address>(aContext->Rbp);
+#elif defined(GP_ARCH_x86)
+  aRegs.mPC = reinterpret_cast<Address>(aContext->Eip);
+  aRegs.mSP = reinterpret_cast<Address>(aContext->Esp);
+  aRegs.mFP = reinterpret_cast<Address>(aContext->Ebp);
+#elif defined(GP_ARCH_arm64)
+  aRegs.mPC = reinterpret_cast<Address>(aContext->Pc);
+  aRegs.mSP = reinterpret_cast<Address>(aContext->Sp);
+  aRegs.mFP = reinterpret_cast<Address>(aContext->Fp);
+#else
+#  error "bad arch"
+#endif
+  aRegs.mLR = 0;
+}
+
+// Gets a real (i.e. not pseudo) handle for the current thread, with the
+// permissions needed for profiling.
+// @return a real HANDLE for the current thread.
+static HANDLE GetRealCurrentThreadHandleForProfiling() {
+  HANDLE realCurrentThreadHandle;
+  if (!::DuplicateHandle(
+          ::GetCurrentProcess(), ::GetCurrentThread(), ::GetCurrentProcess(),
+          &realCurrentThreadHandle,
+          THREAD_GET_CONTEXT | THREAD_SUSPEND_RESUME | THREAD_QUERY_INFORMATION,
+          FALSE, 0)) {
+    return nullptr;
+  }
+
+  return realCurrentThreadHandle;
+}
+
+class PlatformData {
+ public:
+  // Get a handle to the calling thread. This is the thread that we are
+  // going to profile. We need a real handle because we are going to use it in
+  // the sampler thread.
+  explicit PlatformData(int aThreadId)
+      : mProfiledThread(GetRealCurrentThreadHandleForProfiling()) {
+    MOZ_ASSERT(aThreadId == ::GetCurrentThreadId());
+    MOZ_COUNT_CTOR(PlatformData);
+  }
+
+  ~PlatformData() {
+    if (mProfiledThread != nullptr) {
+      CloseHandle(mProfiledThread);
+      mProfiledThread = nullptr;
+    }
+    MOZ_COUNT_DTOR(PlatformData);
+  }
+
+  HANDLE ProfiledThread() { return mProfiledThread; }
+
+  RunningTimes& PreviousThreadRunningTimesRef() {
+    return mPreviousThreadRunningTimes;
+  }
+
+ private:
+  HANDLE mProfiledThread;
+  RunningTimes mPreviousThreadRunningTimes;
+};
+
+#if defined(USE_MOZ_STACK_WALK)
+HANDLE
+GetThreadHandle(PlatformData* aData) { return aData->ProfiledThread(); }
+#endif
+
+static const HANDLE kNoThread = INVALID_HANDLE_VALUE;
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN Sampler target specifics
+
+Sampler::Sampler(PSLockRef aLock) {}
+
+void Sampler::Disable(PSLockRef aLock) {}
+
+static void StreamMetaPlatformSampleUnits(PSLockRef aLock,
+                                          SpliceableJSONWriter& aWriter) {
+  aWriter.StringProperty("threadCPUDelta", "variable CPU cycles");
+}
+
+static RunningTimes GetThreadRunningTimesDiff(
+    PSLockRef aLock, const RegisteredThread& aRegisteredThread) {
+  AUTO_PROFILER_STATS(GetRunningTimes);
+
+  PlatformData* const platformData = aRegisteredThread.GetPlatformData();
+  MOZ_RELEASE_ASSERT(platformData);
+  const HANDLE profiledThread = platformData->ProfiledThread();
+
+  const RunningTimes newRunningTimes = GetRunningTimesWithTightTimestamp(
+      [profiledThread](RunningTimes& aRunningTimes) {
+        AUTO_PROFILER_STATS(GetRunningTimes_QueryThreadCycleTime);
+        if (ULONG64 cycles;
+            QueryThreadCycleTime(profiledThread, &cycles) != 0) {
+          aRunningTimes.ResetThreadCPUDelta(cycles);
+        } else {
+          aRunningTimes.ClearThreadCPUDelta();
+        }
+      });
+
+  const RunningTimes diff =
+      newRunningTimes - platformData->PreviousThreadRunningTimesRef();
+  platformData->PreviousThreadRunningTimesRef() = newRunningTimes;
+  return diff;
+}
+
+template <typename Func>
+void Sampler::SuspendAndSampleAndResumeThread(
+    PSLockRef aLock, const RegisteredThread& aRegisteredThread,
+    const TimeStamp& aNow, const Func& aProcessRegs) {
+  HANDLE profiled_thread =
+      aRegisteredThread.GetPlatformData()->ProfiledThread();
+  if (profiled_thread == nullptr) {
+    return;
+  }
+
+  // Context used for sampling the register state of the profiled thread.
+  CONTEXT context;
+  memset(&context, 0, sizeof(context));
+
+  //----------------------------------------------------------------//
+  // Suspend the samplee thread and get its context.
+
+  static const DWORD kSuspendFailed = static_cast<DWORD>(-1);
+  if (SuspendThread(profiled_thread) == kSuspendFailed) {
+    return;
+  }
+
+  // SuspendThread is asynchronous, so the thread may still be running.
+  // Call GetThreadContext first to ensure the thread is really suspended.
+  // See https://blogs.msdn.microsoft.com/oldnewthing/20150205-00/?p=44743.
+
+  // Using only CONTEXT_CONTROL is faster but on 64-bit it causes crashes in
+  // RtlVirtualUnwind (see bug 1120126) so we set all the flags.
+#if defined(GP_ARCH_amd64)
+  context.ContextFlags = CONTEXT_FULL;
+#else
+  context.ContextFlags = CONTEXT_CONTROL;
+#endif
+  if (!GetThreadContext(profiled_thread, &context)) {
+    ResumeThread(profiled_thread);
+    return;
+  }
+
+  //----------------------------------------------------------------//
+  // Sample the target thread.
+
+  // WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
+  //
+  // The profiler's "critical section" begins here.  We must be very careful
+  // what we do here, or risk deadlock.  See the corresponding comment in
+  // platform-linux-android.cpp for details.
+
+  Registers regs;
+  PopulateRegsFromContext(regs, &context);
+  aProcessRegs(regs, aNow);
+
+  //----------------------------------------------------------------//
+  // Resume the target thread.
+
+  ResumeThread(profiled_thread);
+
+  // The profiler's critical section ends here.
+  //
+  // WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
+}
+
+// END Sampler target specifics
+////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN SamplerThread target specifics
+
+static unsigned int __stdcall ThreadEntry(void* aArg) {
+  auto thread = static_cast<SamplerThread*>(aArg);
+  thread->Run();
+  return 0;
+}
+
+SamplerThread::SamplerThread(PSLockRef aLock, uint32_t aActivityGeneration,
+                             double aIntervalMilliseconds)
+    : mSampler(aLock),
+      mActivityGeneration(aActivityGeneration),
+      mIntervalMicroseconds(
+          std::max(1, int(floor(aIntervalMilliseconds * 1000 + 0.5)))) {
+  // By default we'll not adjust the timer resolution which tends to be
+  // around 16ms. However, if the requested interval is sufficiently low
+  // we'll try to adjust the resolution to match.
+  if (mIntervalMicroseconds < 10 * 1000) {
+    ::timeBeginPeriod(mIntervalMicroseconds / 1000);
+  }
+
+  // Create a new thread. It is important to use _beginthreadex() instead of
+  // the Win32 function CreateThread(), because the CreateThread() does not
+  // initialize thread-specific structures in the C runtime library.
+  mThread = reinterpret_cast<HANDLE>(_beginthreadex(nullptr,
+                                                    /* stack_size */ 0,
+                                                    ThreadEntry, this,
+                                                    /* initflag */ 0, nullptr));
+  if (mThread == 0) {
+    MOZ_CRASH("_beginthreadex failed");
+  }
+}
+
+SamplerThread::~SamplerThread() {
+  WaitForSingleObject(mThread, INFINITE);
+
+  // Close our own handle for the thread.
+  if (mThread != kNoThread) {
+    CloseHandle(mThread);
+  }
+
+  // Just in the unlikely case some callbacks were added between the end of the
+  // thread and now.
+  InvokePostSamplingCallbacks(std::move(mPostSamplingCallbackList),
+                              SamplingState::JustStopped);
+}
+
+void SamplerThread::SleepMicro(uint32_t aMicroseconds) {
+  // For now, keep the old behaviour of minimum Sleep(1), even for
+  // smaller-than-usual sleeps after an overshoot, unless the user has
+  // explicitly opted into a sub-millisecond profiler interval.
+  if (mIntervalMicroseconds >= 1000) {
+    ::Sleep(std::max(1u, aMicroseconds / 1000));
+  } else {
+    TimeStamp start = TimeStamp::NowUnfuzzed();
+    TimeStamp end = start + TimeDuration::FromMicroseconds(aMicroseconds);
+
+    // First, sleep for as many whole milliseconds as possible.
+    if (aMicroseconds >= 1000) {
+      ::Sleep(aMicroseconds / 1000);
+    }
+
+    // Then, spin until enough time has passed.
+    while (TimeStamp::NowUnfuzzed() < end) {
+      YieldProcessor();
+    }
+  }
+}
+
+void SamplerThread::Stop(PSLockRef aLock) {
+  // Disable any timer resolution changes we've made. Do it now while
+  // gPSMutex is locked, i.e. before any other SamplerThread can be created
+  // and call ::timeBeginPeriod().
+  //
+  // It's safe to do this now even though this SamplerThread is still alive,
+  // because the next time the main loop of Run() iterates it won't get past
+  // the mActivityGeneration check, and so it won't make any more ::Sleep()
+  // calls.
+  if (mIntervalMicroseconds < 10 * 1000) {
+    ::timeEndPeriod(mIntervalMicroseconds / 1000);
+  }
+
+  mSampler.Disable(aLock);
+}
+
+// END SamplerThread target specifics
+////////////////////////////////////////////////////////////////////////
+
+static void PlatformInit(PSLockRef aLock) {}
+
+#if defined(HAVE_NATIVE_UNWIND)
+void Registers::SyncPopulate() {
+  CONTEXT context;
+  RtlCaptureContext(&context);
+  PopulateRegsFromContext(*this, &context);
+}
+#endif
+
+#if defined(GP_PLAT_amd64_windows)
+
+// Use InitializeWin64ProfilerHooks from the base profiler.
+
+namespace mozilla {
+namespace baseprofiler {
+MFBT_API void InitializeWin64ProfilerHooks();
+}  // namespace baseprofiler
+}  // namespace mozilla
+
+using mozilla::baseprofiler::InitializeWin64ProfilerHooks;
+
+#endif  // defined(GP_PLAT_amd64_windows)
diff --git a/tools/profiler/core/platform.cpp b/tools/profiler/core/platform.cpp
new file mode 100644
index 0000000000..9b193535d9
--- /dev/null
+++ b/tools/profiler/core/platform.cpp
@@ -0,0 +1,5894 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// There are three kinds of samples done by the profiler.
+//
+// - A "periodic" sample is the most complex kind. It is done in response to a
+//   timer while the profiler is active. It involves writing a stack trace plus
+//   a variety of other values (memory measurements, responsiveness
+//   measurements, markers, etc.) into the main ProfileBuffer. The sampling is
+//   done from off-thread, and so SuspendAndSampleAndResumeThread() is used to
+//   get the register values.
+//
+// - A "synchronous" sample is a simpler kind. It is done in response to an API
+//   call (profiler_get_backtrace()). It involves writing a stack trace and
+//   little else into a temporary ProfileBuffer, and wrapping that up in a
+//   ProfilerBacktrace that can be subsequently used in a marker. The sampling
+//   is done on-thread, and so Registers::SyncPopulate() is used to get the
+//   register values.
+//
+// - A "backtrace" sample is the simplest kind. It is done in response to an
+//   API call (profiler_suspend_and_sample_thread()). It involves getting a
+//   stack trace via a ProfilerStackCollector; it does not write to a
+//   ProfileBuffer. The sampling is done from off-thread, and so uses
+//   SuspendAndSampleAndResumeThread() to get the register values.
+
+#include "platform.h"
+
+#include "GeckoProfiler.h"
+#include "GeckoProfilerReporter.h"
+#include "PageInformation.h"
+#include "ProfileBuffer.h"
+#include "ProfiledThreadData.h"
+#include "ProfilerBacktrace.h"
+#include "ProfilerChild.h"
+#include "ProfilerCodeAddressService.h"
+#include "ProfilerIOInterposeObserver.h"
+#include "ProfilerParent.h"
+#include "RegisteredThread.h"
+#include "shared-libraries.h"
+#include "ThreadInfo.h"
+#include "VTuneProfiler.h"
+
+#include "js/TraceLoggerAPI.h"
+#include "js/ProfilingFrameIterator.h"
+#include "memory_hooks.h"
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/Atomics.h"
+#include "mozilla/AutoProfilerLabel.h"
+#include "mozilla/ExtensionPolicyService.h"
+#include "mozilla/extensions/WebExtensionPolicy.h"
+#include "mozilla/net/HttpBaseChannel.h"  // for net::TimingStruct
+#include "mozilla/Printf.h"
+#include "mozilla/ProfileBufferChunkManagerSingle.h"
+#include "mozilla/ProfileBufferChunkManagerWithLocalLimit.h"
+#include "mozilla/ProfileChunkedBuffer.h"
+#include "mozilla/SchedulerGroup.h"
+#include "mozilla/Services.h"
+#include "mozilla/StackWalk.h"
+#include "mozilla/StaticPtr.h"
+#include "mozilla/ThreadLocal.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/Tuple.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Vector.h"
+#include "BaseProfiler.h"
+#include "nsDirectoryServiceDefs.h"
+#include "nsDirectoryServiceUtils.h"
+#include "nsIDocShell.h"
+#include "nsIHttpProtocolHandler.h"
+#include "nsIObserverService.h"
+#include "nsIPropertyBag2.h"
+#include "nsIXULAppInfo.h"
+#include "nsIXULRuntime.h"
+#include "nsJSPrincipals.h"
+#include "nsMemoryReporterManager.h"
+#include "nsProfilerStartParams.h"
+#include "nsScriptSecurityManager.h"
+#include "nsSystemInfo.h"
+#include "nsThreadUtils.h"
+#include "nsXULAppAPI.h"
+#include "Tracing.h"
+#include "prdtoa.h"
+#include "prtime.h"
+
+#include <algorithm>
+#include <errno.h>
+#include <fstream>
+#include <ostream>
+#include <set>
+#include <sstream>
+#include <type_traits>
+
+#ifdef MOZ_TASK_TRACER
+#  include "GeckoTaskTracer.h"
+#endif
+
+#if defined(GP_OS_android)
+#  include "mozilla/java/GeckoJavaSamplerNatives.h"
+#endif
+
+// Win32 builds always have frame pointers, so FramePointerStackWalk() always
+// works.
+#if defined(GP_PLAT_x86_windows)
+#  define HAVE_NATIVE_UNWIND
+#  define USE_FRAME_POINTER_STACK_WALK
+#endif
+
+// Win64 builds always omit frame pointers, so we use the slower
+// MozStackWalk(), which works in that case.
+#if defined(GP_PLAT_amd64_windows)
+#  define HAVE_NATIVE_UNWIND
+#  define USE_MOZ_STACK_WALK
+#endif
+
+// AArch64 Win64 doesn't seem to use frame pointers, so we use the slower
+// MozStackWalk().
+#if defined(GP_PLAT_arm64_windows)
+#  define HAVE_NATIVE_UNWIND
+#  define USE_MOZ_STACK_WALK
+#endif
+
+// Mac builds only have frame pointers when MOZ_PROFILING is specified, so
+// FramePointerStackWalk() only works in that case. We don't use MozStackWalk()
+// on Mac.
+#if defined(GP_OS_darwin) && defined(MOZ_PROFILING)
+#  define HAVE_NATIVE_UNWIND
+#  define USE_FRAME_POINTER_STACK_WALK
+#endif
+
+// Android builds use the ARM Exception Handling ABI to unwind.
+#if defined(GP_PLAT_arm_linux) || defined(GP_PLAT_arm_android)
+#  define HAVE_NATIVE_UNWIND
+#  define USE_EHABI_STACKWALK
+#  include "EHABIStackWalk.h"
+#endif
+
+// Linux/BSD builds use LUL, which uses DWARF info to unwind stacks.
+#if defined(GP_PLAT_amd64_linux) || defined(GP_PLAT_x86_linux) ||       \
+    defined(GP_PLAT_amd64_android) || defined(GP_PLAT_x86_android) ||   \
+    defined(GP_PLAT_mips64_linux) || defined(GP_PLAT_arm64_linux) ||    \
+    defined(GP_PLAT_arm64_android) || defined(GP_PLAT_amd64_freebsd) || \
+    defined(GP_PLAT_arm64_freebsd)
+#  define HAVE_NATIVE_UNWIND
+#  define USE_LUL_STACKWALK
+#  include "lul/LulMain.h"
+#  include "lul/platform-linux-lul.h"
+
+// On linux we use LUL for periodic samples and synchronous samples, but we use
+// FramePointerStackWalk for backtrace samples when MOZ_PROFILING is enabled.
+// (See the comment at the top of the file for a definition of
+// periodic/synchronous/backtrace.).
+//
+// FramePointerStackWalk can produce incomplete stacks when the current entry is
+// in a shared library without framepointers, however LUL can take a long time
+// to initialize, which is undesirable for consumers of
+// profiler_suspend_and_sample_thread like the Background Hang Reporter.
+#  if defined(MOZ_PROFILING)
+#    define USE_FRAME_POINTER_STACK_WALK
+#  endif
+#endif
+
+// We can only stackwalk without expensive initialization on platforms which
+// support FramePointerStackWalk or MozStackWalk. LUL Stackwalking requires
+// initializing LUL, and EHABIStackWalk requires initializing EHABI, both of
+// which can be expensive.
+#if defined(USE_FRAME_POINTER_STACK_WALK) || defined(USE_MOZ_STACK_WALK)
+#  define HAVE_FASTINIT_NATIVE_UNWIND
+#endif
+
+#ifdef MOZ_VALGRIND
+#  include <valgrind/memcheck.h>
+#else
+#  define VALGRIND_MAKE_MEM_DEFINED(_addr, _len) ((void)0)
+#endif
+
+#if defined(GP_OS_linux) || defined(GP_OS_android) || defined(GP_OS_freebsd)
+#  include <ucontext.h>
+#endif
+
+using namespace mozilla;
+using mozilla::profiler::detail::RacyFeatures;
+
+LazyLogModule gProfilerLog("prof");
+
+// Statically initialized to 0, then set once from profiler_init(), which should
+// be called from the main thread before any other use of the profiler.
+int scProfilerMainThreadId;
+
+#if defined(GP_OS_android)
+class GeckoJavaSampler
+    : public java::GeckoJavaSampler::Natives<GeckoJavaSampler> {
+ private:
+  GeckoJavaSampler();
+
+ public:
+  static double GetProfilerTime() {
+    if (!profiler_is_active()) {
+      return 0.0;
+    }
+    return profiler_time();
+  };
+};
+#endif
+
+constexpr static bool ValidateFeatures() {
+  int expectedFeatureNumber = 0;
+
+  // Feature numbers should start at 0 and increase by 1 each.
+#define CHECK_FEATURE(n_, str_, Name_, desc_) \
+  if ((n_) != expectedFeatureNumber) {        \
+    return false;                             \
+  }                                           \
+  ++expectedFeatureNumber;
+
+  PROFILER_FOR_EACH_FEATURE(CHECK_FEATURE)
+
+#undef CHECK_FEATURE
+
+  return true;
+}
+
+static_assert(ValidateFeatures(), "Feature list is invalid");
+
+// Return all features that are available on this platform.
+static uint32_t AvailableFeatures() {
+  uint32_t features = 0;
+
+#define ADD_FEATURE(n_, str_, Name_, desc_) \
+  ProfilerFeature::Set##Name_(features);
+
+  // Add all the possible features.
+  PROFILER_FOR_EACH_FEATURE(ADD_FEATURE)
+
+#undef ADD_FEATURE
+
+  // Now remove features not supported on this platform/configuration.
+#if !defined(GP_OS_android)
+  ProfilerFeature::ClearJava(features);
+#endif
+#if !defined(HAVE_NATIVE_UNWIND)
+  ProfilerFeature::ClearStackWalk(features);
+#endif
+#if !defined(MOZ_TASK_TRACER)
+  ProfilerFeature::ClearTaskTracer(features);
+#endif
+#if defined(MOZ_REPLACE_MALLOC) && defined(MOZ_PROFILER_MEMORY)
+  if (getenv("XPCOM_MEM_BLOAT_LOG")) {
+    NS_WARNING("XPCOM_MEM_BLOAT_LOG is set, disabling native allocations.");
+    // The memory hooks are available, but the bloat log is enabled, which is
+    // not compatible with the native allocations tracking. See the comment in
+    // enable_native_allocations() (tools/profiler/core/memory_hooks.cpp) for
+    // more information.
+    ProfilerFeature::ClearNativeAllocations(features);
+  }
+#else
+  // The memory hooks are not available.
+  ProfilerFeature::ClearNativeAllocations(features);
+#endif
+  if (!JS::TraceLoggerSupported()) {
+    ProfilerFeature::ClearJSTracer(features);
+  }
+
+  return features;
+}
+
+// Default features common to all contexts (even if not available).
+static uint32_t DefaultFeatures() {
+  return ProfilerFeature::Java | ProfilerFeature::JS | ProfilerFeature::Leaf |
+         ProfilerFeature::StackWalk | ProfilerFeature::Threads |
+         ProfilerFeature::Screenshots;
+}
+
+// Extra default features when MOZ_PROFILER_STARTUP is set (even if not
+// available).
+static uint32_t StartupExtraDefaultFeatures() {
+  // Enable CPUUtilization by default for startup profiles as it is useful to
+  // see when startup alternates between CPU intensive tasks and being blocked.
+  // Enable file I/Os by default for startup profiles as startup is heavy on
+  // I/O operations.
+  return ProfilerFeature::CPUUtilization | ProfilerFeature::FileIOAll;
+}
+
+// The class is a thin shell around mozglue PlatformMutex. It does not preserve
+// behavior in JS record/replay. It provides a mechanism to determine if it is
+// locked or not in order for memory hooks to avoid re-entering the profiler
+// locked state.
+class PSMutex : private ::mozilla::detail::MutexImpl {
+ public:
+  PSMutex() : ::mozilla::detail::MutexImpl() {}
+
+  void Lock() {
+    const int tid = profiler_current_thread_id();
+    MOZ_ASSERT(tid != 0);
+
+    // This is only designed to catch recursive locking:
+    // - If the current thread doesn't own the mutex, `mOwningThreadId` must be
+    //   zero or a different thread id written by another thread; it may change
+    //   again at any time, but never to the current thread's id.
+    // - If the current thread owns the mutex, `mOwningThreadId` must be its id.
+    MOZ_ASSERT(mOwningThreadId != tid);
+
+    ::mozilla::detail::MutexImpl::lock();
+
+    // We now hold the mutex, it should have been in the unlocked state before.
+    MOZ_ASSERT(mOwningThreadId == 0);
+    // And we can write our own thread id.
+    mOwningThreadId = tid;
+  }
+
+  [[nodiscard]] bool TryLock() {
+    const int tid = profiler_current_thread_id();
+    MOZ_ASSERT(tid != 0);
+
+    // This is only designed to catch recursive locking:
+    // - If the current thread doesn't own the mutex, `mOwningThreadId` must be
+    //   zero or a different thread id written by another thread; it may change
+    //   again at any time, but never to the current thread's id.
+    // - If the current thread owns the mutex, `mOwningThreadId` must be its id.
+    MOZ_ASSERT(mOwningThreadId != tid);
+
+    if (!::mozilla::detail::MutexImpl::tryLock()) {
+      // Failed to lock, nothing more to do.
+      return false;
+    }
+
+    // We now hold the mutex, it should have been in the unlocked state before.
+    MOZ_ASSERT(mOwningThreadId == 0);
+    // And we can write our own thread id.
+    mOwningThreadId = tid;
+
+    return true;
+  }
+
+  void Unlock() {
+    // This should never trigger! But check just in case something has gone
+    // very wrong (e.g., memory corruption).
+    AssertCurrentThreadOwns();
+
+    // We're still holding the mutex here, so it's safe to just reset
+    // `mOwningThreadId`.
+    mOwningThreadId = 0;
+
+    ::mozilla::detail::MutexImpl::unlock();
+  }
+
+  // Does the current thread own this mutex?
+  // False positive or false negatives are not possible:
+  // - If `true`, the current thread owns the mutex, it has written its own
+  //   `mOwningThreadId` when taking the lock, and no-one else can modify it
+  //   until the current thread itself unlocks the mutex.
+  // - If `false`, the current thread does not own the mutex, therefore either
+  //   `mOwningThreadId` is zero (unlocked), or it is a different thread id
+  //   written by another thread, but it can never be the current thread's id
+  //   until the current thread itself locks the mutex.
+  bool IsLockedOnCurrentThread() const {
+    return mOwningThreadId == profiler_current_thread_id();
+  }
+
+  void AssertCurrentThreadOwns() const {
+    MOZ_ASSERT(IsLockedOnCurrentThread());
+  }
+
+  void AssertCurrentThreadDoesNotOwn() const {
+    MOZ_ASSERT(!IsLockedOnCurrentThread());
+  }
+
+ private:
+  // Zero when unlocked, or the thread id of the owning thread.
+  // This should only be used to compare with the current thread id; any other
+  // number (0 or other id) could change at any time because the current thread
+  // wouldn't own the lock.
+  Atomic<int, MemoryOrdering::SequentiallyConsistent> mOwningThreadId{0};
+};
+
+// RAII class to lock the profiler mutex.
+class MOZ_RAII PSAutoLock {
+ public:
+  explicit PSAutoLock(PSMutex& aMutex) : mMutex(aMutex) { mMutex.Lock(); }
+  ~PSAutoLock() { mMutex.Unlock(); }
+
+ private:
+  // Allow PSAutoTryLock to call the following `PSAutoLock(PSMutex&, int)`
+  // constructor through `Maybe<const PSAutoLock>::emplace()`.
+  friend class Maybe<const PSAutoLock>;
+
+  // Special constructor taking an already-locked mutex. The `int` parameter is
+  // necessary to distinguish it from the main constructor.
+  PSAutoLock(PSMutex& aAlreadyLockedMutex, int) : mMutex(aAlreadyLockedMutex) {
+    mMutex.AssertCurrentThreadOwns();
+  }
+
+  PSMutex& mMutex;
+};
+
+// RAII class that attempts to lock the profiler mutex. Example usage:
+//   PSAutoTryLock tryLock(gPSMutex);
+//   if (tryLock.IsLocked()) { locked_foo(tryLock.LockRef()); }
+class MOZ_RAII PSAutoTryLock {
+ public:
+  explicit PSAutoTryLock(PSMutex& aMutex) {
+    if (aMutex.TryLock()) {
+      mMaybePSAutoLock.emplace(aMutex, 0);
+    }
+  }
+
+  // Return true if the mutex was aquired and locked.
+  [[nodiscard]] bool IsLocked() const { return mMaybePSAutoLock.isSome(); }
+
+  // Assuming the mutex is locked, return a reference to a `PSAutoLock` for that
+  // mutex, which can be passed as proof-of-lock.
+  [[nodiscard]] const PSAutoLock& LockRef() const {
+    MOZ_ASSERT(IsLocked());
+    return mMaybePSAutoLock.ref();
+  }
+
+ private:
+  // `mMaybePSAutoLock` is `Nothing` if locking failed, otherwise it contains a
+  // `const PSAutoLock` holding the locked mutex, and whose reference may be
+  // passed to functions expecting a proof-of-lock.
+  Maybe<const PSAutoLock> mMaybePSAutoLock;
+};
+
+// Only functions that take a PSLockRef arg can access CorePS's and ActivePS's
+// fields.
+typedef const PSAutoLock& PSLockRef;
+
+#define PS_GET(type_, name_)      \
+  static type_ name_(PSLockRef) { \
+    MOZ_ASSERT(sInstance);        \
+    return sInstance->m##name_;   \
+  }
+
+#define PS_GET_LOCKLESS(type_, name_) \
+  static type_ name_() {              \
+    MOZ_ASSERT(sInstance);            \
+    return sInstance->m##name_;       \
+  }
+
+#define PS_GET_AND_SET(type_, name_)                  \
+  PS_GET(type_, name_)                                \
+  static void Set##name_(PSLockRef, type_ a##name_) { \
+    MOZ_ASSERT(sInstance);                            \
+    sInstance->m##name_ = a##name_;                   \
+  }
+
+static const size_t MAX_JS_FRAMES = 1024;
+using JsFrameBuffer = JS::ProfilingFrameIterator::Frame[MAX_JS_FRAMES];
+
+// All functions in this file can run on multiple threads unless they have an
+// NS_IsMainThread() assertion.
+
+// This class contains the profiler's core global state, i.e. that which is
+// valid even when the profiler is not active. Most profile operations can't do
+// anything useful when this class is not instantiated, so we release-assert
+// its non-nullness in all such operations.
+//
+// Accesses to CorePS are guarded by gPSMutex. Getters and setters take a
+// PSAutoLock reference as an argument as proof that the gPSMutex is currently
+// locked. This makes it clear when gPSMutex is locked and helps avoid
+// accidental unlocked accesses to global state. There are ways to circumvent
+// this mechanism, but please don't do so without *very* good reason and a
+// detailed explanation.
+//
+// The exceptions to this rule:
+//
+// - mProcessStartTime, because it's immutable;
+//
+// - each thread's RacyRegisteredThread object is accessible without locking via
+//   TLSRegisteredThread::RacyRegisteredThread().
+class CorePS {
+ private:
+  CorePS()
+      : mProcessStartTime(TimeStamp::ProcessCreation()),
+        // This needs its own mutex, because it is used concurrently from
+        // functions guarded by gPSMutex as well as others without safety (e.g.,
+        // profiler_add_marker). It is *not* used inside the critical section of
+        // the sampler, because mutexes cannot be used there.
+        mCoreBuffer(ProfileChunkedBuffer::ThreadSafety::WithMutex)
+#ifdef USE_LUL_STACKWALK
+        ,
+        mLul(nullptr)
+#endif
+  {
+    MOZ_ASSERT(NS_IsMainThread(),
+               "CorePS must be created from the main thread");
+  }
+
+  ~CorePS() {}
+
+ public:
+  static void Create(PSLockRef aLock) {
+    MOZ_ASSERT(!sInstance);
+    sInstance = new CorePS();
+  }
+
+  static void Destroy(PSLockRef aLock) {
+    MOZ_ASSERT(sInstance);
+    delete sInstance;
+    sInstance = nullptr;
+  }
+
+  // Unlike ActivePS::Exists(), CorePS::Exists() can be called without gPSMutex
+  // being locked. This is because CorePS is instantiated so early on the main
+  // thread that we don't have to worry about it being racy.
+  static bool Exists() { return !!sInstance; }
+
+  static void AddSizeOf(PSLockRef, MallocSizeOf aMallocSizeOf,
+                        size_t& aProfSize, size_t& aLulSize) {
+    MOZ_ASSERT(sInstance);
+
+    aProfSize += aMallocSizeOf(sInstance);
+
+    for (auto& registeredThread : sInstance->mRegisteredThreads) {
+      aProfSize += registeredThread->SizeOfIncludingThis(aMallocSizeOf);
+    }
+
+    for (auto& registeredPage : sInstance->mRegisteredPages) {
+      aProfSize += registeredPage->SizeOfIncludingThis(aMallocSizeOf);
+    }
+
+    // Measurement of the following things may be added later if DMD finds it
+    // is worthwhile:
+    // - CorePS::mRegisteredThreads itself (its elements' children are
+    // measured above)
+    // - CorePS::mRegisteredPages itself (its elements' children are
+    // measured above)
+    // - CorePS::mInterposeObserver
+
+#if defined(USE_LUL_STACKWALK)
+    if (sInstance->mLul) {
+      aLulSize += sInstance->mLul->SizeOfIncludingThis(aMallocSizeOf);
+    }
+#endif
+  }
+
+  // No PSLockRef is needed for this field because it's immutable.
+  PS_GET_LOCKLESS(TimeStamp, ProcessStartTime)
+
+  // No PSLockRef is needed for this field because it's thread-safe.
+  PS_GET_LOCKLESS(ProfileChunkedBuffer&, CoreBuffer)
+
+  PS_GET(const Vector<UniquePtr<RegisteredThread>>&, RegisteredThreads)
+
+  PS_GET(JsFrameBuffer&, JsFrames)
+
+  static void AppendRegisteredThread(
+      PSLockRef, UniquePtr<RegisteredThread>&& aRegisteredThread) {
+    MOZ_ASSERT(sInstance);
+    MOZ_RELEASE_ASSERT(
+        sInstance->mRegisteredThreads.append(std::move(aRegisteredThread)));
+  }
+
+  static void RemoveRegisteredThread(PSLockRef,
+                                     RegisteredThread* aRegisteredThread) {
+    MOZ_ASSERT(sInstance);
+    // Remove aRegisteredThread from mRegisteredThreads.
+    for (UniquePtr<RegisteredThread>& rt : sInstance->mRegisteredThreads) {
+      if (rt.get() == aRegisteredThread) {
+        sInstance->mRegisteredThreads.erase(&rt);
+        return;
+      }
+    }
+  }
+
+  PS_GET(Vector<RefPtr<PageInformation>>&, RegisteredPages)
+
+  static void AppendRegisteredPage(PSLockRef,
+                                   RefPtr<PageInformation>&& aRegisteredPage) {
+    MOZ_ASSERT(sInstance);
+    struct RegisteredPageComparator {
+      PageInformation* aA;
+      bool operator()(PageInformation* aB) const { return aA->Equals(aB); }
+    };
+
+    auto foundPageIter = std::find_if(
+        sInstance->mRegisteredPages.begin(), sInstance->mRegisteredPages.end(),
+        RegisteredPageComparator{aRegisteredPage.get()});
+
+    if (foundPageIter != sInstance->mRegisteredPages.end()) {
+      if ((*foundPageIter)->Url().EqualsLiteral("about:blank")) {
+        // When a BrowsingContext is loaded, the first url loaded in it will be
+        // about:blank, and if the principal matches, the first document loaded
+        // in it will share an inner window. That's why we should delete the
+        // intermittent about:blank if they share the inner window.
+        sInstance->mRegisteredPages.erase(foundPageIter);
+      } else {
+        // Do not register the same page again.
+        return;
+      }
+    }
+
+    MOZ_RELEASE_ASSERT(
+        sInstance->mRegisteredPages.append(std::move(aRegisteredPage)));
+  }
+
+  static void RemoveRegisteredPage(PSLockRef,
+                                   uint64_t aRegisteredInnerWindowID) {
+    MOZ_ASSERT(sInstance);
+    // Remove RegisteredPage from mRegisteredPages by given inner window ID.
+    sInstance->mRegisteredPages.eraseIf([&](const RefPtr<PageInformation>& rd) {
+      return rd->InnerWindowID() == aRegisteredInnerWindowID;
+    });
+  }
+
+  static void ClearRegisteredPages(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    sInstance->mRegisteredPages.clear();
+  }
+
+  PS_GET(const Vector<BaseProfilerCount*>&, Counters)
+
+  static void AppendCounter(PSLockRef, BaseProfilerCount* aCounter) {
+    MOZ_ASSERT(sInstance);
+    // we don't own the counter; they may be stored in static objects
+    MOZ_RELEASE_ASSERT(sInstance->mCounters.append(aCounter));
+  }
+
+  static void RemoveCounter(PSLockRef, BaseProfilerCount* aCounter) {
+    // we may be called to remove a counter after the profiler is stopped or
+    // late in shutdown.
+    if (sInstance) {
+      auto* counter = std::find(sInstance->mCounters.begin(),
+                                sInstance->mCounters.end(), aCounter);
+      MOZ_RELEASE_ASSERT(counter != sInstance->mCounters.end());
+      sInstance->mCounters.erase(counter);
+    }
+  }
+
+#ifdef USE_LUL_STACKWALK
+  static lul::LUL* Lul(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    return sInstance->mLul.get();
+  }
+  static void SetLul(PSLockRef, UniquePtr<lul::LUL> aLul) {
+    MOZ_ASSERT(sInstance);
+    sInstance->mLul = std::move(aLul);
+  }
+#endif
+
+  PS_GET_AND_SET(const nsACString&, ProcessName)
+  PS_GET_AND_SET(const nsACString&, ETLDplus1)
+
+ private:
+  // The singleton instance
+  static CorePS* sInstance;
+
+  // The time that the process started.
+  const TimeStamp mProcessStartTime;
+
+  // The thread-safe blocks-oriented buffer into which all profiling data is
+  // recorded.
+  // ActivePS controls the lifetime of the underlying contents buffer: When
+  // ActivePS does not exist, mCoreBuffer is empty and rejects all reads&writes;
+  // see ActivePS for further details.
+  // Note: This needs to live here outside of ActivePS, because some producers
+  // are indirectly controlled (e.g., by atomic flags) and therefore may still
+  // attempt to write some data shortly after ActivePS has shutdown and deleted
+  // the underlying buffer in memory.
+  ProfileChunkedBuffer mCoreBuffer;
+
+  // Info on all the registered threads.
+  // ThreadIds in mRegisteredThreads are unique.
+  Vector<UniquePtr<RegisteredThread>> mRegisteredThreads;
+
+  // Info on all the registered pages.
+  // InnerWindowIDs in mRegisteredPages are unique.
+  Vector<RefPtr<PageInformation>> mRegisteredPages;
+
+  // Non-owning pointers to all active counters
+  Vector<BaseProfilerCount*> mCounters;
+
+#ifdef USE_LUL_STACKWALK
+  // LUL's state. Null prior to the first activation, non-null thereafter.
+  UniquePtr<lul::LUL> mLul;
+#endif
+
+  // Process name, provided by child process initialization code.
+  nsAutoCString mProcessName;
+  // Private name, provided by child process initialization code (eTLD+1 in
+  // fission)
+  nsAutoCString mETLDplus1;
+
+  // This memory buffer is used by the MergeStacks mechanism. Previously it was
+  // stack allocated, but this led to a stack overflow, as it was too much
+  // memory. Here the buffer can be pre-allocated, and shared with the
+  // MergeStacks feature as needed. MergeStacks is only run while holding the
+  // lock, so it is safe to have only one instance allocated for all of the
+  // threads.
+  JsFrameBuffer mJsFrames;
+};
+
+CorePS* CorePS::sInstance = nullptr;
+
+ProfileChunkedBuffer& profiler_get_core_buffer() {
+  MOZ_ASSERT(CorePS::Exists());
+  return CorePS::CoreBuffer();
+}
+
+class SamplerThread;
+
+static SamplerThread* NewSamplerThread(PSLockRef aLock, uint32_t aGeneration,
+                                       double aInterval);
+
+struct LiveProfiledThreadData {
+  RegisteredThread* mRegisteredThread;
+  UniquePtr<ProfiledThreadData> mProfiledThreadData;
+};
+
+// The buffer size is provided as a number of "entries", this is their size in
+// bytes.
+constexpr static uint32_t scBytesPerEntry = 8;
+
+// This class contains the profiler's global state that is valid only when the
+// profiler is active. When not instantiated, the profiler is inactive.
+//
+// Accesses to ActivePS are guarded by gPSMutex, in much the same fashion as
+// CorePS.
+//
+class ActivePS {
+ private:
+  // We need to decide how many chunks of what size we want to fit in the given
+  // total maximum capacity for this process, in the (likely) context of
+  // multiple processes doing the same choice and having an inter-process
+  // mechanism to control the overal memory limit.
+
+  // Minimum chunk size allowed, enough for at least one stack.
+  constexpr static uint32_t scMinimumChunkSize =
+      2 * ProfileBufferChunkManager::scExpectedMaximumStackSize;
+
+  // Ideally we want at least 2 unreleased chunks to work with (1 current and 1
+  // next), and 2 released chunks (so that one can be recycled when old, leaving
+  // one with some data).
+  constexpr static uint32_t scMinimumNumberOfChunks = 4;
+
+  // And we want to limit chunks to a maximum size, which is a compromise
+  // between:
+  // - A big size, which helps with reducing the rate of allocations and IPCs.
+  // - A small size, which helps with equalizing the duration of recorded data
+  //   (as the inter-process controller will discard the oldest chunks in all
+  //   Firefox processes).
+  constexpr static uint32_t scMaximumChunkSize = 1024 * 1024;
+
+ public:
+  // We should be able to store at least the minimum number of the smallest-
+  // possible chunks.
+  constexpr static uint32_t scMinimumBufferSize =
+      scMinimumNumberOfChunks * scMinimumChunkSize;
+  // Note: Keep in sync with GeckoThread.maybeStartGeckoProfiler:
+  // https://searchfox.org/mozilla-central/source/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java
+  constexpr static uint32_t scMinimumBufferEntries =
+      scMinimumBufferSize / scBytesPerEntry;
+
+  // Limit to 2GiB.
+  constexpr static uint32_t scMaximumBufferSize = 2u * 1024u * 1024u * 1024u;
+  constexpr static uint32_t scMaximumBufferEntries =
+      scMaximumBufferSize / scBytesPerEntry;
+
+  constexpr static uint32_t ClampToAllowedEntries(uint32_t aEntries) {
+    if (aEntries <= scMinimumBufferEntries) {
+      return scMinimumBufferEntries;
+    }
+    if (aEntries >= scMaximumBufferEntries) {
+      return scMaximumBufferEntries;
+    }
+    return aEntries;
+  }
+
+ private:
+  constexpr static uint32_t ChunkSizeForEntries(uint32_t aEntries) {
+    return uint32_t(std::min(size_t(ClampToAllowedEntries(aEntries)) *
+                                 scBytesPerEntry / scMinimumNumberOfChunks,
+                             size_t(scMaximumChunkSize)));
+  }
+
+  static uint32_t AdjustFeatures(uint32_t aFeatures, uint32_t aFilterCount) {
+    // Filter out any features unavailable in this platform/configuration.
+    aFeatures &= AvailableFeatures();
+
+    // Always enable ProfilerFeature::Threads if we have a filter, because
+    // users sometimes ask to filter by a list of threads but forget to
+    // explicitly specify ProfilerFeature::Threads.
+    if (aFilterCount > 0) {
+      aFeatures |= ProfilerFeature::Threads;
+    }
+
+    // Some features imply others.
+    if (aFeatures & ProfilerFeature::FileIOAll) {
+      aFeatures |= ProfilerFeature::MainThreadIO | ProfilerFeature::FileIO;
+    } else if (aFeatures & ProfilerFeature::FileIO) {
+      aFeatures |= ProfilerFeature::MainThreadIO;
+    }
+
+    return aFeatures;
+  }
+
+  ActivePS(PSLockRef aLock, PowerOfTwo32 aCapacity, double aInterval,
+           uint32_t aFeatures, const char** aFilters, uint32_t aFilterCount,
+           uint64_t aActiveBrowsingContextID, const Maybe<double>& aDuration)
+      : mGeneration(sNextGeneration++),
+        mCapacity(aCapacity),
+        mDuration(aDuration),
+        mInterval(aInterval),
+        mFeatures(AdjustFeatures(aFeatures, aFilterCount)),
+        mActiveBrowsingContextID(aActiveBrowsingContextID),
+        mProfileBufferChunkManager(
+            size_t(ClampToAllowedEntries(aCapacity.Value())) * scBytesPerEntry,
+            ChunkSizeForEntries(aCapacity.Value())),
+        mProfileBuffer([this]() -> ProfileChunkedBuffer& {
+          CorePS::CoreBuffer().SetChunkManager(mProfileBufferChunkManager);
+          return CorePS::CoreBuffer();
+        }()),
+        // The new sampler thread doesn't start sampling immediately because the
+        // main loop within Run() is blocked until this function's caller
+        // unlocks gPSMutex.
+        mSamplerThread(NewSamplerThread(aLock, mGeneration, aInterval)),
+        mInterposeObserver((ProfilerFeature::HasMainThreadIO(aFeatures) ||
+                            ProfilerFeature::HasFileIO(aFeatures) ||
+                            ProfilerFeature::HasFileIOAll(aFeatures))
+                               ? new ProfilerIOInterposeObserver()
+                               : nullptr),
+        mIsPaused(false),
+        mIsSamplingPaused(false)
+#if defined(GP_OS_linux) || defined(GP_OS_freebsd)
+        ,
+        mWasSamplingPaused(false)
+#endif
+  {
+    // Deep copy aFilters.
+    MOZ_ALWAYS_TRUE(mFilters.resize(aFilterCount));
+    for (uint32_t i = 0; i < aFilterCount; ++i) {
+      mFilters[i] = aFilters[i];
+    }
+
+#if !defined(RELEASE_OR_BETA)
+    if (mInterposeObserver) {
+      // We need to register the observer on the main thread, because we want
+      // to observe IO that happens on the main thread.
+      // IOInterposer needs to be initialized before calling
+      // IOInterposer::Register or our observer will be silently dropped.
+      if (NS_IsMainThread()) {
+        IOInterposer::Init();
+        IOInterposer::Register(IOInterposeObserver::OpAll, mInterposeObserver);
+      } else {
+        RefPtr<ProfilerIOInterposeObserver> observer = mInterposeObserver;
+        NS_DispatchToMainThread(
+            NS_NewRunnableFunction("ActivePS::ActivePS", [=]() {
+              IOInterposer::Init();
+              IOInterposer::Register(IOInterposeObserver::OpAll, observer);
+            }));
+      }
+    }
+#endif
+  }
+
+  ~ActivePS() {
+#if !defined(RELEASE_OR_BETA)
+    if (mInterposeObserver) {
+      // We need to unregister the observer on the main thread, because that's
+      // where we've registered it.
+      if (NS_IsMainThread()) {
+        IOInterposer::Unregister(IOInterposeObserver::OpAll,
+                                 mInterposeObserver);
+      } else {
+        RefPtr<ProfilerIOInterposeObserver> observer = mInterposeObserver;
+        NS_DispatchToMainThread(
+            NS_NewRunnableFunction("ActivePS::~ActivePS", [=]() {
+              IOInterposer::Unregister(IOInterposeObserver::OpAll, observer);
+            }));
+      }
+    }
+#endif
+    CorePS::CoreBuffer().ResetChunkManager();
+  }
+
+  bool ThreadSelected(const char* aThreadName) {
+    if (mFilters.empty()) {
+      return true;
+    }
+
+    std::string name = aThreadName;
+    std::transform(name.begin(), name.end(), name.begin(), ::tolower);
+
+    for (uint32_t i = 0; i < mFilters.length(); ++i) {
+      std::string filter = mFilters[i];
+
+      if (filter == "*") {
+        return true;
+      }
+
+      std::transform(filter.begin(), filter.end(), filter.begin(), ::tolower);
+
+      // Crude, non UTF-8 compatible, case insensitive substring search
+      if (name.find(filter) != std::string::npos) {
+        return true;
+      }
+
+      // If the filter starts with pid:, check for a pid match
+      if (filter.find("pid:") == 0) {
+        std::string mypid = std::to_string(profiler_current_process_id());
+        if (filter.compare(4, std::string::npos, mypid) == 0) {
+          return true;
+        }
+      }
+    }
+
+    return false;
+  }
+
+ public:
+  static void Create(PSLockRef aLock, PowerOfTwo32 aCapacity, double aInterval,
+                     uint32_t aFeatures, const char** aFilters,
+                     uint32_t aFilterCount, uint64_t aActiveBrowsingContextID,
+                     const Maybe<double>& aDuration) {
+    MOZ_ASSERT(!sInstance);
+    sInstance = new ActivePS(aLock, aCapacity, aInterval, aFeatures, aFilters,
+                             aFilterCount, aActiveBrowsingContextID, aDuration);
+  }
+
+  [[nodiscard]] static SamplerThread* Destroy(PSLockRef aLock) {
+    MOZ_ASSERT(sInstance);
+    auto samplerThread = sInstance->mSamplerThread;
+    delete sInstance;
+    sInstance = nullptr;
+
+    return samplerThread;
+  }
+
+  static bool Exists(PSLockRef) { return !!sInstance; }
+
+  static bool Equals(PSLockRef, PowerOfTwo32 aCapacity,
+                     const Maybe<double>& aDuration, double aInterval,
+                     uint32_t aFeatures, const char** aFilters,
+                     uint32_t aFilterCount, uint64_t aActiveBrowsingContextID) {
+    MOZ_ASSERT(sInstance);
+    if (sInstance->mCapacity != aCapacity ||
+        sInstance->mDuration != aDuration ||
+        sInstance->mInterval != aInterval ||
+        sInstance->mFeatures != aFeatures ||
+        sInstance->mFilters.length() != aFilterCount ||
+        sInstance->mActiveBrowsingContextID != aActiveBrowsingContextID) {
+      return false;
+    }
+
+    for (uint32_t i = 0; i < sInstance->mFilters.length(); ++i) {
+      if (strcmp(sInstance->mFilters[i].c_str(), aFilters[i]) != 0) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  static size_t SizeOf(PSLockRef, MallocSizeOf aMallocSizeOf) {
+    MOZ_ASSERT(sInstance);
+
+    size_t n = aMallocSizeOf(sInstance);
+
+    n += sInstance->mProfileBuffer.SizeOfExcludingThis(aMallocSizeOf);
+
+    // Measurement of the following members may be added later if DMD finds it
+    // is worthwhile:
+    // - mLiveProfiledThreads (both the array itself, and the contents)
+    // - mDeadProfiledThreads (both the array itself, and the contents)
+    //
+
+    return n;
+  }
+
+  static bool ShouldProfileThread(PSLockRef aLock, ThreadInfo* aInfo) {
+    MOZ_ASSERT(sInstance);
+    return ((aInfo->IsMainThread() || FeatureThreads(aLock)) &&
+            sInstance->ThreadSelected(aInfo->Name()));
+  }
+
+  [[nodiscard]] static bool AppendPostSamplingCallback(
+      PSLockRef, PostSamplingCallback&& aCallback);
+
+  // Writes out the current active configuration of the profile.
+  static void WriteActiveConfiguration(
+      PSLockRef aLock, JSONWriter& aWriter,
+      const Span<const char>& aPropertyName = MakeStringSpan("")) {
+    if (!sInstance) {
+      if (!aPropertyName.empty()) {
+        aWriter.NullProperty(aPropertyName);
+      } else {
+        aWriter.NullElement();
+      }
+      return;
+    };
+
+    if (!aPropertyName.empty()) {
+      aWriter.StartObjectProperty(aPropertyName);
+    } else {
+      aWriter.StartObjectElement();
+    }
+
+    {
+      aWriter.StartArrayProperty("features", aWriter.SingleLineStyle);
+#define WRITE_ACTIVE_FEATURES(n_, str_, Name_, desc_)    \
+  if (profiler_feature_active(ProfilerFeature::Name_)) { \
+    aWriter.StringElement(str_);                         \
+  }
+
+      PROFILER_FOR_EACH_FEATURE(WRITE_ACTIVE_FEATURES)
+#undef WRITE_ACTIVE_FEATURES
+      aWriter.EndArray();
+    }
+    {
+      aWriter.StartArrayProperty("threads", aWriter.SingleLineStyle);
+      for (const auto& filter : sInstance->mFilters) {
+        aWriter.StringElement(filter);
+      }
+      aWriter.EndArray();
+    }
+    {
+      // Now write all the simple values.
+
+      // The interval is also available on profile.meta.interval
+      aWriter.DoubleProperty("interval", sInstance->mInterval);
+      aWriter.IntProperty("capacity", sInstance->mCapacity.Value());
+      if (sInstance->mDuration) {
+        aWriter.DoubleProperty("duration", sInstance->mDuration.value());
+      }
+      // Here, we are converting uint64_t to double. Browsing Context IDs are
+      // being created using `nsContentUtils::GenerateProcessSpecificId`, which
+      // is specifically designed to only use 53 of the 64 bits to be lossless
+      // when passed into and out of JS as a double.
+      aWriter.DoubleProperty("activeBrowsingContextID",
+                             sInstance->mActiveBrowsingContextID);
+    }
+    aWriter.EndObject();
+  }
+
+  PS_GET(uint32_t, Generation)
+
+  PS_GET(PowerOfTwo32, Capacity)
+
+  PS_GET(Maybe<double>, Duration)
+
+  PS_GET(double, Interval)
+
+  PS_GET(uint32_t, Features)
+
+  PS_GET(uint64_t, ActiveBrowsingContextID)
+
+#define PS_GET_FEATURE(n_, str_, Name_, desc_)                \
+  static bool Feature##Name_(PSLockRef) {                     \
+    MOZ_ASSERT(sInstance);                                    \
+    return ProfilerFeature::Has##Name_(sInstance->mFeatures); \
+  }
+
+  PROFILER_FOR_EACH_FEATURE(PS_GET_FEATURE)
+
+#undef PS_GET_FEATURE
+
+  static uint32_t JSFlags(PSLockRef aLock) {
+    uint32_t Flags = 0;
+    Flags |=
+        FeatureJS(aLock) ? uint32_t(JSInstrumentationFlags::StackSampling) : 0;
+    Flags |= FeatureJSTracer(aLock)
+                 ? uint32_t(JSInstrumentationFlags::TraceLogging)
+                 : 0;
+    Flags |= FeatureJSAllocations(aLock)
+                 ? uint32_t(JSInstrumentationFlags::Allocations)
+                 : 0;
+    return Flags;
+  }
+
+  PS_GET(const Vector<std::string>&, Filters)
+
+  // Not using PS_GET, because only the "Controlled" interface of
+  // `mProfileBufferChunkManager` should be exposed here.
+  static ProfileBufferControlledChunkManager& ControlledChunkManager(
+      PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    return sInstance->mProfileBufferChunkManager;
+  }
+
+  static void FulfillChunkRequests(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    sInstance->mProfileBufferChunkManager.FulfillChunkRequests();
+  }
+
+  static ProfileBuffer& Buffer(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    return sInstance->mProfileBuffer;
+  }
+
+  static const Vector<LiveProfiledThreadData>& LiveProfiledThreads(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    return sInstance->mLiveProfiledThreads;
+  }
+
+  // Returns an array containing (RegisteredThread*, ProfiledThreadData*) pairs
+  // for all threads that should be included in a profile, both for threads
+  // that are still registered, and for threads that have been unregistered but
+  // still have data in the buffer.
+  // For threads that have already been unregistered, the RegisteredThread
+  // pointer will be null.
+  // The returned array is sorted by thread register time.
+  // Do not hold on to the return value across thread registration or profiler
+  // restarts.
+  static Vector<std::pair<RegisteredThread*, ProfiledThreadData*>>
+  ProfiledThreads(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    Vector<std::pair<RegisteredThread*, ProfiledThreadData*>> array;
+    MOZ_RELEASE_ASSERT(
+        array.initCapacity(sInstance->mLiveProfiledThreads.length() +
+                           sInstance->mDeadProfiledThreads.length()));
+    for (auto& t : sInstance->mLiveProfiledThreads) {
+      MOZ_RELEASE_ASSERT(array.append(
+          std::make_pair(t.mRegisteredThread, t.mProfiledThreadData.get())));
+    }
+    for (auto& t : sInstance->mDeadProfiledThreads) {
+      MOZ_RELEASE_ASSERT(
+          array.append(std::make_pair((RegisteredThread*)nullptr, t.get())));
+    }
+
+    std::sort(array.begin(), array.end(),
+              [](const std::pair<RegisteredThread*, ProfiledThreadData*>& a,
+                 const std::pair<RegisteredThread*, ProfiledThreadData*>& b) {
+                return a.second->Info()->RegisterTime() <
+                       b.second->Info()->RegisterTime();
+              });
+    return array;
+  }
+
+  static Vector<RefPtr<PageInformation>> ProfiledPages(PSLockRef aLock) {
+    MOZ_ASSERT(sInstance);
+    Vector<RefPtr<PageInformation>> array;
+    for (auto& d : CorePS::RegisteredPages(aLock)) {
+      MOZ_RELEASE_ASSERT(array.append(d));
+    }
+    for (auto& d : sInstance->mDeadProfiledPages) {
+      MOZ_RELEASE_ASSERT(array.append(d));
+    }
+    // We don't need to sort the pages like threads since we won't show them
+    // as a list.
+    return array;
+  }
+
+  // Do a linear search through mLiveProfiledThreads to find the
+  // ProfiledThreadData object for a RegisteredThread.
+  static ProfiledThreadData* GetProfiledThreadData(
+      PSLockRef, RegisteredThread* aRegisteredThread) {
+    MOZ_ASSERT(sInstance);
+    for (const LiveProfiledThreadData& thread :
+         sInstance->mLiveProfiledThreads) {
+      if (thread.mRegisteredThread == aRegisteredThread) {
+        return thread.mProfiledThreadData.get();
+      }
+    }
+    return nullptr;
+  }
+
+  static ProfiledThreadData* AddLiveProfiledThread(
+      PSLockRef, RegisteredThread* aRegisteredThread,
+      UniquePtr<ProfiledThreadData>&& aProfiledThreadData) {
+    MOZ_ASSERT(sInstance);
+    MOZ_RELEASE_ASSERT(
+        sInstance->mLiveProfiledThreads.append(LiveProfiledThreadData{
+            aRegisteredThread, std::move(aProfiledThreadData)}));
+
+    // Return a weak pointer to the ProfiledThreadData object.
+    return sInstance->mLiveProfiledThreads.back().mProfiledThreadData.get();
+  }
+
+  static void UnregisterThread(PSLockRef aLockRef,
+                               RegisteredThread* aRegisteredThread) {
+    MOZ_ASSERT(sInstance);
+
+    DiscardExpiredDeadProfiledThreads(aLockRef);
+
+    // Find the right entry in the mLiveProfiledThreads array and remove the
+    // element, moving the ProfiledThreadData object for the thread into the
+    // mDeadProfiledThreads array.
+    // The thread's RegisteredThread object gets destroyed here.
+    for (size_t i = 0; i < sInstance->mLiveProfiledThreads.length(); i++) {
+      LiveProfiledThreadData& thread = sInstance->mLiveProfiledThreads[i];
+      if (thread.mRegisteredThread == aRegisteredThread) {
+        thread.mProfiledThreadData->NotifyUnregistered(
+            sInstance->mProfileBuffer.BufferRangeEnd());
+        MOZ_RELEASE_ASSERT(sInstance->mDeadProfiledThreads.append(
+            std::move(thread.mProfiledThreadData)));
+        sInstance->mLiveProfiledThreads.erase(
+            &sInstance->mLiveProfiledThreads[i]);
+        return;
+      }
+    }
+  }
+
+  PS_GET_AND_SET(bool, IsPaused)
+
+  // True if sampling is paused (though generic `SetIsPaused()` or specific
+  // `SetIsSamplingPaused()`).
+  static bool IsSamplingPaused(PSLockRef lock) {
+    MOZ_ASSERT(sInstance);
+    return IsPaused(lock) || sInstance->mIsSamplingPaused;
+  }
+
+  static void SetIsSamplingPaused(PSLockRef, bool aIsSamplingPaused) {
+    MOZ_ASSERT(sInstance);
+    sInstance->mIsSamplingPaused = aIsSamplingPaused;
+  }
+
+#if defined(GP_OS_linux) || defined(GP_OS_freebsd)
+  PS_GET_AND_SET(bool, WasSamplingPaused)
+#endif
+
+  static void DiscardExpiredDeadProfiledThreads(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    uint64_t bufferRangeStart = sInstance->mProfileBuffer.BufferRangeStart();
+    // Discard any dead threads that were unregistered before bufferRangeStart.
+    sInstance->mDeadProfiledThreads.eraseIf(
+        [bufferRangeStart](
+            const UniquePtr<ProfiledThreadData>& aProfiledThreadData) {
+          Maybe<uint64_t> bufferPosition =
+              aProfiledThreadData->BufferPositionWhenUnregistered();
+          MOZ_RELEASE_ASSERT(bufferPosition,
+                             "should have unregistered this thread");
+          return *bufferPosition < bufferRangeStart;
+        });
+  }
+
+  static void UnregisterPage(PSLockRef aLock,
+                             uint64_t aRegisteredInnerWindowID) {
+    MOZ_ASSERT(sInstance);
+    auto& registeredPages = CorePS::RegisteredPages(aLock);
+    for (size_t i = 0; i < registeredPages.length(); i++) {
+      RefPtr<PageInformation>& page = registeredPages[i];
+      if (page->InnerWindowID() == aRegisteredInnerWindowID) {
+        page->NotifyUnregistered(sInstance->mProfileBuffer.BufferRangeEnd());
+        MOZ_RELEASE_ASSERT(
+            sInstance->mDeadProfiledPages.append(std::move(page)));
+        registeredPages.erase(&registeredPages[i--]);
+      }
+    }
+  }
+
+  static void DiscardExpiredPages(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    uint64_t bufferRangeStart = sInstance->mProfileBuffer.BufferRangeStart();
+    // Discard any dead pages that were unregistered before
+    // bufferRangeStart.
+    sInstance->mDeadProfiledPages.eraseIf(
+        [bufferRangeStart](const RefPtr<PageInformation>& aProfiledPage) {
+          Maybe<uint64_t> bufferPosition =
+              aProfiledPage->BufferPositionWhenUnregistered();
+          MOZ_RELEASE_ASSERT(bufferPosition,
+                             "should have unregistered this page");
+          return *bufferPosition < bufferRangeStart;
+        });
+  }
+
+  static void ClearUnregisteredPages(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    sInstance->mDeadProfiledPages.clear();
+  }
+
+  static void ClearExpiredExitProfiles(PSLockRef) {
+    MOZ_ASSERT(sInstance);
+    uint64_t bufferRangeStart = sInstance->mProfileBuffer.BufferRangeStart();
+    // Discard exit profiles that were gathered before our buffer RangeStart.
+    // If we have started to overwrite our data from when the Base profile was
+    // added, we should get rid of that Base profile because it's now older than
+    // our oldest Gecko profile data.
+    //
+    // When adding: (In practice the starting buffer should be empty)
+    // v Start == End
+    // |                 <-- Buffer range, initially empty.
+    // ^ mGeckoIndexWhenBaseProfileAdded < Start FALSE -> keep it
+    //
+    // Later, still in range:
+    // v Start   v End
+    // |=========|       <-- Buffer range growing.
+    // ^ mGeckoIndexWhenBaseProfileAdded < Start FALSE -> keep it
+    //
+    // Even later, now out of range:
+    //       v Start      v End
+    //       |============|       <-- Buffer range full and sliding.
+    // ^ mGeckoIndexWhenBaseProfileAdded < Start TRUE! -> Discard it
+    if (sInstance->mBaseProfileThreads &&
+        sInstance->mGeckoIndexWhenBaseProfileAdded
+                .ConvertToProfileBufferIndex() <
+            CorePS::CoreBuffer().GetState().mRangeStart) {
+      DEBUG_LOG("ClearExpiredExitProfiles() - Discarding base profile %p",
+                sInstance->mBaseProfileThreads.get());
+      sInstance->mBaseProfileThreads.reset();
+    }
+    sInstance->mExitProfiles.eraseIf(
+        [bufferRangeStart](const ExitProfile& aExitProfile) {
+          return aExitProfile.mBufferPositionAtGatherTime < bufferRangeStart;
+        });
+  }
+
+  static void AddBaseProfileThreads(PSLockRef aLock,
+                                    UniquePtr<char[]> aBaseProfileThreads) {
+    MOZ_ASSERT(sInstance);
+    DEBUG_LOG("AddBaseProfileThreads(%p)", aBaseProfileThreads.get());
+    sInstance->mBaseProfileThreads = std::move(aBaseProfileThreads);
+    sInstance->mGeckoIndexWhenBaseProfileAdded =
+        ProfileBufferBlockIndex::CreateFromProfileBufferIndex(
+            CorePS::CoreBuffer().GetState().mRangeEnd);
+  }
+
+  static UniquePtr<char[]> MoveBaseProfileThreads(PSLockRef aLock) {
+    MOZ_ASSERT(sInstance);
+
+    ClearExpiredExitProfiles(aLock);
+
+    DEBUG_LOG("MoveBaseProfileThreads() - Consuming base profile %p",
+              sInstance->mBaseProfileThreads.get());
+    return std::move(sInstance->mBaseProfileThreads);
+  }
+
+  static void AddExitProfile(PSLockRef aLock, const nsCString& aExitProfile) {
+    MOZ_ASSERT(sInstance);
+
+    ClearExpiredExitProfiles(aLock);
+
+    MOZ_RELEASE_ASSERT(sInstance->mExitProfiles.append(
+        ExitProfile{aExitProfile, sInstance->mProfileBuffer.BufferRangeEnd()}));
+  }
+
+  static Vector<nsCString> MoveExitProfiles(PSLockRef aLock) {
+    MOZ_ASSERT(sInstance);
+
+    ClearExpiredExitProfiles(aLock);
+
+    Vector<nsCString> profiles;
+    MOZ_RELEASE_ASSERT(
+        profiles.initCapacity(sInstance->mExitProfiles.length()));
+    for (auto& profile : sInstance->mExitProfiles) {
+      MOZ_RELEASE_ASSERT(profiles.append(std::move(profile.mJSON)));
+    }
+    sInstance->mExitProfiles.clear();
+    return profiles;
+  }
+
+ private:
+  // The singleton instance.
+  static ActivePS* sInstance;
+
+  // We need to track activity generations. If we didn't we could have the
+  // following scenario.
+  //
+  // - profiler_stop() locks gPSMutex, de-instantiates ActivePS, unlocks
+  //   gPSMutex, deletes the SamplerThread (which does a join).
+  //
+  // - profiler_start() runs on a different thread, locks gPSMutex,
+  //   re-instantiates ActivePS, unlocks gPSMutex -- all before the join
+  //   completes.
+  //
+  // - SamplerThread::Run() locks gPSMutex, sees that ActivePS is instantiated,
+  //   and continues as if the start/stop pair didn't occur. Also
+  //   profiler_stop() is stuck, unable to finish.
+  //
+  // By checking ActivePS *and* the generation, we can avoid this scenario.
+  // sNextGeneration is used to track the next generation number; it is static
+  // because it must persist across different ActivePS instantiations.
+  const uint32_t mGeneration;
+  static uint32_t sNextGeneration;
+
+  // The maximum number of entries in mProfileBuffer.
+  const PowerOfTwo32 mCapacity;
+
+  // The maximum duration of entries in mProfileBuffer, in seconds.
+  const Maybe<double> mDuration;
+
+  // The interval between samples, measured in milliseconds.
+  const double mInterval;
+
+  // The profile features that are enabled.
+  const uint32_t mFeatures;
+
+  // Substrings of names of threads we want to profile.
+  Vector<std::string> mFilters;
+
+  // Browsing Context ID of the active active browser screen's active tab.
+  // It's being used to determine the profiled tab. It's "0" if we failed to
+  // get the ID.
+  const uint64_t mActiveBrowsingContextID;
+
+  // The chunk manager used by `mProfileBuffer` below.
+  ProfileBufferChunkManagerWithLocalLimit mProfileBufferChunkManager;
+
+  // The buffer into which all samples are recorded.
+  ProfileBuffer mProfileBuffer;
+
+  // ProfiledThreadData objects for any threads that were profiled at any point
+  // during this run of the profiler:
+  //  - mLiveProfiledThreads contains all threads that are still registered, and
+  //  - mDeadProfiledThreads contains all threads that have already been
+  //    unregistered but for which there is still data in the profile buffer.
+  Vector<LiveProfiledThreadData> mLiveProfiledThreads;
+  Vector<UniquePtr<ProfiledThreadData>> mDeadProfiledThreads;
+
+  // Info on all the dead pages.
+  // Registered pages are being moved to this array after unregistration.
+  // We are keeping them in case we need them in the profile data.
+  // We are removing them when we ensure that we won't need them anymore.
+  Vector<RefPtr<PageInformation>> mDeadProfiledPages;
+
+  // The current sampler thread. This class is not responsible for destroying
+  // the SamplerThread object; the Destroy() method returns it so the caller
+  // can destroy it.
+  SamplerThread* const mSamplerThread;
+
+  // The interposer that records main thread I/O.
+  RefPtr<ProfilerIOInterposeObserver> mInterposeObserver;
+
+  // Is the profiler fully paused?
+  bool mIsPaused;
+
+  // Is the profiler periodic sampling paused?
+  bool mIsSamplingPaused;
+
+#if defined(GP_OS_linux) || defined(GP_OS_freebsd)
+  // Used to record whether the sampler was paused just before forking. False
+  // at all times except just before/after forking.
+  bool mWasSamplingPaused;
+#endif
+
+  // Optional startup profile thread array from BaseProfiler.
+  UniquePtr<char[]> mBaseProfileThreads;
+  ProfileBufferBlockIndex mGeckoIndexWhenBaseProfileAdded;
+
+  struct ExitProfile {
+    nsCString mJSON;
+    uint64_t mBufferPositionAtGatherTime;
+  };
+  Vector<ExitProfile> mExitProfiles;
+};
+
+ActivePS* ActivePS::sInstance = nullptr;
+uint32_t ActivePS::sNextGeneration = 0;
+
+#undef PS_GET
+#undef PS_GET_LOCKLESS
+#undef PS_GET_AND_SET
+
+// The mutex that guards accesses to CorePS and ActivePS.
+static PSMutex gPSMutex;
+
+Atomic<uint32_t, MemoryOrdering::Relaxed> RacyFeatures::sActiveAndFeatures(0);
+
+// Each live thread has a RegisteredThread, and we store a reference to it in
+// TLS. This class encapsulates that TLS, and also handles the associated
+// profiling stack used by AutoProfilerLabel.
+class TLSRegisteredThread {
+ public:
+  // This should only be called once before any other access.
+  // In this case it's called from `profiler_init()` on the main thread, before
+  // the main thread registers itself.
+  static void Init() {
+    MOZ_ASSERT(sState == State::Uninitialized, "Already initialized");
+    AutoProfilerLabel::ProfilingStackOwnerTLS::Init();
+    MOZ_ASSERT(
+        AutoProfilerLabel::ProfilingStackOwnerTLS::sState !=
+            AutoProfilerLabel::ProfilingStackOwnerTLS::State::Uninitialized,
+        "Unexpected ProfilingStackOwnerTLS::sState after "
+        "ProfilingStackOwnerTLS::Init()");
+    sState =
+        (AutoProfilerLabel::ProfilingStackOwnerTLS::sState ==
+             AutoProfilerLabel::ProfilingStackOwnerTLS::State::Initialized &&
+         sRegisteredThread.init())
+            ? State::Initialized
+            : State::Unavailable;
+  }
+
+  static bool IsTLSInited() {
+    MOZ_ASSERT(sState != State::Uninitialized,
+               "TLSRegisteredThread should only be accessed after Init()");
+    return sState == State::Initialized;
+  }
+
+  // Get the entire RegisteredThread. Accesses are guarded by gPSMutex.
+  static class RegisteredThread* RegisteredThread(PSLockRef) {
+    if (!IsTLSInited()) {
+      return nullptr;
+    }
+    return sRegisteredThread.get();
+  }
+
+  // Get only the RacyRegisteredThread. Accesses are not guarded by gPSMutex.
+  static class RacyRegisteredThread* RacyRegisteredThread() {
+    if (!IsTLSInited()) {
+      return nullptr;
+    }
+    class RegisteredThread* registeredThread = sRegisteredThread.get();
+    return registeredThread ? &registeredThread->RacyRegisteredThread()
+                            : nullptr;
+  }
+
+  // Get only the ProfilingStack. Accesses are not guarded by gPSMutex.
+  // RacyRegisteredThread() can also be used to get the ProfilingStack, but that
+  // is marginally slower because it requires an extra pointer indirection.
+  static ProfilingStack* Stack() {
+    if (!IsTLSInited()) {
+      return nullptr;
+    }
+    ProfilingStackOwner* profilingStackOwner =
+        AutoProfilerLabel::ProfilingStackOwnerTLS::Get();
+    if (!profilingStackOwner) {
+      return nullptr;
+    }
+    return &profilingStackOwner->ProfilingStack();
+  }
+
+  static void SetRegisteredThreadAndAutoProfilerLabelProfilingStack(
+      PSLockRef, class RegisteredThread* aRegisteredThread) {
+    if (!IsTLSInited()) {
+      return;
+    }
+    MOZ_RELEASE_ASSERT(
+        aRegisteredThread,
+        "Use ResetRegisteredThread() instead of SetRegisteredThread(nullptr)");
+    sRegisteredThread.set(aRegisteredThread);
+    ProfilingStackOwner& profilingStackOwner =
+        aRegisteredThread->RacyRegisteredThread().ProfilingStackOwner();
+    profilingStackOwner.AddRef();
+    AutoProfilerLabel::ProfilingStackOwnerTLS::Set(&profilingStackOwner);
+  }
+
+  // Only reset the registered thread. The AutoProfilerLabel's ProfilingStack
+  // is kept, because the thread may not have unregistered itself yet, so it may
+  // still push/pop labels even after the profiler has shut down.
+  static void ResetRegisteredThread(PSLockRef) {
+    if (!IsTLSInited()) {
+      return;
+    }
+    sRegisteredThread.set(nullptr);
+  }
+
+  // Reset the AutoProfilerLabels' ProfilingStack, because the thread is
+  // unregistering itself.
+  static void ResetAutoProfilerLabelProfilingStack(PSLockRef) {
+    if (!IsTLSInited()) {
+      return;
+    }
+    MOZ_RELEASE_ASSERT(
+        AutoProfilerLabel::ProfilingStackOwnerTLS::Get(),
+        "ResetAutoProfilerLabelProfilingStack should only be called once");
+    AutoProfilerLabel::ProfilingStackOwnerTLS::Get()->Release();
+    AutoProfilerLabel::ProfilingStackOwnerTLS::Set(nullptr);
+  }
+
+ private:
+  // Only written once from `profiler_init` calling
+  // `TLSRegisteredThread::Init()`; all reads should only happen after `Init()`,
+  // so there is no need to make it atomic.
+  enum class State { Uninitialized = 0, Initialized, Unavailable };
+  static State sState;
+
+  // This is a non-owning reference to the RegisteredThread;
+  // CorePS::mRegisteredThreads is the owning reference. On thread
+  // deregistration, this reference is cleared and the RegisteredThread is
+  // destroyed.
+  static MOZ_THREAD_LOCAL(class RegisteredThread*) sRegisteredThread;
+};
+
+// Zero-initialized to State::Uninitialized.
+/* static */
+TLSRegisteredThread::State TLSRegisteredThread::sState;
+
+/* static */
+MOZ_THREAD_LOCAL(RegisteredThread*) TLSRegisteredThread::sRegisteredThread;
+
+// Only written once from `profiler_init` (through `TLSRegisteredThread::Init()`
+// and `AutoProfilerLabel::ProfilingStackOwnerTLS::Init()`); all reads should
+// only happen after `Init()`, so there is no need to make it atomic.
+// Zero-initialized to State::Uninitialized.
+/* static */
+AutoProfilerLabel::ProfilingStackOwnerTLS::State
+    AutoProfilerLabel::ProfilingStackOwnerTLS::sState;
+
+// Although you can access a thread's ProfilingStack via
+// TLSRegisteredThread::sRegisteredThread, we also have a second TLS pointer
+// directly to the ProfilingStack. Here's why.
+//
+// - We need to be able to push to and pop from the ProfilingStack in
+//   AutoProfilerLabel.
+//
+// - The class functions are hot and must be defined in GeckoProfiler.h so they
+//   can be inlined.
+//
+// - We don't want to expose TLSRegisteredThread (and RegisteredThread) in
+//   GeckoProfiler.h.
+//
+// This second pointer isn't ideal, but does provide a way to satisfy those
+// constraints. TLSRegisteredThread is responsible for updating it.
+//
+// The (Racy)RegisteredThread and AutoProfilerLabel::ProfilingStackOwnerTLS
+// co-own the thread's ProfilingStack, so whichever is reset second, is
+// responsible for destroying the ProfilingStack; Because MOZ_THREAD_LOCAL
+// doesn't support RefPtr, AddRef&Release are done explicitly in
+// TLSRegisteredThread.
+/* static */
+MOZ_THREAD_LOCAL(ProfilingStackOwner*)
+AutoProfilerLabel::ProfilingStackOwnerTLS::sProfilingStackOwnerTLS;
+
+/* static */
+void AutoProfilerLabel::ProfilingStackOwnerTLS::Init() {
+  MOZ_ASSERT(sState == State::Uninitialized, "Already initialized");
+  sState =
+      sProfilingStackOwnerTLS.init() ? State::Initialized : State::Unavailable;
+}
+
+void ProfilingStackOwner::DumpStackAndCrash() const {
+  fprintf(stderr,
+          "ProfilingStackOwner::DumpStackAndCrash() thread id: %d, size: %u\n",
+          profiler_current_thread_id(), unsigned(mProfilingStack.stackSize()));
+  js::ProfilingStackFrame* allFrames = mProfilingStack.frames;
+  for (uint32_t i = 0; i < mProfilingStack.stackSize(); i++) {
+    js::ProfilingStackFrame& frame = allFrames[i];
+    if (frame.isLabelFrame()) {
+      fprintf(stderr, "%u: label frame, sp=%p, label='%s' (%s)\n", unsigned(i),
+              frame.stackAddress(), frame.label(),
+              frame.dynamicString() ? frame.dynamicString() : "-");
+    } else {
+      fprintf(stderr, "%u: non-label frame\n", unsigned(i));
+    }
+  }
+
+  MOZ_CRASH("Non-empty stack!");
+}
+
+// The name of the main thread.
+static const char* const kMainThreadName = "GeckoMain";
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN sampling/unwinding code
+
+// The registers used for stack unwinding and a few other sampling purposes.
+// The ctor does nothing; users are responsible for filling in the fields.
+class Registers {
+ public:
+  Registers() : mPC{nullptr}, mSP{nullptr}, mFP{nullptr}, mLR{nullptr} {}
+
+#if defined(HAVE_NATIVE_UNWIND)
+  // Fills in mPC, mSP, mFP, mLR, and mContext for a synchronous sample.
+  void SyncPopulate();
+#endif
+
+  void Clear() { memset(this, 0, sizeof(*this)); }
+
+  // These fields are filled in by
+  // Sampler::SuspendAndSampleAndResumeThread() for periodic and backtrace
+  // samples, and by SyncPopulate() for synchronous samples.
+  Address mPC;  // Instruction pointer.
+  Address mSP;  // Stack pointer.
+  Address mFP;  // Frame pointer.
+  Address mLR;  // ARM link register.
+#if defined(GP_OS_linux) || defined(GP_OS_android) || defined(GP_OS_freebsd)
+  // This contains all the registers, which means it duplicates the four fields
+  // above. This is ok.
+  ucontext_t* mContext;  // The context from the signal handler.
+#endif
+};
+
+// Setting MAX_NATIVE_FRAMES too high risks the unwinder wasting a lot of time
+// looping on corrupted stacks.
+static const size_t MAX_NATIVE_FRAMES = 1024;
+
+struct NativeStack {
+  void* mPCs[MAX_NATIVE_FRAMES];
+  void* mSPs[MAX_NATIVE_FRAMES];
+  size_t mCount;  // Number of frames filled.
+
+  NativeStack() : mPCs(), mSPs(), mCount(0) {}
+};
+
+Atomic<bool> WALKING_JS_STACK(false);
+
+struct AutoWalkJSStack {
+  bool walkAllowed;
+
+  AutoWalkJSStack() : walkAllowed(false) {
+    walkAllowed = WALKING_JS_STACK.compareExchange(false, true);
+  }
+
+  ~AutoWalkJSStack() {
+    if (walkAllowed) {
+      WALKING_JS_STACK = false;
+    }
+  }
+};
+
+// Merges the profiling stack, native stack, and JS stack, outputting the
+// details to aCollector.
+static void MergeStacks(uint32_t aFeatures, bool aIsSynchronous,
+                        const RegisteredThread& aRegisteredThread,
+                        const Registers& aRegs, const NativeStack& aNativeStack,
+                        ProfilerStackCollector& aCollector,
+                        JsFrameBuffer aJsFrames) {
+  // WARNING: this function runs within the profiler's "critical section".
+  // WARNING: this function might be called while the profiler is inactive, and
+  //          cannot rely on ActivePS.
+
+  const ProfilingStack& profilingStack =
+      aRegisteredThread.RacyRegisteredThread().ProfilingStack();
+  const js::ProfilingStackFrame* profilingStackFrames = profilingStack.frames;
+  uint32_t profilingStackFrameCount = profilingStack.stackSize();
+  JSContext* context = aRegisteredThread.GetJSContext();
+
+  // Make a copy of the JS stack into a JSFrame array. This is necessary since,
+  // like the native stack, the JS stack is iterated youngest-to-oldest and we
+  // need to iterate oldest-to-youngest when adding frames to aInfo.
+
+  // Non-periodic sampling passes Nothing() as the buffer write position to
+  // ProfilingFrameIterator to avoid incorrectly resetting the buffer position
+  // of sampled JIT frames inside the JS engine.
+  Maybe<uint64_t> samplePosInBuffer;
+  if (!aIsSynchronous) {
+    // aCollector.SamplePositionInBuffer() will return Nothing() when
+    // profiler_suspend_and_sample_thread is called from the background hang
+    // reporter.
+    samplePosInBuffer = aCollector.SamplePositionInBuffer();
+  }
+  uint32_t jsCount = 0;
+
+  // Only walk jit stack if profiling frame iterator is turned on.
+  if (context && JS::IsProfilingEnabledForContext(context)) {
+    AutoWalkJSStack autoWalkJSStack;
+
+    if (autoWalkJSStack.walkAllowed) {
+      JS::ProfilingFrameIterator::RegisterState registerState;
+      registerState.pc = aRegs.mPC;
+      registerState.sp = aRegs.mSP;
+      registerState.lr = aRegs.mLR;
+      registerState.fp = aRegs.mFP;
+
+      JS::ProfilingFrameIterator jsIter(context, registerState,
+                                        samplePosInBuffer);
+      for (; jsCount < MAX_JS_FRAMES && !jsIter.done(); ++jsIter) {
+        if (aIsSynchronous || jsIter.isWasm()) {
+          uint32_t extracted =
+              jsIter.extractStack(aJsFrames, jsCount, MAX_JS_FRAMES);
+          jsCount += extracted;
+          if (jsCount == MAX_JS_FRAMES) {
+            break;
+          }
+        } else {
+          Maybe<JS::ProfilingFrameIterator::Frame> frame =
+              jsIter.getPhysicalFrameWithoutLabel();
+          if (frame.isSome()) {
+            aJsFrames[jsCount++] = frame.value();
+          }
+        }
+      }
+    }
+  }
+
+  // While the profiling stack array is ordered oldest-to-youngest, the JS and
+  // native arrays are ordered youngest-to-oldest. We must add frames to aInfo
+  // oldest-to-youngest. Thus, iterate over the profiling stack forwards and JS
+  // and native arrays backwards. Note: this means the terminating condition
+  // jsIndex and nativeIndex is being < 0.
+  uint32_t profilingStackIndex = 0;
+  int32_t jsIndex = jsCount - 1;
+  int32_t nativeIndex = aNativeStack.mCount - 1;
+
+  uint8_t* lastLabelFrameStackAddr = nullptr;
+  uint8_t* jitEndStackAddr = nullptr;
+
+  // Iterate as long as there is at least one frame remaining.
+  while (profilingStackIndex != profilingStackFrameCount || jsIndex >= 0 ||
+         nativeIndex >= 0) {
+    // There are 1 to 3 frames available. Find and add the oldest.
+    uint8_t* profilingStackAddr = nullptr;
+    uint8_t* jsStackAddr = nullptr;
+    uint8_t* nativeStackAddr = nullptr;
+    uint8_t* jsActivationAddr = nullptr;
+
+    if (profilingStackIndex != profilingStackFrameCount) {
+      const js::ProfilingStackFrame& profilingStackFrame =
+          profilingStackFrames[profilingStackIndex];
+
+      if (profilingStackFrame.isLabelFrame() ||
+          profilingStackFrame.isSpMarkerFrame()) {
+        lastLabelFrameStackAddr = (uint8_t*)profilingStackFrame.stackAddress();
+      }
+
+      // Skip any JS_OSR frames. Such frames are used when the JS interpreter
+      // enters a jit frame on a loop edge (via on-stack-replacement, or OSR).
+      // To avoid both the profiling stack frame and jit frame being recorded
+      // (and showing up twice), the interpreter marks the interpreter
+      // profiling stack frame as JS_OSR to ensure that it doesn't get counted.
+      if (profilingStackFrame.isOSRFrame()) {
+        profilingStackIndex++;
+        continue;
+      }
+
+      MOZ_ASSERT(lastLabelFrameStackAddr);
+      profilingStackAddr = lastLabelFrameStackAddr;
+    }
+
+    if (jsIndex >= 0) {
+      jsStackAddr = (uint8_t*)aJsFrames[jsIndex].stackAddress;
+      jsActivationAddr = (uint8_t*)aJsFrames[jsIndex].activation;
+    }
+
+    if (nativeIndex >= 0) {
+      nativeStackAddr = (uint8_t*)aNativeStack.mSPs[nativeIndex];
+    }
+
+    // If there's a native stack frame which has the same SP as a profiling
+    // stack frame, pretend we didn't see the native stack frame.  Ditto for a
+    // native stack frame which has the same SP as a JS stack frame.  In effect
+    // this means profiling stack frames or JS frames trump conflicting native
+    // frames.
+    if (nativeStackAddr && (profilingStackAddr == nativeStackAddr ||
+                            jsStackAddr == nativeStackAddr)) {
+      nativeStackAddr = nullptr;
+      nativeIndex--;
+      MOZ_ASSERT(profilingStackAddr || jsStackAddr);
+    }
+
+    // Sanity checks.
+    MOZ_ASSERT_IF(profilingStackAddr,
+                  profilingStackAddr != jsStackAddr &&
+                      profilingStackAddr != nativeStackAddr);
+    MOZ_ASSERT_IF(jsStackAddr, jsStackAddr != profilingStackAddr &&
+                                   jsStackAddr != nativeStackAddr);
+    MOZ_ASSERT_IF(nativeStackAddr, nativeStackAddr != profilingStackAddr &&
+                                       nativeStackAddr != jsStackAddr);
+
+    // Check to see if profiling stack frame is top-most.
+    if (profilingStackAddr > jsStackAddr &&
+        profilingStackAddr > nativeStackAddr) {
+      MOZ_ASSERT(profilingStackIndex < profilingStackFrameCount);
+      const js::ProfilingStackFrame& profilingStackFrame =
+          profilingStackFrames[profilingStackIndex];
+
+      // Sp marker frames are just annotations and should not be recorded in
+      // the profile.
+      if (!profilingStackFrame.isSpMarkerFrame()) {
+        // The JIT only allows the top-most frame to have a nullptr pc.
+        MOZ_ASSERT_IF(
+            profilingStackFrame.isJsFrame() && profilingStackFrame.script() &&
+                !profilingStackFrame.pc(),
+            &profilingStackFrame ==
+                &profilingStack.frames[profilingStack.stackSize() - 1]);
+        aCollector.CollectProfilingStackFrame(profilingStackFrame);
+      }
+      profilingStackIndex++;
+      continue;
+    }
+
+    // Check to see if JS jit stack frame is top-most
+    if (jsStackAddr > nativeStackAddr) {
+      MOZ_ASSERT(jsIndex >= 0);
+      const JS::ProfilingFrameIterator::Frame& jsFrame = aJsFrames[jsIndex];
+      jitEndStackAddr = (uint8_t*)jsFrame.endStackAddress;
+      // Stringifying non-wasm JIT frames is delayed until streaming time. To
+      // re-lookup the entry in the JitcodeGlobalTable, we need to store the
+      // JIT code address (OptInfoAddr) in the circular buffer.
+      //
+      // Note that we cannot do this when we are sychronously sampling the
+      // current thread; that is, when called from profiler_get_backtrace. The
+      // captured backtrace is usually externally stored for an indeterminate
+      // amount of time, such as in nsRefreshDriver. Problematically, the
+      // stored backtrace may be alive across a GC during which the profiler
+      // itself is disabled. In that case, the JS engine is free to discard its
+      // JIT code. This means that if we inserted such OptInfoAddr entries into
+      // the buffer, nsRefreshDriver would now be holding on to a backtrace
+      // with stale JIT code return addresses.
+      if (aIsSynchronous ||
+          jsFrame.kind == JS::ProfilingFrameIterator::Frame_Wasm) {
+        aCollector.CollectWasmFrame(jsFrame.label);
+      } else if (jsFrame.kind ==
+                 JS::ProfilingFrameIterator::Frame_BaselineInterpreter) {
+        // Materialize a ProfilingStackFrame similar to the C++ Interpreter. We
+        // also set the IS_BLINTERP_FRAME flag to differentiate though.
+        JSScript* script = jsFrame.interpreterScript;
+        jsbytecode* pc = jsFrame.interpreterPC();
+        js::ProfilingStackFrame stackFrame;
+        constexpr uint32_t ExtraFlags =
+            uint32_t(js::ProfilingStackFrame::Flags::IS_BLINTERP_FRAME);
+        stackFrame.initJsFrame<JS::ProfilingCategoryPair::JS_BaselineInterpret,
+                               ExtraFlags>("", jsFrame.label, script, pc,
+                                           jsFrame.realmID);
+        aCollector.CollectProfilingStackFrame(stackFrame);
+      } else {
+        MOZ_ASSERT(jsFrame.kind == JS::ProfilingFrameIterator::Frame_Ion ||
+                   jsFrame.kind == JS::ProfilingFrameIterator::Frame_Baseline);
+        aCollector.CollectJitReturnAddr(jsFrame.returnAddress());
+      }
+
+      jsIndex--;
+      continue;
+    }
+
+    // If we reach here, there must be a native stack frame and it must be the
+    // greatest frame.
+    if (nativeStackAddr &&
+        // If the latest JS frame was JIT, this could be the native frame that
+        // corresponds to it. In that case, skip the native frame, because
+        // there's no need for the same frame to be present twice in the stack.
+        // The JS frame can be considered the symbolicated version of the native
+        // frame.
+        (!jitEndStackAddr || nativeStackAddr < jitEndStackAddr) &&
+        // This might still be a JIT operation, check to make sure that is not
+        // in range of the NEXT JavaScript's stacks' activation address.
+        (!jsActivationAddr || nativeStackAddr > jsActivationAddr)) {
+      MOZ_ASSERT(nativeIndex >= 0);
+      void* addr = (void*)aNativeStack.mPCs[nativeIndex];
+      aCollector.CollectNativeLeafAddr(addr);
+    }
+    if (nativeIndex >= 0) {
+      nativeIndex--;
+    }
+  }
+
+  // Update the JS context with the current profile sample buffer generation.
+  //
+  // Only do this for periodic samples. We don't want to do this for
+  // synchronous samples, and we also don't want to do it for calls to
+  // profiler_suspend_and_sample_thread() from the background hang reporter -
+  // in that case, aCollector.BufferRangeStart() will return Nothing().
+  if (!aIsSynchronous && context && aCollector.BufferRangeStart()) {
+    uint64_t bufferRangeStart = *aCollector.BufferRangeStart();
+    JS::SetJSContextProfilerSampleBufferRangeStart(context, bufferRangeStart);
+  }
+}
+
+#if defined(GP_OS_windows) && defined(USE_MOZ_STACK_WALK)
+static HANDLE GetThreadHandle(PlatformData* aData);
+#endif
+
+#if defined(USE_FRAME_POINTER_STACK_WALK) || defined(USE_MOZ_STACK_WALK)
+static void StackWalkCallback(uint32_t aFrameNumber, void* aPC, void* aSP,
+                              void* aClosure) {
+  NativeStack* nativeStack = static_cast<NativeStack*>(aClosure);
+  MOZ_ASSERT(nativeStack->mCount < MAX_NATIVE_FRAMES);
+  nativeStack->mSPs[nativeStack->mCount] = aSP;
+  nativeStack->mPCs[nativeStack->mCount] = aPC;
+  nativeStack->mCount++;
+}
+#endif
+
+#if defined(USE_FRAME_POINTER_STACK_WALK)
+static void DoFramePointerBacktrace(PSLockRef aLock,
+                                    const RegisteredThread& aRegisteredThread,
+                                    const Registers& aRegs,
+                                    NativeStack& aNativeStack) {
+  // WARNING: this function runs within the profiler's "critical section".
+  // WARNING: this function might be called while the profiler is inactive, and
+  //          cannot rely on ActivePS.
+
+  // Start with the current function. We use 0 as the frame number here because
+  // the FramePointerStackWalk() call below will use 1..N. This is a bit weird
+  // but it doesn't matter because StackWalkCallback() doesn't use the frame
+  // number argument.
+  StackWalkCallback(/* frameNum */ 0, aRegs.mPC, aRegs.mSP, &aNativeStack);
+
+  uint32_t maxFrames = uint32_t(MAX_NATIVE_FRAMES - aNativeStack.mCount);
+
+  const void* stackEnd = aRegisteredThread.StackTop();
+  if (aRegs.mFP >= aRegs.mSP && aRegs.mFP <= stackEnd) {
+    FramePointerStackWalk(StackWalkCallback, /* skipFrames */ 0, maxFrames,
+                          &aNativeStack, reinterpret_cast<void**>(aRegs.mFP),
+                          const_cast<void*>(stackEnd));
+  }
+}
+#endif
+
+#if defined(USE_MOZ_STACK_WALK)
+static void DoMozStackWalkBacktrace(PSLockRef aLock,
+                                    const RegisteredThread& aRegisteredThread,
+                                    const Registers& aRegs,
+                                    NativeStack& aNativeStack) {
+  // WARNING: this function runs within the profiler's "critical section".
+  // WARNING: this function might be called while the profiler is inactive, and
+  //          cannot rely on ActivePS.
+
+  // Start with the current function. We use 0 as the frame number here because
+  // the MozStackWalkThread() call below will use 1..N. This is a bit weird but
+  // it doesn't matter because StackWalkCallback() doesn't use the frame number
+  // argument.
+  StackWalkCallback(/* frameNum */ 0, aRegs.mPC, aRegs.mSP, &aNativeStack);
+
+  uint32_t maxFrames = uint32_t(MAX_NATIVE_FRAMES - aNativeStack.mCount);
+
+  HANDLE thread = GetThreadHandle(aRegisteredThread.GetPlatformData());
+  MOZ_ASSERT(thread);
+  MozStackWalkThread(StackWalkCallback, /* skipFrames */ 0, maxFrames,
+                     &aNativeStack, thread, /* context */ nullptr);
+}
+#endif
+
+#ifdef USE_EHABI_STACKWALK
+static void DoEHABIBacktrace(PSLockRef aLock,
+                             const RegisteredThread& aRegisteredThread,
+                             const Registers& aRegs,
+                             NativeStack& aNativeStack) {
+  // WARNING: this function runs within the profiler's "critical section".
+  // WARNING: this function might be called while the profiler is inactive, and
+  //          cannot rely on ActivePS.
+
+  aNativeStack.mCount =
+      EHABIStackWalk(aRegs.mContext->uc_mcontext,
+                     const_cast<void*>(aRegisteredThread.StackTop()),
+                     aNativeStack.mSPs, aNativeStack.mPCs, MAX_NATIVE_FRAMES);
+}
+#endif
+
+#ifdef USE_LUL_STACKWALK
+
+// See the comment at the callsite for why this function is necessary.
+#  if defined(MOZ_HAVE_ASAN_BLACKLIST)
+MOZ_ASAN_BLACKLIST static void ASAN_memcpy(void* aDst, const void* aSrc,
+                                           size_t aLen) {
+  // The obvious thing to do here is call memcpy(). However, although
+  // ASAN_memcpy() is not instrumented by ASAN, memcpy() still is, and the
+  // false positive still manifests! So we must implement memcpy() ourselves
+  // within this function.
+  char* dst = static_cast<char*>(aDst);
+  const char* src = static_cast<const char*>(aSrc);
+
+  for (size_t i = 0; i < aLen; i++) {
+    dst[i] = src[i];
+  }
+}
+#  endif
+
+static void DoLULBacktrace(PSLockRef aLock,
+                           const RegisteredThread& aRegisteredThread,
+                           const Registers& aRegs, NativeStack& aNativeStack) {
+  // WARNING: this function runs within the profiler's "critical section".
+  // WARNING: this function might be called while the profiler is inactive, and
+  //          cannot rely on ActivePS.
+
+  const mcontext_t* mc = &aRegs.mContext->uc_mcontext;
+
+  lul::UnwindRegs startRegs;
+  memset(&startRegs, 0, sizeof(startRegs));
+
+#  if defined(GP_PLAT_amd64_linux) || defined(GP_PLAT_amd64_android)
+  startRegs.xip = lul::TaggedUWord(mc->gregs[REG_RIP]);
+  startRegs.xsp = lul::TaggedUWord(mc->gregs[REG_RSP]);
+  startRegs.xbp = lul::TaggedUWord(mc->gregs[REG_RBP]);
+#  elif defined(GP_PLAT_amd64_freebsd)
+  startRegs.xip = lul::TaggedUWord(mc->mc_rip);
+  startRegs.xsp = lul::TaggedUWord(mc->mc_rsp);
+  startRegs.xbp = lul::TaggedUWord(mc->mc_rbp);
+#  elif defined(GP_PLAT_arm_linux) || defined(GP_PLAT_arm_android)
+  startRegs.r15 = lul::TaggedUWord(mc->arm_pc);
+  startRegs.r14 = lul::TaggedUWord(mc->arm_lr);
+  startRegs.r13 = lul::TaggedUWord(mc->arm_sp);
+  startRegs.r12 = lul::TaggedUWord(mc->arm_ip);
+  startRegs.r11 = lul::TaggedUWord(mc->arm_fp);
+  startRegs.r7 = lul::TaggedUWord(mc->arm_r7);
+#  elif defined(GP_PLAT_arm64_linux) || defined(GP_PLAT_arm64_android)
+  startRegs.pc = lul::TaggedUWord(mc->pc);
+  startRegs.x29 = lul::TaggedUWord(mc->regs[29]);
+  startRegs.x30 = lul::TaggedUWord(mc->regs[30]);
+  startRegs.sp = lul::TaggedUWord(mc->sp);
+#  elif defined(GP_PLAT_arm64_freebsd)
+  startRegs.pc = lul::TaggedUWord(mc->mc_gpregs.gp_elr);
+  startRegs.x29 = lul::TaggedUWord(mc->mc_gpregs.gp_x[29]);
+  startRegs.x30 = lul::TaggedUWord(mc->mc_gpregs.gp_lr);
+  startRegs.sp = lul::TaggedUWord(mc->mc_gpregs.gp_sp);
+#  elif defined(GP_PLAT_x86_linux) || defined(GP_PLAT_x86_android)
+  startRegs.xip = lul::TaggedUWord(mc->gregs[REG_EIP]);
+  startRegs.xsp = lul::TaggedUWord(mc->gregs[REG_ESP]);
+  startRegs.xbp = lul::TaggedUWord(mc->gregs[REG_EBP]);
+#  elif defined(GP_PLAT_mips64_linux)
+  startRegs.pc = lul::TaggedUWord(mc->pc);
+  startRegs.sp = lul::TaggedUWord(mc->gregs[29]);
+  startRegs.fp = lul::TaggedUWord(mc->gregs[30]);
+#  else
+#    error "Unknown plat"
+#  endif
+
+  // Copy up to N_STACK_BYTES from rsp-REDZONE upwards, but not going past the
+  // stack's registered top point.  Do some basic sanity checks too.  This
+  // assumes that the TaggedUWord holding the stack pointer value is valid, but
+  // it should be, since it was constructed that way in the code just above.
+
+  // We could construct |stackImg| so that LUL reads directly from the stack in
+  // question, rather than from a copy of it.  That would reduce overhead and
+  // space use a bit.  However, it gives a problem with dynamic analysis tools
+  // (ASan, TSan, Valgrind) which is that such tools will report invalid or
+  // racing memory accesses, and such accesses will be reported deep inside LUL.
+  // By taking a copy here, we can either sanitise the copy (for Valgrind) or
+  // copy it using an unchecked memcpy (for ASan, TSan).  That way we don't have
+  // to try and suppress errors inside LUL.
+  //
+  // N_STACK_BYTES is set to 160KB.  This is big enough to hold all stacks
+  // observed in some minutes of testing, whilst keeping the size of this
+  // function (DoNativeBacktrace)'s frame reasonable.  Most stacks observed in
+  // practice are small, 4KB or less, and so the copy costs are insignificant
+  // compared to other profiler overhead.
+  //
+  // |stackImg| is allocated on this (the sampling thread's) stack.  That
+  // implies that the frame for this function is at least N_STACK_BYTES large.
+  // In general it would be considered unacceptable to have such a large frame
+  // on a stack, but it only exists for the unwinder thread, and so is not
+  // expected to be a problem.  Allocating it on the heap is troublesome because
+  // this function runs whilst the sampled thread is suspended, so any heap
+  // allocation risks deadlock.  Allocating it as a global variable is not
+  // thread safe, which would be a problem if we ever allow multiple sampler
+  // threads.  Hence allocating it on the stack seems to be the least-worst
+  // option.
+
+  lul::StackImage stackImg;
+
+  {
+#  if defined(GP_PLAT_amd64_linux) || defined(GP_PLAT_amd64_android) || \
+      defined(GP_PLAT_amd64_freebsd)
+    uintptr_t rEDZONE_SIZE = 128;
+    uintptr_t start = startRegs.xsp.Value() - rEDZONE_SIZE;
+#  elif defined(GP_PLAT_arm_linux) || defined(GP_PLAT_arm_android)
+    uintptr_t rEDZONE_SIZE = 0;
+    uintptr_t start = startRegs.r13.Value() - rEDZONE_SIZE;
+#  elif defined(GP_PLAT_arm64_linux) || defined(GP_PLAT_arm64_android) || \
+      defined(GP_PLAT_arm64_freebsd)
+    uintptr_t rEDZONE_SIZE = 0;
+    uintptr_t start = startRegs.sp.Value() - rEDZONE_SIZE;
+#  elif defined(GP_PLAT_x86_linux) || defined(GP_PLAT_x86_android)
+    uintptr_t rEDZONE_SIZE = 0;
+    uintptr_t start = startRegs.xsp.Value() - rEDZONE_SIZE;
+#  elif defined(GP_PLAT_mips64_linux)
+    uintptr_t rEDZONE_SIZE = 0;
+    uintptr_t start = startRegs.sp.Value() - rEDZONE_SIZE;
+#  else
+#    error "Unknown plat"
+#  endif
+    uintptr_t end = reinterpret_cast<uintptr_t>(aRegisteredThread.StackTop());
+    uintptr_t ws = sizeof(void*);
+    start &= ~(ws - 1);
+    end &= ~(ws - 1);
+    uintptr_t nToCopy = 0;
+    if (start < end) {
+      nToCopy = end - start;
+      if (nToCopy > lul::N_STACK_BYTES) nToCopy = lul::N_STACK_BYTES;
+    }
+    MOZ_ASSERT(nToCopy <= lul::N_STACK_BYTES);
+    stackImg.mLen = nToCopy;
+    stackImg.mStartAvma = start;
+    if (nToCopy > 0) {
+      // If this is a vanilla memcpy(), ASAN makes the following complaint:
+      //
+      //   ERROR: AddressSanitizer: stack-buffer-underflow ...
+      //   ...
+      //   HINT: this may be a false positive if your program uses some custom
+      //   stack unwind mechanism or swapcontext
+      //
+      // This code is very much a custom stack unwind mechanism! So we use an
+      // alternative memcpy() implementation that is ignored by ASAN.
+#  if defined(MOZ_HAVE_ASAN_BLACKLIST)
+      ASAN_memcpy(&stackImg.mContents[0], (void*)start, nToCopy);
+#  else
+      memcpy(&stackImg.mContents[0], (void*)start, nToCopy);
+#  endif
+      (void)VALGRIND_MAKE_MEM_DEFINED(&stackImg.mContents[0], nToCopy);
+    }
+  }
+
+  size_t framePointerFramesAcquired = 0;
+  lul::LUL* lul = CorePS::Lul(aLock);
+  lul->Unwind(reinterpret_cast<uintptr_t*>(aNativeStack.mPCs),
+              reinterpret_cast<uintptr_t*>(aNativeStack.mSPs),
+              &aNativeStack.mCount, &framePointerFramesAcquired,
+              MAX_NATIVE_FRAMES, &startRegs, &stackImg);
+
+  // Update stats in the LUL stats object.  Unfortunately this requires
+  // three global memory operations.
+  lul->mStats.mContext += 1;
+  lul->mStats.mCFI += aNativeStack.mCount - 1 - framePointerFramesAcquired;
+  lul->mStats.mFP += framePointerFramesAcquired;
+}
+
+#endif
+
+#ifdef HAVE_NATIVE_UNWIND
+static void DoNativeBacktrace(PSLockRef aLock,
+                              const RegisteredThread& aRegisteredThread,
+                              const Registers& aRegs,
+                              NativeStack& aNativeStack) {
+  // This method determines which stackwalker is used for periodic and
+  // synchronous samples. (Backtrace samples are treated differently, see
+  // profiler_suspend_and_sample_thread() for details). The only part of the
+  // ordering that matters is that LUL must precede FRAME_POINTER, because on
+  // Linux they can both be present.
+#  if defined(USE_LUL_STACKWALK)
+  DoLULBacktrace(aLock, aRegisteredThread, aRegs, aNativeStack);
+#  elif defined(USE_EHABI_STACKWALK)
+  DoEHABIBacktrace(aLock, aRegisteredThread, aRegs, aNativeStack);
+#  elif defined(USE_FRAME_POINTER_STACK_WALK)
+  DoFramePointerBacktrace(aLock, aRegisteredThread, aRegs, aNativeStack);
+#  elif defined(USE_MOZ_STACK_WALK)
+  DoMozStackWalkBacktrace(aLock, aRegisteredThread, aRegs, aNativeStack);
+#  else
+#    error "Invalid configuration"
+#  endif
+}
+#endif
+
+// Writes some components shared by periodic and synchronous profiles to
+// ActivePS's ProfileBuffer. (This should only be called from DoSyncSample()
+// and DoPeriodicSample().)
+//
+// The grammar for entry sequences is in a comment above
+// ProfileBuffer::StreamSamplesToJSON.
+static inline void DoSharedSample(PSLockRef aLock, bool aIsSynchronous,
+                                  RegisteredThread& aRegisteredThread,
+                                  const Registers& aRegs, uint64_t aSamplePos,
+                                  ProfileBuffer& aBuffer) {
+  // WARNING: this function runs within the profiler's "critical section".
+
+  MOZ_ASSERT(!aBuffer.IsThreadSafe(),
+             "Mutexes cannot be used inside this critical section");
+
+  MOZ_RELEASE_ASSERT(ActivePS::Exists(aLock));
+
+  ProfileBufferCollector collector(aBuffer, aSamplePos);
+  NativeStack nativeStack;
+#if defined(HAVE_NATIVE_UNWIND)
+  if (ActivePS::FeatureStackWalk(aLock)) {
+    DoNativeBacktrace(aLock, aRegisteredThread, aRegs, nativeStack);
+
+    MergeStacks(ActivePS::Features(aLock), aIsSynchronous, aRegisteredThread,
+                aRegs, nativeStack, collector, CorePS::JsFrames(aLock));
+  } else
+#endif
+  {
+    MergeStacks(ActivePS::Features(aLock), aIsSynchronous, aRegisteredThread,
+                aRegs, nativeStack, collector, CorePS::JsFrames(aLock));
+
+    // We can't walk the whole native stack, but we can record the top frame.
+    if (ActivePS::FeatureLeaf(aLock)) {
+      aBuffer.AddEntry(ProfileBufferEntry::NativeLeafAddr((void*)aRegs.mPC));
+    }
+  }
+}
+
+// Writes the components of a synchronous sample to the given ProfileBuffer.
+static void DoSyncSample(PSLockRef aLock, RegisteredThread& aRegisteredThread,
+                         const TimeStamp& aNow, const Registers& aRegs,
+                         ProfileBuffer& aBuffer) {
+  // WARNING: this function runs within the profiler's "critical section".
+
+  uint64_t samplePos =
+      aBuffer.AddThreadIdEntry(aRegisteredThread.Info()->ThreadId());
+
+  TimeDuration delta = aNow - CorePS::ProcessStartTime();
+  aBuffer.AddEntry(ProfileBufferEntry::Time(delta.ToMilliseconds()));
+
+  DoSharedSample(aLock, /* aIsSynchronous = */ true, aRegisteredThread, aRegs,
+                 samplePos, aBuffer);
+}
+
+// Writes the components of a periodic sample to ActivePS's ProfileBuffer.
+// The ThreadId entry is already written in the main ProfileBuffer, its location
+// is `aSamplePos`, we can write the rest to `aBuffer` (which may be different).
+static inline void DoPeriodicSample(PSLockRef aLock,
+                                    RegisteredThread& aRegisteredThread,
+                                    const Registers& aRegs, uint64_t aSamplePos,
+                                    ProfileBuffer& aBuffer) {
+  // WARNING: this function runs within the profiler's "critical section".
+
+  DoSharedSample(aLock, /* aIsSynchronous = */ false, aRegisteredThread, aRegs,
+                 aSamplePos, aBuffer);
+}
+
+// END sampling/unwinding code
+////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN saving/streaming code
+
+const static uint64_t kJS_MAX_SAFE_UINTEGER = +9007199254740991ULL;
+
+static int64_t SafeJSInteger(uint64_t aValue) {
+  return aValue <= kJS_MAX_SAFE_UINTEGER ? int64_t(aValue) : -1;
+}
+
+static void AddSharedLibraryInfoToStream(JSONWriter& aWriter,
+                                         const SharedLibrary& aLib) {
+  aWriter.StartObjectElement();
+  aWriter.IntProperty("start", SafeJSInteger(aLib.GetStart()));
+  aWriter.IntProperty("end", SafeJSInteger(aLib.GetEnd()));
+  aWriter.IntProperty("offset", SafeJSInteger(aLib.GetOffset()));
+  aWriter.StringProperty("name", NS_ConvertUTF16toUTF8(aLib.GetModuleName()));
+  aWriter.StringProperty("path", NS_ConvertUTF16toUTF8(aLib.GetModulePath()));
+  aWriter.StringProperty("debugName",
+                         NS_ConvertUTF16toUTF8(aLib.GetDebugName()));
+  aWriter.StringProperty("debugPath",
+                         NS_ConvertUTF16toUTF8(aLib.GetDebugPath()));
+  aWriter.StringProperty("breakpadId", aLib.GetBreakpadId());
+  aWriter.StringProperty("arch", aLib.GetArch());
+  aWriter.EndObject();
+}
+
+void AppendSharedLibraries(JSONWriter& aWriter) {
+  SharedLibraryInfo info = SharedLibraryInfo::GetInfoForSelf();
+  info.SortByAddress();
+  for (size_t i = 0; i < info.GetSize(); i++) {
+    AddSharedLibraryInfoToStream(aWriter, info.GetEntry(i));
+  }
+}
+
+#ifdef MOZ_TASK_TRACER
+static void StreamNameAndThreadId(JSONWriter& aWriter, const char* aName,
+                                  int aThreadId) {
+  aWriter.StartObjectElement();
+  {
+    if (XRE_GetProcessType() == GeckoProcessType_Plugin) {
+      // TODO Add the proper plugin name
+      aWriter.StringProperty("name", "Plugin");
+    } else {
+      aWriter.StringProperty("name", aName);
+    }
+    aWriter.IntProperty("tid", aThreadId);
+  }
+  aWriter.EndObject();
+}
+#endif
+
+static void StreamTaskTracer(PSLockRef aLock, SpliceableJSONWriter& aWriter) {
+#ifdef MOZ_TASK_TRACER
+  MOZ_RELEASE_ASSERT(CorePS::Exists() && ActivePS::Exists(aLock));
+
+  aWriter.StartArrayProperty("data");
+  {
+    UniquePtr<Vector<nsCString>> data =
+        tasktracer::GetLoggedData(CorePS::ProcessStartTime());
+    for (const nsCString& dataString : *data) {
+      aWriter.StringElement(dataString.get());
+    }
+  }
+  aWriter.EndArray();
+
+  aWriter.StartArrayProperty("threads");
+  {
+    ActivePS::DiscardExpiredDeadProfiledThreads(aLock);
+    Vector<std::pair<RegisteredThread*, ProfiledThreadData*>> threads =
+        ActivePS::ProfiledThreads(aLock);
+    for (auto& thread : threads) {
+      RefPtr<ThreadInfo> info = thread.second->Info();
+      StreamNameAndThreadId(aWriter, info->Name(), info->ThreadId());
+    }
+  }
+  aWriter.EndArray();
+
+  aWriter.DoubleProperty("start",
+                         static_cast<double>(tasktracer::GetStartTime()));
+#endif
+}
+
+static void StreamCategories(SpliceableJSONWriter& aWriter) {
+  // Same order as ProfilingCategory. Format:
+  // [
+  //   {
+  //     name: "Idle",
+  //     color: "transparent",
+  //     subcategories: ["Other"],
+  //   },
+  //   {
+  //     name: "Other",
+  //     color: "grey",
+  //     subcategories: [
+  //       "JSM loading",
+  //       "Subprocess launching",
+  //       "DLL loading"
+  //     ]
+  //   },
+  //   ...
+  // ]
+
+#define CATEGORY_JSON_BEGIN_CATEGORY(name, labelAsString, color) \
+  aWriter.Start();                                               \
+  aWriter.StringProperty("name", labelAsString);                 \
+  aWriter.StringProperty("color", color);                        \
+  aWriter.StartArrayProperty("subcategories");
+#define CATEGORY_JSON_SUBCATEGORY(supercategory, name, labelAsString) \
+  aWriter.StringElement(labelAsString);
+#define CATEGORY_JSON_END_CATEGORY \
+  aWriter.EndArray();              \
+  aWriter.EndObject();
+
+  MOZ_PROFILING_CATEGORY_LIST(CATEGORY_JSON_BEGIN_CATEGORY,
+                              CATEGORY_JSON_SUBCATEGORY,
+                              CATEGORY_JSON_END_CATEGORY)
+
+#undef CATEGORY_JSON_BEGIN_CATEGORY
+#undef CATEGORY_JSON_SUBCATEGORY
+#undef CATEGORY_JSON_END_CATEGORY
+}
+
+static void StreamMarkerSchema(SpliceableJSONWriter& aWriter) {
+  // Get an array view with all registered marker-type-specific functions.
+  Span<const base_profiler_markers_detail::Streaming::MarkerTypeFunctions>
+      markerTypeFunctionsArray =
+          base_profiler_markers_detail::Streaming::MarkerTypeFunctionsArray();
+  // List of streamed marker names, this is used to spot duplicates.
+  std::set<std::string> names;
+  // Stream the display schema for each different one. (Duplications may come
+  // from the same code potentially living in different libraries.)
+  for (const auto& markerTypeFunctions : markerTypeFunctionsArray) {
+    auto name = markerTypeFunctions.mMarkerTypeNameFunction();
+    // std::set.insert(T&&) returns a pair, its `second` is true if the element
+    // was actually inserted (i.e., it was not there yet.)
+    const bool didInsert =
+        names.insert(std::string(name.data(), name.size())).second;
+    if (didInsert) {
+      markerTypeFunctions.mMarkerSchemaFunction().Stream(aWriter, name);
+    }
+  }
+}
+
+// Some meta information that is better recorded before streaming the profile.
+// This is *not* intended to be cached, as some values could change between
+// profiling sessions.
+struct PreRecordedMetaInformation {
+  bool mAsyncStacks;
+
+  // This struct should only live on the stack, so it's fine to use Auto
+  // strings.
+  nsAutoCString mHttpPlatform;
+  nsAutoCString mHttpOscpu;
+  nsAutoCString mHttpMisc;
+
+  nsAutoCString mRuntimeABI;
+  nsAutoCString mRuntimeToolkit;
+
+  nsAutoCString mAppInfoProduct;
+  nsAutoCString mAppInfoAppBuildID;
+  nsAutoCString mAppInfoSourceURL;
+
+  int32_t mProcessInfoCpuCount;
+  int32_t mProcessInfoCpuCores;
+};
+
+// This function should be called out of the profiler lock.
+// It gathers non-trivial data that doesn't require the profiler to stop, or for
+// which the request could theoretically deadlock if the profiler is locked.
+static PreRecordedMetaInformation PreRecordMetaInformation() {
+  gPSMutex.AssertCurrentThreadDoesNotOwn();
+
+  PreRecordedMetaInformation info = {};  // Aggregate-init all fields.
+
+  if (!NS_IsMainThread()) {
+    // Leave these properties out if we're not on the main thread.
+    // At the moment, the only case in which this function is called on a
+    // background thread is if we're in a content process and are going to
+    // send this profile to the parent process. In that case, the parent
+    // process profile's "meta" object already has the rest of the properties,
+    // and the parent process profile is dumped on that process's main thread.
+    return info;
+  }
+
+  info.mAsyncStacks = Preferences::GetBool("javascript.options.asyncstack");
+
+  nsresult res;
+
+  if (nsCOMPtr<nsIHttpProtocolHandler> http =
+          do_GetService(NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX "http", &res);
+      !NS_FAILED(res) && http) {
+    Unused << http->GetPlatform(info.mHttpPlatform);
+    Unused << http->GetOscpu(info.mHttpOscpu);
+    Unused << http->GetMisc(info.mHttpMisc);
+  }
+
+  if (nsCOMPtr<nsIXULRuntime> runtime =
+          do_GetService("@mozilla.org/xre/runtime;1");
+      runtime) {
+    Unused << runtime->GetXPCOMABI(info.mRuntimeABI);
+    Unused << runtime->GetWidgetToolkit(info.mRuntimeToolkit);
+  }
+
+  if (nsCOMPtr<nsIXULAppInfo> appInfo =
+          do_GetService("@mozilla.org/xre/app-info;1");
+      appInfo) {
+    Unused << appInfo->GetName(info.mAppInfoProduct);
+    Unused << appInfo->GetAppBuildID(info.mAppInfoAppBuildID);
+    Unused << appInfo->GetSourceURL(info.mAppInfoSourceURL);
+  }
+
+  ProcessInfo processInfo = {};  // Aggregate-init all fields to false/zeroes.
+  if (NS_SUCCEEDED(CollectProcessInfo(processInfo))) {
+    info.mProcessInfoCpuCount = processInfo.cpuCount;
+    info.mProcessInfoCpuCores = processInfo.cpuCores;
+  }
+
+  return info;
+}
+
+// Implemented in platform-specific cpps, to add object properties describing
+// the units of CPU measurements in samples.
+static void StreamMetaPlatformSampleUnits(PSLockRef aLock,
+                                          SpliceableJSONWriter& aWriter);
+
+static void StreamMetaJSCustomObject(
+    PSLockRef aLock, SpliceableJSONWriter& aWriter, bool aIsShuttingDown,
+    const PreRecordedMetaInformation& aPreRecordedMetaInformation) {
+  MOZ_RELEASE_ASSERT(CorePS::Exists() && ActivePS::Exists(aLock));
+
+  aWriter.IntProperty("version", 22);
+
+  // The "startTime" field holds the number of milliseconds since midnight
+  // January 1, 1970 GMT. This grotty code computes (Now - (Now -
+  // ProcessStartTime)) to convert CorePS::ProcessStartTime() into that form.
+  TimeDuration delta = TimeStamp::NowUnfuzzed() - CorePS::ProcessStartTime();
+  aWriter.DoubleProperty(
+      "startTime",
+      static_cast<double>(PR_Now() / 1000.0 - delta.ToMilliseconds()));
+
+  // Write the shutdownTime field. Unlike startTime, shutdownTime is not an
+  // absolute time stamp: It's relative to startTime. This is consistent with
+  // all other (non-"startTime") times anywhere in the profile JSON.
+  if (aIsShuttingDown) {
+    aWriter.DoubleProperty("shutdownTime", profiler_time());
+  } else {
+    aWriter.NullProperty("shutdownTime");
+  }
+
+  aWriter.StartArrayProperty("categories");
+  StreamCategories(aWriter);
+  aWriter.EndArray();
+
+  aWriter.StartArrayProperty("markerSchema");
+  StreamMarkerSchema(aWriter);
+  aWriter.EndArray();
+
+  ActivePS::WriteActiveConfiguration(aLock, aWriter,
+                                     MakeStringSpan("configuration"));
+
+  if (!NS_IsMainThread()) {
+    // Leave the rest of the properties out if we're not on the main thread.
+    // At the moment, the only case in which this function is called on a
+    // background thread is if we're in a content process and are going to
+    // send this profile to the parent process. In that case, the parent
+    // process profile's "meta" object already has the rest of the properties,
+    // and the parent process profile is dumped on that process's main thread.
+    return;
+  }
+
+  aWriter.DoubleProperty("interval", ActivePS::Interval(aLock));
+  aWriter.IntProperty("stackwalk", ActivePS::FeatureStackWalk(aLock));
+
+#ifdef DEBUG
+  aWriter.IntProperty("debug", 1);
+#else
+  aWriter.IntProperty("debug", 0);
+#endif
+
+  aWriter.IntProperty("gcpoison", JS::IsGCPoisoning() ? 1 : 0);
+
+  aWriter.IntProperty("asyncstack", aPreRecordedMetaInformation.mAsyncStacks);
+
+  aWriter.IntProperty("processType", XRE_GetProcessType());
+
+  aWriter.StringProperty("updateChannel", MOZ_STRINGIFY(MOZ_UPDATE_CHANNEL));
+
+  if (!aPreRecordedMetaInformation.mHttpPlatform.IsEmpty()) {
+    aWriter.StringProperty("platform",
+                           aPreRecordedMetaInformation.mHttpPlatform);
+  }
+  if (!aPreRecordedMetaInformation.mHttpOscpu.IsEmpty()) {
+    aWriter.StringProperty("oscpu", aPreRecordedMetaInformation.mHttpOscpu);
+  }
+  if (!aPreRecordedMetaInformation.mHttpMisc.IsEmpty()) {
+    aWriter.StringProperty("misc", aPreRecordedMetaInformation.mHttpMisc);
+  }
+
+  if (!aPreRecordedMetaInformation.mRuntimeABI.IsEmpty()) {
+    aWriter.StringProperty("abi", aPreRecordedMetaInformation.mRuntimeABI);
+  }
+  if (!aPreRecordedMetaInformation.mRuntimeToolkit.IsEmpty()) {
+    aWriter.StringProperty("toolkit",
+                           aPreRecordedMetaInformation.mRuntimeToolkit);
+  }
+
+  if (!aPreRecordedMetaInformation.mAppInfoProduct.IsEmpty()) {
+    aWriter.StringProperty("product",
+                           aPreRecordedMetaInformation.mAppInfoProduct);
+  }
+  if (!aPreRecordedMetaInformation.mAppInfoAppBuildID.IsEmpty()) {
+    aWriter.StringProperty("appBuildID",
+                           aPreRecordedMetaInformation.mAppInfoAppBuildID);
+  }
+  if (!aPreRecordedMetaInformation.mAppInfoSourceURL.IsEmpty()) {
+    aWriter.StringProperty("sourceURL",
+                           aPreRecordedMetaInformation.mAppInfoSourceURL);
+  }
+
+  if (aPreRecordedMetaInformation.mProcessInfoCpuCores > 0) {
+    aWriter.IntProperty("physicalCPUs",
+                        aPreRecordedMetaInformation.mProcessInfoCpuCores);
+  }
+  if (aPreRecordedMetaInformation.mProcessInfoCpuCount > 0) {
+    aWriter.IntProperty("logicalCPUs",
+                        aPreRecordedMetaInformation.mProcessInfoCpuCount);
+  }
+
+  aWriter.StartObjectProperty("sampleUnits");
+  {
+    aWriter.StringProperty("time", "ms");
+    aWriter.StringProperty("eventDelay", "ms");
+    StreamMetaPlatformSampleUnits(aLock, aWriter);
+  }
+  aWriter.EndObject();
+
+  // We should avoid collecting extension metadata for profiler while XPCOM is
+  // shutting down since it cannot create a new ExtensionPolicyService.
+  if (!gXPCOMShuttingDown) {
+    aWriter.StartObjectProperty("extensions");
+    {
+      {
+        JSONSchemaWriter schema(aWriter);
+        schema.WriteField("id");
+        schema.WriteField("name");
+        schema.WriteField("baseURL");
+      }
+
+      aWriter.StartArrayProperty("data");
+      {
+        nsTArray<RefPtr<WebExtensionPolicy>> exts;
+        ExtensionPolicyService::GetSingleton().GetAll(exts);
+
+        for (auto& ext : exts) {
+          aWriter.StartArrayElement(JSONWriter::SingleLineStyle);
+
+          nsAutoString id;
+          ext->GetId(id);
+          aWriter.StringElement(NS_ConvertUTF16toUTF8(id));
+
+          aWriter.StringElement(NS_ConvertUTF16toUTF8(ext->Name()));
+
+          auto url = ext->GetURL(u""_ns);
+          if (url.isOk()) {
+            aWriter.StringElement(NS_ConvertUTF16toUTF8(url.unwrap()));
+          }
+
+          aWriter.EndArray();
+        }
+      }
+      aWriter.EndArray();
+    }
+    aWriter.EndObject();
+  }
+}
+
+static void StreamPages(PSLockRef aLock, SpliceableJSONWriter& aWriter) {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+  ActivePS::DiscardExpiredPages(aLock);
+  for (const auto& page : ActivePS::ProfiledPages(aLock)) {
+    page->StreamJSON(aWriter);
+  }
+}
+
+#if defined(GP_OS_android)
+template <int N>
+static bool StartsWith(const nsACString& string, const char (&prefix)[N]) {
+  if (N - 1 > string.Length()) {
+    return false;
+  }
+  return memcmp(string.Data(), prefix, N - 1) == 0;
+}
+
+static JS::ProfilingCategoryPair InferJavaCategory(nsACString& aName) {
+  if (aName.EqualsLiteral("android.os.MessageQueue.nativePollOnce()")) {
+    return JS::ProfilingCategoryPair::IDLE;
+  }
+  if (aName.EqualsLiteral("java.lang.Object.wait()")) {
+    return JS::ProfilingCategoryPair::JAVA_BLOCKED;
+  }
+  if (StartsWith(aName, "android.") || StartsWith(aName, "com.android.")) {
+    return JS::ProfilingCategoryPair::JAVA_ANDROID;
+  }
+  if (StartsWith(aName, "mozilla.") || StartsWith(aName, "org.mozilla.")) {
+    return JS::ProfilingCategoryPair::JAVA_MOZILLA;
+  }
+  if (StartsWith(aName, "java.") || StartsWith(aName, "sun.") ||
+      StartsWith(aName, "com.sun.")) {
+    return JS::ProfilingCategoryPair::JAVA_LANGUAGE;
+  }
+  if (StartsWith(aName, "kotlin.") || StartsWith(aName, "kotlinx.")) {
+    return JS::ProfilingCategoryPair::JAVA_KOTLIN;
+  }
+  if (StartsWith(aName, "androidx.")) {
+    return JS::ProfilingCategoryPair::JAVA_ANDROIDX;
+  }
+  return JS::ProfilingCategoryPair::OTHER;
+}
+
+static void CollectJavaThreadProfileData(ProfileBuffer& aProfileBuffer) {
+  // locked_profiler_start uses sample count is 1000 for Java thread.
+  // This entry size is enough now, but we might have to estimate it
+  // if we can customize it
+
+  // Pass the samples
+  // FIXME(bug 1618560): We are currently only profiling the Android UI thread.
+  constexpr int threadId = 0;
+  int sampleId = 0;
+  while (true) {
+    // Gets the data from the Android UI thread only.
+    double sampleTime = java::GeckoJavaSampler::GetSampleTime(sampleId);
+    if (sampleTime == 0.0) {
+      break;
+    }
+
+    aProfileBuffer.AddThreadIdEntry(threadId);
+    aProfileBuffer.AddEntry(ProfileBufferEntry::Time(sampleTime));
+    int frameId = 0;
+    while (true) {
+      jni::String::LocalRef frameName =
+          java::GeckoJavaSampler::GetFrameName(sampleId, frameId++);
+      if (!frameName) {
+        break;
+      }
+      nsCString frameNameString = frameName->ToCString();
+
+      auto categoryPair = InferJavaCategory(frameNameString);
+      aProfileBuffer.CollectCodeLocation("", frameNameString.get(), 0, 0,
+                                         Nothing(), Nothing(),
+                                         Some(categoryPair));
+    }
+    sampleId++;
+  }
+
+  // Pass the markers now
+  while (true) {
+    // Gets the data from the Android UI thread only.
+    java::GeckoJavaSampler::Marker::LocalRef marker =
+        java::GeckoJavaSampler::PollNextMarker();
+    if (!marker) {
+      // All markers are transferred.
+      break;
+    }
+
+    // Get all the marker information from the Java thread using JNI.
+    nsCString markerName = marker->GetMarkerName()->ToCString();
+    jni::String::LocalRef text = marker->GetMarkerText();
+    TimeStamp startTime =
+        CorePS::ProcessStartTime() +
+        TimeDuration::FromMilliseconds(marker->GetStartTime());
+
+    double endTimeMs = marker->GetEndTime();
+    // A marker can be either a duration with start and end, or a point in time
+    // with only startTime. If endTime is 0, this means it's a point in time.
+    TimeStamp endTime = endTimeMs == 0
+                            ? startTime
+                            : CorePS::ProcessStartTime() +
+                                  TimeDuration::FromMilliseconds(endTimeMs);
+    MarkerTiming timing = endTimeMs == 0
+                              ? MarkerTiming::InstantAt(startTime)
+                              : MarkerTiming::Interval(startTime, endTime);
+
+    if (!text) {
+      // This marker doesn't have a text.
+      AddMarkerToBuffer(aProfileBuffer.UnderlyingChunkedBuffer(), markerName,
+                        geckoprofiler::category::JAVA_ANDROID,
+                        {MarkerThreadId(threadId), std::move(timing)});
+    } else {
+      // This marker has a text.
+      AddMarkerToBuffer(aProfileBuffer.UnderlyingChunkedBuffer(), markerName,
+                        geckoprofiler::category::JAVA_ANDROID,
+                        {MarkerThreadId(threadId), std::move(timing)},
+                        geckoprofiler::markers::TextMarker{},
+                        text->ToCString());
+    }
+  }
+}
+#endif
+
+UniquePtr<ProfilerCodeAddressService>
+profiler_code_address_service_for_presymbolication() {
+  static const bool preSymbolicate = []() {
+    const char* symbolicate = getenv("MOZ_PROFILER_SYMBOLICATE");
+    return symbolicate && symbolicate[0] != '\0';
+  }();
+  return preSymbolicate ? MakeUnique<ProfilerCodeAddressService>() : nullptr;
+}
+
+static void locked_profiler_stream_json_for_this_process(
+    PSLockRef aLock, SpliceableJSONWriter& aWriter, double aSinceTime,
+    const PreRecordedMetaInformation& aPreRecordedMetaInformation,
+    bool aIsShuttingDown, ProfilerCodeAddressService* aService) {
+  LOG("locked_profiler_stream_json_for_this_process");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists() && ActivePS::Exists(aLock));
+
+  AUTO_PROFILER_STATS(locked_profiler_stream_json_for_this_process);
+
+  const double collectionStartMs = profiler_time();
+
+  ProfileBuffer& buffer = ActivePS::Buffer(aLock);
+
+  // If there is a set "Window length", discard older data.
+  Maybe<double> durationS = ActivePS::Duration(aLock);
+  if (durationS.isSome()) {
+    const double durationStartMs = collectionStartMs - *durationS * 1000;
+    buffer.DiscardSamplesBeforeTime(durationStartMs);
+  }
+
+  // Put shared library info
+  aWriter.StartArrayProperty("libs");
+  AppendSharedLibraries(aWriter);
+  aWriter.EndArray();
+
+  // Put meta data
+  aWriter.StartObjectProperty("meta");
+  {
+    StreamMetaJSCustomObject(aLock, aWriter, aIsShuttingDown,
+                             aPreRecordedMetaInformation);
+  }
+  aWriter.EndObject();
+
+  // Put page data
+  aWriter.StartArrayProperty("pages");
+  { StreamPages(aLock, aWriter); }
+  aWriter.EndArray();
+
+  buffer.StreamProfilerOverheadToJSON(aWriter, CorePS::ProcessStartTime(),
+                                      aSinceTime);
+  buffer.StreamCountersToJSON(aWriter, CorePS::ProcessStartTime(), aSinceTime);
+
+  // Data of TaskTracer doesn't belong in the circular buffer.
+  if (ActivePS::FeatureTaskTracer(aLock)) {
+    aWriter.StartObjectProperty("tasktracer");
+    StreamTaskTracer(aLock, aWriter);
+    aWriter.EndObject();
+  }
+
+  // Lists the samples for each thread profile
+  aWriter.StartArrayProperty("threads");
+  {
+    ActivePS::DiscardExpiredDeadProfiledThreads(aLock);
+    Vector<std::pair<RegisteredThread*, ProfiledThreadData*>> threads =
+        ActivePS::ProfiledThreads(aLock);
+    for (auto& thread : threads) {
+      RegisteredThread* registeredThread = thread.first;
+      JSContext* cx =
+          registeredThread ? registeredThread->GetJSContext() : nullptr;
+      ProfiledThreadData* profiledThreadData = thread.second;
+      profiledThreadData->StreamJSON(
+          buffer, cx, aWriter, CorePS::ProcessName(aLock),
+          CorePS::ETLDplus1(aLock), CorePS::ProcessStartTime(), aSinceTime,
+          ActivePS::FeatureJSTracer(aLock), aService);
+    }
+
+#if defined(GP_OS_android)
+    if (ActivePS::FeatureJava(aLock)) {
+      // We are allocating it chunk by chunk. So this will not allocate 64 MiB
+      // at once. This size should be more than enough for java threads.
+      // This buffer is being created for each process but Android has
+      // relatively less processes compared to desktop, so it's okay here.
+      mozilla::ProfileBufferChunkManagerWithLocalLimit chunkManager(
+          64 * 1024 * 1024, 1024 * 1024);
+      ProfileChunkedBuffer bufferManager(
+          ProfileChunkedBuffer::ThreadSafety::WithoutMutex, chunkManager);
+      ProfileBuffer javaBuffer(bufferManager);
+      CollectJavaThreadProfileData(javaBuffer);
+
+      // Set the thread id of the Android UI thread to be 0.
+      // We are profiling the Android UI thread twice: Both from the C++ side
+      // (as a regular C++ profiled thread with the name "AndroidUI"), and from
+      // the Java side. The thread's actual ID is mozilla::jni::GetUIThreadId(),
+      // but since we're using that ID for the C++ side, we need to pick another
+      // tid that doesn't conflict with it for the Java side. So we just use 0.
+      // Once we add support for profiling of other java threads, we'll have to
+      // get their thread id and name via JNI.
+      RefPtr<ThreadInfo> threadInfo = new ThreadInfo(
+          "AndroidUI (JVM)", 0, false, CorePS::ProcessStartTime());
+      ProfiledThreadData profiledThreadData(threadInfo, nullptr);
+      profiledThreadData.StreamJSON(
+          javaBuffer, nullptr, aWriter, CorePS::ProcessName(aLock),
+          CorePS::ETLDplus1(aLock), CorePS::ProcessStartTime(), aSinceTime,
+          ActivePS::FeatureJSTracer(aLock), nullptr);
+    }
+#endif
+
+    UniquePtr<char[]> baseProfileThreads =
+        ActivePS::MoveBaseProfileThreads(aLock);
+    if (baseProfileThreads) {
+      aWriter.Splice(MakeStringSpan(baseProfileThreads.get()));
+    }
+  }
+  aWriter.EndArray();
+
+  if (ActivePS::FeatureJSTracer(aLock)) {
+    aWriter.StartArrayProperty("jsTracerDictionary");
+    {
+      JS::AutoTraceLoggerLockGuard lockGuard;
+      // Collect Event Dictionary
+      JS::TraceLoggerDictionaryBuffer collectionBuffer(lockGuard);
+      while (collectionBuffer.NextChunk()) {
+        aWriter.StringElement(
+            MakeStringSpan(collectionBuffer.internalBuffer()));
+      }
+    }
+    aWriter.EndArray();
+  }
+
+  aWriter.StartArrayProperty("pausedRanges");
+  { buffer.StreamPausedRangesToJSON(aWriter, aSinceTime); }
+  aWriter.EndArray();
+
+  const double collectionEndMs = profiler_time();
+
+  // Record timestamps for the collection into the buffer, so that consumers
+  // know why we didn't collect any samples for its duration.
+  // We put these entries into the buffer after we've collected the profile,
+  // so they'll be visible for the *next* profile collection (if they haven't
+  // been overwritten due to buffer wraparound by then).
+  buffer.AddEntry(ProfileBufferEntry::CollectionStart(collectionStartMs));
+  buffer.AddEntry(ProfileBufferEntry::CollectionEnd(collectionEndMs));
+}
+
+bool profiler_stream_json_for_this_process(
+    SpliceableJSONWriter& aWriter, double aSinceTime, bool aIsShuttingDown,
+    ProfilerCodeAddressService* aService) {
+  LOG("profiler_stream_json_for_this_process");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  const auto preRecordedMetaInformation = PreRecordMetaInformation();
+
+  PSAutoLock lock(gPSMutex);
+
+  if (!ActivePS::Exists(lock)) {
+    return false;
+  }
+
+  locked_profiler_stream_json_for_this_process(lock, aWriter, aSinceTime,
+                                               preRecordedMetaInformation,
+                                               aIsShuttingDown, aService);
+  return true;
+}
+
+// END saving/streaming code
+////////////////////////////////////////////////////////////////////////
+
+static char FeatureCategory(uint32_t aFeature) {
+  if (aFeature & DefaultFeatures()) {
+    if (aFeature & AvailableFeatures()) {
+      return 'D';
+    }
+    return 'd';
+  }
+
+  if (aFeature & StartupExtraDefaultFeatures()) {
+    if (aFeature & AvailableFeatures()) {
+      return 'S';
+    }
+    return 's';
+  }
+
+  if (aFeature & AvailableFeatures()) {
+    return '-';
+  }
+  return 'x';
+}
+
+// Doesn't exist if aExitCode is 0
+static void PrintUsageThenExit(int aExitCode) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+
+  printf(
+      "\n"
+      "Profiler environment variable usage:\n"
+      "\n"
+      "  MOZ_PROFILER_HELP\n"
+      "  If set to any value, prints this message.\n"
+      "  Use MOZ_BASE_PROFILER_HELP for BaseProfiler help.\n"
+      "\n"
+      "  MOZ_LOG\n"
+      "  Enables logging. The levels of logging available are\n"
+      "  'prof:3' (least verbose), 'prof:4', 'prof:5' (most verbose).\n"
+      "\n"
+      "  MOZ_PROFILER_STARTUP\n"
+      "  If set to any value other than '' or '0'/'N'/'n', starts the\n"
+      "  profiler immediately on start-up.\n"
+      "  Useful if you want profile code that runs very early.\n"
+      "\n"
+      "  MOZ_PROFILER_STARTUP_ENTRIES=<%u..%u>\n"
+      "  If MOZ_PROFILER_STARTUP is set, specifies the number of entries per\n"
+      "  process in the profiler's circular buffer when the profiler is first\n"
+      "  started.\n"
+      "  If unset, the platform default is used:\n"
+      "  %u entries per process, or %u when MOZ_PROFILER_STARTUP is set.\n"
+      "  (%u bytes per entry -> %u or %u total bytes per process)\n"
+      "\n"
+      "  MOZ_PROFILER_STARTUP_DURATION=<1..>\n"
+      "  If MOZ_PROFILER_STARTUP is set, specifies the maximum life time of\n"
+      "  entries in the the profiler's circular buffer when the profiler is\n"
+      "  first started, in seconds.\n"
+      "  If unset, the life time of the entries will only be restricted by\n"
+      "  MOZ_PROFILER_STARTUP_ENTRIES (or its default value), and no\n"
+      "  additional time duration restriction will be applied.\n"
+      "\n"
+      "  MOZ_PROFILER_STARTUP_INTERVAL=<1..%d>\n"
+      "  If MOZ_PROFILER_STARTUP is set, specifies the sample interval,\n"
+      "  measured in milliseconds, when the profiler is first started.\n"
+      "  If unset, the platform default is used.\n"
+      "\n"
+      "  MOZ_PROFILER_STARTUP_FEATURES_BITFIELD=<Number>\n"
+      "  If MOZ_PROFILER_STARTUP is set, specifies the profiling features, as\n"
+      "  the integer value of the features bitfield.\n"
+      "  If unset, the value from MOZ_PROFILER_STARTUP_FEATURES is used.\n"
+      "\n"
+      "  MOZ_PROFILER_STARTUP_FEATURES=<Features>\n"
+      "  If MOZ_PROFILER_STARTUP is set, specifies the profiling features, as\n"
+      "  a comma-separated list of strings.\n"
+      "  Ignored if  MOZ_PROFILER_STARTUP_FEATURES_BITFIELD is set.\n"
+      "  If unset, the platform default is used.\n"
+      "\n"
+      "    Features: (x=unavailable, D/d=default/unavailable,\n"
+      "               S/s=MOZ_PROFILER_STARTUP extra default/unavailable)\n",
+      unsigned(ActivePS::scMinimumBufferEntries),
+      unsigned(ActivePS::scMaximumBufferEntries),
+      unsigned(PROFILER_DEFAULT_ENTRIES.Value()),
+      unsigned(PROFILER_DEFAULT_STARTUP_ENTRIES.Value()),
+      unsigned(scBytesPerEntry),
+      unsigned(PROFILER_DEFAULT_ENTRIES.Value() * scBytesPerEntry),
+      unsigned(PROFILER_DEFAULT_STARTUP_ENTRIES.Value() * scBytesPerEntry),
+      PROFILER_MAX_INTERVAL);
+
+#define PRINT_FEATURE(n_, str_, Name_, desc_)                                  \
+  printf("    %c %7u: \"%s\" (%s)\n", FeatureCategory(ProfilerFeature::Name_), \
+         ProfilerFeature::Name_, str_, desc_);
+
+  PROFILER_FOR_EACH_FEATURE(PRINT_FEATURE)
+
+#undef PRINT_FEATURE
+
+  printf(
+      "    -        \"default\" (All above D+S defaults)\n"
+      "\n"
+      "  MOZ_PROFILER_STARTUP_FILTERS=<Filters>\n"
+      "  If MOZ_PROFILER_STARTUP is set, specifies the thread filters, as a\n"
+      "  comma-separated list of strings. A given thread will be sampled if\n"
+      "  any of the filters is a case-insensitive substring of the thread\n"
+      "  name. If unset, a default is used.\n"
+      "\n"
+      "  MOZ_PROFILER_SHUTDOWN\n"
+      "  If set, the profiler saves a profile to the named file on shutdown.\n"
+      "\n"
+      "  MOZ_PROFILER_SYMBOLICATE\n"
+      "  If set, the profiler will pre-symbolicate profiles.\n"
+      "  *Note* This will add a significant pause when gathering data, and\n"
+      "  is intended mainly for local development.\n"
+      "\n"
+      "  MOZ_PROFILER_LUL_TEST\n"
+      "  If set to any value, runs LUL unit tests at startup.\n"
+      "\n"
+      "  This platform %s native unwinding.\n"
+      "\n",
+#if defined(HAVE_NATIVE_UNWIND)
+      "supports"
+#else
+      "does not support"
+#endif
+  );
+
+  if (aExitCode != 0) {
+    exit(aExitCode);
+  }
+}
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN Sampler
+
+#if defined(GP_OS_linux) || defined(GP_OS_android)
+struct SigHandlerCoordinator;
+#endif
+
+// Sampler performs setup and teardown of the state required to sample with the
+// profiler. Sampler may exist when ActivePS is not present.
+//
+// SuspendAndSampleAndResumeThread must only be called from a single thread,
+// and must not sample the thread it is being called from. A separate Sampler
+// instance must be used for each thread which wants to capture samples.
+
+// WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
+//
+// With the exception of SamplerThread, all Sampler objects must be Disable-d
+// before releasing the lock which was used to create them. This avoids races
+// on linux with the SIGPROF signal handler.
+
+class Sampler {
+ public:
+  // Sets up the profiler such that it can begin sampling.
+  explicit Sampler(PSLockRef aLock);
+
+  // Disable the sampler, restoring it to its previous state. This must be
+  // called once, and only once, before the Sampler is destroyed.
+  void Disable(PSLockRef aLock);
+
+  // This method suspends and resumes the samplee thread. It calls the passed-in
+  // function-like object aProcessRegs (passing it a populated |const
+  // Registers&| arg) while the samplee thread is suspended.  Note that
+  // the aProcessRegs function must be very careful not to do anything that
+  // requires a lock, since we may have interrupted the thread at any point.
+  // As an example, you can't call TimeStamp::Now() since on windows it
+  // takes a lock on the performance counter.
+  //
+  // Func must be a function-like object of type `void()`.
+  template <typename Func>
+  void SuspendAndSampleAndResumeThread(
+      PSLockRef aLock, const RegisteredThread& aRegisteredThread,
+      const TimeStamp& aNow, const Func& aProcessRegs);
+
+ private:
+#if defined(GP_OS_linux) || defined(GP_OS_android) || defined(GP_OS_freebsd)
+  // Used to restore the SIGPROF handler when ours is removed.
+  struct sigaction mOldSigprofHandler;
+
+  // This process' ID. Needed as an argument for tgkill in
+  // SuspendAndSampleAndResumeThread.
+  int mMyPid;
+
+  // The sampler thread's ID.  Used to assert that it is not sampling itself,
+  // which would lead to deadlock.
+  int mSamplerTid;
+
+ public:
+  // This is the one-and-only variable used to communicate between the sampler
+  // thread and the samplee thread's signal handler. It's static because the
+  // samplee thread's signal handler is static.
+  static struct SigHandlerCoordinator* sSigHandlerCoordinator;
+#endif
+};
+
+// END Sampler
+////////////////////////////////////////////////////////////////////////
+
+// Platform-specific function that retrieves per-thread CPU measurements.
+static RunningTimes GetThreadRunningTimesDiff(
+    PSLockRef aLock, const RegisteredThread& aRegisteredThread);
+
+// Template function to be used by `GetThreadRunningTimesDiff()` (unless some
+// platform has a better way to achieve this).
+// It help perform CPU measurements and tie them to a timestamp, such that the
+// measurements and timestamp are very close together.
+// This is necessary, because the relative CPU usage is computed by dividing
+// consecutive CPU measurements by their timestamp difference; if there was an
+// unexpected big gap, it could skew this computation and produce impossible
+// spikes that would hide the rest of the data. See bug 1685938 for more info.
+// Note that this may call the measurement function more than once; it is
+// assumed to normally be fast.
+// This was verified experimentally, but there is currently no regression
+// testing for it; see follow-up bug 1687402.
+template <typename GetCPURunningTimesFunction>
+RunningTimes GetRunningTimesWithTightTimestamp(
+    GetCPURunningTimesFunction&& aGetCPURunningTimesFunction) {
+  // Once per process, compute a threshold over which running times and their
+  // timestamp is considered too far apart.
+  static const TimeDuration scMaxRunningTimesReadDuration = [&]() {
+    // Run the main CPU measurements + timestamp a number of times and capture
+    // their durations.
+    constexpr int loops = 128;
+    TimeDuration durations[loops];
+    RunningTimes runningTimes;
+    TimeStamp before = TimeStamp::NowUnfuzzed();
+    for (int i = 0; i < loops; ++i) {
+      AUTO_PROFILER_STATS(GetRunningTimes_MaxRunningTimesReadDuration);
+      aGetCPURunningTimesFunction(runningTimes);
+      const TimeStamp after = TimeStamp::NowUnfuzzed();
+      durations[i] = after - before;
+      before = after;
+    }
+    // Move median duration to the middle.
+    std::nth_element(&durations[0], &durations[loops / 2], &durations[loops]);
+    // Use median*8 as cut-off point.
+    // Typical durations should be around a microsecond, the cut-off should then
+    // be around 10 microseconds, well below the expected minimum inter-sample
+    // interval (observed as a few milliseconds), so overall this should keep
+    // cpu/interval spikes
+    return durations[loops / 2] * 8;
+  }();
+
+  // Record CPU measurements between two timestamps.
+  RunningTimes runningTimes;
+  TimeStamp before = TimeStamp::NowUnfuzzed();
+  aGetCPURunningTimesFunction(runningTimes);
+  TimeStamp after = TimeStamp::NowUnfuzzed();
+  // In most cases, the above should be quick enough. But if not, repeat:
+  while (MOZ_UNLIKELY(after - before > scMaxRunningTimesReadDuration)) {
+    AUTO_PROFILER_STATS(GetRunningTimes_REDO);
+    before = after;
+    aGetCPURunningTimesFunction(runningTimes);
+    after = TimeStamp::NowUnfuzzed();
+  }
+  // Finally, record the closest timestamp just after the final measurement was
+  // done. This must stay *after* the CPU measurements.
+  runningTimes.SetPostMeasurementTimeStamp(after);
+
+  return runningTimes;
+}
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN SamplerThread
+
+// The sampler thread controls sampling and runs whenever the profiler is
+// active. It periodically runs through all registered threads, finds those
+// that should be sampled, then pauses and samples them.
+
+class SamplerThread {
+ public:
+  // Creates a sampler thread, but doesn't start it.
+  SamplerThread(PSLockRef aLock, uint32_t aActivityGeneration,
+                double aIntervalMilliseconds);
+  ~SamplerThread();
+
+  // This runs on (is!) the sampler thread.
+  void Run();
+
+  // This runs on the main thread.
+  void Stop(PSLockRef aLock);
+
+  void AppendPostSamplingCallback(PSLockRef, PostSamplingCallback&& aCallback) {
+    // We are under lock, so it's safe to just modify the list pointer.
+    // Also this means the sampler has not started its run yet, so any callback
+    // added now will be invoked at the end of the next loop; this guarantees
+    // that the callback will be invoked after at least one full sampling loop.
+    mPostSamplingCallbackList = MakeUnique<PostSamplingCallbackListItem>(
+        std::move(mPostSamplingCallbackList), std::move(aCallback));
+  }
+
+ private:
+  // Item containing a post-sampling callback, and a tail-list of more items.
+  // Using a linked list means no need to move items when adding more, and
+  // "stealing" the whole list is one pointer move.
+  struct PostSamplingCallbackListItem {
+    UniquePtr<PostSamplingCallbackListItem> mPrev;
+    PostSamplingCallback mCallback;
+
+    PostSamplingCallbackListItem(UniquePtr<PostSamplingCallbackListItem> aPrev,
+                                 PostSamplingCallback&& aCallback)
+        : mPrev(std::move(aPrev)), mCallback(std::move(aCallback)) {}
+  };
+
+  [[nodiscard]] UniquePtr<PostSamplingCallbackListItem>
+  TakePostSamplingCallbacks(PSLockRef) {
+    return std::move(mPostSamplingCallbackList);
+  }
+
+  static void InvokePostSamplingCallbacks(
+      UniquePtr<PostSamplingCallbackListItem> aCallbacks,
+      SamplingState aSamplingState) {
+    if (!aCallbacks) {
+      return;
+    }
+    // We want to drill down to the last element in this list, which is the
+    // oldest one, so that we invoke them in FIFO order.
+    // We don't expect many callbacks, so it's safe to recurse. Note that we're
+    // moving-from the UniquePtr, so the tail will implicitly get destroyed.
+    InvokePostSamplingCallbacks(std::move(aCallbacks->mPrev), aSamplingState);
+    // We are going to destroy this item, so we can safely move-from the
+    // callback before calling it (in case it has an rvalue-ref-qualified call
+    // operator).
+    std::move(aCallbacks->mCallback)(aSamplingState);
+    // It may be tempting for a future maintainer to change aCallbacks into an
+    // rvalue reference; this will remind them not to do that!
+    static_assert(
+        std::is_same_v<decltype(aCallbacks),
+                       UniquePtr<PostSamplingCallbackListItem>>,
+        "We need to capture the list by-value, to implicitly destroy it");
+  }
+
+  // This suspends the calling thread for the given number of microseconds.
+  // Best effort timing.
+  void SleepMicro(uint32_t aMicroseconds);
+
+  // The sampler used to suspend and sample threads.
+  Sampler mSampler;
+
+  // The activity generation, for detecting when the sampler thread must stop.
+  const uint32_t mActivityGeneration;
+
+  // The interval between samples, measured in microseconds.
+  const int mIntervalMicroseconds;
+
+  // The OS-specific handle for the sampler thread.
+#if defined(GP_OS_windows)
+  HANDLE mThread;
+#elif defined(GP_OS_darwin) || defined(GP_OS_linux) || \
+    defined(GP_OS_android) || defined(GP_OS_freebsd)
+  pthread_t mThread;
+#endif
+
+  // Post-sampling callbacks are kept in a simple linked list, which will be
+  // stolen by the sampler thread at the end of its next run.
+  UniquePtr<PostSamplingCallbackListItem> mPostSamplingCallbackList;
+
+  SamplerThread(const SamplerThread&) = delete;
+  void operator=(const SamplerThread&) = delete;
+};
+
+// [[nodiscard]] static
+bool ActivePS::AppendPostSamplingCallback(PSLockRef aLock,
+                                          PostSamplingCallback&& aCallback) {
+  if (!sInstance || !sInstance->mSamplerThread) {
+    return false;
+  }
+  sInstance->mSamplerThread->AppendPostSamplingCallback(aLock,
+                                                        std::move(aCallback));
+  return true;
+}
+
+// This function is required because we need to create a SamplerThread within
+// ActivePS's constructor, but SamplerThread is defined after ActivePS. It
+// could probably be removed by moving some code around.
+static SamplerThread* NewSamplerThread(PSLockRef aLock, uint32_t aGeneration,
+                                       double aInterval) {
+  return new SamplerThread(aLock, aGeneration, aInterval);
+}
+
+// This function is the sampler thread.  This implementation is used for all
+// targets.
+void SamplerThread::Run() {
+  PR_SetCurrentThreadName("SamplerThread");
+
+  // Features won't change during this SamplerThread's lifetime, so we can read
+  // them once and store them locally.
+  const uint32_t features = []() -> uint32_t {
+    PSAutoLock lock(gPSMutex);
+    if (!ActivePS::Exists(lock)) {
+      // If there is no active profiler, it doesn't matter what we return,
+      // because this thread will exit before any feature is used.
+      return 0;
+    }
+    return ActivePS::Features(lock);
+  }();
+
+  // Not *no*-stack-sampling means we do want stack sampling.
+  const bool stackSampling = !ProfilerFeature::HasNoStackSampling(features);
+
+  const bool cpuUtilization = ProfilerFeature::HasCPUUtilization(features);
+
+  // Use local ProfileBuffer and underlying buffer to capture the stack.
+  // (This is to avoid touching the CorePS::CoreBuffer lock while a thread is
+  // suspended, because that thread could be working with the CorePS::CoreBuffer
+  // as well.)
+  mozilla::ProfileBufferChunkManagerSingle localChunkManager(
+      ProfileBufferChunkManager::scExpectedMaximumStackSize);
+  ProfileChunkedBuffer localBuffer(
+      ProfileChunkedBuffer::ThreadSafety::WithoutMutex, localChunkManager);
+  ProfileBuffer localProfileBuffer(localBuffer);
+
+  // Will be kept between collections, to know what each collection does.
+  auto previousState = localBuffer.GetState();
+
+  // This will be set inside the loop, from inside the lock scope, to capture
+  // all callbacks added before that, but none after the lock is released.
+  UniquePtr<PostSamplingCallbackListItem> postSamplingCallbacks;
+  // This will be set inside the loop, before invoking callbacks outside.
+  SamplingState samplingState{};
+
+  const TimeDuration sampleInterval =
+      TimeDuration::FromMicroseconds(mIntervalMicroseconds);
+  const uint32_t minimumIntervalSleepUs =
+      static_cast<uint32_t>(mIntervalMicroseconds / 4);
+
+  // This is the scheduled time at which each sampling loop should start.
+  // It will determine the ideal next sampling start by adding the expected
+  // interval, unless when sampling runs late -- See end of while() loop.
+  TimeStamp scheduledSampleStart = TimeStamp::NowUnfuzzed();
+
+  while (true) {
+    const TimeStamp sampleStart = TimeStamp::NowUnfuzzed();
+
+    // This scope is for |lock|. It ends before we sleep below.
+    {
+      // There should be no local callbacks left from a previous loop.
+      MOZ_ASSERT(!postSamplingCallbacks);
+
+      PSAutoLock lock(gPSMutex);
+      TimeStamp lockAcquired = TimeStamp::NowUnfuzzed();
+
+      // Move all the post-sampling callbacks locally, so that new ones cannot
+      // sneak in between the end of the lock scope and the invocation after it.
+      postSamplingCallbacks = TakePostSamplingCallbacks(lock);
+
+      if (!ActivePS::Exists(lock)) {
+        // Exit the `while` loop, including the lock scope, before invoking
+        // callbacks and returning.
+        samplingState = SamplingState::JustStopped;
+        break;
+      }
+
+      // At this point profiler_stop() might have been called, and
+      // profiler_start() might have been called on another thread. If this
+      // happens the generation won't match.
+      if (ActivePS::Generation(lock) != mActivityGeneration) {
+        samplingState = SamplingState::JustStopped;
+        // Exit the `while` loop, including the lock scope, before invoking
+        // callbacks and returning.
+        break;
+      }
+
+      ActivePS::ClearExpiredExitProfiles(lock);
+
+      TimeStamp expiredMarkersCleaned = TimeStamp::NowUnfuzzed();
+
+      if (!ActivePS::IsSamplingPaused(lock)) {
+        double sampleStartDeltaMs =
+            (sampleStart - CorePS::ProcessStartTime()).ToMilliseconds();
+        ProfileBuffer& buffer = ActivePS::Buffer(lock);
+
+        // handle per-process generic counters
+        const Vector<BaseProfilerCount*>& counters = CorePS::Counters(lock);
+        for (auto& counter : counters) {
+          // create Buffer entries for each counter
+          buffer.AddEntry(ProfileBufferEntry::CounterId(counter));
+          buffer.AddEntry(ProfileBufferEntry::Time(sampleStartDeltaMs));
+          // XXX support keyed maps of counts
+          // In the future, we'll support keyed counters - for example, counters
+          // with a key which is a thread ID. For "simple" counters we'll just
+          // use a key of 0.
+          int64_t count;
+          uint64_t number;
+          counter->Sample(count, number);
+          buffer.AddEntry(ProfileBufferEntry::CounterKey(0));
+          buffer.AddEntry(ProfileBufferEntry::Count(count));
+          if (number) {
+            buffer.AddEntry(ProfileBufferEntry::Number(number));
+          }
+        }
+        TimeStamp countersSampled = TimeStamp::NowUnfuzzed();
+
+        if (stackSampling || cpuUtilization) {
+          samplingState = SamplingState::SamplingCompleted;
+
+          const Vector<LiveProfiledThreadData>& liveThreads =
+              ActivePS::LiveProfiledThreads(lock);
+
+          for (auto& thread : liveThreads) {
+            RegisteredThread* registeredThread = thread.mRegisteredThread;
+            ProfiledThreadData* profiledThreadData =
+                thread.mProfiledThreadData.get();
+            RefPtr<ThreadInfo> info = registeredThread->Info();
+
+            const RunningTimes runningTimesDiff = [&]() {
+              if (!cpuUtilization) {
+                // If we don't need CPU measurements, we only need a timestamp.
+                return RunningTimes(TimeStamp::NowUnfuzzed());
+              }
+              return GetThreadRunningTimesDiff(lock, *registeredThread);
+            }();
+
+            const TimeStamp& now = runningTimesDiff.PostMeasurementTimeStamp();
+            double threadSampleDeltaMs =
+                (now - CorePS::ProcessStartTime()).ToMilliseconds();
+
+            // If the thread is asleep and has been sampled before in the same
+            // sleep episode, find and copy the previous sample, as that's
+            // cheaper than taking a new sample.
+            // However we're using current running times (instead of copying the
+            // old ones) because some work could have happened.
+            if (registeredThread->RacyRegisteredThread()
+                    .CanDuplicateLastSampleDueToSleep()) {
+              const bool dup_ok = ActivePS::Buffer(lock).DuplicateLastSample(
+                  info->ThreadId(), threadSampleDeltaMs,
+                  profiledThreadData->LastSample(), runningTimesDiff);
+              if (dup_ok) {
+                continue;
+              }
+            }
+
+            AUTO_PROFILER_STATS(gecko_SamplerThread_Run_DoPeriodicSample);
+
+            // Add the thread ID now, so we know its position in the main
+            // buffer, which is used by some JS data.
+            // (DoPeriodicSample only knows about the temporary local buffer.)
+            uint64_t samplePos =
+                buffer.AddThreadIdEntry(registeredThread->Info()->ThreadId());
+            profiledThreadData->LastSample() = Some(samplePos);
+
+            // Also add the time, so it's always there after the thread ID, as
+            // expected by the parser. (Other stack data is optional.)
+            buffer.AddEntry(ProfileBufferEntry::TimeBeforeCompactStack(
+                threadSampleDeltaMs));
+
+            Maybe<double> unresponsiveDuration_ms;
+
+            // If we have RunningTimes data, store it before the CompactStack.
+            // Note: It is not stored inside the CompactStack so that it doesn't
+            // get incorrectly duplicated when the thread is sleeping.
+            if (!runningTimesDiff.IsEmpty()) {
+              CorePS::CoreBuffer().PutObjects(
+                  ProfileBufferEntry::Kind::RunningTimes, runningTimesDiff);
+            }
+
+            if (stackSampling) {
+              // Suspend the thread and collect its stack data in the local
+              // buffer.
+              mSampler.SuspendAndSampleAndResumeThread(
+                  lock, *registeredThread, now,
+                  [&](const Registers& aRegs, const TimeStamp& aNow) {
+                    DoPeriodicSample(lock, *registeredThread, aRegs, samplePos,
+                                     localProfileBuffer);
+
+                    // For "eventDelay", we want the input delay - but if
+                    // there are no events in the input queue (or even if there
+                    // are), we're interested in how long the delay *would* be
+                    // for an input event now, which would be the time to finish
+                    // the current event + the delay caused by any events
+                    // already in the input queue (plus any High priority
+                    // events).  Events at lower priorities (in a
+                    // PrioritizedEventQueue) than Input count for input delay
+                    // only for the duration that they're running, since when
+                    // they finish, any queued input event would run.
+                    //
+                    // Unless we record the time state of all events and queue
+                    // states at all times, this is hard to precisely calculate,
+                    // but we can approximate it well in post-processing with
+                    // RunningEventDelay and RunningEventStart.
+                    //
+                    // RunningEventDelay is the time duration the event was
+                    // queued before starting execution.  RunningEventStart is
+                    // the time the event started. (Note: since we care about
+                    // Input event delays on MainThread, for
+                    // PrioritizedEventQueues we return 0 for RunningEventDelay
+                    // if the currently running event has a lower priority than
+                    // Input (since Input events won't queue behind them).
+                    //
+                    // To directly measure this we would need to record the time
+                    // at which the newest event currently in each queue at time
+                    // X (the sample time) finishes running.  This of course
+                    // would require looking into the future, or recording all
+                    // this state and then post-processing it later. If we were
+                    // to trace every event start and end we could do this, but
+                    // it would have significant overhead to do so (and buffer
+                    // usage).  From a recording of RunningEventDelays and
+                    // RunningEventStarts we can infer the actual delay:
+                    //
+                    // clang-format off
+                    // Event queue: <tail> D  :  C  :  B  : A <head>
+                    // Time inserted (ms): 40 :  20 : 10  : 0
+                    // Run Time (ms):      30 : 100 : 40  : 30
+                    //
+                    // 0    10   20   30   40   50   60   70   80   90  100  110  120  130  140  150  160  170
+                    // [A||||||||||||]
+                    //      ----------[B|||||||||||||||||]
+                    //           -------------------------[C|||||||||||||||||||||||||||||||||||||||||||||||]
+                    //                     -----------------------------------------------------------------[D|||||||||...]
+                    //
+                    // Calculate the delay of a new event added at time t: (run every sample)
+                    //    TimeSinceRunningEventBlockedInputEvents = RunningEventDelay + (now - RunningEventStart);
+                    //    effective_submission = now - TimeSinceRunningEventBlockedInputEvents;
+                    //    delta = (now - last_sample_time);
+                    //    last_sample_time = now;
+                    //    for (t=effective_submission to now) {
+                    //       delay[t] += delta;
+                    //    }
+                    //
+                    // Can be reduced in overhead by:
+                    //    TimeSinceRunningEventBlockedInputEvents = RunningEventDelay + (now - RunningEventStart);
+                    //    effective_submission = now - TimeSinceRunningEventBlockedInputEvents;
+                    //    if (effective_submission != last_submission) {
+                    //      delta = (now - last_submision);
+                    //      // this loop should be made to match each sample point in the range
+                    //      // intead of assuming 1ms sampling as this pseudocode does
+                    //      for (t=last_submission to effective_submission-1) {
+                    //         delay[t] += delta;
+                    //         delta -= 1; // assumes 1ms; adjust as needed to match for()
+                    //      }
+                    //      last_submission = effective_submission;
+                    //    }
+                    //
+                    // Time  Head of queue   Running Event  RunningEventDelay  Delay of       Effective     Started    Calc (submission->now add 10ms)  Final
+                    //                                                         hypothetical   Submission    Running @                                   result
+                    //                                                         event E
+                    // 0        Empty            A                0                30              0           0       @0=10                             30
+                    // 10         B              A                0                60              0           0       @0=20, @10=10                     60
+                    // 20         B              A                0               150              0           0       @0=30, @10=20, @20=10            150
+                    // 30         C              B               20               140             10          30       @10=20, @20=10, @30=0            140
+                    // 40         C              B               20               160                                  @10=30, @20=20...                160
+                    // 50         C              B               20               150                                                                   150
+                    // 60         C              B               20               140                                  @10=50, @20=40...                140
+                    // 70         D              C               50               130             20          70       @20=50, @30=40...                130
+                    // ...
+                    // 160        D              C               50                40                                  @20=140, @30=130...               40
+                    // 170      <empty>          D              140                30             40                   @40=140, @50=130... (rounding)    30
+                    // 180      <empty>          D              140                20             40                   @40=150                           20
+                    // 190      <empty>          D              140                10             40                   @40=160                           10
+                    // 200      <empty>        <empty>            0                 0             NA                                                      0
+                    //
+                    // Function Delay(t) = the time between t and the time at which a hypothetical
+                    // event e would start executing, if e was enqueued at time t.
+                    //
+                    // Delay(-1) = 0 // Before A was enqueued. No wait time, can start running
+                    //               // instantly.
+                    // Delay(0) = 30 // The hypothetical event e got enqueued just after A got
+                    //               // enqueued. It can start running at 30, when A is done.
+                    // Delay(5) = 25
+                    // Delay(10) = 60 // Can start running at 70, after both A and B are done.
+                    // Delay(19) = 51
+                    // Delay(20) = 150 // Can start running at 170, after A, B & C.
+                    // Delay(25) = 145
+                    // Delay(30) = 170 // Can start running at 200, after A, B, C & D.
+                    // Delay(120) = 80
+                    // Delay(200) = 0 // (assuming nothing was enqueued after D)
+                    //
+                    // For every event that gets enqueued, the Delay time will go up by the
+                    // event's running time at the time at which the event is enqueued.
+                    // The Delay function will be a sawtooth of the following shape:
+                    //
+                    //             |\           |...
+                    //             | \          |
+                    //        |\   |  \         |
+                    //        | \  |   \        |
+                    //     |\ |  \ |    \       |
+                    //  |\ | \|   \|     \      |
+                    //  | \|              \     |
+                    // _|                  \____|
+                    //
+                    //
+                    // A more complex example with a PrioritizedEventQueue:
+                    //
+                    // Event queue: <tail> D  :  C  :  B  : A <head>
+                    // Time inserted (ms): 40 :  20 : 10  : 0
+                    // Run Time (ms):      30 : 100 : 40  : 30
+                    // Priority:         Input: Norm: Norm: Norm
+                    //
+                    // 0    10   20   30   40   50   60   70   80   90  100  110  120  130  140  150  160  170
+                    // [A||||||||||||]
+                    //      ----------[B|||||||||||||||||]
+                    //           ----------------------------------------[C|||||||||||||||||||||||||||||||||||||||||||||||]
+                    //                     ---------------[D||||||||||||]
+                    //
+                    //
+                    // Time  Head of queue   Running Event  RunningEventDelay  Delay of       Effective   Started    Calc (submission->now add 10ms)   Final
+                    //                                                         hypothetical   Submission  Running @                                    result
+                    //                                                         event
+                    // 0        Empty            A                0                30              0           0       @0=10                             30
+                    // 10         B              A                0                20              0           0       @0=20, @10=10                     20
+                    // 20         B              A                0                10              0           0       @0=30, @10=20, @20=10             10
+                    // 30         C              B                0                40             30          30       @30=10                            40
+                    // 40         C              B                0                60             30                   @40=10, @30=20                    60
+                    // 50         C              B                0                50             30                   @50=10, @40=20, @30=30            50
+                    // 60         C              B                0                40             30                   @60=10, @50=20, @40=30, @30=40    40
+                    // 70         C              D               30                30             40          70       @60=20, @50=30, @40=40            30
+                    // 80         C              D               30                20             40          70       ...@50=40, @40=50                 20
+                    // 90         C              D               30                10             40          70       ...@60=40, @50=50, @40=60         10
+                    // 100      <empty>          C                0               100             100        100       @100=10                          100
+                    // 110      <empty>          C                0                90             100        100       @110=10, @100=20                  90
+
+                    //
+                    // For PrioritizedEventQueue, the definition of the Delay(t) function is adjusted: the hypothetical event e has Input priority.
+                    // Delay(-1) = 0 // Before A was enqueued. No wait time, can start running
+                    //               // instantly.
+                    // Delay(0) = 30 // The hypothetical input event e got enqueued just after A got
+                    //               // enqueued. It can start running at 30, when A is done.
+                    // Delay(5) = 25
+                    // Delay(10) = 20
+                    // Delay(25) = 5 // B has been queued, but e does not need to wait for B because e has Input priority and B does not.
+                    //               // So e can start running at 30, when A is done.
+                    // Delay(30) = 40 // Can start running at 70, after B is done.
+                    // Delay(40) = 60 // Can start at 100, after B and D are done (D is Input Priority)
+                    // Delay(80) = 20
+                    // Delay(100) = 100 // Wait for C to finish
+
+                    // clang-format on
+                    //
+                    // Alternatively we could insert (recycled instead of
+                    // allocated/freed) input events at every sample period
+                    // (1ms...), and use them to back-calculate the delay.  This
+                    // might also be somewhat expensive, and would require
+                    // guessing at the maximum delay, which would likely be in
+                    // the seconds, and so you'd need 1000's of pre-allocated
+                    // events per queue per thread - so there would be a memory
+                    // impact as well.
+
+                    TimeDuration currentEventDelay;
+                    TimeDuration currentEventRunning;
+                    registeredThread->GetRunningEventDelay(
+                        aNow, currentEventDelay, currentEventRunning);
+
+                    // Note: eventDelay is a different definition of
+                    // responsiveness than the 16ms event injection.
+
+                    // Don't suppress 0's for now; that can be a future
+                    // optimization.  We probably want one zero to be stored
+                    // before we start suppressing, which would be more
+                    // complex.
+                    unresponsiveDuration_ms =
+                        Some(currentEventDelay.ToMilliseconds() +
+                             currentEventRunning.ToMilliseconds());
+                  });
+
+              // If we got eventDelay data, store it before the CompactStack.
+              // Note: It is not stored inside the CompactStack so that it
+              // doesn't get incorrectly duplicated when the thread is sleeping.
+              if (unresponsiveDuration_ms.isSome()) {
+                CorePS::CoreBuffer().PutObjects(
+                    ProfileBufferEntry::Kind::UnresponsiveDurationMs,
+                    *unresponsiveDuration_ms);
+              }
+            }
+
+            // There *must* be a CompactStack after a TimeBeforeCompactStack;
+            // but note that other entries may have been concurrently inserted
+            // between the TimeBeforeCompactStack above and now. If the captured
+            // sample from `DoPeriodicSample` is complete, copy it into the
+            // global buffer, otherwise add an empty one to satisfy the parser
+            // that expects one.
+            auto state = localBuffer.GetState();
+            if (NS_WARN_IF(state.mFailedPutBytes !=
+                           previousState.mFailedPutBytes)) {
+              LOG("Stack sample too big for local storage, failed to store %u "
+                  "bytes",
+                  unsigned(state.mFailedPutBytes -
+                           previousState.mFailedPutBytes));
+              // There *must* be a CompactStack after a TimeBeforeCompactStack,
+              // even an empty one.
+              CorePS::CoreBuffer().PutObjects(
+                  ProfileBufferEntry::Kind::CompactStack,
+                  UniquePtr<ProfileChunkedBuffer>(nullptr));
+            } else if (state.mRangeEnd - previousState.mRangeEnd >=
+                       *CorePS::CoreBuffer().BufferLength()) {
+              LOG("Stack sample too big for profiler storage, needed %u bytes",
+                  unsigned(state.mRangeEnd - previousState.mRangeEnd));
+              // There *must* be a CompactStack after a TimeBeforeCompactStack,
+              // even an empty one.
+              CorePS::CoreBuffer().PutObjects(
+                  ProfileBufferEntry::Kind::CompactStack,
+                  UniquePtr<ProfileChunkedBuffer>(nullptr));
+            } else {
+              CorePS::CoreBuffer().PutObjects(
+                  ProfileBufferEntry::Kind::CompactStack, localBuffer);
+            }
+
+            // Clean up for the next run.
+            localBuffer.Clear();
+            previousState = localBuffer.GetState();
+          }
+        } else {
+          samplingState = SamplingState::NoStackSamplingCompleted;
+        }
+
+#if defined(USE_LUL_STACKWALK)
+        // The LUL unwind object accumulates frame statistics. Periodically we
+        // should poke it to give it a chance to print those statistics.  This
+        // involves doing I/O (fprintf, __android_log_print, etc.) and so
+        // can't safely be done from the critical section inside
+        // SuspendAndSampleAndResumeThread, which is why it is done here.
+        CorePS::Lul(lock)->MaybeShowStats();
+#endif
+        TimeStamp threadsSampled = TimeStamp::NowUnfuzzed();
+
+        {
+          AUTO_PROFILER_STATS(Sampler_FulfillChunkRequests);
+          ActivePS::FulfillChunkRequests(lock);
+        }
+
+        buffer.CollectOverheadStats(sampleStartDeltaMs,
+                                    lockAcquired - sampleStart,
+                                    expiredMarkersCleaned - lockAcquired,
+                                    countersSampled - expiredMarkersCleaned,
+                                    threadsSampled - countersSampled);
+      } else {
+        samplingState = SamplingState::SamplingPaused;
+      }
+    }
+    // gPSMutex is not held after this point.
+
+    // Invoke end-of-sampling callbacks outside of the locked scope.
+    InvokePostSamplingCallbacks(std::move(postSamplingCallbacks),
+                                samplingState);
+
+    ProfilerChild::ProcessPendingUpdate();
+
+    // We expect the next sampling loop to start `sampleInterval` after this
+    // loop here was scheduled to start.
+    scheduledSampleStart += sampleInterval;
+
+    // Try to sleep until we reach that next scheduled time.
+    const TimeStamp beforeSleep = TimeStamp::NowUnfuzzed();
+    if (scheduledSampleStart >= beforeSleep) {
+      // There is still time before the next scheduled sample time.
+      const uint32_t sleepTimeUs = static_cast<uint32_t>(
+          (scheduledSampleStart - beforeSleep).ToMicroseconds());
+      if (sleepTimeUs >= minimumIntervalSleepUs) {
+        SleepMicro(sleepTimeUs);
+      } else {
+        // If we're too close to that time, sleep the minimum amount of time.
+        // Note that the next scheduled start is not shifted, so at the end of
+        // the next loop, sleep may again be adjusted to get closer to schedule.
+        SleepMicro(minimumIntervalSleepUs);
+      }
+    } else {
+      // This sampling loop ended after the next sampling should have started!
+      // There is little point to try and keep up to schedule now, it would
+      // require more work, while it's likely we're late because the system is
+      // already busy. Try and restart a normal schedule from now.
+      scheduledSampleStart = beforeSleep + sampleInterval;
+      SleepMicro(static_cast<uint32_t>(sampleInterval.ToMicroseconds()));
+    }
+  }
+
+  // End of `while` loop. We can only be here from a `break` inside the loop.
+  InvokePostSamplingCallbacks(std::move(postSamplingCallbacks), samplingState);
+}
+
+// We #include these files directly because it means those files can use
+// declarations from this file trivially.  These provide target-specific
+// implementations of all SamplerThread methods except Run().
+#if defined(GP_OS_windows)
+#  include "platform-win32.cpp"
+#elif defined(GP_OS_darwin)
+#  include "platform-macos.cpp"
+#elif defined(GP_OS_linux) || defined(GP_OS_android) || defined(GP_OS_freebsd)
+#  include "platform-linux-android.cpp"
+#else
+#  error "bad platform"
+#endif
+
+UniquePlatformData AllocPlatformData(int aThreadId) {
+  return UniquePlatformData(new PlatformData(aThreadId));
+}
+
+void PlatformDataDestructor::operator()(PlatformData* aData) { delete aData; }
+
+// END SamplerThread
+////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////
+// BEGIN externally visible functions
+
+MOZ_DEFINE_MALLOC_SIZE_OF(GeckoProfilerMallocSizeOf)
+
+NS_IMETHODIMP
+GeckoProfilerReporter::CollectReports(nsIHandleReportCallback* aHandleReport,
+                                      nsISupports* aData, bool aAnonymize) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+
+  size_t profSize = 0;
+  size_t lulSize = 0;
+
+  {
+    PSAutoLock lock(gPSMutex);
+
+    if (CorePS::Exists()) {
+      CorePS::AddSizeOf(lock, GeckoProfilerMallocSizeOf, profSize, lulSize);
+    }
+
+    if (ActivePS::Exists(lock)) {
+      profSize += ActivePS::SizeOf(lock, GeckoProfilerMallocSizeOf);
+    }
+  }
+
+  MOZ_COLLECT_REPORT(
+      "explicit/profiler/profiler-state", KIND_HEAP, UNITS_BYTES, profSize,
+      "Memory used by the Gecko Profiler's global state (excluding memory used "
+      "by LUL).");
+
+#if defined(USE_LUL_STACKWALK)
+  MOZ_COLLECT_REPORT(
+      "explicit/profiler/lul", KIND_HEAP, UNITS_BYTES, lulSize,
+      "Memory used by LUL, a stack unwinder used by the Gecko Profiler.");
+#endif
+
+  return NS_OK;
+}
+
+NS_IMPL_ISUPPORTS(GeckoProfilerReporter, nsIMemoryReporter)
+
+static uint32_t ParseFeature(const char* aFeature, bool aIsStartup) {
+  if (strcmp(aFeature, "default") == 0) {
+    return (aIsStartup ? (DefaultFeatures() | StartupExtraDefaultFeatures())
+                       : DefaultFeatures()) &
+           AvailableFeatures();
+  }
+
+#define PARSE_FEATURE_BIT(n_, str_, Name_, desc_) \
+  if (strcmp(aFeature, str_) == 0) {              \
+    return ProfilerFeature::Name_;                \
+  }
+
+  PROFILER_FOR_EACH_FEATURE(PARSE_FEATURE_BIT)
+
+#undef PARSE_FEATURE_BIT
+
+  printf("\nUnrecognized feature \"%s\".\n\n", aFeature);
+  // Since we may have an old feature we don't implement anymore, don't exit
+  PrintUsageThenExit(0);
+  return 0;
+}
+
+uint32_t ParseFeaturesFromStringArray(const char** aFeatures,
+                                      uint32_t aFeatureCount,
+                                      bool aIsStartup /* = false */) {
+  uint32_t features = 0;
+  for (size_t i = 0; i < aFeatureCount; i++) {
+    features |= ParseFeature(aFeatures[i], aIsStartup);
+  }
+  return features;
+}
+
+static bool IsRegisteredThreadInRegisteredThreadsList(
+    PSLockRef aLock, RegisteredThread* aThread) {
+  const auto& registeredThreads = CorePS::RegisteredThreads(aLock);
+  for (const auto& registeredThread : registeredThreads) {
+    if (registeredThread.get() == aThread) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+static ProfilingStack* locked_register_thread(PSLockRef aLock,
+                                              const char* aName,
+                                              void* aStackTop) {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  VTUNE_REGISTER_THREAD(aName);
+
+  if (!TLSRegisteredThread::IsTLSInited()) {
+    return nullptr;
+  }
+
+  RefPtr<ThreadInfo> info =
+      new ThreadInfo(aName, profiler_current_thread_id(), NS_IsMainThread());
+  UniquePtr<RegisteredThread> registeredThread = MakeUnique<RegisteredThread>(
+      info, NS_GetCurrentThreadNoCreate(), aStackTop);
+
+  TLSRegisteredThread::SetRegisteredThreadAndAutoProfilerLabelProfilingStack(
+      aLock, registeredThread.get());
+
+  if (ActivePS::Exists(aLock) && ActivePS::ShouldProfileThread(aLock, info)) {
+    registeredThread->RacyRegisteredThread().SetIsBeingProfiled(true);
+    nsCOMPtr<nsIEventTarget> eventTarget = registeredThread->GetEventTarget();
+    ProfiledThreadData* profiledThreadData = ActivePS::AddLiveProfiledThread(
+        aLock, registeredThread.get(),
+        MakeUnique<ProfiledThreadData>(info, eventTarget));
+
+    if (ActivePS::FeatureJS(aLock)) {
+      // This StartJSSampling() call is on-thread, so we can poll manually to
+      // start JS sampling immediately.
+      registeredThread->StartJSSampling(ActivePS::JSFlags(aLock));
+      registeredThread->PollJSSampling();
+      if (registeredThread->GetJSContext()) {
+        profiledThreadData->NotifyReceivedJSContext(
+            ActivePS::Buffer(aLock).BufferRangeEnd());
+      }
+    }
+  }
+
+  MOZ_RELEASE_ASSERT(TLSRegisteredThread::RegisteredThread(aLock),
+                     "TLS should be set when registering thread");
+  MOZ_RELEASE_ASSERT(
+      registeredThread == TLSRegisteredThread::RegisteredThread(aLock),
+      "TLS should be set as expected when registering thread");
+
+  ProfilingStack* profilingStack =
+      &registeredThread->RacyRegisteredThread().ProfilingStack();
+
+  CorePS::AppendRegisteredThread(aLock, std::move(registeredThread));
+
+  return profilingStack;
+}
+
+static void NotifyObservers(const char* aTopic,
+                            nsISupports* aSubject = nullptr) {
+  if (!NS_IsMainThread()) {
+    // Dispatch a task to the main thread that notifies observers.
+    // If NotifyObservers is called both on and off the main thread within a
+    // short time, the order of the notifications can be different from the
+    // order of the calls to NotifyObservers.
+    // Getting the order 100% right isn't that important at the moment, because
+    // these notifications are only observed in the parent process, where the
+    // profiler_* functions are currently only called on the main thread.
+    nsCOMPtr<nsISupports> subject = aSubject;
+    NS_DispatchToMainThread(NS_NewRunnableFunction(
+        "NotifyObservers", [=] { NotifyObservers(aTopic, subject); }));
+    return;
+  }
+
+  if (nsCOMPtr<nsIObserverService> os = services::GetObserverService()) {
+    os->NotifyObservers(aSubject, aTopic, nullptr);
+  }
+}
+
+static void NotifyProfilerStarted(const PowerOfTwo32& aCapacity,
+                                  const Maybe<double>& aDuration,
+                                  double aInterval, uint32_t aFeatures,
+                                  const char** aFilters, uint32_t aFilterCount,
+                                  uint64_t aActiveBrowsingContextID) {
+  nsTArray<nsCString> filtersArray;
+  for (size_t i = 0; i < aFilterCount; ++i) {
+    filtersArray.AppendElement(aFilters[i]);
+  }
+
+  nsCOMPtr<nsIProfilerStartParams> params = new nsProfilerStartParams(
+      aCapacity.Value(), aDuration, aInterval, aFeatures,
+      std::move(filtersArray), aActiveBrowsingContextID);
+
+  ProfilerParent::ProfilerStarted(params);
+  NotifyObservers("profiler-started", params);
+}
+
+static void locked_profiler_start(PSLockRef aLock, PowerOfTwo32 aCapacity,
+                                  double aInterval, uint32_t aFeatures,
+                                  const char** aFilters, uint32_t aFilterCount,
+                                  uint64_t aActiveBrowsingContextID,
+                                  const Maybe<double>& aDuration);
+
+// This basically duplicates AutoProfilerLabel's constructor.
+static void* MozGlueLabelEnter(const char* aLabel, const char* aDynamicString,
+                               void* aSp) {
+  ProfilingStackOwner* profilingStackOwner =
+      AutoProfilerLabel::ProfilingStackOwnerTLS::Get();
+  if (profilingStackOwner) {
+    profilingStackOwner->ProfilingStack().pushLabelFrame(
+        aLabel, aDynamicString, aSp, JS::ProfilingCategoryPair::OTHER);
+  }
+  return profilingStackOwner;
+}
+
+// This basically duplicates AutoProfilerLabel's destructor.
+static void MozGlueLabelExit(void* aProfilingStackOwner) {
+  if (aProfilingStackOwner) {
+    reinterpret_cast<ProfilingStackOwner*>(aProfilingStackOwner)
+        ->ProfilingStack()
+        .pop();
+  }
+}
+
+static Vector<const char*> SplitAtCommas(const char* aString,
+                                         UniquePtr<char[]>& aStorage) {
+  size_t len = strlen(aString);
+  aStorage = MakeUnique<char[]>(len + 1);
+  PodCopy(aStorage.get(), aString, len + 1);
+
+  // Iterate over all characters in aStorage and split at commas, by
+  // overwriting commas with the null char.
+  Vector<const char*> array;
+  size_t currentElementStart = 0;
+  for (size_t i = 0; i <= len; i++) {
+    if (aStorage[i] == ',') {
+      aStorage[i] = '\0';
+    }
+    if (aStorage[i] == '\0') {
+      MOZ_RELEASE_ASSERT(array.append(&aStorage[currentElementStart]));
+      currentElementStart = i + 1;
+    }
+  }
+  return array;
+}
+
+void profiler_init_threadmanager() {
+  LOG("profiler_init_threadmanager");
+
+  PSAutoLock lock(gPSMutex);
+  RegisteredThread* registeredThread =
+      TLSRegisteredThread::RegisteredThread(lock);
+  if (registeredThread && !registeredThread->GetEventTarget()) {
+    registeredThread->ResetMainThread(NS_GetCurrentThreadNoCreate());
+  }
+}
+
+void profiler_init(void* aStackTop) {
+  LOG("profiler_init");
+
+  scProfilerMainThreadId = profiler_current_thread_id();
+
+  VTUNE_INIT();
+
+  MOZ_RELEASE_ASSERT(!CorePS::Exists());
+
+  if (getenv("MOZ_PROFILER_HELP")) {
+    PrintUsageThenExit(1);  // terminates execution
+  }
+
+  // This must be before any TLS access (e.g.: Thread registration, labels...).
+  TLSRegisteredThread::Init();
+
+  SharedLibraryInfo::Initialize();
+
+  uint32_t features = DefaultFeatures() & AvailableFeatures();
+
+  UniquePtr<char[]> filterStorage;
+
+  Vector<const char*> filters;
+  MOZ_RELEASE_ASSERT(filters.append("GeckoMain"));
+  MOZ_RELEASE_ASSERT(filters.append("Compositor"));
+  MOZ_RELEASE_ASSERT(filters.append("Renderer"));
+  MOZ_RELEASE_ASSERT(filters.append("DOM Worker"));
+
+  PowerOfTwo32 capacity = PROFILER_DEFAULT_ENTRIES;
+  Maybe<double> duration = Nothing();
+  double interval = PROFILER_DEFAULT_INTERVAL;
+
+  {
+    PSAutoLock lock(gPSMutex);
+
+    // We've passed the possible failure point. Instantiate CorePS, which
+    // indicates that the profiler has initialized successfully.
+    CorePS::Create(lock);
+
+    // profiler_init implicitly registers this thread as main thread.
+    Unused << locked_register_thread(lock, kMainThreadName, aStackTop);
+
+    // Platform-specific initialization.
+    PlatformInit(lock);
+
+#ifdef MOZ_TASK_TRACER
+    tasktracer::InitTaskTracer();
+#endif
+
+#if defined(GP_OS_android)
+    if (jni::IsAvailable()) {
+      GeckoJavaSampler::Init();
+    }
+#endif
+
+    // (Linux-only) We could create CorePS::mLul and read unwind info into it
+    // at this point. That would match the lifetime implied by destruction of
+    // it in profiler_shutdown() just below. However, that gives a big delay on
+    // startup, even if no profiling is actually to be done. So, instead, it is
+    // created on demand at the first call to PlatformStart().
+
+    const char* startupEnv = getenv("MOZ_PROFILER_STARTUP");
+    if (!startupEnv || startupEnv[0] == '\0' ||
+        ((startupEnv[0] == '0' || startupEnv[0] == 'N' ||
+          startupEnv[0] == 'n') &&
+         startupEnv[1] == '\0')) {
+      return;
+    }
+
+    LOG("- MOZ_PROFILER_STARTUP is set");
+
+    // Startup default capacity may be different.
+    capacity = PROFILER_DEFAULT_STARTUP_ENTRIES;
+
+    const char* startupCapacity = getenv("MOZ_PROFILER_STARTUP_ENTRIES");
+    if (startupCapacity && startupCapacity[0] != '\0') {
+      errno = 0;
+      long capacityLong = strtol(startupCapacity, nullptr, 10);
+      // `long` could be 32 or 64 bits, so we force a 64-bit comparison with
+      // the maximum 32-bit signed number (as more than that is clamped down to
+      // 2^31 anyway).
+      if (errno == 0 && capacityLong > 0 &&
+          static_cast<uint64_t>(capacityLong) <=
+              static_cast<uint64_t>(INT32_MAX)) {
+        capacity = PowerOfTwo32(ActivePS::ClampToAllowedEntries(
+            static_cast<uint32_t>(capacityLong)));
+        LOG("- MOZ_PROFILER_STARTUP_ENTRIES = %u", unsigned(capacity.Value()));
+      } else {
+        LOG("- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s",
+            startupCapacity);
+        PrintUsageThenExit(1);
+      }
+    }
+
+    const char* startupDuration = getenv("MOZ_PROFILER_STARTUP_DURATION");
+    if (startupDuration && startupDuration[0] != '\0') {
+      errno = 0;
+      double durationVal = PR_strtod(startupDuration, nullptr);
+      if (errno == 0 && durationVal >= 0.0) {
+        if (durationVal > 0.0) {
+          duration = Some(durationVal);
+        }
+        LOG("- MOZ_PROFILER_STARTUP_DURATION = %f", durationVal);
+      } else {
+        LOG("- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s",
+            startupDuration);
+        PrintUsageThenExit(1);
+      }
+    }
+
+    const char* startupInterval = getenv("MOZ_PROFILER_STARTUP_INTERVAL");
+    if (startupInterval && startupInterval[0] != '\0') {
+      errno = 0;
+      interval = PR_strtod(startupInterval, nullptr);
+      if (errno == 0 && interval > 0.0 && interval <= PROFILER_MAX_INTERVAL) {
+        LOG("- MOZ_PROFILER_STARTUP_INTERVAL = %f", interval);
+      } else {
+        LOG("- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s",
+            startupInterval);
+        PrintUsageThenExit(1);
+      }
+    }
+
+    features |= StartupExtraDefaultFeatures() & AvailableFeatures();
+
+    const char* startupFeaturesBitfield =
+        getenv("MOZ_PROFILER_STARTUP_FEATURES_BITFIELD");
+    if (startupFeaturesBitfield && startupFeaturesBitfield[0] != '\0') {
+      errno = 0;
+      features = strtol(startupFeaturesBitfield, nullptr, 10);
+      if (errno == 0 && features != 0) {
+        LOG("- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d", features);
+      } else {
+        LOG("- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s",
+            startupFeaturesBitfield);
+        PrintUsageThenExit(1);
+      }
+    } else {
+      const char* startupFeatures = getenv("MOZ_PROFILER_STARTUP_FEATURES");
+      if (startupFeatures && startupFeatures[0] != '\0') {
+        // Interpret startupFeatures as a list of feature strings, separated by
+        // commas.
+        UniquePtr<char[]> featureStringStorage;
+        Vector<const char*> featureStringArray =
+            SplitAtCommas(startupFeatures, featureStringStorage);
+        features = ParseFeaturesFromStringArray(featureStringArray.begin(),
+                                                featureStringArray.length(),
+                                                /* aIsStartup */ true);
+        LOG("- MOZ_PROFILER_STARTUP_FEATURES = %d", features);
+      }
+    }
+
+    const char* startupFilters = getenv("MOZ_PROFILER_STARTUP_FILTERS");
+    if (startupFilters && startupFilters[0] != '\0') {
+      filters = SplitAtCommas(startupFilters, filterStorage);
+      LOG("- MOZ_PROFILER_STARTUP_FILTERS = %s", startupFilters);
+    }
+
+    locked_profiler_start(lock, capacity, interval, features, filters.begin(),
+                          filters.length(), 0, duration);
+  }
+
+#if defined(MOZ_REPLACE_MALLOC) && defined(MOZ_PROFILER_MEMORY)
+  // Start counting memory allocations (outside of lock because this may call
+  // profiler_add_sampled_counter which would attempt to take the lock.)
+  mozilla::profiler::install_memory_hooks();
+#endif
+
+  // We do this with gPSMutex unlocked. The comment in profiler_stop() explains
+  // why.
+  NotifyProfilerStarted(capacity, duration, interval, features, filters.begin(),
+                        filters.length(), 0);
+}
+
+static void locked_profiler_save_profile_to_file(
+    PSLockRef aLock, const char* aFilename,
+    const PreRecordedMetaInformation& aPreRecordedMetaInformation,
+    bool aIsShuttingDown);
+
+static SamplerThread* locked_profiler_stop(PSLockRef aLock);
+
+void profiler_shutdown(IsFastShutdown aIsFastShutdown) {
+  LOG("profiler_shutdown");
+
+  VTUNE_SHUTDOWN();
+
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  const auto preRecordedMetaInformation = PreRecordMetaInformation();
+
+  ProfilerParent::ProfilerWillStopIfStarted();
+
+  // If the profiler is active we must get a handle to the SamplerThread before
+  // ActivePS is destroyed, in order to delete it.
+  SamplerThread* samplerThread = nullptr;
+  {
+    PSAutoLock lock(gPSMutex);
+
+    // Save the profile on shutdown if requested.
+    if (ActivePS::Exists(lock)) {
+      const char* filename = getenv("MOZ_PROFILER_SHUTDOWN");
+      if (filename) {
+        locked_profiler_save_profile_to_file(lock, filename,
+                                             preRecordedMetaInformation,
+                                             /* aIsShuttingDown */ true);
+      }
+      if (aIsFastShutdown == IsFastShutdown::Yes) {
+        return;
+      }
+
+      samplerThread = locked_profiler_stop(lock);
+    } else if (aIsFastShutdown == IsFastShutdown::Yes) {
+      return;
+    }
+
+    CorePS::Destroy(lock);
+
+    // We just destroyed CorePS and the ThreadInfos it contains, so we can
+    // clear this thread's TLSRegisteredThread.
+    TLSRegisteredThread::ResetRegisteredThread(lock);
+    // We can also clear the AutoProfilerLabel's ProfilingStack because the
+    // main thread should not use labels after profiler_shutdown.
+    TLSRegisteredThread::ResetAutoProfilerLabelProfilingStack(lock);
+
+#ifdef MOZ_TASK_TRACER
+    tasktracer::ShutdownTaskTracer();
+#endif
+  }
+
+  // We do these operations with gPSMutex unlocked. The comments in
+  // profiler_stop() explain why.
+  if (samplerThread) {
+    ProfilerParent::ProfilerStopped();
+    NotifyObservers("profiler-stopped");
+    delete samplerThread;
+  }
+}
+
+static bool WriteProfileToJSONWriter(SpliceableChunkedJSONWriter& aWriter,
+                                     double aSinceTime, bool aIsShuttingDown,
+                                     ProfilerCodeAddressService* aService) {
+  LOG("WriteProfileToJSONWriter");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  aWriter.Start();
+  {
+    if (!profiler_stream_json_for_this_process(aWriter, aSinceTime,
+                                               aIsShuttingDown, aService)) {
+      return false;
+    }
+
+    // Don't include profiles from other processes because this is a
+    // synchronous function.
+    aWriter.StartArrayProperty("processes");
+    aWriter.EndArray();
+  }
+  aWriter.End();
+  return true;
+}
+
+void profiler_set_process_name(const nsACString& aProcessName,
+                               const nsACString* aETLDplus1) {
+  LOG("profiler_set_process_name(\"%s\", \"%s\")", aProcessName.Data(),
+      aETLDplus1 ? aETLDplus1->Data() : "<none>");
+  PSAutoLock lock(gPSMutex);
+  CorePS::SetProcessName(lock, aProcessName);
+  if (aETLDplus1) {
+    CorePS::SetETLDplus1(lock, *aETLDplus1);
+  }
+}
+
+UniquePtr<char[]> profiler_get_profile(double aSinceTime,
+                                       bool aIsShuttingDown) {
+  LOG("profiler_get_profile");
+
+  UniquePtr<ProfilerCodeAddressService> service =
+      profiler_code_address_service_for_presymbolication();
+
+  SpliceableChunkedJSONWriter b;
+  if (!WriteProfileToJSONWriter(b, aSinceTime, aIsShuttingDown,
+                                service.get())) {
+    return nullptr;
+  }
+  return b.ChunkedWriteFunc().CopyData();
+}
+
+void profiler_get_profile_json_into_lazily_allocated_buffer(
+    const std::function<char*(size_t)>& aAllocator, double aSinceTime,
+    bool aIsShuttingDown) {
+  LOG("profiler_get_profile_json_into_lazily_allocated_buffer");
+
+  UniquePtr<ProfilerCodeAddressService> service =
+      profiler_code_address_service_for_presymbolication();
+
+  SpliceableChunkedJSONWriter b;
+  if (!WriteProfileToJSONWriter(b, aSinceTime, aIsShuttingDown,
+                                service.get())) {
+    return;
+  }
+
+  b.ChunkedWriteFunc().CopyDataIntoLazilyAllocatedBuffer(aAllocator);
+}
+
+void profiler_get_start_params(int* aCapacity, Maybe<double>* aDuration,
+                               double* aInterval, uint32_t* aFeatures,
+                               Vector<const char*>* aFilters,
+                               uint64_t* aActiveBrowsingContextID) {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  if (NS_WARN_IF(!aCapacity) || NS_WARN_IF(!aDuration) ||
+      NS_WARN_IF(!aInterval) || NS_WARN_IF(!aFeatures) ||
+      NS_WARN_IF(!aFilters)) {
+    return;
+  }
+
+  PSAutoLock lock(gPSMutex);
+
+  if (!ActivePS::Exists(lock)) {
+    *aCapacity = 0;
+    *aDuration = Nothing();
+    *aInterval = 0;
+    *aFeatures = 0;
+    *aActiveBrowsingContextID = 0;
+    aFilters->clear();
+    return;
+  }
+
+  *aCapacity = ActivePS::Capacity(lock).Value();
+  *aDuration = ActivePS::Duration(lock);
+  *aInterval = ActivePS::Interval(lock);
+  *aFeatures = ActivePS::Features(lock);
+  *aActiveBrowsingContextID = ActivePS::ActiveBrowsingContextID(lock);
+
+  const Vector<std::string>& filters = ActivePS::Filters(lock);
+  MOZ_ALWAYS_TRUE(aFilters->resize(filters.length()));
+  for (uint32_t i = 0; i < filters.length(); ++i) {
+    (*aFilters)[i] = filters[i].c_str();
+  }
+}
+
+ProfileBufferControlledChunkManager* profiler_get_controlled_chunk_manager() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+  PSAutoLock lock(gPSMutex);
+  if (NS_WARN_IF(!ActivePS::Exists(lock))) {
+    return nullptr;
+  }
+  return &ActivePS::ControlledChunkManager(lock);
+}
+
+namespace mozilla {
+
+void GetProfilerEnvVarsForChildProcess(
+    std::function<void(const char* key, const char* value)>&& aSetEnv) {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  if (!ActivePS::Exists(lock)) {
+    aSetEnv("MOZ_PROFILER_STARTUP", "");
+    return;
+  }
+
+  aSetEnv("MOZ_PROFILER_STARTUP", "1");
+
+  // Hidden option to stop Base Profiler, mostly due to Talos intermittents,
+  // see https://bugzilla.mozilla.org/show_bug.cgi?id=1638851#c3
+  // TODO: Investigate root cause and remove this in bugs 1648324 and 1648325.
+  if (getenv("MOZ_PROFILER_STARTUP_NO_BASE")) {
+    aSetEnv("MOZ_PROFILER_STARTUP_NO_BASE", "1");
+  }
+
+  auto capacityString =
+      Smprintf("%u", unsigned(ActivePS::Capacity(lock).Value()));
+  aSetEnv("MOZ_PROFILER_STARTUP_ENTRIES", capacityString.get());
+
+  // Use AppendFloat instead of Smprintf with %f because the decimal
+  // separator used by %f is locale-dependent. But the string we produce needs
+  // to be parseable by strtod, which only accepts the period character as a
+  // decimal separator. AppendFloat always uses the period character.
+  nsCString intervalString;
+  intervalString.AppendFloat(ActivePS::Interval(lock));
+  aSetEnv("MOZ_PROFILER_STARTUP_INTERVAL", intervalString.get());
+
+  auto featuresString = Smprintf("%d", ActivePS::Features(lock));
+  aSetEnv("MOZ_PROFILER_STARTUP_FEATURES_BITFIELD", featuresString.get());
+
+  std::string filtersString;
+  const Vector<std::string>& filters = ActivePS::Filters(lock);
+  for (uint32_t i = 0; i < filters.length(); ++i) {
+    if (i != 0) {
+      filtersString += ",";
+    }
+    filtersString += filters[i];
+  }
+  aSetEnv("MOZ_PROFILER_STARTUP_FILTERS", filtersString.c_str());
+}
+
+}  // namespace mozilla
+
+void profiler_received_exit_profile(const nsCString& aExitProfile) {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+  PSAutoLock lock(gPSMutex);
+  if (!ActivePS::Exists(lock)) {
+    return;
+  }
+  ActivePS::AddExitProfile(lock, aExitProfile);
+}
+
+Vector<nsCString> profiler_move_exit_profiles() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+  PSAutoLock lock(gPSMutex);
+  Vector<nsCString> profiles;
+  if (ActivePS::Exists(lock)) {
+    profiles = ActivePS::MoveExitProfiles(lock);
+  }
+  return profiles;
+}
+
+static void locked_profiler_save_profile_to_file(
+    PSLockRef aLock, const char* aFilename,
+    const PreRecordedMetaInformation& aPreRecordedMetaInformation,
+    bool aIsShuttingDown = false) {
+  LOG("locked_profiler_save_profile_to_file(%s)", aFilename);
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists() && ActivePS::Exists(aLock));
+
+  std::ofstream stream;
+  stream.open(aFilename);
+  if (stream.is_open()) {
+    SpliceableJSONWriter w(MakeUnique<OStreamJSONWriteFunc>(stream));
+    w.Start();
+    {
+      locked_profiler_stream_json_for_this_process(aLock, w, /* sinceTime */ 0,
+                                                   aPreRecordedMetaInformation,
+                                                   aIsShuttingDown, nullptr);
+
+      w.StartArrayProperty("processes");
+      Vector<nsCString> exitProfiles = ActivePS::MoveExitProfiles(aLock);
+      for (auto& exitProfile : exitProfiles) {
+        if (!exitProfile.IsEmpty()) {
+          w.Splice(exitProfile);
+        }
+      }
+      w.EndArray();
+    }
+    w.End();
+
+    stream.close();
+  }
+}
+
+void profiler_save_profile_to_file(const char* aFilename) {
+  LOG("profiler_save_profile_to_file(%s)", aFilename);
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  const auto preRecordedMetaInformation = PreRecordMetaInformation();
+
+  PSAutoLock lock(gPSMutex);
+
+  if (!ActivePS::Exists(lock)) {
+    return;
+  }
+
+  locked_profiler_save_profile_to_file(lock, aFilename,
+                                       preRecordedMetaInformation);
+}
+
+uint32_t profiler_get_available_features() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+  return AvailableFeatures();
+}
+
+Maybe<ProfilerBufferInfo> profiler_get_buffer_info() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  if (!ActivePS::Exists(lock)) {
+    return Nothing();
+  }
+
+  return Some(ActivePS::Buffer(lock).GetProfilerBufferInfo());
+}
+
+static void PollJSSamplingForCurrentThread() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  RegisteredThread* registeredThread =
+      TLSRegisteredThread::RegisteredThread(lock);
+  if (!registeredThread) {
+    return;
+  }
+
+  registeredThread->PollJSSampling();
+}
+
+// When the profiler is started on a background thread, we can't synchronously
+// call PollJSSampling on the main thread's ThreadInfo. And the next regular
+// call to PollJSSampling on the main thread would only happen once the main
+// thread triggers a JS interrupt callback.
+// This means that all the JS execution between profiler_start() and the first
+// JS interrupt would happen with JS sampling disabled, and we wouldn't get any
+// JS function information for that period of time.
+// So in order to start JS sampling as soon as possible, we dispatch a runnable
+// to the main thread which manually calls PollJSSamplingForCurrentThread().
+// In some cases this runnable will lose the race with the next JS interrupt.
+// That's fine; PollJSSamplingForCurrentThread() is immune to redundant calls.
+static void TriggerPollJSSamplingOnMainThread() {
+  nsCOMPtr<nsIThread> mainThread;
+  nsresult rv = NS_GetMainThread(getter_AddRefs(mainThread));
+  if (NS_SUCCEEDED(rv) && mainThread) {
+    nsCOMPtr<nsIRunnable> task =
+        NS_NewRunnableFunction("TriggerPollJSSamplingOnMainThread",
+                               []() { PollJSSamplingForCurrentThread(); });
+    SchedulerGroup::Dispatch(TaskCategory::Other, task.forget());
+  }
+}
+
+static bool HasMinimumLength(const char* aString, size_t aMinimumLength) {
+  if (!aString) {
+    return false;
+  }
+  for (size_t i = 0; i < aMinimumLength; ++i) {
+    if (aString[i] == '\0') {
+      return false;
+    }
+  }
+  return true;
+}
+
+static void locked_profiler_start(PSLockRef aLock, PowerOfTwo32 aCapacity,
+                                  double aInterval, uint32_t aFeatures,
+                                  const char** aFilters, uint32_t aFilterCount,
+                                  uint64_t aActiveBrowsingContextID,
+                                  const Maybe<double>& aDuration) {
+  if (LOG_TEST) {
+    LOG("locked_profiler_start");
+    LOG("- capacity  = %u", unsigned(aCapacity.Value()));
+    LOG("- duration  = %.2f", aDuration ? *aDuration : -1);
+    LOG("- interval = %.2f", aInterval);
+    LOG("- browsing context ID = %" PRIu64, aActiveBrowsingContextID);
+
+#define LOG_FEATURE(n_, str_, Name_, desc_)     \
+  if (ProfilerFeature::Has##Name_(aFeatures)) { \
+    LOG("- feature  = %s", str_);               \
+  }
+
+    PROFILER_FOR_EACH_FEATURE(LOG_FEATURE)
+
+#undef LOG_FEATURE
+
+    for (uint32_t i = 0; i < aFilterCount; i++) {
+      LOG("- threads  = %s", aFilters[i]);
+    }
+  }
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists() && !ActivePS::Exists(aLock));
+
+  UniquePtr<char[]> baseprofile;
+  if (baseprofiler::profiler_is_active()) {
+    // Note that we still hold the lock, so the sampler cannot run yet and
+    // interact negatively with the still-active BaseProfiler sampler.
+    // Assume that Base Profiler is active because of MOZ_PROFILER_STARTUP.
+    // Capture the Base Profiler startup profile threads (if any).
+    baseprofile = baseprofiler::profiler_get_profile(
+        /* aSinceTime */ 0, /* aIsShuttingDown */ false,
+        /* aOnlyThreads */ true);
+
+    // Now stop Base Profiler (BP), as further recording will be ignored anyway,
+    // and so that it won't clash with Gecko Profiler (GP) sampling starting
+    // after the lock is dropped.
+    // On Linux this is especially important to do before creating the GP
+    // sampler, because the BP sampler may send a signal (to stop threads to be
+    // sampled), which the GP would intercept before its own initialization is
+    // complete and ready to handle such signals.
+    // Note that even though `profiler_stop()` doesn't immediately destroy and
+    // join the sampler thread, it safely deactivates it in such a way that the
+    // thread will soon exit without doing any actual work.
+    // TODO: Allow non-sampling profiling to continue.
+    // TODO: Re-start BP after GP shutdown, to capture post-XPCOM shutdown.
+    baseprofiler::profiler_stop();
+  }
+
+#if defined(GP_PLAT_amd64_windows)
+  InitializeWin64ProfilerHooks();
+#endif
+
+  // Fall back to the default values if the passed-in values are unreasonable.
+  // We want to be able to store at least one full stack.
+  PowerOfTwo32 capacity =
+      (aCapacity.Value() >=
+       ProfileBufferChunkManager::scExpectedMaximumStackSize / scBytesPerEntry)
+          ? aCapacity
+          : PROFILER_DEFAULT_ENTRIES;
+  Maybe<double> duration = aDuration;
+
+  if (aDuration && *aDuration <= 0) {
+    duration = Nothing();
+  }
+
+  double interval = aInterval > 0 ? aInterval : PROFILER_DEFAULT_INTERVAL;
+
+  ActivePS::Create(aLock, capacity, interval, aFeatures, aFilters, aFilterCount,
+                   aActiveBrowsingContextID, duration);
+
+  // ActivePS::Create can only succeed or crash.
+  MOZ_ASSERT(ActivePS::Exists(aLock));
+
+  // An "empty" profile string may in fact contain 1 character (a newline), so
+  // we want at least 2 characters to register a profile.
+  if (HasMinimumLength(baseprofile.get(), 2)) {
+    // The BaseProfiler startup profile will be stored as a separate "process"
+    // in the Gecko Profiler profile, and shown as a new track under the
+    // corresponding Gecko Profiler thread.
+    ActivePS::AddBaseProfileThreads(aLock, std::move(baseprofile));
+  }
+
+  // Set up profiling for each registered thread, if appropriate.
+#if defined(MOZ_REPLACE_MALLOC) && defined(MOZ_PROFILER_MEMORY)
+  bool isMainThreadBeingProfiled = false;
+#endif
+  int tid = profiler_current_thread_id();
+  const Vector<UniquePtr<RegisteredThread>>& registeredThreads =
+      CorePS::RegisteredThreads(aLock);
+  for (auto& registeredThread : registeredThreads) {
+    RefPtr<ThreadInfo> info = registeredThread->Info();
+
+    if (ActivePS::ShouldProfileThread(aLock, info)) {
+      registeredThread->RacyRegisteredThread().SetIsBeingProfiled(true);
+      nsCOMPtr<nsIEventTarget> eventTarget = registeredThread->GetEventTarget();
+      ProfiledThreadData* profiledThreadData = ActivePS::AddLiveProfiledThread(
+          aLock, registeredThread.get(),
+          MakeUnique<ProfiledThreadData>(info, eventTarget));
+      if (ActivePS::FeatureJS(aLock)) {
+        registeredThread->StartJSSampling(ActivePS::JSFlags(aLock));
+        if (info->ThreadId() == tid) {
+          // We can manually poll the current thread so it starts sampling
+          // immediately.
+          registeredThread->PollJSSampling();
+        } else if (info->IsMainThread()) {
+          // Dispatch a runnable to the main thread to call PollJSSampling(),
+          // so that we don't have wait for the next JS interrupt callback in
+          // order to start profiling JS.
+          TriggerPollJSSamplingOnMainThread();
+        }
+      }
+#if defined(MOZ_REPLACE_MALLOC) && defined(MOZ_PROFILER_MEMORY)
+      if (info->IsMainThread()) {
+        isMainThreadBeingProfiled = true;
+      }
+#endif
+      registeredThread->RacyRegisteredThread().ReinitializeOnResume();
+      if (registeredThread->GetJSContext()) {
+        profiledThreadData->NotifyReceivedJSContext(0);
+      }
+    }
+  }
+
+  // Setup support for pushing/popping labels in mozglue.
+  RegisterProfilerLabelEnterExit(MozGlueLabelEnter, MozGlueLabelExit);
+
+#ifdef MOZ_TASK_TRACER
+  if (ActivePS::FeatureTaskTracer(aLock)) {
+    tasktracer::StartLogging();
+  }
+#endif
+
+#if defined(GP_OS_android)
+  if (ActivePS::FeatureJava(aLock)) {
+    int javaInterval = interval;
+    // Java sampling doesn't accurately keep up with the sampling rate that is
+    // lower than 1ms.
+    if (javaInterval < 1) {
+      javaInterval = 1;
+    }
+    // Send the interval-relative entry count, but we have 100000 hard cap in
+    // the java code, it can't be more than that.
+    java::GeckoJavaSampler::Start(
+        javaInterval, std::round((double)(capacity.Value()) * interval /
+                                 (double)(javaInterval)));
+  }
+#endif
+
+#if defined(MOZ_REPLACE_MALLOC) && defined(MOZ_PROFILER_MEMORY)
+  if (ActivePS::FeatureNativeAllocations(aLock)) {
+    if (isMainThreadBeingProfiled) {
+      mozilla::profiler::enable_native_allocations();
+    } else {
+      NS_WARNING(
+          "The nativeallocations feature is turned on, but the main thread is "
+          "not being profiled. The allocations are only stored on the main "
+          "thread.");
+    }
+  }
+#endif
+
+  if (ProfilerFeature::HasAudioCallbackTracing(aFeatures)) {
+    StartAudioCallbackTracing();
+  }
+
+  // At the very end, set up RacyFeatures.
+  RacyFeatures::SetActive(ActivePS::Features(aLock));
+}
+
+void profiler_start(PowerOfTwo32 aCapacity, double aInterval,
+                    uint32_t aFeatures, const char** aFilters,
+                    uint32_t aFilterCount, uint64_t aActiveBrowsingContextID,
+                    const Maybe<double>& aDuration) {
+  LOG("profiler_start");
+
+  ProfilerParent::ProfilerWillStopIfStarted();
+
+  SamplerThread* samplerThread = nullptr;
+  {
+    PSAutoLock lock(gPSMutex);
+
+    // Initialize if necessary.
+    if (!CorePS::Exists()) {
+      profiler_init(nullptr);
+    }
+
+    // Reset the current state if the profiler is running.
+    if (ActivePS::Exists(lock)) {
+      samplerThread = locked_profiler_stop(lock);
+    }
+
+    locked_profiler_start(lock, aCapacity, aInterval, aFeatures, aFilters,
+                          aFilterCount, aActiveBrowsingContextID, aDuration);
+  }
+
+#if defined(MOZ_REPLACE_MALLOC) && defined(MOZ_PROFILER_MEMORY)
+  // Start counting memory allocations (outside of lock because this may call
+  // profiler_add_sampled_counter which would attempt to take the lock.)
+  mozilla::profiler::install_memory_hooks();
+#endif
+
+  // We do these operations with gPSMutex unlocked. The comments in
+  // profiler_stop() explain why.
+  if (samplerThread) {
+    ProfilerParent::ProfilerStopped();
+    NotifyObservers("profiler-stopped");
+    delete samplerThread;
+  }
+  NotifyProfilerStarted(aCapacity, aDuration, aInterval, aFeatures, aFilters,
+                        aFilterCount, aActiveBrowsingContextID);
+}
+
+void profiler_ensure_started(PowerOfTwo32 aCapacity, double aInterval,
+                             uint32_t aFeatures, const char** aFilters,
+                             uint32_t aFilterCount,
+                             uint64_t aActiveBrowsingContextID,
+                             const Maybe<double>& aDuration) {
+  LOG("profiler_ensure_started");
+
+  ProfilerParent::ProfilerWillStopIfStarted();
+
+  bool startedProfiler = false;
+  SamplerThread* samplerThread = nullptr;
+  {
+    PSAutoLock lock(gPSMutex);
+
+    // Initialize if necessary.
+    if (!CorePS::Exists()) {
+      profiler_init(nullptr);
+    }
+
+    if (ActivePS::Exists(lock)) {
+      // The profiler is active.
+      if (!ActivePS::Equals(lock, aCapacity, aDuration, aInterval, aFeatures,
+                            aFilters, aFilterCount, aActiveBrowsingContextID)) {
+        // Stop and restart with different settings.
+        samplerThread = locked_profiler_stop(lock);
+        locked_profiler_start(lock, aCapacity, aInterval, aFeatures, aFilters,
+                              aFilterCount, aActiveBrowsingContextID,
+                              aDuration);
+        startedProfiler = true;
+      }
+    } else {
+      // The profiler is stopped.
+      locked_profiler_start(lock, aCapacity, aInterval, aFeatures, aFilters,
+                            aFilterCount, aActiveBrowsingContextID, aDuration);
+      startedProfiler = true;
+    }
+  }
+
+  // We do these operations with gPSMutex unlocked. The comments in
+  // profiler_stop() explain why.
+  if (samplerThread) {
+    ProfilerParent::ProfilerStopped();
+    NotifyObservers("profiler-stopped");
+    delete samplerThread;
+  }
+
+  if (startedProfiler) {
+    NotifyProfilerStarted(aCapacity, aDuration, aInterval, aFeatures, aFilters,
+                          aFilterCount, aActiveBrowsingContextID);
+  }
+}
+
+[[nodiscard]] static SamplerThread* locked_profiler_stop(PSLockRef aLock) {
+  LOG("locked_profiler_stop");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists() && ActivePS::Exists(aLock));
+
+  // At the very start, clear RacyFeatures.
+  RacyFeatures::SetInactive();
+
+  if (ActivePS::FeatureAudioCallbackTracing(aLock)) {
+    StopAudioCallbackTracing();
+  }
+
+#if defined(GP_OS_android)
+  if (ActivePS::FeatureJava(aLock)) {
+    java::GeckoJavaSampler::Stop();
+  }
+#endif
+
+#ifdef MOZ_TASK_TRACER
+  if (ActivePS::FeatureTaskTracer(aLock)) {
+    tasktracer::StopLogging();
+  }
+#endif
+
+  // Remove support for pushing/popping labels in mozglue.
+  RegisterProfilerLabelEnterExit(nullptr, nullptr);
+
+  // Stop sampling live threads.
+  int tid = profiler_current_thread_id();
+  const Vector<LiveProfiledThreadData>& liveProfiledThreads =
+      ActivePS::LiveProfiledThreads(aLock);
+  for (auto& thread : liveProfiledThreads) {
+    RegisteredThread* registeredThread = thread.mRegisteredThread;
+    registeredThread->RacyRegisteredThread().SetIsBeingProfiled(false);
+    if (ActivePS::FeatureJS(aLock)) {
+      registeredThread->StopJSSampling();
+      RefPtr<ThreadInfo> info = registeredThread->Info();
+      if (info->ThreadId() == tid) {
+        // We can manually poll the current thread so it stops profiling
+        // immediately.
+        registeredThread->PollJSSampling();
+      } else if (info->IsMainThread()) {
+        // Dispatch a runnable to the main thread to call PollJSSampling(),
+        // so that we don't have wait for the next JS interrupt callback in
+        // order to start profiling JS.
+        TriggerPollJSSamplingOnMainThread();
+      }
+    }
+  }
+
+#if defined(MOZ_REPLACE_MALLOC) && defined(MOZ_PROFILER_MEMORY)
+  if (ActivePS::FeatureNativeAllocations(aLock)) {
+    mozilla::profiler::disable_native_allocations();
+  }
+#endif
+
+  // The Stop() call doesn't actually stop Run(); that happens in this
+  // function's caller when the sampler thread is destroyed. Stop() just gives
+  // the SamplerThread a chance to do some cleanup with gPSMutex locked.
+  SamplerThread* samplerThread = ActivePS::Destroy(aLock);
+  samplerThread->Stop(aLock);
+
+  return samplerThread;
+}
+
+void profiler_stop() {
+  LOG("profiler_stop");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  ProfilerParent::ProfilerWillStopIfStarted();
+
+#if defined(MOZ_REPLACE_MALLOC) && defined(MOZ_PROFILER_MEMORY)
+  // Remove the hooks early, as native allocations (if they are on) can be
+  // quite expensive.
+  mozilla::profiler::remove_memory_hooks();
+#endif
+
+  SamplerThread* samplerThread;
+  {
+    PSAutoLock lock(gPSMutex);
+
+    if (!ActivePS::Exists(lock)) {
+      return;
+    }
+
+    samplerThread = locked_profiler_stop(lock);
+  }
+
+  // We notify observers with gPSMutex unlocked. Otherwise we might get a
+  // deadlock, if code run by these functions calls a profiler function that
+  // locks gPSMutex, for example when it wants to insert a marker.
+  // (This has been seen in practise in bug 1346356, when we were still firing
+  // these notifications synchronously.)
+  ProfilerParent::ProfilerStopped();
+  NotifyObservers("profiler-stopped");
+
+  // We delete with gPSMutex unlocked. Otherwise we would get a deadlock: we
+  // would be waiting here with gPSMutex locked for SamplerThread::Run() to
+  // return so the join operation within the destructor can complete, but Run()
+  // needs to lock gPSMutex to return.
+  //
+  // Because this call occurs with gPSMutex unlocked, it -- including the final
+  // iteration of Run()'s loop -- must be able detect deactivation and return
+  // in a way that's safe with respect to other gPSMutex-locking operations
+  // that may have occurred in the meantime.
+  delete samplerThread;
+}
+
+bool profiler_is_paused() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  if (!ActivePS::Exists(lock)) {
+    return false;
+  }
+
+  return ActivePS::IsPaused(lock);
+}
+
+/* [[nodiscard]] */ bool profiler_callback_after_sampling(
+    PostSamplingCallback&& aCallback) {
+  LOG("profiler_callback_after_sampling");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  return ActivePS::AppendPostSamplingCallback(lock, std::move(aCallback));
+}
+
+void profiler_pause() {
+  LOG("profiler_pause");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  {
+    PSAutoLock lock(gPSMutex);
+
+    if (!ActivePS::Exists(lock)) {
+      return;
+    }
+
+#if defined(GP_OS_android)
+    if (ActivePS::FeatureJava(lock) && !ActivePS::IsSamplingPaused(lock)) {
+      // Not paused yet, so this is the first pause, let Java know.
+      // TODO: Distinguish Pause and PauseSampling in Java.
+      java::GeckoJavaSampler::PauseSampling();
+    }
+#endif
+
+    RacyFeatures::SetPaused();
+    ActivePS::SetIsPaused(lock, true);
+    ActivePS::Buffer(lock).AddEntry(ProfileBufferEntry::Pause(profiler_time()));
+  }
+
+  // gPSMutex must be unlocked when we notify, to avoid potential deadlocks.
+  ProfilerParent::ProfilerPaused();
+  NotifyObservers("profiler-paused");
+}
+
+void profiler_resume() {
+  LOG("profiler_resume");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  {
+    PSAutoLock lock(gPSMutex);
+
+    if (!ActivePS::Exists(lock)) {
+      return;
+    }
+
+    ActivePS::Buffer(lock).AddEntry(
+        ProfileBufferEntry::Resume(profiler_time()));
+    ActivePS::SetIsPaused(lock, false);
+    RacyFeatures::SetUnpaused();
+
+#if defined(GP_OS_android)
+    if (ActivePS::FeatureJava(lock) && !ActivePS::IsSamplingPaused(lock)) {
+      // Not paused anymore, so this is the last unpause, let Java know.
+      // TODO: Distinguish Unpause and UnpauseSampling in Java.
+      java::GeckoJavaSampler::UnpauseSampling();
+    }
+#endif
+  }
+
+  // gPSMutex must be unlocked when we notify, to avoid potential deadlocks.
+  ProfilerParent::ProfilerResumed();
+  NotifyObservers("profiler-resumed");
+}
+
+bool profiler_is_sampling_paused() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  if (!ActivePS::Exists(lock)) {
+    return false;
+  }
+
+  return ActivePS::IsSamplingPaused(lock);
+}
+
+void profiler_pause_sampling() {
+  LOG("profiler_pause_sampling");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  {
+    PSAutoLock lock(gPSMutex);
+
+    if (!ActivePS::Exists(lock)) {
+      return;
+    }
+
+#if defined(GP_OS_android)
+    if (ActivePS::FeatureJava(lock) && !ActivePS::IsSamplingPaused(lock)) {
+      // Not paused yet, so this is the first pause, let Java know.
+      // TODO: Distinguish Pause and PauseSampling in Java.
+      java::GeckoJavaSampler::PauseSampling();
+    }
+#endif
+
+    RacyFeatures::SetSamplingPaused();
+    ActivePS::SetIsSamplingPaused(lock, true);
+    ActivePS::Buffer(lock).AddEntry(
+        ProfileBufferEntry::PauseSampling(profiler_time()));
+  }
+
+  // gPSMutex must be unlocked when we notify, to avoid potential deadlocks.
+  ProfilerParent::ProfilerPausedSampling();
+  NotifyObservers("profiler-paused-sampling");
+}
+
+void profiler_resume_sampling() {
+  LOG("profiler_resume_sampling");
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  {
+    PSAutoLock lock(gPSMutex);
+
+    if (!ActivePS::Exists(lock)) {
+      return;
+    }
+
+    ActivePS::Buffer(lock).AddEntry(
+        ProfileBufferEntry::ResumeSampling(profiler_time()));
+    ActivePS::SetIsSamplingPaused(lock, false);
+    RacyFeatures::SetSamplingUnpaused();
+
+#if defined(GP_OS_android)
+    if (ActivePS::FeatureJava(lock) && !ActivePS::IsSamplingPaused(lock)) {
+      // Not paused anymore, so this is the last unpause, let Java know.
+      // TODO: Distinguish Unpause and UnpauseSampling in Java.
+      java::GeckoJavaSampler::UnpauseSampling();
+    }
+#endif
+  }
+
+  // gPSMutex must be unlocked when we notify, to avoid potential deadlocks.
+  ProfilerParent::ProfilerResumedSampling();
+  NotifyObservers("profiler-resumed-sampling");
+}
+
+bool profiler_feature_active(uint32_t aFeature) {
+  // This function runs both on and off the main thread.
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  // This function is hot enough that we use RacyFeatures, not ActivePS.
+  return RacyFeatures::IsActiveWithFeature(aFeature);
+}
+
+void profiler_write_active_configuration(JSONWriter& aWriter) {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+  PSAutoLock lock(gPSMutex);
+  ActivePS::WriteActiveConfiguration(lock, aWriter);
+}
+
+void profiler_add_sampled_counter(BaseProfilerCount* aCounter) {
+  DEBUG_LOG("profiler_add_sampled_counter(%s)", aCounter->mLabel);
+  PSAutoLock lock(gPSMutex);
+  CorePS::AppendCounter(lock, aCounter);
+}
+
+void profiler_remove_sampled_counter(BaseProfilerCount* aCounter) {
+  DEBUG_LOG("profiler_remove_sampled_counter(%s)", aCounter->mLabel);
+  PSAutoLock lock(gPSMutex);
+  // Note: we don't enforce a final sample, though we could do so if the
+  // profiler was active
+  CorePS::RemoveCounter(lock, aCounter);
+}
+
+ProfilingStack* profiler_register_thread(const char* aName,
+                                         void* aGuessStackTop) {
+  DEBUG_LOG("profiler_register_thread(%s)", aName);
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  // Make sure we have a nsThread wrapper for the current thread, and that NSPR
+  // knows its name.
+  (void)NS_GetCurrentThread();
+  NS_SetCurrentThreadName(aName);
+
+  if (!TLSRegisteredThread::IsTLSInited()) {
+    return nullptr;
+  }
+
+  PSAutoLock lock(gPSMutex);
+
+  if (RegisteredThread* thread = TLSRegisteredThread::RegisteredThread(lock)) {
+    MOZ_RELEASE_ASSERT(IsRegisteredThreadInRegisteredThreadsList(lock, thread),
+                       "Thread being re-registered is not in registered thread "
+                       "list even though its TLS is non-null");
+    MOZ_RELEASE_ASSERT(
+        thread->Info()->ThreadId() == profiler_current_thread_id(),
+        "Thread being re-registered has changed its TID");
+    LOG("profiler_register_thread(%s) - thread %d already registered as %s",
+        aName, profiler_current_thread_id(), thread->Info()->Name());
+    // TODO: Use new name. This is currently not possible because the
+    // RegisteredThread's ThreadInfo cannot be changed.
+    // In the meantime, we record a marker that could be used in the frontend.
+    nsCString text("Thread ");
+    text.AppendInt(profiler_current_thread_id());
+    text.AppendLiteral(" \"");
+    text.AppendASCII(thread->Info()->Name());
+    text.AppendLiteral("\" attempted to re-register as \"");
+    text.AppendASCII(aName);
+    text.AppendLiteral("\"");
+    PROFILER_MARKER_TEXT("profiler_register_thread again", OTHER_Profiling,
+                         MarkerThreadId::MainThread(), text);
+
+    return &thread->RacyRegisteredThread().ProfilingStack();
+  }
+
+  void* stackTop = GetStackTop(aGuessStackTop);
+  return locked_register_thread(lock, aName, stackTop);
+}
+
+void profiler_unregister_thread() {
+  PSAutoLock lock(gPSMutex);
+
+  if (!TLSRegisteredThread::IsTLSInited()) {
+    return;
+  }
+
+  if (!CorePS::Exists()) {
+    // This function can be called after the main thread has already shut down.
+    // We want to reset the AutoProfilerLabel's ProfilingStack pointer (if
+    // needed), because a thread could stay registered after the profiler has
+    // shut down.
+    TLSRegisteredThread::ResetAutoProfilerLabelProfilingStack(lock);
+    return;
+  }
+
+  // We don't call RegisteredThread::StopJSSampling() here; there's no point
+  // doing that for a JS thread that is in the process of disappearing.
+
+  if (RegisteredThread* registeredThread =
+          TLSRegisteredThread::RegisteredThread(lock)) {
+    MOZ_RELEASE_ASSERT(
+        IsRegisteredThreadInRegisteredThreadsList(lock, registeredThread),
+        "Thread being unregistered is not in registered thread list even "
+        "though its TLS is non-null");
+    MOZ_RELEASE_ASSERT(
+        registeredThread->Info()->ThreadId() == profiler_current_thread_id(),
+        "Thread being unregistered has changed its TID");
+    RefPtr<ThreadInfo> info = registeredThread->Info();
+
+    DEBUG_LOG("profiler_unregister_thread: %s", info->Name());
+
+    if (ActivePS::Exists(lock)) {
+      ActivePS::UnregisterThread(lock, registeredThread);
+    }
+
+    // Clear the pointer to the RegisteredThread object that we're about to
+    // destroy, as well as the AutoProfilerLabel's ProfilingStack because the
+    // thread is unregistering itself and won't need the ProfilingStack anymore.
+    TLSRegisteredThread::ResetRegisteredThread(lock);
+    TLSRegisteredThread::ResetAutoProfilerLabelProfilingStack(lock);
+
+    // Remove the thread from the list of registered threads. This deletes the
+    // registeredThread object.
+    CorePS::RemoveRegisteredThread(lock, registeredThread);
+
+    MOZ_RELEASE_ASSERT(
+        !IsRegisteredThreadInRegisteredThreadsList(lock, registeredThread),
+        "After unregistering, thread should no longer be in the registered "
+        "thread list");
+    MOZ_RELEASE_ASSERT(
+        !TLSRegisteredThread::RegisteredThread(lock),
+        "TLS should have been reset after un-registering thread");
+  } else {
+    // There are two ways TLSRegisteredThread::RegisteredThread() might be
+    // empty.
+    //
+    // - TLSRegisteredThread::Init() failed in locked_register_thread().
+    //
+    // - We've already called profiler_unregister_thread() for this thread.
+    //   (Whether or not it should, this does happen in practice.)
+    LOG("profiler_unregister_thread() - thread %d already unregistered",
+        profiler_current_thread_id());
+    // We cannot record a marker on this thread because it was already
+    // unregistered. Send it to the main thread (unless this *is* already the
+    // main thread, which has been unregistered); this may be useful to catch
+    // mismatched register/unregister pairs in Firefox.
+    if (int tid = profiler_current_thread_id();
+        tid != profiler_main_thread_id()) {
+      nsCString threadIdString;
+      threadIdString.AppendInt(tid);
+      PROFILER_MARKER_TEXT("profiler_unregister_thread again", OTHER_Profiling,
+                           MarkerThreadId::MainThread(), threadIdString);
+    }
+  }
+}
+
+void profiler_register_page(uint64_t aBrowsingContextID,
+                            uint64_t aInnerWindowID, const nsCString& aUrl,
+                            uint64_t aEmbedderInnerWindowID) {
+  DEBUG_LOG("profiler_register_page(%" PRIu64 ", %" PRIu64 ", %s, %" PRIu64 ")",
+            aBrowsingContextID, aInnerWindowID, aUrl.get(),
+            aEmbedderInnerWindowID);
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  // When a Browsing context is first loaded, the first url loaded in it will be
+  // about:blank. Because of that, this call keeps the first non-about:blank
+  // registration of window and discards the previous one.
+  RefPtr<PageInformation> pageInfo = new PageInformation(
+      aBrowsingContextID, aInnerWindowID, aUrl, aEmbedderInnerWindowID);
+  CorePS::AppendRegisteredPage(lock, std::move(pageInfo));
+
+  // After appending the given page to CorePS, look for the expired
+  // pages and remove them if there are any.
+  if (ActivePS::Exists(lock)) {
+    ActivePS::DiscardExpiredPages(lock);
+  }
+}
+
+void profiler_unregister_page(uint64_t aRegisteredInnerWindowID) {
+  PSAutoLock lock(gPSMutex);
+
+  if (!CorePS::Exists()) {
+    // This function can be called after the main thread has already shut down.
+    return;
+  }
+
+  // During unregistration, if the profiler is active, we have to keep the
+  // page information since there may be some markers associated with the given
+  // page. But if profiler is not active. we have no reason to keep the
+  // page information here because there can't be any marker associated with it.
+  if (ActivePS::Exists(lock)) {
+    ActivePS::UnregisterPage(lock, aRegisteredInnerWindowID);
+  } else {
+    CorePS::RemoveRegisteredPage(lock, aRegisteredInnerWindowID);
+  }
+}
+
+void profiler_clear_all_pages() {
+  {
+    PSAutoLock lock(gPSMutex);
+
+    if (!CorePS::Exists()) {
+      // This function can be called after the main thread has already shut
+      // down.
+      return;
+    }
+
+    CorePS::ClearRegisteredPages(lock);
+    if (ActivePS::Exists(lock)) {
+      ActivePS::ClearUnregisteredPages(lock);
+    }
+  }
+
+  // gPSMutex must be unlocked when we notify, to avoid potential deadlocks.
+  ProfilerParent::ClearAllPages();
+}
+
+Maybe<uint64_t> profiler_get_inner_window_id_from_docshell(
+    nsIDocShell* aDocshell) {
+  Maybe<uint64_t> innerWindowID = Nothing();
+  if (aDocshell) {
+    auto outerWindow = aDocshell->GetWindow();
+    if (outerWindow) {
+      auto innerWindow = outerWindow->GetCurrentInnerWindow();
+      if (innerWindow) {
+        innerWindowID = Some(innerWindow->WindowID());
+      }
+    }
+  }
+  return innerWindowID;
+}
+
+void profiler_thread_sleep() {
+  // This function runs both on and off the main thread.
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  RacyRegisteredThread* racyRegisteredThread =
+      TLSRegisteredThread::RacyRegisteredThread();
+  if (!racyRegisteredThread) {
+    return;
+  }
+
+  racyRegisteredThread->SetSleeping();
+}
+
+void profiler_thread_wake() {
+  // This function runs both on and off the main thread.
+
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  RacyRegisteredThread* racyRegisteredThread =
+      TLSRegisteredThread::RacyRegisteredThread();
+  if (!racyRegisteredThread) {
+    return;
+  }
+
+  racyRegisteredThread->SetAwake();
+}
+
+bool mozilla::profiler::detail::IsThreadBeingProfiled() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  const RacyRegisteredThread* racyRegisteredThread =
+      TLSRegisteredThread::RacyRegisteredThread();
+  return racyRegisteredThread && racyRegisteredThread->IsBeingProfiled();
+}
+
+bool mozilla::profiler::detail::IsThreadRegistered() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  const RacyRegisteredThread* racyRegisteredThread =
+      TLSRegisteredThread::RacyRegisteredThread();
+  // The simple presence of this TLS pointer is proof that the thread is
+  // registered.
+  return !!racyRegisteredThread;
+}
+
+bool profiler_thread_is_sleeping() {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  RacyRegisteredThread* racyRegisteredThread =
+      TLSRegisteredThread::RacyRegisteredThread();
+  if (!racyRegisteredThread) {
+    return false;
+  }
+  return racyRegisteredThread->IsSleeping();
+}
+
+void profiler_js_interrupt_callback() {
+  // This function runs on JS threads being sampled.
+  PollJSSamplingForCurrentThread();
+}
+
+double profiler_time() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  TimeDuration delta = TimeStamp::NowUnfuzzed() - CorePS::ProcessStartTime();
+  return delta.ToMilliseconds();
+}
+
+bool profiler_capture_backtrace_into(ProfileChunkedBuffer& aChunkedBuffer) {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  if (!ActivePS::Exists(lock)) {
+    return false;
+  }
+
+  RegisteredThread* registeredThread =
+      TLSRegisteredThread::RegisteredThread(lock);
+  if (!registeredThread) {
+    // If this was called from a non-registered thread, return false and do no
+    // more work. This can happen from a memory hook. Before the allocation
+    // tracking there was a MOZ_ASSERT() here checking for the existence of a
+    // registeredThread.
+    return false;
+  }
+
+  ProfileBuffer profileBuffer(aChunkedBuffer);
+
+  Registers regs;
+#if defined(HAVE_NATIVE_UNWIND)
+  regs.SyncPopulate();
+#else
+  regs.Clear();
+#endif
+
+  DoSyncSample(lock, *registeredThread, TimeStamp::NowUnfuzzed(), regs,
+               profileBuffer);
+
+  return true;
+}
+
+UniquePtr<ProfileChunkedBuffer> profiler_capture_backtrace() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  // Quick is-active check before allocating a buffer.
+  if (!profiler_is_active()) {
+    return nullptr;
+  }
+
+  auto buffer = MakeUnique<ProfileChunkedBuffer>(
+      ProfileChunkedBuffer::ThreadSafety::WithoutMutex,
+      MakeUnique<ProfileBufferChunkManagerSingle>(
+          ProfileBufferChunkManager::scExpectedMaximumStackSize));
+
+  if (!profiler_capture_backtrace_into(*buffer)) {
+    return nullptr;
+  }
+
+  return buffer;
+}
+
+UniqueProfilerBacktrace profiler_get_backtrace() {
+  UniquePtr<ProfileChunkedBuffer> buffer = profiler_capture_backtrace();
+
+  if (!buffer) {
+    return nullptr;
+  }
+
+  return UniqueProfilerBacktrace(
+      new ProfilerBacktrace("SyncProfile", std::move(buffer)));
+}
+
+void ProfilerBacktraceDestructor::operator()(ProfilerBacktrace* aBacktrace) {
+  delete aBacktrace;
+}
+
+// This is a simplified version of profiler_add_marker that can be easily passed
+// into the JS engine.
+void profiler_add_js_marker(const char* aMarkerName, const char* aMarkerText) {
+  PROFILER_MARKER_TEXT(
+      ProfilerString8View::WrapNullTerminatedString(aMarkerName), JS, {},
+      ProfilerString8View::WrapNullTerminatedString(aMarkerText));
+}
+
+void profiler_add_js_allocation_marker(JS::RecordAllocationInfo&& info) {
+  if (!profiler_can_accept_markers()) {
+    return;
+  }
+
+  struct JsAllocationMarker {
+    static constexpr mozilla::Span<const char> MarkerTypeName() {
+      return mozilla::MakeStringSpan("JS allocation");
+    }
+    static void StreamJSONMarkerData(
+        mozilla::baseprofiler::SpliceableJSONWriter& aWriter,
+        const mozilla::ProfilerString16View& aTypeName,
+        const mozilla::ProfilerString8View& aClassName,
+        const mozilla::ProfilerString16View& aDescriptiveTypeName,
+        const mozilla::ProfilerString8View& aCoarseType, uint64_t aSize,
+        bool aInNursery) {
+      if (aClassName.Length() != 0) {
+        aWriter.StringProperty("className", aClassName);
+      }
+      if (aTypeName.Length() != 0) {
+        aWriter.StringProperty(
+            "typeName",
+            NS_ConvertUTF16toUTF8(aTypeName.Data(), aTypeName.Length()));
+      }
+      if (aDescriptiveTypeName.Length() != 0) {
+        aWriter.StringProperty(
+            "descriptiveTypeName",
+            NS_ConvertUTF16toUTF8(aDescriptiveTypeName.Data(),
+                                  aDescriptiveTypeName.Length()));
+      }
+      aWriter.StringProperty("coarseType", aCoarseType);
+      aWriter.IntProperty("size", aSize);
+      aWriter.BoolProperty("inNursery", aInNursery);
+    }
+    static mozilla::MarkerSchema MarkerTypeDisplay() {
+      return mozilla::MarkerSchema::SpecialFrontendLocation{};
+    }
+  };
+
+  profiler_add_marker(
+      "JS allocation", geckoprofiler::category::JS, MarkerStack::Capture(),
+      JsAllocationMarker{},
+      ProfilerString16View::WrapNullTerminatedString(info.typeName),
+      ProfilerString8View::WrapNullTerminatedString(info.className),
+      ProfilerString16View::WrapNullTerminatedString(info.descriptiveTypeName),
+      ProfilerString8View::WrapNullTerminatedString(info.coarseType), info.size,
+      info.inNursery);
+}
+
+bool profiler_is_locked_on_current_thread() {
+  // This function is used to help users avoid calling `profiler_...` functions
+  // when the profiler may already have a lock in place, which would prevent a
+  // 2nd recursive lock (resulting in a crash or a never-ending wait), or a
+  // deadlock between any two mutexes. So we must return `true` for any of:
+  // - The main profiler mutex, used by most functions, and/or
+  // - The buffer mutex, used directly in some functions without locking the
+  //   main mutex, e.g., marker-related functions.
+  // - The ProfilerParent or ProfilerChild mutex, used to store and process
+  //   buffer chunk updates.
+  return gPSMutex.IsLockedOnCurrentThread() ||
+         CorePS::CoreBuffer().IsThreadSafeAndLockedOnCurrentThread() ||
+         ProfilerParent::IsLockedOnCurrentThread() ||
+         ProfilerChild::IsLockedOnCurrentThread();
+}
+
+static constexpr net::TimingStruct scEmptyNetTimingStruct;
+
+void profiler_add_network_marker(
+    nsIURI* aURI, const nsACString& aRequestMethod, int32_t aPriority,
+    uint64_t aChannelId, NetworkLoadType aType, mozilla::TimeStamp aStart,
+    mozilla::TimeStamp aEnd, int64_t aCount,
+    mozilla::net::CacheDisposition aCacheDisposition, uint64_t aInnerWindowID,
+    const mozilla::net::TimingStruct* aTimings, nsIURI* aRedirectURI,
+    UniquePtr<ProfileChunkedBuffer> aSource,
+    const Maybe<nsDependentCString>& aContentType) {
+  if (!profiler_can_accept_markers()) {
+    return;
+  }
+
+  nsAutoCStringN<2048> name;
+  name.AppendASCII("Load ");
+  // top 32 bits are process id of the load
+  name.AppendInt(aChannelId & 0xFFFFFFFFu);
+
+  // These can do allocations/frees/etc; avoid if not active
+  nsAutoCStringN<2048> spec;
+  if (aURI) {
+    aURI->GetAsciiSpec(spec);
+    name.AppendASCII(": ");
+    name.Append(spec);
+  }
+
+  nsAutoCString redirect_spec;
+  if (aRedirectURI) {
+    aRedirectURI->GetAsciiSpec(redirect_spec);
+  }
+
+  struct NetworkMarker {
+    static constexpr Span<const char> MarkerTypeName() {
+      return MakeStringSpan("Network");
+    }
+    static void StreamJSONMarkerData(
+        baseprofiler::SpliceableJSONWriter& aWriter, mozilla::TimeStamp aStart,
+        mozilla::TimeStamp aEnd, int64_t aID, const ProfilerString8View& aURI,
+        const ProfilerString8View& aRequestMethod, NetworkLoadType aType,
+        int32_t aPri, int64_t aCount, net::CacheDisposition aCacheDisposition,
+        const net::TimingStruct& aTimings,
+        const ProfilerString8View& aRedirectURI,
+        const ProfilerString8View& aContentType) {
+      // This payload still streams a startTime and endTime property because it
+      // made the migration to MarkerTiming on the front-end easier.
+      aWriter.TimeProperty("startTime", aStart);
+      aWriter.TimeProperty("endTime", aEnd);
+
+      aWriter.IntProperty("id", aID);
+      aWriter.StringProperty("status", GetNetworkState(aType));
+      if (Span<const char> cacheString = GetCacheState(aCacheDisposition);
+          !cacheString.IsEmpty()) {
+        aWriter.StringProperty("cache", cacheString);
+      }
+      aWriter.IntProperty("pri", aPri);
+      if (aCount > 0) {
+        aWriter.IntProperty("count", aCount);
+      }
+      if (aURI.Length() != 0) {
+        aWriter.StringProperty("URI", aURI);
+      }
+      if (aRedirectURI.Length() != 0) {
+        aWriter.StringProperty("RedirectURI", aRedirectURI);
+      }
+      aWriter.StringProperty("requestMethod", aRequestMethod);
+
+      if (aContentType.Length() != 0) {
+        aWriter.StringProperty("contentType", aContentType);
+      } else {
+        aWriter.NullProperty("contentType");
+      }
+
+      if (aType != NetworkLoadType::LOAD_START) {
+        aWriter.TimeProperty("domainLookupStart", aTimings.domainLookupStart);
+        aWriter.TimeProperty("domainLookupEnd", aTimings.domainLookupEnd);
+        aWriter.TimeProperty("connectStart", aTimings.connectStart);
+        aWriter.TimeProperty("tcpConnectEnd", aTimings.tcpConnectEnd);
+        aWriter.TimeProperty("secureConnectionStart",
+                             aTimings.secureConnectionStart);
+        aWriter.TimeProperty("connectEnd", aTimings.connectEnd);
+        aWriter.TimeProperty("requestStart", aTimings.requestStart);
+        aWriter.TimeProperty("responseStart", aTimings.responseStart);
+        aWriter.TimeProperty("responseEnd", aTimings.responseEnd);
+      }
+    }
+    static MarkerSchema MarkerTypeDisplay() {
+      return MarkerSchema::SpecialFrontendLocation{};
+    }
+
+   private:
+    static Span<const char> GetNetworkState(NetworkLoadType aType) {
+      switch (aType) {
+        case NetworkLoadType::LOAD_START:
+          return MakeStringSpan("STATUS_START");
+        case NetworkLoadType::LOAD_STOP:
+          return MakeStringSpan("STATUS_STOP");
+        case NetworkLoadType::LOAD_REDIRECT:
+          return MakeStringSpan("STATUS_REDIRECT");
+        default:
+          MOZ_ASSERT(false, "Unexpected NetworkLoadType enum value.");
+          return MakeStringSpan("");
+      }
+    }
+
+    static Span<const char> GetCacheState(
+        net::CacheDisposition aCacheDisposition) {
+      switch (aCacheDisposition) {
+        case net::kCacheUnresolved:
+          return MakeStringSpan("Unresolved");
+        case net::kCacheHit:
+          return MakeStringSpan("Hit");
+        case net::kCacheHitViaReval:
+          return MakeStringSpan("HitViaReval");
+        case net::kCacheMissedViaReval:
+          return MakeStringSpan("MissedViaReval");
+        case net::kCacheMissed:
+          return MakeStringSpan("Missed");
+        case net::kCacheUnknown:
+          return MakeStringSpan("");
+        default:
+          MOZ_ASSERT(false, "Unexpected CacheDisposition enum value.");
+          return MakeStringSpan("");
+      }
+    }
+  };
+
+  profiler_add_marker(
+      name, geckoprofiler::category::NETWORK,
+      {MarkerTiming::Interval(aStart, aEnd),
+       MarkerStack::TakeBacktrace(std::move(aSource)),
+       MarkerInnerWindowId(aInnerWindowID)},
+      NetworkMarker{}, aStart, aEnd, static_cast<int64_t>(aChannelId), spec,
+      aRequestMethod, aType, aPriority, aCount, aCacheDisposition,
+      aTimings ? *aTimings : scEmptyNetTimingStruct, redirect_spec,
+      aContentType ? ProfilerString8View(*aContentType)
+                   : ProfilerString8View());
+}
+
+bool profiler_add_native_allocation_marker(int64_t aSize,
+                                           uintptr_t aMemoryAddress) {
+  if (!profiler_can_accept_markers()) {
+    return false;
+  }
+
+  // Because native allocations may be intercepted anywhere, blocking while
+  // locking the profiler mutex here could end up causing a deadlock if another
+  // mutex is taken, which the profiler may indirectly need elsewhere.
+  // See bug 1642726 for such a scenario.
+  // So instead we bail out if the mutex is already locked. Native allocations
+  // are statistically sampled anyway, so missing a few because of this is
+  // acceptable.
+  if (gPSMutex.IsLockedOnCurrentThread()) {
+    return false;
+  }
+
+  struct NativeAllocationMarker {
+    static constexpr mozilla::Span<const char> MarkerTypeName() {
+      return mozilla::MakeStringSpan("Native allocation");
+    }
+    static void StreamJSONMarkerData(
+        mozilla::baseprofiler::SpliceableJSONWriter& aWriter, int64_t aSize,
+        uintptr_t aMemoryAddress, int aThreadId) {
+      aWriter.IntProperty("size", aSize);
+      aWriter.IntProperty("memoryAddress",
+                          static_cast<int64_t>(aMemoryAddress));
+      aWriter.IntProperty("threadId", aThreadId);
+    }
+    static mozilla::MarkerSchema MarkerTypeDisplay() {
+      return mozilla::MarkerSchema::SpecialFrontendLocation{};
+    }
+  };
+
+  profiler_add_marker("Native allocation", geckoprofiler::category::OTHER,
+                      {MarkerThreadId::MainThread(), MarkerStack::Capture()},
+                      NativeAllocationMarker{}, aSize, aMemoryAddress,
+                      profiler_current_thread_id());
+  return true;
+}
+
+void profiler_set_js_context(JSContext* aCx) {
+  MOZ_ASSERT(aCx);
+
+  PSAutoLock lock(gPSMutex);
+
+  RegisteredThread* registeredThread =
+      TLSRegisteredThread::RegisteredThread(lock);
+  if (!registeredThread) {
+    return;
+  }
+
+  registeredThread->SetJSContext(aCx);
+
+  // This call is on-thread, so we can call PollJSSampling() to start JS
+  // sampling immediately.
+  registeredThread->PollJSSampling();
+
+  if (ActivePS::Exists(lock)) {
+    ProfiledThreadData* profiledThreadData =
+        ActivePS::GetProfiledThreadData(lock, registeredThread);
+    if (profiledThreadData) {
+      profiledThreadData->NotifyReceivedJSContext(
+          ActivePS::Buffer(lock).BufferRangeEnd());
+    }
+  }
+}
+
+void profiler_clear_js_context() {
+  MOZ_RELEASE_ASSERT(CorePS::Exists());
+
+  PSAutoLock lock(gPSMutex);
+
+  RegisteredThread* registeredThread =
+      TLSRegisteredThread::RegisteredThread(lock);
+  if (!registeredThread) {
+    return;
+  }
+
+  JSContext* cx = registeredThread->GetJSContext();
+  if (!cx) {
+    return;
+  }
+
+  if (ActivePS::Exists(lock) && ActivePS::FeatureJS(lock)) {
+    ProfiledThreadData* profiledThreadData =
+        ActivePS::GetProfiledThreadData(lock, registeredThread);
+    if (profiledThreadData) {
+      profiledThreadData->NotifyAboutToLoseJSContext(
+          cx, CorePS::ProcessStartTime(), ActivePS::Buffer(lock));
+
+      // Notify the JS context that profiling for this context has stopped.
+      // Do this by calling StopJSSampling and PollJSSampling before
+      // nulling out the JSContext.
+      registeredThread->StopJSSampling();
+      registeredThread->PollJSSampling();
+
+      registeredThread->ClearJSContext();
+
+      // Tell the thread that we'd like to have JS sampling on this
+      // thread again, once it gets a new JSContext (if ever).
+      registeredThread->StartJSSampling(ActivePS::JSFlags(lock));
+      return;
+    }
+  }
+
+  registeredThread->ClearJSContext();
+}
+
+// NOTE: aCollector's methods will be called while the target thread is paused.
+// Doing things in those methods like allocating -- which may try to claim
+// locks -- is a surefire way to deadlock.
+void profiler_suspend_and_sample_thread(int aThreadId, uint32_t aFeatures,
+                                        ProfilerStackCollector& aCollector,
+                                        bool aSampleNative /* = true */) {
+  // Lock the profiler mutex
+  PSAutoLock lock(gPSMutex);
+
+  const Vector<UniquePtr<RegisteredThread>>& registeredThreads =
+      CorePS::RegisteredThreads(lock);
+  for (auto& thread : registeredThreads) {
+    RefPtr<ThreadInfo> info = thread->Info();
+    RegisteredThread& registeredThread = *thread.get();
+
+    if (info->ThreadId() == aThreadId) {
+      if (info->IsMainThread()) {
+        aCollector.SetIsMainThread();
+      }
+
+      // Allocate the space for the native stack
+      NativeStack nativeStack;
+
+      // Suspend, sample, and then resume the target thread.
+      Sampler sampler(lock);
+      TimeStamp now = TimeStamp::Now();
+      sampler.SuspendAndSampleAndResumeThread(
+          lock, registeredThread, now,
+          [&](const Registers& aRegs, const TimeStamp& aNow) {
+            // The target thread is now suspended. Collect a native backtrace,
+            // and call the callback.
+            bool isSynchronous = false;
+#if defined(HAVE_FASTINIT_NATIVE_UNWIND)
+            if (aSampleNative) {
+          // We can only use FramePointerStackWalk or MozStackWalk from
+          // suspend_and_sample_thread as other stackwalking methods may not be
+          // initialized.
+#  if defined(USE_FRAME_POINTER_STACK_WALK)
+              DoFramePointerBacktrace(lock, registeredThread, aRegs,
+                                      nativeStack);
+#  elif defined(USE_MOZ_STACK_WALK)
+              DoMozStackWalkBacktrace(lock, registeredThread, aRegs,
+                                      nativeStack);
+#  else
+#    error "Invalid configuration"
+#  endif
+
+              MergeStacks(aFeatures, isSynchronous, registeredThread, aRegs,
+                          nativeStack, aCollector, CorePS::JsFrames(lock));
+            } else
+#endif
+            {
+              MergeStacks(aFeatures, isSynchronous, registeredThread, aRegs,
+                          nativeStack, aCollector, CorePS::JsFrames(lock));
+
+              if (ProfilerFeature::HasLeaf(aFeatures)) {
+                aCollector.CollectNativeLeafAddr((void*)aRegs.mPC);
+              }
+            }
+          });
+
+      // NOTE: Make sure to disable the sampler before it is destroyed, in case
+      // the profiler is running at the same time.
+      sampler.Disable(lock);
+      break;
+    }
+  }
+}
+
+// END externally visible functions
+////////////////////////////////////////////////////////////////////////
diff --git a/tools/profiler/core/platform.h b/tools/profiler/core/platform.h
new file mode 100644
index 0000000000..a3a508d8b6
--- /dev/null
+++ b/tools/profiler/core/platform.h
@@ -0,0 +1,300 @@
+// Copyright (c) 2006-2011 The Chromium Authors. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+//  * Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+//  * Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in
+//    the documentation and/or other materials provided with the
+//    distribution.
+//  * Neither the name of Google, Inc. nor the names of its contributors
+//    may be used to endorse or promote products derived from this
+//    software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+// COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+// INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+// BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+// OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+// AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+// OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+// SUCH DAMAGE.
+
+#ifndef TOOLS_PLATFORM_H_
+#define TOOLS_PLATFORM_H_
+
+#include "PlatformMacros.h"
+
+#include "mozilla/Logging.h"
+#include "mozilla/MathAlgorithms.h"
+#include "mozilla/ProfileBufferEntrySerialization.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Vector.h"
+#include "nsString.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+
+class ProfilerCodeAddressService;
+
+namespace mozilla {
+struct SymbolTable;
+}
+
+extern mozilla::LazyLogModule gProfilerLog;
+
+// These are for MOZ_LOG="prof:3" or higher. It's the default logging level for
+// the profiler, and should be used sparingly.
+#define LOG_TEST MOZ_LOG_TEST(gProfilerLog, mozilla::LogLevel::Info)
+#define LOG(arg, ...)                            \
+  MOZ_LOG(gProfilerLog, mozilla::LogLevel::Info, \
+          ("[%d] " arg, profiler_current_process_id(), ##__VA_ARGS__))
+
+// These are for MOZ_LOG="prof:4" or higher. It should be used for logging that
+// is somewhat more verbose than LOG.
+#define DEBUG_LOG_TEST MOZ_LOG_TEST(gProfilerLog, mozilla::LogLevel::Debug)
+#define DEBUG_LOG(arg, ...)                       \
+  MOZ_LOG(gProfilerLog, mozilla::LogLevel::Debug, \
+          ("[%d] " arg, profiler_current_process_id(), ##__VA_ARGS__))
+
+typedef uint8_t* Address;
+
+// ----------------------------------------------------------------------------
+// Miscellaneous
+
+class PlatformData;
+
+// We can't new/delete the type safely without defining it
+// (-Wdelete-incomplete).  Use these to hide the details from clients.
+struct PlatformDataDestructor {
+  void operator()(PlatformData*);
+};
+
+typedef mozilla::UniquePtr<PlatformData, PlatformDataDestructor>
+    UniquePlatformData;
+UniquePlatformData AllocPlatformData(int aThreadId);
+
+namespace mozilla {
+class JSONWriter;
+}
+void AppendSharedLibraries(mozilla::JSONWriter& aWriter);
+
+// Convert the array of strings to a bitfield.
+uint32_t ParseFeaturesFromStringArray(const char** aFeatures,
+                                      uint32_t aFeatureCount,
+                                      bool aIsStartup = false);
+
+void profiler_get_profile_json_into_lazily_allocated_buffer(
+    const std::function<char*(size_t)>& aAllocator, double aSinceTime,
+    bool aIsShuttingDown);
+
+// Flags to conveniently track various JS instrumentations.
+enum class JSInstrumentationFlags {
+  StackSampling = 0x1,
+  TraceLogging = 0x2,
+  Allocations = 0x4,
+};
+
+// Record an exit profile from a child process.
+void profiler_received_exit_profile(const nsCString& aExitProfile);
+
+// Write out the information of the active profiling configuration.
+void profiler_write_active_configuration(mozilla::JSONWriter& aWriter);
+
+// Extract all received exit profiles that have not yet expired (i.e., they
+// still intersect with this process' buffer range).
+mozilla::Vector<nsCString> profiler_move_exit_profiles();
+
+// If the "MOZ_PROFILER_SYMBOLICATE" env-var is set, we return a new
+// ProfilerCodeAddressService object to use for local symbolication of profiles.
+// This is off by default, and mainly intended for local development.
+mozilla::UniquePtr<ProfilerCodeAddressService>
+profiler_code_address_service_for_presymbolication();
+
+extern "C" {
+// This function is defined in the profiler rust module at
+// tools/profiler/rust-helper. mozilla::SymbolTable and CompactSymbolTable
+// have identical memory layout.
+bool profiler_get_symbol_table(const char* debug_path, const char* breakpad_id,
+                               mozilla::SymbolTable* symbol_table);
+
+bool profiler_demangle_rust(const char* mangled, char* buffer, size_t len);
+}
+
+// For each running times value, call MACRO(index, name, unit, jsonProperty)
+#define PROFILER_FOR_EACH_RUNNING_TIME(MACRO) \
+  MACRO(0, ThreadCPU, Delta, threadCPUDelta)
+
+// This class contains all "running times" such as CPU usage measurements.
+// All measurements are listed in `PROFILER_FOR_EACH_RUNNING_TIME` above.
+// Each measurement is optional and only takes a value when explicitly set.
+// Two RunningTimes object may be subtracted, to get the difference between
+// known values.
+class RunningTimes {
+ public:
+  constexpr RunningTimes() = default;
+
+  // Constructor with only a timestamp, useful when no measurements will be
+  // taken.
+  constexpr explicit RunningTimes(const mozilla::TimeStamp& aTimeStamp)
+      : mPostMeasurementTimeStamp(aTimeStamp) {}
+
+  constexpr void Clear() { *this = RunningTimes{}; }
+
+  constexpr bool IsEmpty() const { return mKnownBits == 0; }
+
+  // This should be called right after CPU measurements have been taken.
+  void SetPostMeasurementTimeStamp(const mozilla::TimeStamp& aTimeStamp) {
+    mPostMeasurementTimeStamp = aTimeStamp;
+  }
+
+  const mozilla::TimeStamp& PostMeasurementTimeStamp() const {
+    return mPostMeasurementTimeStamp;
+  }
+
+  // Should be filled for any registered thread.
+
+#define RUNNING_TIME_MEMBER(index, name, unit, jsonProperty)          \
+  constexpr bool Is##name##unit##Known() const {                      \
+    return (mKnownBits & mGot##name##unit) != 0;                      \
+  }                                                                   \
+                                                                      \
+  constexpr void Clear##name##unit() {                                \
+    m##name##unit = 0;                                                \
+    mKnownBits &= ~mGot##name##unit;                                  \
+  }                                                                   \
+                                                                      \
+  constexpr void Reset##name##unit(uint64_t a##name##unit) {          \
+    m##name##unit = a##name##unit;                                    \
+    mKnownBits |= mGot##name##unit;                                   \
+  }                                                                   \
+                                                                      \
+  constexpr void Set##name##unit(uint64_t a##name##unit) {            \
+    MOZ_ASSERT(!Is##name##unit##Known(), #name #unit " already set"); \
+    Reset##name##unit(a##name##unit);                                 \
+  }                                                                   \
+                                                                      \
+  constexpr mozilla::Maybe<uint64_t> Get##name##unit() const {        \
+    if (Is##name##unit##Known()) {                                    \
+      return mozilla::Some(m##name##unit);                            \
+    }                                                                 \
+    return mozilla::Nothing{};                                        \
+  }
+
+  PROFILER_FOR_EACH_RUNNING_TIME(RUNNING_TIME_MEMBER)
+
+#undef RUNNING_TIME_MEMBER
+
+  // Take values from another RunningTimes.
+  RunningTimes& TakeFrom(RunningTimes& aOther) {
+    if (!aOther.IsEmpty()) {
+#define RUNNING_TIME_TAKE(index, name, unit, jsonProperty)   \
+  if (aOther.Is##name##unit##Known()) {                      \
+    Set##name##unit(std::exchange(aOther.m##name##unit, 0)); \
+  }
+
+      PROFILER_FOR_EACH_RUNNING_TIME(RUNNING_TIME_TAKE)
+
+#undef RUNNING_TIME_TAKE
+
+      aOther.mKnownBits = 0;
+    }
+    return *this;
+  }
+
+  // Difference from `aBefore` to `this`. Any unknown makes the result unknown.
+  // PostMeasurementTimeStamp set to `this` PostMeasurementTimeStamp, to keep
+  // the most recent timestamp associated with the end of the interval over
+  // which the difference applies.
+  RunningTimes operator-(const RunningTimes& aBefore) const {
+    RunningTimes diff;
+    diff.mPostMeasurementTimeStamp = mPostMeasurementTimeStamp;
+#define RUNNING_TIME_SUB(index, name, unit, jsonProperty)           \
+  if (Is##name##unit##Known() && aBefore.Is##name##unit##Known()) { \
+    diff.Set##name##unit(m##name##unit - aBefore.m##name##unit);    \
+  }
+
+    PROFILER_FOR_EACH_RUNNING_TIME(RUNNING_TIME_SUB)
+
+#undef RUNNING_TIME_SUB
+    return diff;
+  }
+
+ private:
+  friend mozilla::ProfileBufferEntryWriter::Serializer<RunningTimes>;
+  friend mozilla::ProfileBufferEntryReader::Deserializer<RunningTimes>;
+
+  mozilla::TimeStamp mPostMeasurementTimeStamp;
+
+  uint32_t mKnownBits = 0u;
+
+#define RUNNING_TIME_MEMBER(index, name, unit, jsonProperty) \
+  static constexpr uint32_t mGot##name##unit = 1u << index;  \
+  uint64_t m##name##unit = 0;
+
+  PROFILER_FOR_EACH_RUNNING_TIME(RUNNING_TIME_MEMBER)
+
+#undef RUNNING_TIME_MEMBER
+};
+
+template <>
+struct mozilla::ProfileBufferEntryWriter::Serializer<RunningTimes> {
+  static Length Bytes(const RunningTimes& aRunningTimes) {
+    return ULEB128Size(aRunningTimes.mKnownBits) +
+           mozilla::CountPopulation32(aRunningTimes.mKnownBits) *
+               sizeof(uint64_t);
+  }
+
+  static void Write(ProfileBufferEntryWriter& aEW,
+                    const RunningTimes& aRunningTimes) {
+    aEW.WriteULEB128(aRunningTimes.mKnownBits);
+
+#define RUNNING_TIME_SERIALIZE(index, name, unit, jsonProperty) \
+  if (aRunningTimes.Is##name##unit##Known()) {                  \
+    aEW.WriteObject(aRunningTimes.m##name##unit);               \
+  }
+
+    PROFILER_FOR_EACH_RUNNING_TIME(RUNNING_TIME_SERIALIZE)
+
+#undef RUNNING_TIME_SERIALIZE
+  }
+};
+
+template <>
+struct mozilla::ProfileBufferEntryReader::Deserializer<RunningTimes> {
+  static void ReadInto(ProfileBufferEntryReader& aER,
+                       RunningTimes& aRunningTimes) {
+    aRunningTimes = Read(aER);
+  }
+
+  static RunningTimes Read(ProfileBufferEntryReader& aER) {
+    // Start with empty running times, everything is cleared.
+    RunningTimes times;
+
+    // This sets all the bits into mKnownBits, we don't need to modify it
+    // further.
+    times.mKnownBits = aER.ReadULEB128<uint32_t>();
+
+    // For each member that should be known, read its value.
+#define RUNNING_TIME_DESERIALIZE(index, name, unit, jsonProperty) \
+  if (times.Is##name##unit##Known()) {                            \
+    aER.ReadIntoObject(times.m##name##unit);                      \
+  }
+
+    PROFILER_FOR_EACH_RUNNING_TIME(RUNNING_TIME_DESERIALIZE)
+
+#undef RUNNING_TIME_DESERIALIZE
+
+    return times;
+  }
+};
+
+#endif /* ndef TOOLS_PLATFORM_H_ */
diff --git a/tools/profiler/core/shared-libraries-linux.cc b/tools/profiler/core/shared-libraries-linux.cc
new file mode 100644
index 0000000000..d91c78f632
--- /dev/null
+++ b/tools/profiler/core/shared-libraries-linux.cc
@@ -0,0 +1,253 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "shared-libraries.h"
+
+#define PATH_MAX_TOSTRING(x) #x
+#define PATH_MAX_STRING(x) PATH_MAX_TOSTRING(x)
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <limits.h>
+#include <unistd.h>
+#include <fstream>
+#include "platform.h"
+#include "shared-libraries.h"
+#include "GeckoProfiler.h"
+#include "mozilla/Sprintf.h"
+#include "mozilla/Unused.h"
+#include "nsDebug.h"
+#include "nsNativeCharsetUtils.h"
+#include <nsTArray.h>
+
+#include "common/linux/file_id.h"
+#include <algorithm>
+#include <dlfcn.h>
+#if defined(GP_OS_linux) || defined(GP_OS_android)
+#  include <features.h>
+#endif
+#include <sys/types.h>
+
+#if defined(GP_OS_linux) || defined(GP_OS_android) || defined(GP_OS_freebsd)
+#  include <link.h>  // dl_phdr_info
+#else
+#  error "Unexpected configuration"
+#endif
+
+#if defined(GP_OS_android)
+extern "C" MOZ_EXPORT __attribute__((weak)) int dl_iterate_phdr(
+    int (*callback)(struct dl_phdr_info* info, size_t size, void* data),
+    void* data);
+#endif
+
+struct LoadedLibraryInfo {
+  LoadedLibraryInfo(const char* aName, unsigned long aBaseAddress,
+                    unsigned long aFirstMappingStart,
+                    unsigned long aLastMappingEnd)
+      : mName(aName),
+        mBaseAddress(aBaseAddress),
+        mFirstMappingStart(aFirstMappingStart),
+        mLastMappingEnd(aLastMappingEnd) {}
+
+  nsCString mName;
+  unsigned long mBaseAddress;
+  unsigned long mFirstMappingStart;
+  unsigned long mLastMappingEnd;
+};
+
+static nsCString IDtoUUIDString(
+    const google_breakpad::wasteful_vector<uint8_t>& aIdentifier) {
+  using namespace google_breakpad;
+
+  nsCString uuid;
+  const std::string str = FileID::ConvertIdentifierToUUIDString(aIdentifier);
+  uuid.Append(str.c_str(), str.size());
+  // This is '0', not '\0', since it represents the breakpad id age.
+  uuid.Append('0');
+  return uuid;
+}
+
+// Get the breakpad Id for the binary file pointed by bin_name
+static nsCString getId(const char* bin_name) {
+  using namespace google_breakpad;
+
+  PageAllocator allocator;
+  auto_wasteful_vector<uint8_t, kDefaultBuildIdSize> identifier(&allocator);
+
+  FileID file_id(bin_name);
+  if (file_id.ElfFileIdentifier(identifier)) {
+    return IDtoUUIDString(identifier);
+  }
+
+  return ""_ns;
+}
+
+static SharedLibrary SharedLibraryAtPath(const char* path,
+                                         unsigned long libStart,
+                                         unsigned long libEnd,
+                                         unsigned long offset = 0) {
+  nsAutoString pathStr;
+  mozilla::Unused << NS_WARN_IF(
+      NS_FAILED(NS_CopyNativeToUnicode(nsDependentCString(path), pathStr)));
+
+  nsAutoString nameStr = pathStr;
+  int32_t pos = nameStr.RFindChar('/');
+  if (pos != kNotFound) {
+    nameStr.Cut(0, pos + 1);
+  }
+
+  return SharedLibrary(libStart, libEnd, offset, getId(path), nameStr, pathStr,
+                       nameStr, pathStr, ""_ns, "");
+}
+
+static int dl_iterate_callback(struct dl_phdr_info* dl_info, size_t size,
+                               void* data) {
+  auto libInfoList = reinterpret_cast<nsTArray<LoadedLibraryInfo>*>(data);
+
+  if (dl_info->dlpi_phnum <= 0) return 0;
+
+  unsigned long baseAddress = dl_info->dlpi_addr;
+  unsigned long firstMappingStart = -1;
+  unsigned long lastMappingEnd = 0;
+
+  for (size_t i = 0; i < dl_info->dlpi_phnum; i++) {
+    if (dl_info->dlpi_phdr[i].p_type != PT_LOAD) {
+      continue;
+    }
+    unsigned long start = dl_info->dlpi_addr + dl_info->dlpi_phdr[i].p_vaddr;
+    unsigned long end = start + dl_info->dlpi_phdr[i].p_memsz;
+    if (start < firstMappingStart) {
+      firstMappingStart = start;
+    }
+    if (end > lastMappingEnd) {
+      lastMappingEnd = end;
+    }
+  }
+
+  libInfoList->AppendElement(LoadedLibraryInfo(
+      dl_info->dlpi_name, baseAddress, firstMappingStart, lastMappingEnd));
+
+  return 0;
+}
+
+SharedLibraryInfo SharedLibraryInfo::GetInfoForSelf() {
+  SharedLibraryInfo info;
+
+#if defined(GP_OS_linux)
+  // We need to find the name of the executable (exeName, exeNameLen) and the
+  // address of its executable section (exeExeAddr) in the running image.
+  char exeName[PATH_MAX];
+  memset(exeName, 0, sizeof(exeName));
+
+  ssize_t exeNameLen = readlink("/proc/self/exe", exeName, sizeof(exeName) - 1);
+  if (exeNameLen == -1) {
+    // readlink failed for whatever reason.  Note this, but keep going.
+    exeName[0] = '\0';
+    exeNameLen = 0;
+    LOG("SharedLibraryInfo::GetInfoForSelf(): readlink failed");
+  } else {
+    // Assert no buffer overflow.
+    MOZ_RELEASE_ASSERT(exeNameLen >= 0 &&
+                       exeNameLen < static_cast<ssize_t>(sizeof(exeName)));
+  }
+
+  unsigned long exeExeAddr = 0;
+#endif
+
+#if defined(GP_OS_android)
+  // If dl_iterate_phdr doesn't exist, we give up immediately.
+  if (!dl_iterate_phdr) {
+    // On ARM Android, dl_iterate_phdr is provided by the custom linker.
+    // So if libxul was loaded by the system linker (e.g. as part of
+    // xpcshell when running tests), it won't be available and we should
+    // not call it.
+    return info;
+  }
+#endif
+
+#if defined(GP_OS_linux) || defined(GP_OS_android)
+  // Read info from /proc/self/maps. We ignore most of it.
+  pid_t pid = profiler_current_process_id();
+  char path[PATH_MAX];
+  SprintfLiteral(path, "/proc/%d/maps", pid);
+  std::ifstream maps(path);
+  std::string line;
+  while (std::getline(maps, line)) {
+    int ret;
+    unsigned long start;
+    unsigned long end;
+    char perm[6 + 1] = "";
+    unsigned long offset;
+    char modulePath[PATH_MAX + 1] = "";
+    ret = sscanf(line.c_str(),
+                 "%lx-%lx %6s %lx %*s %*x %" PATH_MAX_STRING(PATH_MAX) "s\n",
+                 &start, &end, perm, &offset, modulePath);
+    if (!strchr(perm, 'x')) {
+      // Ignore non executable entries
+      continue;
+    }
+    if (ret != 5 && ret != 4) {
+      LOG("SharedLibraryInfo::GetInfoForSelf(): "
+          "reading /proc/self/maps failed");
+      continue;
+    }
+
+#  if defined(GP_OS_linux)
+    // Try to establish the main executable's load address.
+    if (exeNameLen > 0 && strcmp(modulePath, exeName) == 0) {
+      exeExeAddr = start;
+    }
+#  elif defined(GP_OS_android)
+    // Use /proc/pid/maps to get the dalvik-jit section since it has no
+    // associated phdrs.
+    if (0 == strcmp(modulePath, "/dev/ashmem/dalvik-jit-code-cache")) {
+      info.AddSharedLibrary(
+          SharedLibraryAtPath(modulePath, start, end, offset));
+      if (info.GetSize() > 10000) {
+        LOG("SharedLibraryInfo::GetInfoForSelf(): "
+            "implausibly large number of mappings acquired");
+        break;
+      }
+    }
+#  endif
+  }
+#endif
+
+  nsTArray<LoadedLibraryInfo> libInfoList;
+
+  // We collect the bulk of the library info using dl_iterate_phdr.
+  dl_iterate_phdr(dl_iterate_callback, &libInfoList);
+
+  for (const auto& libInfo : libInfoList) {
+    info.AddSharedLibrary(
+        SharedLibraryAtPath(libInfo.mName.get(), libInfo.mFirstMappingStart,
+                            libInfo.mLastMappingEnd,
+                            libInfo.mFirstMappingStart - libInfo.mBaseAddress));
+  }
+
+#if defined(GP_OS_linux)
+  // Make another pass over the information we just harvested from
+  // dl_iterate_phdr.  If we see a nameless object mapped at what we earlier
+  // established to be the main executable's load address, attach the
+  // executable's name to that entry.
+  for (size_t i = 0; i < info.GetSize(); i++) {
+    SharedLibrary& lib = info.GetMutableEntry(i);
+    if (lib.GetStart() <= exeExeAddr && exeExeAddr <= lib.GetEnd() &&
+        lib.GetNativeDebugPath().empty()) {
+      lib = SharedLibraryAtPath(exeName, lib.GetStart(), lib.GetEnd(),
+                                lib.GetOffset());
+
+      // We only expect to see one such entry.
+      break;
+    }
+  }
+#endif
+
+  return info;
+}
+
+void SharedLibraryInfo::Initialize() { /* do nothing */
+}
diff --git a/tools/profiler/core/shared-libraries-macos.cc b/tools/profiler/core/shared-libraries-macos.cc
new file mode 100644
index 0000000000..eb2704ea08
--- /dev/null
+++ b/tools/profiler/core/shared-libraries-macos.cc
@@ -0,0 +1,185 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "shared-libraries.h"
+
+#include "ClearOnShutdown.h"
+#include "mozilla/StaticMutex.h"
+#include "mozilla/Unused.h"
+#include "nsNativeCharsetUtils.h"
+#include <AvailabilityMacros.h>
+
+#include <dlfcn.h>
+#include <mach-o/arch.h>
+#include <mach-o/dyld_images.h>
+#include <mach-o/dyld.h>
+#include <mach-o/loader.h>
+#include <mach/mach_init.h>
+#include <mach/mach_traps.h>
+#include <mach/task_info.h>
+#include <mach/task.h>
+#include <sstream>
+#include <stdlib.h>
+#include <string.h>
+#include <vector>
+
+// Architecture specific abstraction.
+#if defined(GP_ARCH_x86)
+typedef mach_header platform_mach_header;
+typedef segment_command mach_segment_command_type;
+#  define MACHO_MAGIC_NUMBER MH_MAGIC
+#  define CMD_SEGMENT LC_SEGMENT
+#  define seg_size uint32_t
+#else
+typedef mach_header_64 platform_mach_header;
+typedef segment_command_64 mach_segment_command_type;
+#  define MACHO_MAGIC_NUMBER MH_MAGIC_64
+#  define CMD_SEGMENT LC_SEGMENT_64
+#  define seg_size uint64_t
+#endif
+
+struct NativeSharedLibrary {
+  const platform_mach_header* header;
+  std::string path;
+};
+static std::vector<NativeSharedLibrary>* sSharedLibrariesList = nullptr;
+static mozilla::StaticMutex sSharedLibrariesMutex;
+
+static void SharedLibraryAddImage(const struct mach_header* mh,
+                                  intptr_t vmaddr_slide) {
+  // NOTE: Presumably for backwards-compatibility reasons, this function accepts
+  // a mach_header even on 64-bit where it ought to be a mach_header_64. We cast
+  // it to the right type here.
+  auto header = reinterpret_cast<const platform_mach_header*>(mh);
+
+  Dl_info info;
+  if (!dladdr(header, &info)) {
+    return;
+  }
+
+  mozilla::StaticMutexAutoLock lock(sSharedLibrariesMutex);
+  if (!sSharedLibrariesList) {
+    return;
+  }
+
+  NativeSharedLibrary lib = {header, info.dli_fname};
+  sSharedLibrariesList->push_back(lib);
+}
+
+static void SharedLibraryRemoveImage(const struct mach_header* mh,
+                                     intptr_t vmaddr_slide) {
+  // NOTE: Presumably for backwards-compatibility reasons, this function accepts
+  // a mach_header even on 64-bit where it ought to be a mach_header_64. We cast
+  // it to the right type here.
+  auto header = reinterpret_cast<const platform_mach_header*>(mh);
+
+  mozilla::StaticMutexAutoLock lock(sSharedLibrariesMutex);
+  if (!sSharedLibrariesList) {
+    return;
+  }
+
+  uint32_t count = sSharedLibrariesList->size();
+  for (uint32_t i = 0; i < count; ++i) {
+    if ((*sSharedLibrariesList)[i].header == header) {
+      sSharedLibrariesList->erase(sSharedLibrariesList->begin() + i);
+      return;
+    }
+  }
+}
+
+void SharedLibraryInfo::Initialize() {
+  // NOTE: We intentionally leak this memory here. We're allocating dynamically
+  // in order to avoid static initializers.
+  sSharedLibrariesList = new std::vector<NativeSharedLibrary>();
+
+  _dyld_register_func_for_add_image(SharedLibraryAddImage);
+  _dyld_register_func_for_remove_image(SharedLibraryRemoveImage);
+}
+
+static void addSharedLibrary(const platform_mach_header* header,
+                             const char* path, SharedLibraryInfo& info) {
+  const struct load_command* cmd =
+      reinterpret_cast<const struct load_command*>(header + 1);
+
+  seg_size size = 0;
+  unsigned long long start = reinterpret_cast<unsigned long long>(header);
+  // Find the cmd segment in the macho image. It will contain the offset we care
+  // about.
+  const uint8_t* uuid_bytes = nullptr;
+  for (unsigned int i = 0;
+       cmd && (i < header->ncmds) && (uuid_bytes == nullptr || size == 0);
+       ++i) {
+    if (cmd->cmd == CMD_SEGMENT) {
+      const mach_segment_command_type* seg =
+          reinterpret_cast<const mach_segment_command_type*>(cmd);
+
+      if (!strcmp(seg->segname, "__TEXT")) {
+        size = seg->vmsize;
+      }
+    } else if (cmd->cmd == LC_UUID) {
+      const uuid_command* ucmd = reinterpret_cast<const uuid_command*>(cmd);
+      uuid_bytes = ucmd->uuid;
+    }
+
+    cmd = reinterpret_cast<const struct load_command*>(
+        reinterpret_cast<const char*>(cmd) + cmd->cmdsize);
+  }
+
+  nsAutoCString uuid;
+  if (uuid_bytes != nullptr) {
+    uuid.AppendPrintf(
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "%02X"
+        "0" /* breakpad id age */,
+        uuid_bytes[0], uuid_bytes[1], uuid_bytes[2], uuid_bytes[3],
+        uuid_bytes[4], uuid_bytes[5], uuid_bytes[6], uuid_bytes[7],
+        uuid_bytes[8], uuid_bytes[9], uuid_bytes[10], uuid_bytes[11],
+        uuid_bytes[12], uuid_bytes[13], uuid_bytes[14], uuid_bytes[15]);
+  }
+
+  nsAutoString pathStr;
+  mozilla::Unused << NS_WARN_IF(
+      NS_FAILED(NS_CopyNativeToUnicode(nsDependentCString(path), pathStr)));
+
+  nsAutoString nameStr = pathStr;
+  int32_t pos = nameStr.RFindChar('/');
+  if (pos != kNotFound) {
+    nameStr.Cut(0, pos + 1);
+  }
+
+  const NXArchInfo* archInfo =
+      NXGetArchInfoFromCpuType(header->cputype, header->cpusubtype);
+
+  info.AddSharedLibrary(SharedLibrary(start, start + size, 0, uuid, nameStr,
+                                      pathStr, nameStr, pathStr, ""_ns,
+                                      archInfo ? archInfo->name : ""));
+}
+
+// Translate the statically stored sSharedLibrariesList information into a
+// SharedLibraryInfo object.
+SharedLibraryInfo SharedLibraryInfo::GetInfoForSelf() {
+  mozilla::StaticMutexAutoLock lock(sSharedLibrariesMutex);
+  SharedLibraryInfo sharedLibraryInfo;
+
+  for (auto& info : *sSharedLibrariesList) {
+    addSharedLibrary(info.header, info.path.c_str(), sharedLibraryInfo);
+  }
+
+  return sharedLibraryInfo;
+}
diff --git a/tools/profiler/core/shared-libraries-win32.cc b/tools/profiler/core/shared-libraries-win32.cc
new file mode 100644
index 0000000000..e209e4328f
--- /dev/null
+++ b/tools/profiler/core/shared-libraries-win32.cc
@@ -0,0 +1,246 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <windows.h>
+#include <dbghelp.h>
+#include <sstream>
+#include <psapi.h>
+
+#include "shared-libraries.h"
+#include "nsWindowsHelpers.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Unused.h"
+#include "mozilla/WindowsProcessMitigations.h"
+#include "mozilla/WindowsVersion.h"
+#include "nsNativeCharsetUtils.h"
+#include "nsPrintfCString.h"
+#include "nsReadableUtils.h"
+
+#define CV_SIGNATURE 0x53445352  // 'SDSR'
+
+struct CodeViewRecord70 {
+  uint32_t signature;
+  GUID pdbSignature;
+  uint32_t pdbAge;
+  // A UTF-8 string, according to
+  // https://github.com/Microsoft/microsoft-pdb/blob/082c5290e5aff028ae84e43affa8be717aa7af73/PDB/dbi/locator.cpp#L785
+  char pdbFileName[1];
+};
+
+static bool GetPdbInfo(uintptr_t aStart, nsID& aSignature, uint32_t& aAge,
+                       char** aPdbName) {
+  if (!aStart) {
+    return false;
+  }
+
+  PIMAGE_DOS_HEADER dosHeader = reinterpret_cast<PIMAGE_DOS_HEADER>(aStart);
+  if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
+    return false;
+  }
+
+  PIMAGE_NT_HEADERS ntHeaders =
+      reinterpret_cast<PIMAGE_NT_HEADERS>(aStart + dosHeader->e_lfanew);
+  if (ntHeaders->Signature != IMAGE_NT_SIGNATURE) {
+    return false;
+  }
+
+  uint32_t relativeVirtualAddress =
+      ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG]
+          .VirtualAddress;
+  if (!relativeVirtualAddress) {
+    return false;
+  }
+
+  PIMAGE_DEBUG_DIRECTORY debugDirectory =
+      reinterpret_cast<PIMAGE_DEBUG_DIRECTORY>(aStart + relativeVirtualAddress);
+  if (!debugDirectory || debugDirectory->Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
+    return false;
+  }
+
+  CodeViewRecord70* debugInfo = reinterpret_cast<CodeViewRecord70*>(
+      aStart + debugDirectory->AddressOfRawData);
+  if (!debugInfo || debugInfo->signature != CV_SIGNATURE) {
+    return false;
+  }
+
+  aAge = debugInfo->pdbAge;
+  GUID& pdbSignature = debugInfo->pdbSignature;
+  aSignature.m0 = pdbSignature.Data1;
+  aSignature.m1 = pdbSignature.Data2;
+  aSignature.m2 = pdbSignature.Data3;
+  memcpy(aSignature.m3, pdbSignature.Data4, sizeof(pdbSignature.Data4));
+
+  // The PDB file name could be different from module filename, so report both
+  // e.g. The PDB for C:\Windows\SysWOW64\ntdll.dll is wntdll.pdb
+  *aPdbName = debugInfo->pdbFileName;
+
+  return true;
+}
+
+static nsCString GetVersion(WCHAR* dllPath) {
+  DWORD infoSize = GetFileVersionInfoSizeW(dllPath, nullptr);
+  if (infoSize == 0) {
+    return ""_ns;
+  }
+
+  mozilla::UniquePtr<unsigned char[]> infoData =
+      mozilla::MakeUnique<unsigned char[]>(infoSize);
+  if (!GetFileVersionInfoW(dllPath, 0, infoSize, infoData.get())) {
+    return ""_ns;
+  }
+
+  VS_FIXEDFILEINFO* vInfo;
+  UINT vInfoLen;
+  if (!VerQueryValueW(infoData.get(), L"\\", (LPVOID*)&vInfo, &vInfoLen)) {
+    return ""_ns;
+  }
+  if (!vInfo) {
+    return ""_ns;
+  }
+
+  nsPrintfCString version("%d.%d.%d.%d", vInfo->dwFileVersionMS >> 16,
+                          vInfo->dwFileVersionMS & 0xFFFF,
+                          vInfo->dwFileVersionLS >> 16,
+                          vInfo->dwFileVersionLS & 0xFFFF);
+  return std::move(version);
+}
+
+SharedLibraryInfo SharedLibraryInfo::GetInfoForSelf() {
+  SharedLibraryInfo sharedLibraryInfo;
+
+  HANDLE hProcess = GetCurrentProcess();
+  mozilla::UniquePtr<HMODULE[]> hMods;
+  size_t modulesNum = 0;
+  if (hProcess != NULL) {
+    DWORD modulesSize;
+    if (!EnumProcessModules(hProcess, nullptr, 0, &modulesSize)) {
+      return sharedLibraryInfo;
+    }
+    modulesNum = modulesSize / sizeof(HMODULE);
+    hMods = mozilla::MakeUnique<HMODULE[]>(modulesNum);
+    if (!EnumProcessModules(hProcess, hMods.get(), modulesNum * sizeof(HMODULE),
+                            &modulesSize)) {
+      return sharedLibraryInfo;
+    }
+    // The list may have shrunk between calls
+    if (modulesSize / sizeof(HMODULE) < modulesNum) {
+      modulesNum = modulesSize / sizeof(HMODULE);
+    }
+  }
+
+  for (unsigned int i = 0; i < modulesNum; i++) {
+    WCHAR modulePath[MAX_PATH + 1];
+    if (!GetModuleFileNameEx(hProcess, hMods[i], modulePath,
+                             sizeof(modulePath) / sizeof(WCHAR))) {
+      continue;
+    }
+
+    MODULEINFO module = {0};
+    if (!GetModuleInformation(hProcess, hMods[i], &module,
+                              sizeof(MODULEINFO))) {
+      continue;
+    }
+
+    nsAutoString modulePathStr(modulePath);
+    nsAutoString moduleNameStr = modulePathStr;
+    int32_t pos = moduleNameStr.RFindCharInSet(u"\\/");
+    if (pos != kNotFound) {
+      moduleNameStr.Cut(0, pos + 1);
+    }
+
+    // Hackaround for Bug 1607574.  Nvidia's shim driver nvd3d9wrap[x].dll
+    // detours LoadLibraryExW when it's loaded and the detour function causes
+    // AV when the code tries to access data pointing to an address within
+    // unloaded nvinit[x].dll.
+    // The crashing code is executed when a given parameter is "detoured.dll"
+    // and OS version is older than 6.2.  We hit that crash at the following
+    // call to LoadLibraryEx even if we specify LOAD_LIBRARY_AS_DATAFILE.
+    // We work around it by skipping LoadLibraryEx, and add a library info with
+    // a dummy breakpad id instead.
+#if !defined(_M_ARM64)
+#  if defined(_M_AMD64)
+    LPCWSTR kNvidiaShimDriver = L"nvd3d9wrapx.dll";
+    LPCWSTR kNvidiaInitDriver = L"nvinitx.dll";
+#  elif defined(_M_IX86)
+    LPCWSTR kNvidiaShimDriver = L"nvd3d9wrap.dll";
+    LPCWSTR kNvidiaInitDriver = L"nvinit.dll";
+#  endif
+    if (moduleNameStr.LowerCaseEqualsLiteral("detoured.dll") &&
+        !mozilla::IsWin8OrLater() && ::GetModuleHandle(kNvidiaShimDriver) &&
+        !::GetModuleHandle(kNvidiaInitDriver)) {
+      constexpr auto pdbNameStr = u"detoured.pdb"_ns;
+      SharedLibrary shlib((uintptr_t)module.lpBaseOfDll,
+                          (uintptr_t)module.lpBaseOfDll + module.SizeOfImage,
+                          0,  // DLLs are always mapped at offset 0 on Windows
+                          "000000000000000000000000000000000"_ns, moduleNameStr,
+                          modulePathStr, pdbNameStr, pdbNameStr, ""_ns, "");
+      sharedLibraryInfo.AddSharedLibrary(shlib);
+      continue;
+    }
+#endif  // !defined(_M_ARM64)
+
+    // If EAF+ is enabled, parsing ntdll's PE header via GetPdbInfo() causes
+    // a crash.  We don't include PDB information in SharedLibrary.
+    bool canGetPdbInfo = (!mozilla::IsEafPlusEnabled() ||
+                          !moduleNameStr.LowerCaseEqualsLiteral("ntdll.dll"));
+
+    nsCString breakpadId;
+    // Load the module again to make sure that its handle will remain
+    // valid as we attempt to read the PDB information from it.  We load the
+    // DLL as a datafile so that if the module actually gets unloaded between
+    // the call to EnumProcessModules and the following LoadLibraryEx, we don't
+    // end up running the now newly loaded module's DllMain function.  If the
+    // module is already loaded, LoadLibraryEx just increments its refcount.
+    //
+    // Note that because of the race condition above, merely loading the DLL
+    // again is not safe enough, therefore we also need to make sure that we
+    // can read the memory mapped at the base address before we can safely
+    // proceed to actually access those pages.
+    HMODULE handleLock =
+        LoadLibraryEx(modulePath, NULL, LOAD_LIBRARY_AS_DATAFILE);
+    MEMORY_BASIC_INFORMATION vmemInfo = {0};
+    nsID pdbSig;
+    uint32_t pdbAge;
+    nsAutoString pdbPathStr;
+    nsAutoString pdbNameStr;
+    char* pdbName = nullptr;
+    if (handleLock &&
+        sizeof(vmemInfo) ==
+            VirtualQuery(module.lpBaseOfDll, &vmemInfo, sizeof(vmemInfo)) &&
+        vmemInfo.State == MEM_COMMIT && canGetPdbInfo &&
+        GetPdbInfo((uintptr_t)module.lpBaseOfDll, pdbSig, pdbAge, &pdbName)) {
+      MOZ_ASSERT(breakpadId.IsEmpty());
+      breakpadId.AppendPrintf(
+          "%08X"                              // m0
+          "%04X%04X"                          // m1,m2
+          "%02X%02X%02X%02X%02X%02X%02X%02X"  // m3
+          "%X",                               // pdbAge
+          pdbSig.m0, pdbSig.m1, pdbSig.m2, pdbSig.m3[0], pdbSig.m3[1],
+          pdbSig.m3[2], pdbSig.m3[3], pdbSig.m3[4], pdbSig.m3[5], pdbSig.m3[6],
+          pdbSig.m3[7], pdbAge);
+
+      pdbPathStr = NS_ConvertUTF8toUTF16(pdbName);
+      pdbNameStr = pdbPathStr;
+      int32_t pos = pdbNameStr.RFindCharInSet(u"\\/");
+      if (pos != kNotFound) {
+        pdbNameStr.Cut(0, pos + 1);
+      }
+    }
+
+    SharedLibrary shlib((uintptr_t)module.lpBaseOfDll,
+                        (uintptr_t)module.lpBaseOfDll + module.SizeOfImage,
+                        0,  // DLLs are always mapped at offset 0 on Windows
+                        breakpadId, moduleNameStr, modulePathStr, pdbNameStr,
+                        pdbPathStr, GetVersion(modulePath), "");
+    sharedLibraryInfo.AddSharedLibrary(shlib);
+
+    FreeLibrary(handleLock);  // ok to free null handles
+  }
+
+  return sharedLibraryInfo;
+}
+
+void SharedLibraryInfo::Initialize() { /* do nothing */
+}
diff --git a/tools/profiler/core/vtune/ittnotify.h b/tools/profiler/core/vtune/ittnotify.h
new file mode 100644
index 0000000000..f1d65b3328
--- /dev/null
+++ b/tools/profiler/core/vtune/ittnotify.h
@@ -0,0 +1,4123 @@
+/* <copyright>
+  This file is provided under a dual BSD/GPLv2 license.  When using or
+  redistributing this file, you may do so under either license.
+
+  GPL LICENSE SUMMARY
+
+  Copyright (c) 2005-2014 Intel Corporation. All rights reserved.
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+  The full GNU General Public License is included in this distribution
+  in the file called LICENSE.GPL.
+
+  Contact Information:
+  http://software.intel.com/en-us/articles/intel-vtune-amplifier-xe/
+
+  BSD LICENSE
+
+  Copyright (c) 2005-2014 Intel Corporation. All rights reserved.
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in
+      the documentation and/or other materials provided with the
+      distribution.
+    * Neither the name of Intel Corporation nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+</copyright> */
+#ifndef _ITTNOTIFY_H_
+#define _ITTNOTIFY_H_
+
+/**
+@file
+@brief Public User API functions and types
+@mainpage
+
+The ITT API is used to annotate a user's program with additional information
+that can be used by correctness and performance tools. The user inserts
+calls in their program. Those calls generate information that is collected
+at runtime, and used by Intel(R) Threading Tools.
+
+@section API Concepts
+The following general concepts are used throughout the API.
+
+@subsection Unicode Support
+Many API functions take character string arguments. On Windows, there
+are two versions of each such function. The function name is suffixed
+by W if Unicode support is enabled, and by A otherwise. Any API function
+that takes a character string argument adheres to this convention.
+
+@subsection Conditional Compilation
+Many users prefer having an option to modify ITT API code when linking it
+inside their runtimes. ITT API header file provides a mechanism to replace
+ITT API function names inside your code with empty strings. To do this,
+define the macros INTEL_NO_ITTNOTIFY_API during compilation and remove the
+static library from the linker script.
+
+@subsection Domains
+[see domains]
+Domains provide a way to separate notification for different modules or
+libraries in a program. Domains are specified by dotted character strings,
+e.g. TBB.Internal.Control.
+
+A mechanism (to be specified) is provided to enable and disable
+domains. By default, all domains are enabled.
+@subsection Named Entities and Instances
+Named entities (frames, regions, tasks, and markers) communicate
+information about the program to the analysis tools. A named entity often
+refers to a section of program code, or to some set of logical concepts
+that the programmer wants to group together.
+
+Named entities relate to the programmer's static view of the program. When
+the program actually executes, many instances of a given named entity
+may be created.
+
+The API annotations denote instances of named entities. The actual
+named entities are displayed using the analysis tools. In other words,
+the named entities come into existence when instances are created.
+
+Instances of named entities may have instance identifiers (IDs). Some
+API calls use instance identifiers to create relationships between
+different instances of named entities. Other API calls associate data
+with instances of named entities.
+
+Some named entities must always have instance IDs. In particular, regions
+and frames always have IDs. Task and markers need IDs only if the ID is
+needed in another API call (such as adding a relation or metadata).
+
+The lifetime of instance IDs is distinct from the lifetime of
+instances. This allows various relationships to be specified separate
+from the actual execution of instances. This flexibility comes at the
+expense of extra API calls.
+
+The same ID may not be reused for different instances, unless a previous
+[ref] __itt_id_destroy call for that ID has been issued.
+*/
+
+/** @cond exclude_from_documentation */
+#ifndef ITT_OS_WIN
+#  define ITT_OS_WIN   1
+#endif /* ITT_OS_WIN */
+
+#ifndef ITT_OS_LINUX
+#  define ITT_OS_LINUX 2
+#endif /* ITT_OS_LINUX */
+
+#ifndef ITT_OS_MAC
+#  define ITT_OS_MAC   3
+#endif /* ITT_OS_MAC */
+
+#ifndef ITT_OS_FREEBSD
+#  define ITT_OS_FREEBSD   4
+#endif /* ITT_OS_FREEBSD */
+
+#ifndef ITT_OS
+#  if defined WIN32 || defined _WIN32
+#    define ITT_OS ITT_OS_WIN
+#  elif defined( __APPLE__ ) && defined( __MACH__ )
+#    define ITT_OS ITT_OS_MAC
+#  elif defined( __FreeBSD__ )
+#    define ITT_OS ITT_OS_FREEBSD
+#  else
+#    define ITT_OS ITT_OS_LINUX
+#  endif
+#endif /* ITT_OS */
+
+#ifndef ITT_PLATFORM_WIN
+#  define ITT_PLATFORM_WIN 1
+#endif /* ITT_PLATFORM_WIN */
+
+#ifndef ITT_PLATFORM_POSIX
+#  define ITT_PLATFORM_POSIX 2
+#endif /* ITT_PLATFORM_POSIX */
+
+#ifndef ITT_PLATFORM_MAC
+#  define ITT_PLATFORM_MAC 3
+#endif /* ITT_PLATFORM_MAC */
+
+#ifndef ITT_PLATFORM_FREEBSD
+#  define ITT_PLATFORM_FREEBSD 4
+#endif /* ITT_PLATFORM_FREEBSD */
+
+#ifndef ITT_PLATFORM
+#  if ITT_OS==ITT_OS_WIN
+#    define ITT_PLATFORM ITT_PLATFORM_WIN
+#  elif ITT_OS==ITT_OS_MAC
+#    define ITT_PLATFORM ITT_PLATFORM_MAC
+#  elif ITT_OS==ITT_OS_FREEBSD
+#    define ITT_PLATFORM ITT_PLATFORM_FREEBSD
+#  else
+#    define ITT_PLATFORM ITT_PLATFORM_POSIX
+#  endif
+#endif /* ITT_PLATFORM */
+
+#if defined(_UNICODE) && !defined(UNICODE)
+#define UNICODE
+#endif
+
+#include <stddef.h>
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#include <tchar.h>
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#include <stdint.h>
+#if defined(UNICODE) || defined(_UNICODE)
+#include <wchar.h>
+#endif /* UNICODE || _UNICODE */
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+#ifndef ITTAPI_CDECL
+#  if ITT_PLATFORM==ITT_PLATFORM_WIN
+#    define ITTAPI_CDECL __cdecl
+#  else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#    if defined _M_IX86 || defined __i386__
+#      define ITTAPI_CDECL __attribute__ ((cdecl))
+#    else  /* _M_IX86 || __i386__ */
+#      define ITTAPI_CDECL /* actual only on x86 platform */
+#    endif /* _M_IX86 || __i386__ */
+#  endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* ITTAPI_CDECL */
+
+#ifndef STDCALL
+#  if ITT_PLATFORM==ITT_PLATFORM_WIN
+#    define STDCALL __stdcall
+#  else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#    if defined _M_IX86 || defined __i386__
+#      define STDCALL __attribute__ ((stdcall))
+#    else  /* _M_IX86 || __i386__ */
+#      define STDCALL /* supported only on x86 platform */
+#    endif /* _M_IX86 || __i386__ */
+#  endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* STDCALL */
+
+#define ITTAPI    ITTAPI_CDECL
+#define LIBITTAPI ITTAPI_CDECL
+
+/* TODO: Temporary for compatibility! */
+#define ITTAPI_CALL    ITTAPI_CDECL
+#define LIBITTAPI_CALL ITTAPI_CDECL
+
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+/* use __forceinline (VC++ specific) */
+#define ITT_INLINE           __forceinline
+#define ITT_INLINE_ATTRIBUTE /* nothing */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+/*
+ * Generally, functions are not inlined unless optimization is specified.
+ * For functions declared inline, this attribute inlines the function even
+ * if no optimization level was specified.
+ */
+#ifdef __STRICT_ANSI__
+#define ITT_INLINE           static
+#define ITT_INLINE_ATTRIBUTE __attribute__((unused))
+#else  /* __STRICT_ANSI__ */
+#define ITT_INLINE           static inline
+#define ITT_INLINE_ATTRIBUTE __attribute__((always_inline, unused))
+#endif /* __STRICT_ANSI__ */
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+/** @endcond */
+
+#ifdef INTEL_ITTNOTIFY_ENABLE_LEGACY
+#  if ITT_PLATFORM==ITT_PLATFORM_WIN
+#    pragma message("WARNING!!! Deprecated API is used. Please undefine INTEL_ITTNOTIFY_ENABLE_LEGACY macro")
+#  else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#    warning "Deprecated API is used. Please undefine INTEL_ITTNOTIFY_ENABLE_LEGACY macro"
+#  endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#  include "vtune/legacy/ittnotify.h"
+#endif /* INTEL_ITTNOTIFY_ENABLE_LEGACY */
+
+/** @cond exclude_from_documentation */
+/* Helper macro for joining tokens */
+#define ITT_JOIN_AUX(p,n) p##n
+#define ITT_JOIN(p,n)     ITT_JOIN_AUX(p,n)
+
+#ifdef ITT_MAJOR
+#undef ITT_MAJOR
+#endif
+#ifdef ITT_MINOR
+#undef ITT_MINOR
+#endif
+#define ITT_MAJOR     3
+#define ITT_MINOR     0
+
+/* Standard versioning of a token with major and minor version numbers */
+#define ITT_VERSIONIZE(x)    \
+    ITT_JOIN(x,              \
+    ITT_JOIN(_,              \
+    ITT_JOIN(ITT_MAJOR,      \
+    ITT_JOIN(_, ITT_MINOR))))
+
+#ifndef INTEL_ITTNOTIFY_PREFIX
+#  define INTEL_ITTNOTIFY_PREFIX __itt_
+#endif /* INTEL_ITTNOTIFY_PREFIX */
+#ifndef INTEL_ITTNOTIFY_POSTFIX
+#  define INTEL_ITTNOTIFY_POSTFIX _ptr_
+#endif /* INTEL_ITTNOTIFY_POSTFIX */
+
+#define ITTNOTIFY_NAME_AUX(n) ITT_JOIN(INTEL_ITTNOTIFY_PREFIX,n)
+#define ITTNOTIFY_NAME(n)     ITT_VERSIONIZE(ITTNOTIFY_NAME_AUX(ITT_JOIN(n,INTEL_ITTNOTIFY_POSTFIX)))
+
+#define ITTNOTIFY_VOID(n) (!ITTNOTIFY_NAME(n)) ? (void)0 : ITTNOTIFY_NAME(n)
+#define ITTNOTIFY_DATA(n) (!ITTNOTIFY_NAME(n)) ?       0 : ITTNOTIFY_NAME(n)
+
+#define ITTNOTIFY_VOID_D0(n,d)       (!(d)->flags) ? (void)0 : (!ITTNOTIFY_NAME(n)) ? (void)0 : ITTNOTIFY_NAME(n)(d)
+#define ITTNOTIFY_VOID_D1(n,d,x)     (!(d)->flags) ? (void)0 : (!ITTNOTIFY_NAME(n)) ? (void)0 : ITTNOTIFY_NAME(n)(d,x)
+#define ITTNOTIFY_VOID_D2(n,d,x,y)   (!(d)->flags) ? (void)0 : (!ITTNOTIFY_NAME(n)) ? (void)0 : ITTNOTIFY_NAME(n)(d,x,y)
+#define ITTNOTIFY_VOID_D3(n,d,x,y,z) (!(d)->flags) ? (void)0 : (!ITTNOTIFY_NAME(n)) ? (void)0 : ITTNOTIFY_NAME(n)(d,x,y,z)
+#define ITTNOTIFY_VOID_D4(n,d,x,y,z,a)     (!(d)->flags) ? (void)0 : (!ITTNOTIFY_NAME(n)) ? (void)0 : ITTNOTIFY_NAME(n)(d,x,y,z,a)
+#define ITTNOTIFY_VOID_D5(n,d,x,y,z,a,b)   (!(d)->flags) ? (void)0 : (!ITTNOTIFY_NAME(n)) ? (void)0 : ITTNOTIFY_NAME(n)(d,x,y,z,a,b)
+#define ITTNOTIFY_VOID_D6(n,d,x,y,z,a,b,c) (!(d)->flags) ? (void)0 : (!ITTNOTIFY_NAME(n)) ? (void)0 : ITTNOTIFY_NAME(n)(d,x,y,z,a,b,c)
+#define ITTNOTIFY_DATA_D0(n,d)       (!(d)->flags) ?       0 : (!ITTNOTIFY_NAME(n)) ?       0 : ITTNOTIFY_NAME(n)(d)
+#define ITTNOTIFY_DATA_D1(n,d,x)     (!(d)->flags) ?       0 : (!ITTNOTIFY_NAME(n)) ?       0 : ITTNOTIFY_NAME(n)(d,x)
+#define ITTNOTIFY_DATA_D2(n,d,x,y)   (!(d)->flags) ?       0 : (!ITTNOTIFY_NAME(n)) ?       0 : ITTNOTIFY_NAME(n)(d,x,y)
+#define ITTNOTIFY_DATA_D3(n,d,x,y,z) (!(d)->flags) ?       0 : (!ITTNOTIFY_NAME(n)) ?       0 : ITTNOTIFY_NAME(n)(d,x,y,z)
+#define ITTNOTIFY_DATA_D4(n,d,x,y,z,a)     (!(d)->flags) ? 0 : (!ITTNOTIFY_NAME(n)) ?       0 : ITTNOTIFY_NAME(n)(d,x,y,z,a)
+#define ITTNOTIFY_DATA_D5(n,d,x,y,z,a,b)   (!(d)->flags) ? 0 : (!ITTNOTIFY_NAME(n)) ?       0 : ITTNOTIFY_NAME(n)(d,x,y,z,a,b)
+#define ITTNOTIFY_DATA_D6(n,d,x,y,z,a,b,c) (!(d)->flags) ? 0 : (!ITTNOTIFY_NAME(n)) ?       0 : ITTNOTIFY_NAME(n)(d,x,y,z,a,b,c)
+
+#ifdef ITT_STUB
+#undef ITT_STUB
+#endif
+#ifdef ITT_STUBV
+#undef ITT_STUBV
+#endif
+#define ITT_STUBV(api,type,name,args)                             \
+    typedef type (api* ITT_JOIN(ITTNOTIFY_NAME(name),_t)) args;   \
+    extern ITT_JOIN(ITTNOTIFY_NAME(name),_t) ITTNOTIFY_NAME(name);
+#define ITT_STUB ITT_STUBV
+/** @endcond */
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/** @cond exclude_from_gpa_documentation */
+/**
+ * @defgroup public Public API
+ * @{
+ * @}
+ */
+
+/**
+ * @defgroup control Collection Control
+ * @ingroup public
+ * General behavior: application continues to run, but no profiling information is being collected
+ *
+ * Pausing occurs not only for the current thread but for all process as well as spawned processes
+ * - Intel(R) Parallel Inspector and Intel(R) Inspector XE:
+ *   - Does not analyze or report errors that involve memory access.
+ *   - Other errors are reported as usual. Pausing data collection in
+ *     Intel(R) Parallel Inspector and Intel(R) Inspector XE
+ *     only pauses tracing and analyzing memory access.
+ *     It does not pause tracing or analyzing threading APIs.
+ *   .
+ * - Intel(R) Parallel Amplifier and Intel(R) VTune(TM) Amplifier XE:
+ *   - Does continue to record when new threads are started.
+ *   .
+ * - Other effects:
+ *   - Possible reduction of runtime overhead.
+ *   .
+ * @{
+ */
+/** @brief Pause collection */
+void ITTAPI __itt_pause(void);
+/** @brief Resume collection */
+void ITTAPI __itt_resume(void);
+/** @brief Detach collection */
+void ITTAPI __itt_detach(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, pause,  (void))
+ITT_STUBV(ITTAPI, void, resume, (void))
+ITT_STUBV(ITTAPI, void, detach, (void))
+#define __itt_pause      ITTNOTIFY_VOID(pause)
+#define __itt_pause_ptr  ITTNOTIFY_NAME(pause)
+#define __itt_resume     ITTNOTIFY_VOID(resume)
+#define __itt_resume_ptr ITTNOTIFY_NAME(resume)
+#define __itt_detach     ITTNOTIFY_VOID(detach)
+#define __itt_detach_ptr ITTNOTIFY_NAME(detach)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_pause()
+#define __itt_pause_ptr  0
+#define __itt_resume()
+#define __itt_resume_ptr 0
+#define __itt_detach()
+#define __itt_detach_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_pause_ptr  0
+#define __itt_resume_ptr 0
+#define __itt_detach_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} control group */
+/** @endcond */
+
+/**
+ * @defgroup threads Threads
+ * @ingroup public
+ * Give names to threads
+ * @{
+ */
+/**
+ * @brief Sets thread name of calling thread
+ * @param[in] name - name of thread
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+void ITTAPI __itt_thread_set_nameA(const char    *name);
+void ITTAPI __itt_thread_set_nameW(const wchar_t *name);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_thread_set_name     __itt_thread_set_nameW
+#  define __itt_thread_set_name_ptr __itt_thread_set_nameW_ptr
+#else /* UNICODE */
+#  define __itt_thread_set_name     __itt_thread_set_nameA
+#  define __itt_thread_set_name_ptr __itt_thread_set_nameA_ptr
+#endif /* UNICODE */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+void ITTAPI __itt_thread_set_name(const char *name);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUBV(ITTAPI, void, thread_set_nameA, (const char    *name))
+ITT_STUBV(ITTAPI, void, thread_set_nameW, (const wchar_t *name))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUBV(ITTAPI, void, thread_set_name,  (const char    *name))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_thread_set_nameA     ITTNOTIFY_VOID(thread_set_nameA)
+#define __itt_thread_set_nameA_ptr ITTNOTIFY_NAME(thread_set_nameA)
+#define __itt_thread_set_nameW     ITTNOTIFY_VOID(thread_set_nameW)
+#define __itt_thread_set_nameW_ptr ITTNOTIFY_NAME(thread_set_nameW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_thread_set_name     ITTNOTIFY_VOID(thread_set_name)
+#define __itt_thread_set_name_ptr ITTNOTIFY_NAME(thread_set_name)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_thread_set_nameA(name)
+#define __itt_thread_set_nameA_ptr 0
+#define __itt_thread_set_nameW(name)
+#define __itt_thread_set_nameW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_thread_set_name(name)
+#define __itt_thread_set_name_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_thread_set_nameA_ptr 0
+#define __itt_thread_set_nameW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_thread_set_name_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @cond exclude_from_gpa_documentation */
+
+/**
+ * @brief Mark current thread as ignored from this point on, for the duration of its existence.
+ */
+void ITTAPI __itt_thread_ignore(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, thread_ignore, (void))
+#define __itt_thread_ignore     ITTNOTIFY_VOID(thread_ignore)
+#define __itt_thread_ignore_ptr ITTNOTIFY_NAME(thread_ignore)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_thread_ignore()
+#define __itt_thread_ignore_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_thread_ignore_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} threads group */
+
+/**
+ * @defgroup suppress Error suppression
+ * @ingroup public
+ * General behavior: application continues to run, but errors are suppressed
+ *
+ * @{
+ */
+
+/*****************************************************************//**
+ * @name group of functions used for error suppression in correctness tools
+ *********************************************************************/
+/** @{ */
+/**
+ * @hideinitializer
+ * @brief possible value for suppression mask
+ */
+#define __itt_suppress_all_errors 0x7fffffff
+
+/**
+ * @hideinitializer
+ * @brief possible value for suppression mask (suppresses errors from threading analysis)
+ */
+#define __itt_suppress_threading_errors 0x000000ff
+
+/**
+ * @hideinitializer
+ * @brief possible value for suppression mask (suppresses errors from memory analysis)
+ */
+#define __itt_suppress_memory_errors 0x0000ff00
+
+/**
+ * @brief Start suppressing errors identified in mask on this thread
+ */
+void ITTAPI __itt_suppress_push(unsigned int mask);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, suppress_push, (unsigned int mask))
+#define __itt_suppress_push     ITTNOTIFY_VOID(suppress_push)
+#define __itt_suppress_push_ptr ITTNOTIFY_NAME(suppress_push)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_suppress_push(mask)
+#define __itt_suppress_push_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_suppress_push_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Undo the effects of the matching call to __itt_suppress_push
+ */
+void ITTAPI __itt_suppress_pop(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, suppress_pop, (void))
+#define __itt_suppress_pop     ITTNOTIFY_VOID(suppress_pop)
+#define __itt_suppress_pop_ptr ITTNOTIFY_NAME(suppress_pop)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_suppress_pop()
+#define __itt_suppress_pop_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_suppress_pop_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @enum __itt_model_disable
+ * @brief Enumerator for the disable methods
+ */
+typedef enum __itt_suppress_mode {
+    __itt_unsuppress_range,
+    __itt_suppress_range
+} __itt_suppress_mode_t;
+
+/**
+ * @brief Mark a range of memory for error suppression or unsuppression for error types included in mask
+ */
+void ITTAPI __itt_suppress_mark_range(__itt_suppress_mode_t mode, unsigned int mask, void * address, size_t size);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, suppress_mark_range, (__itt_suppress_mode_t mode, unsigned int mask, void * address, size_t size))
+#define __itt_suppress_mark_range     ITTNOTIFY_VOID(suppress_mark_range)
+#define __itt_suppress_mark_range_ptr ITTNOTIFY_NAME(suppress_mark_range)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_suppress_mark_range(mask)
+#define __itt_suppress_mark_range_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_suppress_mark_range_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Undo the effect of a matching call to __itt_suppress_mark_range.   If not matching
+ *        call is found, nothing is changed.
+ */
+void ITTAPI __itt_suppress_clear_range(__itt_suppress_mode_t mode, unsigned int mask, void * address, size_t size);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, suppress_clear_range, (__itt_suppress_mode_t mode, unsigned int mask, void * address, size_t size))
+#define __itt_suppress_clear_range     ITTNOTIFY_VOID(suppress_clear_range)
+#define __itt_suppress_clear_range_ptr ITTNOTIFY_NAME(suppress_clear_range)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_suppress_clear_range(mask)
+#define __itt_suppress_clear_range_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_suppress_clear_range_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} */
+/** @} suppress group */
+
+/**
+ * @defgroup sync Synchronization
+ * @ingroup public
+ * Indicate user-written synchronization code
+ * @{
+ */
+/**
+ * @hideinitializer
+ * @brief possible value of attribute argument for sync object type
+ */
+#define __itt_attr_barrier 1
+
+/**
+ * @hideinitializer
+ * @brief possible value of attribute argument for sync object type
+ */
+#define __itt_attr_mutex   2
+
+/**
+@brief Name a synchronization object
+@param[in] addr       Handle for the synchronization object. You should
+use a real address to uniquely identify the synchronization object.
+@param[in] objtype    null-terminated object type string. If NULL is
+passed, the name will be "User Synchronization".
+@param[in] objname    null-terminated object name string. If NULL,
+no name will be assigned to the object.
+@param[in] attribute  one of [#__itt_attr_barrier, #__itt_attr_mutex]
+ */
+
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+void ITTAPI __itt_sync_createA(void *addr, const char    *objtype, const char    *objname, int attribute);
+void ITTAPI __itt_sync_createW(void *addr, const wchar_t *objtype, const wchar_t *objname, int attribute);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_sync_create     __itt_sync_createW
+#  define __itt_sync_create_ptr __itt_sync_createW_ptr
+#else /* UNICODE */
+#  define __itt_sync_create     __itt_sync_createA
+#  define __itt_sync_create_ptr __itt_sync_createA_ptr
+#endif /* UNICODE */
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+void ITTAPI __itt_sync_create (void *addr, const char *objtype, const char *objname, int attribute);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUBV(ITTAPI, void, sync_createA, (void *addr, const char    *objtype, const char    *objname, int attribute))
+ITT_STUBV(ITTAPI, void, sync_createW, (void *addr, const wchar_t *objtype, const wchar_t *objname, int attribute))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUBV(ITTAPI, void, sync_create,  (void *addr, const char*    objtype, const char*    objname, int attribute))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_sync_createA     ITTNOTIFY_VOID(sync_createA)
+#define __itt_sync_createA_ptr ITTNOTIFY_NAME(sync_createA)
+#define __itt_sync_createW     ITTNOTIFY_VOID(sync_createW)
+#define __itt_sync_createW_ptr ITTNOTIFY_NAME(sync_createW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_sync_create     ITTNOTIFY_VOID(sync_create)
+#define __itt_sync_create_ptr ITTNOTIFY_NAME(sync_create)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_sync_createA(addr, objtype, objname, attribute)
+#define __itt_sync_createA_ptr 0
+#define __itt_sync_createW(addr, objtype, objname, attribute)
+#define __itt_sync_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_sync_create(addr, objtype, objname, attribute)
+#define __itt_sync_create_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_sync_createA_ptr 0
+#define __itt_sync_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_sync_create_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+@brief Rename a synchronization object
+
+You can use the rename call to assign or reassign a name to a given
+synchronization object.
+@param[in] addr  handle for the synchronization object.
+@param[in] name  null-terminated object name string.
+*/
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+void ITTAPI __itt_sync_renameA(void *addr, const char    *name);
+void ITTAPI __itt_sync_renameW(void *addr, const wchar_t *name);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_sync_rename     __itt_sync_renameW
+#  define __itt_sync_rename_ptr __itt_sync_renameW_ptr
+#else /* UNICODE */
+#  define __itt_sync_rename     __itt_sync_renameA
+#  define __itt_sync_rename_ptr __itt_sync_renameA_ptr
+#endif /* UNICODE */
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+void ITTAPI __itt_sync_rename(void *addr, const char *name);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUBV(ITTAPI, void, sync_renameA, (void *addr, const char    *name))
+ITT_STUBV(ITTAPI, void, sync_renameW, (void *addr, const wchar_t *name))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUBV(ITTAPI, void, sync_rename,  (void *addr, const char    *name))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_sync_renameA     ITTNOTIFY_VOID(sync_renameA)
+#define __itt_sync_renameA_ptr ITTNOTIFY_NAME(sync_renameA)
+#define __itt_sync_renameW     ITTNOTIFY_VOID(sync_renameW)
+#define __itt_sync_renameW_ptr ITTNOTIFY_NAME(sync_renameW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_sync_rename     ITTNOTIFY_VOID(sync_rename)
+#define __itt_sync_rename_ptr ITTNOTIFY_NAME(sync_rename)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_sync_renameA(addr, name)
+#define __itt_sync_renameA_ptr 0
+#define __itt_sync_renameW(addr, name)
+#define __itt_sync_renameW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_sync_rename(addr, name)
+#define __itt_sync_rename_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_sync_renameA_ptr 0
+#define __itt_sync_renameW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_sync_rename_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ @brief Destroy a synchronization object.
+ @param addr Handle for the synchronization object.
+ */
+void ITTAPI __itt_sync_destroy(void *addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, sync_destroy, (void *addr))
+#define __itt_sync_destroy     ITTNOTIFY_VOID(sync_destroy)
+#define __itt_sync_destroy_ptr ITTNOTIFY_NAME(sync_destroy)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_sync_destroy(addr)
+#define __itt_sync_destroy_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_sync_destroy_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/*****************************************************************//**
+ * @name group of functions is used for performance measurement tools
+ *********************************************************************/
+/** @{ */
+/**
+ * @brief Enter spin loop on user-defined sync object
+ */
+void ITTAPI __itt_sync_prepare(void* addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, sync_prepare, (void *addr))
+#define __itt_sync_prepare     ITTNOTIFY_VOID(sync_prepare)
+#define __itt_sync_prepare_ptr ITTNOTIFY_NAME(sync_prepare)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_sync_prepare(addr)
+#define __itt_sync_prepare_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_sync_prepare_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Quit spin loop without acquiring spin object
+ */
+void ITTAPI __itt_sync_cancel(void *addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, sync_cancel, (void *addr))
+#define __itt_sync_cancel     ITTNOTIFY_VOID(sync_cancel)
+#define __itt_sync_cancel_ptr ITTNOTIFY_NAME(sync_cancel)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_sync_cancel(addr)
+#define __itt_sync_cancel_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_sync_cancel_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Successful spin loop completion (sync object acquired)
+ */
+void ITTAPI __itt_sync_acquired(void *addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, sync_acquired, (void *addr))
+#define __itt_sync_acquired     ITTNOTIFY_VOID(sync_acquired)
+#define __itt_sync_acquired_ptr ITTNOTIFY_NAME(sync_acquired)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_sync_acquired(addr)
+#define __itt_sync_acquired_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_sync_acquired_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Start sync object releasing code. Is called before the lock release call.
+ */
+void ITTAPI __itt_sync_releasing(void* addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, sync_releasing, (void *addr))
+#define __itt_sync_releasing     ITTNOTIFY_VOID(sync_releasing)
+#define __itt_sync_releasing_ptr ITTNOTIFY_NAME(sync_releasing)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_sync_releasing(addr)
+#define __itt_sync_releasing_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_sync_releasing_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} */
+
+/** @} sync group */
+
+/**************************************************************//**
+ * @name group of functions is used for correctness checking tools
+ ******************************************************************/
+/** @{ */
+/**
+ * @ingroup legacy
+ * @deprecated Legacy API
+ * @brief Fast synchronization which does no require spinning.
+ * - This special function is to be used by TBB and OpenMP libraries only when they know
+ *   there is no spin but they need to suppress TC warnings about shared variable modifications.
+ * - It only has corresponding pointers in static library and does not have corresponding function
+ *   in dynamic library.
+ * @see void __itt_sync_prepare(void* addr);
+ */
+void ITTAPI __itt_fsync_prepare(void* addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, fsync_prepare, (void *addr))
+#define __itt_fsync_prepare     ITTNOTIFY_VOID(fsync_prepare)
+#define __itt_fsync_prepare_ptr ITTNOTIFY_NAME(fsync_prepare)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_fsync_prepare(addr)
+#define __itt_fsync_prepare_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_fsync_prepare_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup legacy
+ * @deprecated Legacy API
+ * @brief Fast synchronization which does no require spinning.
+ * - This special function is to be used by TBB and OpenMP libraries only when they know
+ *   there is no spin but they need to suppress TC warnings about shared variable modifications.
+ * - It only has corresponding pointers in static library and does not have corresponding function
+ *   in dynamic library.
+ * @see void __itt_sync_cancel(void *addr);
+ */
+void ITTAPI __itt_fsync_cancel(void *addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, fsync_cancel, (void *addr))
+#define __itt_fsync_cancel     ITTNOTIFY_VOID(fsync_cancel)
+#define __itt_fsync_cancel_ptr ITTNOTIFY_NAME(fsync_cancel)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_fsync_cancel(addr)
+#define __itt_fsync_cancel_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_fsync_cancel_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup legacy
+ * @deprecated Legacy API
+ * @brief Fast synchronization which does no require spinning.
+ * - This special function is to be used by TBB and OpenMP libraries only when they know
+ *   there is no spin but they need to suppress TC warnings about shared variable modifications.
+ * - It only has corresponding pointers in static library and does not have corresponding function
+ *   in dynamic library.
+ * @see void __itt_sync_acquired(void *addr);
+ */
+void ITTAPI __itt_fsync_acquired(void *addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, fsync_acquired, (void *addr))
+#define __itt_fsync_acquired     ITTNOTIFY_VOID(fsync_acquired)
+#define __itt_fsync_acquired_ptr ITTNOTIFY_NAME(fsync_acquired)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_fsync_acquired(addr)
+#define __itt_fsync_acquired_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_fsync_acquired_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup legacy
+ * @deprecated Legacy API
+ * @brief Fast synchronization which does no require spinning.
+ * - This special function is to be used by TBB and OpenMP libraries only when they know
+ *   there is no spin but they need to suppress TC warnings about shared variable modifications.
+ * - It only has corresponding pointers in static library and does not have corresponding function
+ *   in dynamic library.
+ * @see void __itt_sync_releasing(void* addr);
+ */
+void ITTAPI __itt_fsync_releasing(void* addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, fsync_releasing, (void *addr))
+#define __itt_fsync_releasing     ITTNOTIFY_VOID(fsync_releasing)
+#define __itt_fsync_releasing_ptr ITTNOTIFY_NAME(fsync_releasing)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_fsync_releasing(addr)
+#define __itt_fsync_releasing_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_fsync_releasing_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} */
+
+/**
+ * @defgroup model Modeling by Intel(R) Parallel Advisor
+ * @ingroup public
+ * This is the subset of itt used for modeling by Intel(R) Parallel Advisor.
+ * This API is called ONLY using annotate.h, by "Annotation" macros
+ * the user places in their sources during the parallelism modeling steps.
+ *
+ * site_begin/end and task_begin/end take the address of handle variables,
+ * which are writeable by the API.  Handles must be 0 initialized prior
+ * to the first call to begin, or may cause a run-time failure.
+ * The handles are initialized in a multi-thread safe way by the API if
+ * the handle is 0.  The commonly expected idiom is one static handle to
+ * identify a site or task.  If a site or task of the same name has already
+ * been started during this collection, the same handle MAY be returned,
+ * but is not required to be - it is unspecified if data merging is done
+ * based on name.  These routines also take an instance variable.  Like
+ * the lexical instance, these must be 0 initialized.  Unlike the lexical
+ * instance, this is used to track a single dynamic instance.
+ *
+ * API used by the Intel(R) Parallel Advisor to describe potential concurrency
+ * and related activities. User-added source annotations expand to calls
+ * to these procedures to enable modeling of a hypothetical concurrent
+ * execution serially.
+ * @{
+ */
+#if !defined(_ADVISOR_ANNOTATE_H_) || defined(ANNOTATE_EXPAND_NULL)
+
+typedef void* __itt_model_site;             /*!< @brief handle for lexical site     */
+typedef void* __itt_model_site_instance;    /*!< @brief handle for dynamic instance */
+typedef void* __itt_model_task;             /*!< @brief handle for lexical site     */
+typedef void* __itt_model_task_instance;    /*!< @brief handle for dynamic instance */
+
+/**
+ * @enum __itt_model_disable
+ * @brief Enumerator for the disable methods
+ */
+typedef enum {
+    __itt_model_disable_observation,
+    __itt_model_disable_collection
+} __itt_model_disable;
+
+#endif /* !_ADVISOR_ANNOTATE_H_ || ANNOTATE_EXPAND_NULL */
+
+/**
+ * @brief ANNOTATE_SITE_BEGIN/ANNOTATE_SITE_END support.
+ *
+ * site_begin/end model a potential concurrency site.
+ * site instances may be recursively nested with themselves.
+ * site_end exits the most recently started but unended site for the current
+ * thread.  The handle passed to end may be used to validate structure.
+ * Instances of a site encountered on different threads concurrently
+ * are considered completely distinct. If the site name for two different
+ * lexical sites match, it is unspecified whether they are treated as the
+ * same or different for data presentation.
+ */
+void ITTAPI __itt_model_site_begin(__itt_model_site *site, __itt_model_site_instance *instance, const char *name);
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+void ITTAPI __itt_model_site_beginW(const wchar_t *name);
+#endif
+void ITTAPI __itt_model_site_beginA(const char *name);
+void ITTAPI __itt_model_site_beginAL(const char *name, size_t siteNameLen);
+void ITTAPI __itt_model_site_end  (__itt_model_site *site, __itt_model_site_instance *instance);
+void ITTAPI __itt_model_site_end_2(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, model_site_begin,  (__itt_model_site *site, __itt_model_site_instance *instance, const char *name))
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUBV(ITTAPI, void, model_site_beginW,  (const wchar_t *name))
+#endif
+ITT_STUBV(ITTAPI, void, model_site_beginA,  (const char *name))
+ITT_STUBV(ITTAPI, void, model_site_beginAL,  (const char *name, size_t siteNameLen))
+ITT_STUBV(ITTAPI, void, model_site_end,    (__itt_model_site *site, __itt_model_site_instance *instance))
+ITT_STUBV(ITTAPI, void, model_site_end_2,  (void))
+#define __itt_model_site_begin      ITTNOTIFY_VOID(model_site_begin)
+#define __itt_model_site_begin_ptr  ITTNOTIFY_NAME(model_site_begin)
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_model_site_beginW      ITTNOTIFY_VOID(model_site_beginW)
+#define __itt_model_site_beginW_ptr  ITTNOTIFY_NAME(model_site_beginW)
+#endif
+#define __itt_model_site_beginA      ITTNOTIFY_VOID(model_site_beginA)
+#define __itt_model_site_beginA_ptr  ITTNOTIFY_NAME(model_site_beginA)
+#define __itt_model_site_beginAL      ITTNOTIFY_VOID(model_site_beginAL)
+#define __itt_model_site_beginAL_ptr  ITTNOTIFY_NAME(model_site_beginAL)
+#define __itt_model_site_end        ITTNOTIFY_VOID(model_site_end)
+#define __itt_model_site_end_ptr    ITTNOTIFY_NAME(model_site_end)
+#define __itt_model_site_end_2        ITTNOTIFY_VOID(model_site_end_2)
+#define __itt_model_site_end_2_ptr    ITTNOTIFY_NAME(model_site_end_2)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_model_site_begin(site, instance, name)
+#define __itt_model_site_begin_ptr  0
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_model_site_beginW(name)
+#define __itt_model_site_beginW_ptr  0
+#endif
+#define __itt_model_site_beginA(name)
+#define __itt_model_site_beginA_ptr  0
+#define __itt_model_site_beginAL(name, siteNameLen)
+#define __itt_model_site_beginAL_ptr  0
+#define __itt_model_site_end(site, instance)
+#define __itt_model_site_end_ptr    0
+#define __itt_model_site_end_2()
+#define __itt_model_site_end_2_ptr    0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_model_site_begin_ptr  0
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_model_site_beginW_ptr  0
+#endif
+#define __itt_model_site_beginA_ptr  0
+#define __itt_model_site_beginAL_ptr  0
+#define __itt_model_site_end_ptr    0
+#define __itt_model_site_end_2_ptr    0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief ANNOTATE_TASK_BEGIN/ANNOTATE_TASK_END support
+ *
+ * task_begin/end model a potential task, which is contained within the most
+ * closely enclosing dynamic site.  task_end exits the most recently started
+ * but unended task.  The handle passed to end may be used to validate
+ * structure.  It is unspecified if bad dynamic nesting is detected.  If it
+ * is, it should be encoded in the resulting data collection.  The collector
+ * should not fail due to construct nesting issues, nor attempt to directly
+ * indicate the problem.
+ */
+void ITTAPI __itt_model_task_begin(__itt_model_task *task, __itt_model_task_instance *instance, const char *name);
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+void ITTAPI __itt_model_task_beginW(const wchar_t *name);
+void ITTAPI __itt_model_iteration_taskW(const wchar_t *name);
+#endif
+void ITTAPI __itt_model_task_beginA(const char *name);
+void ITTAPI __itt_model_task_beginAL(const char *name, size_t taskNameLen);
+void ITTAPI __itt_model_iteration_taskA(const char *name);
+void ITTAPI __itt_model_iteration_taskAL(const char *name, size_t taskNameLen);
+void ITTAPI __itt_model_task_end  (__itt_model_task *task, __itt_model_task_instance *instance);
+void ITTAPI __itt_model_task_end_2(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, model_task_begin,  (__itt_model_task *task, __itt_model_task_instance *instance, const char *name))
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUBV(ITTAPI, void, model_task_beginW,  (const wchar_t *name))
+ITT_STUBV(ITTAPI, void, model_iteration_taskW, (const wchar_t *name))
+#endif
+ITT_STUBV(ITTAPI, void, model_task_beginA,  (const char *name))
+ITT_STUBV(ITTAPI, void, model_task_beginAL,  (const char *name, size_t taskNameLen))
+ITT_STUBV(ITTAPI, void, model_iteration_taskA,  (const char *name))
+ITT_STUBV(ITTAPI, void, model_iteration_taskAL,  (const char *name, size_t taskNameLen))
+ITT_STUBV(ITTAPI, void, model_task_end,    (__itt_model_task *task, __itt_model_task_instance *instance))
+ITT_STUBV(ITTAPI, void, model_task_end_2,  (void))
+#define __itt_model_task_begin      ITTNOTIFY_VOID(model_task_begin)
+#define __itt_model_task_begin_ptr  ITTNOTIFY_NAME(model_task_begin)
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_model_task_beginW     ITTNOTIFY_VOID(model_task_beginW)
+#define __itt_model_task_beginW_ptr ITTNOTIFY_NAME(model_task_beginW)
+#define __itt_model_iteration_taskW     ITTNOTIFY_VOID(model_iteration_taskW)
+#define __itt_model_iteration_taskW_ptr ITTNOTIFY_NAME(model_iteration_taskW)
+#endif
+#define __itt_model_task_beginA    ITTNOTIFY_VOID(model_task_beginA)
+#define __itt_model_task_beginA_ptr ITTNOTIFY_NAME(model_task_beginA)
+#define __itt_model_task_beginAL    ITTNOTIFY_VOID(model_task_beginAL)
+#define __itt_model_task_beginAL_ptr ITTNOTIFY_NAME(model_task_beginAL)
+#define __itt_model_iteration_taskA    ITTNOTIFY_VOID(model_iteration_taskA)
+#define __itt_model_iteration_taskA_ptr ITTNOTIFY_NAME(model_iteration_taskA)
+#define __itt_model_iteration_taskAL    ITTNOTIFY_VOID(model_iteration_taskAL)
+#define __itt_model_iteration_taskAL_ptr ITTNOTIFY_NAME(model_iteration_taskAL)
+#define __itt_model_task_end        ITTNOTIFY_VOID(model_task_end)
+#define __itt_model_task_end_ptr    ITTNOTIFY_NAME(model_task_end)
+#define __itt_model_task_end_2        ITTNOTIFY_VOID(model_task_end_2)
+#define __itt_model_task_end_2_ptr    ITTNOTIFY_NAME(model_task_end_2)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_model_task_begin(task, instance, name)
+#define __itt_model_task_begin_ptr  0
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_model_task_beginW(name)
+#define __itt_model_task_beginW_ptr  0
+#endif
+#define __itt_model_task_beginA(name)
+#define __itt_model_task_beginA_ptr  0
+#define __itt_model_task_beginAL(name, siteNameLen)
+#define __itt_model_task_beginAL_ptr  0
+#define __itt_model_iteration_taskA(name)
+#define __itt_model_iteration_taskA_ptr  0
+#define __itt_model_iteration_taskAL(name, siteNameLen)
+#define __itt_model_iteration_taskAL_ptr  0
+#define __itt_model_task_end(task, instance)
+#define __itt_model_task_end_ptr    0
+#define __itt_model_task_end_2()
+#define __itt_model_task_end_2_ptr    0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_model_task_begin_ptr  0
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_model_task_beginW_ptr 0
+#endif
+#define __itt_model_task_beginA_ptr  0
+#define __itt_model_task_beginAL_ptr  0
+#define __itt_model_iteration_taskA_ptr    0
+#define __itt_model_iteration_taskAL_ptr    0
+#define __itt_model_task_end_ptr    0
+#define __itt_model_task_end_2_ptr    0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief ANNOTATE_LOCK_ACQUIRE/ANNOTATE_LOCK_RELEASE support
+ *
+ * lock_acquire/release model a potential lock for both lockset and
+ * performance modeling.  Each unique address is modeled as a separate
+ * lock, with invalid addresses being valid lock IDs.  Specifically:
+ * no storage is accessed by the API at the specified address - it is only
+ * used for lock identification.  Lock acquires may be self-nested and are
+ * unlocked by a corresponding number of releases.
+ * (These closely correspond to __itt_sync_acquired/__itt_sync_releasing,
+ * but may not have identical semantics.)
+ */
+void ITTAPI __itt_model_lock_acquire(void *lock);
+void ITTAPI __itt_model_lock_acquire_2(void *lock);
+void ITTAPI __itt_model_lock_release(void *lock);
+void ITTAPI __itt_model_lock_release_2(void *lock);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, model_lock_acquire, (void *lock))
+ITT_STUBV(ITTAPI, void, model_lock_acquire_2, (void *lock))
+ITT_STUBV(ITTAPI, void, model_lock_release, (void *lock))
+ITT_STUBV(ITTAPI, void, model_lock_release_2, (void *lock))
+#define __itt_model_lock_acquire     ITTNOTIFY_VOID(model_lock_acquire)
+#define __itt_model_lock_acquire_ptr ITTNOTIFY_NAME(model_lock_acquire)
+#define __itt_model_lock_acquire_2     ITTNOTIFY_VOID(model_lock_acquire_2)
+#define __itt_model_lock_acquire_2_ptr ITTNOTIFY_NAME(model_lock_acquire_2)
+#define __itt_model_lock_release     ITTNOTIFY_VOID(model_lock_release)
+#define __itt_model_lock_release_ptr ITTNOTIFY_NAME(model_lock_release)
+#define __itt_model_lock_release_2     ITTNOTIFY_VOID(model_lock_release_2)
+#define __itt_model_lock_release_2_ptr ITTNOTIFY_NAME(model_lock_release_2)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_model_lock_acquire(lock)
+#define __itt_model_lock_acquire_ptr 0
+#define __itt_model_lock_acquire_2(lock)
+#define __itt_model_lock_acquire_2_ptr 0
+#define __itt_model_lock_release(lock)
+#define __itt_model_lock_release_ptr 0
+#define __itt_model_lock_release_2(lock)
+#define __itt_model_lock_release_2_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_model_lock_acquire_ptr 0
+#define __itt_model_lock_acquire_2_ptr 0
+#define __itt_model_lock_release_ptr 0
+#define __itt_model_lock_release_2_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief ANNOTATE_RECORD_ALLOCATION/ANNOTATE_RECORD_DEALLOCATION support
+ *
+ * record_allocation/deallocation describe user-defined memory allocator
+ * behavior, which may be required for correctness modeling to understand
+ * when storage is not expected to be actually reused across threads.
+ */
+void ITTAPI __itt_model_record_allocation  (void *addr, size_t size);
+void ITTAPI __itt_model_record_deallocation(void *addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, model_record_allocation,   (void *addr, size_t size))
+ITT_STUBV(ITTAPI, void, model_record_deallocation, (void *addr))
+#define __itt_model_record_allocation       ITTNOTIFY_VOID(model_record_allocation)
+#define __itt_model_record_allocation_ptr   ITTNOTIFY_NAME(model_record_allocation)
+#define __itt_model_record_deallocation     ITTNOTIFY_VOID(model_record_deallocation)
+#define __itt_model_record_deallocation_ptr ITTNOTIFY_NAME(model_record_deallocation)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_model_record_allocation(addr, size)
+#define __itt_model_record_allocation_ptr   0
+#define __itt_model_record_deallocation(addr)
+#define __itt_model_record_deallocation_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_model_record_allocation_ptr   0
+#define __itt_model_record_deallocation_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief ANNOTATE_INDUCTION_USES support
+ *
+ * Note particular storage is inductive through the end of the current site
+ */
+void ITTAPI __itt_model_induction_uses(void* addr, size_t size);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, model_induction_uses, (void *addr, size_t size))
+#define __itt_model_induction_uses     ITTNOTIFY_VOID(model_induction_uses)
+#define __itt_model_induction_uses_ptr ITTNOTIFY_NAME(model_induction_uses)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_model_induction_uses(addr, size)
+#define __itt_model_induction_uses_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_model_induction_uses_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief ANNOTATE_REDUCTION_USES support
+ *
+ * Note particular storage is used for reduction through the end
+ * of the current site
+ */
+void ITTAPI __itt_model_reduction_uses(void* addr, size_t size);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, model_reduction_uses, (void *addr, size_t size))
+#define __itt_model_reduction_uses     ITTNOTIFY_VOID(model_reduction_uses)
+#define __itt_model_reduction_uses_ptr ITTNOTIFY_NAME(model_reduction_uses)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_model_reduction_uses(addr, size)
+#define __itt_model_reduction_uses_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_model_reduction_uses_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief ANNOTATE_OBSERVE_USES support
+ *
+ * Have correctness modeling record observations about uses of storage
+ * through the end of the current site
+ */
+void ITTAPI __itt_model_observe_uses(void* addr, size_t size);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, model_observe_uses, (void *addr, size_t size))
+#define __itt_model_observe_uses     ITTNOTIFY_VOID(model_observe_uses)
+#define __itt_model_observe_uses_ptr ITTNOTIFY_NAME(model_observe_uses)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_model_observe_uses(addr, size)
+#define __itt_model_observe_uses_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_model_observe_uses_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief ANNOTATE_CLEAR_USES support
+ *
+ * Clear the special handling of a piece of storage related to induction,
+ * reduction or observe_uses
+ */
+void ITTAPI __itt_model_clear_uses(void* addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, model_clear_uses, (void *addr))
+#define __itt_model_clear_uses     ITTNOTIFY_VOID(model_clear_uses)
+#define __itt_model_clear_uses_ptr ITTNOTIFY_NAME(model_clear_uses)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_model_clear_uses(addr)
+#define __itt_model_clear_uses_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_model_clear_uses_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief ANNOTATE_DISABLE_*_PUSH/ANNOTATE_DISABLE_*_POP support
+ *
+ * disable_push/disable_pop push and pop disabling based on a parameter.
+ * Disabling observations stops processing of memory references during
+ * correctness modeling, and all annotations that occur in the disabled
+ * region.  This allows description of code that is expected to be handled
+ * specially during conversion to parallelism or that is not recognized
+ * by tools (e.g. some kinds of synchronization operations.)
+ * This mechanism causes all annotations in the disabled region, other
+ * than disable_push and disable_pop, to be ignored.  (For example, this
+ * might validly be used to disable an entire parallel site and the contained
+ * tasks and locking in it for data collection purposes.)
+ * The disable for collection is a more expensive operation, but reduces
+ * collector overhead significantly.  This applies to BOTH correctness data
+ * collection and performance data collection.  For example, a site
+ * containing a task might only enable data collection for the first 10
+ * iterations.  Both performance and correctness data should reflect this,
+ * and the program should run as close to full speed as possible when
+ * collection is disabled.
+ */
+void ITTAPI __itt_model_disable_push(__itt_model_disable x);
+void ITTAPI __itt_model_disable_pop(void);
+void ITTAPI __itt_model_aggregate_task(size_t x);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, model_disable_push, (__itt_model_disable x))
+ITT_STUBV(ITTAPI, void, model_disable_pop,  (void))
+ITT_STUBV(ITTAPI, void, model_aggregate_task, (size_t x))
+#define __itt_model_disable_push     ITTNOTIFY_VOID(model_disable_push)
+#define __itt_model_disable_push_ptr ITTNOTIFY_NAME(model_disable_push)
+#define __itt_model_disable_pop      ITTNOTIFY_VOID(model_disable_pop)
+#define __itt_model_disable_pop_ptr  ITTNOTIFY_NAME(model_disable_pop)
+#define __itt_model_aggregate_task      ITTNOTIFY_VOID(model_aggregate_task)
+#define __itt_model_aggregate_task_ptr  ITTNOTIFY_NAME(model_aggregate_task)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_model_disable_push(x)
+#define __itt_model_disable_push_ptr 0
+#define __itt_model_disable_pop()
+#define __itt_model_disable_pop_ptr 0
+#define __itt_model_aggregate_task(x)
+#define __itt_model_aggregate_task_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_model_disable_push_ptr 0
+#define __itt_model_disable_pop_ptr 0
+#define __itt_model_aggregate_task_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} model group */
+
+/**
+ * @defgroup heap Heap
+ * @ingroup public
+ * Heap group
+ * @{
+ */
+
+typedef void* __itt_heap_function;
+
+/**
+ * @brief Create an identification for heap function
+ * @return non-zero identifier or NULL
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+__itt_heap_function ITTAPI __itt_heap_function_createA(const char*    name, const char*    domain);
+__itt_heap_function ITTAPI __itt_heap_function_createW(const wchar_t* name, const wchar_t* domain);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_heap_function_create     __itt_heap_function_createW
+#  define __itt_heap_function_create_ptr __itt_heap_function_createW_ptr
+#else
+#  define __itt_heap_function_create     __itt_heap_function_createA
+#  define __itt_heap_function_create_ptr __itt_heap_function_createA_ptr
+#endif /* UNICODE */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+__itt_heap_function ITTAPI __itt_heap_function_create(const char* name, const char* domain);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, __itt_heap_function, heap_function_createA, (const char*    name, const char*    domain))
+ITT_STUB(ITTAPI, __itt_heap_function, heap_function_createW, (const wchar_t* name, const wchar_t* domain))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, __itt_heap_function, heap_function_create,  (const char*    name, const char*    domain))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_heap_function_createA     ITTNOTIFY_DATA(heap_function_createA)
+#define __itt_heap_function_createA_ptr ITTNOTIFY_NAME(heap_function_createA)
+#define __itt_heap_function_createW     ITTNOTIFY_DATA(heap_function_createW)
+#define __itt_heap_function_createW_ptr ITTNOTIFY_NAME(heap_function_createW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_heap_function_create      ITTNOTIFY_DATA(heap_function_create)
+#define __itt_heap_function_create_ptr  ITTNOTIFY_NAME(heap_function_create)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_heap_function_createA(name, domain) (__itt_heap_function)0
+#define __itt_heap_function_createA_ptr 0
+#define __itt_heap_function_createW(name, domain) (__itt_heap_function)0
+#define __itt_heap_function_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_heap_function_create(name, domain)  (__itt_heap_function)0
+#define __itt_heap_function_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_heap_function_createA_ptr 0
+#define __itt_heap_function_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_heap_function_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Record an allocation begin occurrence.
+ */
+void ITTAPI __itt_heap_allocate_begin(__itt_heap_function h, size_t size, int initialized);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_allocate_begin, (__itt_heap_function h, size_t size, int initialized))
+#define __itt_heap_allocate_begin     ITTNOTIFY_VOID(heap_allocate_begin)
+#define __itt_heap_allocate_begin_ptr ITTNOTIFY_NAME(heap_allocate_begin)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_allocate_begin(h, size, initialized)
+#define __itt_heap_allocate_begin_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_allocate_begin_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Record an allocation end occurrence.
+ */
+void ITTAPI __itt_heap_allocate_end(__itt_heap_function h, void** addr, size_t size, int initialized);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_allocate_end, (__itt_heap_function h, void** addr, size_t size, int initialized))
+#define __itt_heap_allocate_end     ITTNOTIFY_VOID(heap_allocate_end)
+#define __itt_heap_allocate_end_ptr ITTNOTIFY_NAME(heap_allocate_end)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_allocate_end(h, addr, size, initialized)
+#define __itt_heap_allocate_end_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_allocate_end_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Record an free begin occurrence.
+ */
+void ITTAPI __itt_heap_free_begin(__itt_heap_function h, void* addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_free_begin, (__itt_heap_function h, void* addr))
+#define __itt_heap_free_begin     ITTNOTIFY_VOID(heap_free_begin)
+#define __itt_heap_free_begin_ptr ITTNOTIFY_NAME(heap_free_begin)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_free_begin(h, addr)
+#define __itt_heap_free_begin_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_free_begin_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Record an free end occurrence.
+ */
+void ITTAPI __itt_heap_free_end(__itt_heap_function h, void* addr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_free_end, (__itt_heap_function h, void* addr))
+#define __itt_heap_free_end     ITTNOTIFY_VOID(heap_free_end)
+#define __itt_heap_free_end_ptr ITTNOTIFY_NAME(heap_free_end)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_free_end(h, addr)
+#define __itt_heap_free_end_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_free_end_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Record an reallocation begin occurrence.
+ */
+void ITTAPI __itt_heap_reallocate_begin(__itt_heap_function h, void* addr, size_t new_size, int initialized);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_reallocate_begin, (__itt_heap_function h, void* addr, size_t new_size, int initialized))
+#define __itt_heap_reallocate_begin     ITTNOTIFY_VOID(heap_reallocate_begin)
+#define __itt_heap_reallocate_begin_ptr ITTNOTIFY_NAME(heap_reallocate_begin)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_reallocate_begin(h, addr, new_size, initialized)
+#define __itt_heap_reallocate_begin_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_reallocate_begin_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Record an reallocation end occurrence.
+ */
+void ITTAPI __itt_heap_reallocate_end(__itt_heap_function h, void* addr, void** new_addr, size_t new_size, int initialized);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_reallocate_end, (__itt_heap_function h, void* addr, void** new_addr, size_t new_size, int initialized))
+#define __itt_heap_reallocate_end     ITTNOTIFY_VOID(heap_reallocate_end)
+#define __itt_heap_reallocate_end_ptr ITTNOTIFY_NAME(heap_reallocate_end)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_reallocate_end(h, addr, new_addr, new_size, initialized)
+#define __itt_heap_reallocate_end_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_reallocate_end_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @brief internal access begin */
+void ITTAPI __itt_heap_internal_access_begin(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_internal_access_begin,  (void))
+#define __itt_heap_internal_access_begin      ITTNOTIFY_VOID(heap_internal_access_begin)
+#define __itt_heap_internal_access_begin_ptr  ITTNOTIFY_NAME(heap_internal_access_begin)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_internal_access_begin()
+#define __itt_heap_internal_access_begin_ptr  0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_internal_access_begin_ptr  0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @brief internal access end */
+void ITTAPI __itt_heap_internal_access_end(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_internal_access_end, (void))
+#define __itt_heap_internal_access_end     ITTNOTIFY_VOID(heap_internal_access_end)
+#define __itt_heap_internal_access_end_ptr ITTNOTIFY_NAME(heap_internal_access_end)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_internal_access_end()
+#define __itt_heap_internal_access_end_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_internal_access_end_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @brief record memory growth begin */
+void ITTAPI __itt_heap_record_memory_growth_begin(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_record_memory_growth_begin,  (void))
+#define __itt_heap_record_memory_growth_begin      ITTNOTIFY_VOID(heap_record_memory_growth_begin)
+#define __itt_heap_record_memory_growth_begin_ptr  ITTNOTIFY_NAME(heap_record_memory_growth_begin)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_record_memory_growth_begin()
+#define __itt_heap_record_memory_growth_begin_ptr  0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_record_memory_growth_begin_ptr  0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @brief record memory growth end */
+void ITTAPI __itt_heap_record_memory_growth_end(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_record_memory_growth_end, (void))
+#define __itt_heap_record_memory_growth_end     ITTNOTIFY_VOID(heap_record_memory_growth_end)
+#define __itt_heap_record_memory_growth_end_ptr ITTNOTIFY_NAME(heap_record_memory_growth_end)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_record_memory_growth_end()
+#define __itt_heap_record_memory_growth_end_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_record_memory_growth_end_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Specify the type of heap detection/reporting to modify.
+ */
+/**
+ * @hideinitializer
+ * @brief Report on memory leaks.
+ */
+#define __itt_heap_leaks 0x00000001
+
+/**
+ * @hideinitializer
+ * @brief Report on memory growth.
+ */
+#define __itt_heap_growth 0x00000002
+
+
+/** @brief heap reset detection */
+void ITTAPI __itt_heap_reset_detection(unsigned int reset_mask);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_reset_detection,  (unsigned int reset_mask))
+#define __itt_heap_reset_detection      ITTNOTIFY_VOID(heap_reset_detection)
+#define __itt_heap_reset_detection_ptr  ITTNOTIFY_NAME(heap_reset_detection)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_reset_detection()
+#define __itt_heap_reset_detection_ptr  0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_reset_detection_ptr  0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @brief report */
+void ITTAPI __itt_heap_record(unsigned int record_mask);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, heap_record, (unsigned int record_mask))
+#define __itt_heap_record     ITTNOTIFY_VOID(heap_record)
+#define __itt_heap_record_ptr ITTNOTIFY_NAME(heap_record)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_heap_record()
+#define __itt_heap_record_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_heap_record_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @} heap group */
+/** @endcond */
+/* ========================================================================== */
+
+/**
+ * @defgroup domains Domains
+ * @ingroup public
+ * Domains group
+ * @{
+ */
+
+/** @cond exclude_from_documentation */
+#pragma pack(push, 8)
+
+typedef struct ___itt_domain
+{
+    volatile int flags; /*!< Zero if disabled, non-zero if enabled. The meaning of different non-zero values is reserved to the runtime */
+    const char* nameA;  /*!< Copy of original name in ASCII. */
+#if defined(UNICODE) || defined(_UNICODE)
+    const wchar_t* nameW; /*!< Copy of original name in UNICODE. */
+#else  /* UNICODE || _UNICODE */
+    void* nameW;
+#endif /* UNICODE || _UNICODE */
+    int   extra1; /*!< Reserved to the runtime */
+    void* extra2; /*!< Reserved to the runtime */
+    struct ___itt_domain* next;
+} __itt_domain;
+
+#pragma pack(pop)
+/** @endcond */
+
+/**
+ * @ingroup domains
+ * @brief Create a domain.
+ * Create domain using some domain name: the URI naming style is recommended.
+ * Because the set of domains is expected to be static over the application's
+ * execution time, there is no mechanism to destroy a domain.
+ * Any domain can be accessed by any thread in the process, regardless of
+ * which thread created the domain. This call is thread-safe.
+ * @param[in] name name of domain
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+__itt_domain* ITTAPI __itt_domain_createA(const char    *name);
+__itt_domain* ITTAPI __itt_domain_createW(const wchar_t *name);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_domain_create     __itt_domain_createW
+#  define __itt_domain_create_ptr __itt_domain_createW_ptr
+#else /* UNICODE */
+#  define __itt_domain_create     __itt_domain_createA
+#  define __itt_domain_create_ptr __itt_domain_createA_ptr
+#endif /* UNICODE */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+__itt_domain* ITTAPI __itt_domain_create(const char *name);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, __itt_domain*, domain_createA, (const char    *name))
+ITT_STUB(ITTAPI, __itt_domain*, domain_createW, (const wchar_t *name))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, __itt_domain*, domain_create,  (const char    *name))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_domain_createA     ITTNOTIFY_DATA(domain_createA)
+#define __itt_domain_createA_ptr ITTNOTIFY_NAME(domain_createA)
+#define __itt_domain_createW     ITTNOTIFY_DATA(domain_createW)
+#define __itt_domain_createW_ptr ITTNOTIFY_NAME(domain_createW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_domain_create     ITTNOTIFY_DATA(domain_create)
+#define __itt_domain_create_ptr ITTNOTIFY_NAME(domain_create)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_domain_createA(name) (__itt_domain*)0
+#define __itt_domain_createA_ptr 0
+#define __itt_domain_createW(name) (__itt_domain*)0
+#define __itt_domain_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_domain_create(name)  (__itt_domain*)0
+#define __itt_domain_create_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_domain_createA_ptr 0
+#define __itt_domain_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_domain_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} domains group */
+
+/**
+ * @defgroup ids IDs
+ * @ingroup public
+ * IDs group
+ * @{
+ */
+
+/** @cond exclude_from_documentation */
+#pragma pack(push, 8)
+
+typedef struct ___itt_id
+{
+    unsigned long long d1, d2, d3;
+} __itt_id;
+
+#pragma pack(pop)
+/** @endcond */
+
+const __itt_id __itt_null = { 0, 0, 0 };
+
+/**
+ * @ingroup ids
+ * @brief A convenience function is provided to create an ID without domain control.
+ * @brief This is a convenience function to initialize an __itt_id structure. This function
+ * does not affect the collector runtime in any way. After you make the ID with this
+ * function, you still must create it with the __itt_id_create function before using the ID
+ * to identify a named entity.
+ * @param[in] addr The address of object; high QWORD of the ID value.
+ * @param[in] extra The extra data to unique identify object; low QWORD of the ID value.
+ */
+
+ITT_INLINE __itt_id ITTAPI __itt_id_make(void* addr, unsigned long long extra) ITT_INLINE_ATTRIBUTE;
+ITT_INLINE __itt_id ITTAPI __itt_id_make(void* addr, unsigned long long extra)
+{
+    __itt_id id = __itt_null;
+    id.d1 = (unsigned long long)((uintptr_t)addr);
+    id.d2 = (unsigned long long)extra;
+    id.d3 = (unsigned long long)0; /* Reserved. Must be zero */
+    return id;
+}
+
+/**
+ * @ingroup ids
+ * @brief Create an instance of identifier.
+ * This establishes the beginning of the lifetime of an instance of
+ * the given ID in the trace. Once this lifetime starts, the ID
+ * can be used to tag named entity instances in calls such as
+ * __itt_task_begin, and to specify relationships among
+ * identified named entity instances, using the \ref relations APIs.
+ * Instance IDs are not domain specific!
+ * @param[in] domain The domain controlling the execution of this call.
+ * @param[in] id The ID to create.
+ */
+void ITTAPI __itt_id_create(const __itt_domain *domain, __itt_id id);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, id_create, (const __itt_domain *domain, __itt_id id))
+#define __itt_id_create(d,x) ITTNOTIFY_VOID_D1(id_create,d,x)
+#define __itt_id_create_ptr  ITTNOTIFY_NAME(id_create)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_id_create(domain,id)
+#define __itt_id_create_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_id_create_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup ids
+ * @brief Destroy an instance of identifier.
+ * This ends the lifetime of the current instance of the given ID value in the trace.
+ * Any relationships that are established after this lifetime ends are invalid.
+ * This call must be performed before the given ID value can be reused for a different
+ * named entity instance.
+ * @param[in] domain The domain controlling the execution of this call.
+ * @param[in] id The ID to destroy.
+ */
+void ITTAPI __itt_id_destroy(const __itt_domain *domain, __itt_id id);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, id_destroy, (const __itt_domain *domain, __itt_id id))
+#define __itt_id_destroy(d,x) ITTNOTIFY_VOID_D1(id_destroy,d,x)
+#define __itt_id_destroy_ptr  ITTNOTIFY_NAME(id_destroy)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_id_destroy(domain,id)
+#define __itt_id_destroy_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_id_destroy_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} ids group */
+
+/**
+ * @defgroup handless String Handles
+ * @ingroup public
+ * String Handles group
+ * @{
+ */
+
+/** @cond exclude_from_documentation */
+#pragma pack(push, 8)
+
+typedef struct ___itt_string_handle
+{
+    const char* strA; /*!< Copy of original string in ASCII. */
+#if defined(UNICODE) || defined(_UNICODE)
+    const wchar_t* strW; /*!< Copy of original string in UNICODE. */
+#else  /* UNICODE || _UNICODE */
+    void* strW;
+#endif /* UNICODE || _UNICODE */
+    int   extra1; /*!< Reserved. Must be zero   */
+    void* extra2; /*!< Reserved. Must be zero   */
+    struct ___itt_string_handle* next;
+} __itt_string_handle;
+
+#pragma pack(pop)
+/** @endcond */
+
+/**
+ * @ingroup handles
+ * @brief Create a string handle.
+ * Create and return handle value that can be associated with a string.
+ * Consecutive calls to __itt_string_handle_create with the same name
+ * return the same value. Because the set of string handles is expected to remain
+ * static during the application's execution time, there is no mechanism to destroy a string handle.
+ * Any string handle can be accessed by any thread in the process, regardless of which thread created
+ * the string handle. This call is thread-safe.
+ * @param[in] name The input string
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+__itt_string_handle* ITTAPI __itt_string_handle_createA(const char    *name);
+__itt_string_handle* ITTAPI __itt_string_handle_createW(const wchar_t *name);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_string_handle_create     __itt_string_handle_createW
+#  define __itt_string_handle_create_ptr __itt_string_handle_createW_ptr
+#else /* UNICODE */
+#  define __itt_string_handle_create     __itt_string_handle_createA
+#  define __itt_string_handle_create_ptr __itt_string_handle_createA_ptr
+#endif /* UNICODE */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+__itt_string_handle* ITTAPI __itt_string_handle_create(const char *name);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, __itt_string_handle*, string_handle_createA, (const char    *name))
+ITT_STUB(ITTAPI, __itt_string_handle*, string_handle_createW, (const wchar_t *name))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, __itt_string_handle*, string_handle_create,  (const char    *name))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_string_handle_createA     ITTNOTIFY_DATA(string_handle_createA)
+#define __itt_string_handle_createA_ptr ITTNOTIFY_NAME(string_handle_createA)
+#define __itt_string_handle_createW     ITTNOTIFY_DATA(string_handle_createW)
+#define __itt_string_handle_createW_ptr ITTNOTIFY_NAME(string_handle_createW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_string_handle_create     ITTNOTIFY_DATA(string_handle_create)
+#define __itt_string_handle_create_ptr ITTNOTIFY_NAME(string_handle_create)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_string_handle_createA(name) (__itt_string_handle*)0
+#define __itt_string_handle_createA_ptr 0
+#define __itt_string_handle_createW(name) (__itt_string_handle*)0
+#define __itt_string_handle_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_string_handle_create(name)  (__itt_string_handle*)0
+#define __itt_string_handle_create_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_string_handle_createA_ptr 0
+#define __itt_string_handle_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_string_handle_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} handles group */
+
+/** @cond exclude_from_documentation */
+typedef unsigned long long __itt_timestamp;
+/** @endcond */
+
+#define __itt_timestamp_none ((__itt_timestamp)-1LL)
+
+/** @cond exclude_from_gpa_documentation */
+
+/**
+ * @ingroup timestamps
+ * @brief Return timestamp corresponding to the current moment.
+ * This returns the timestamp in the format that is the most relevant for the current
+ * host or platform (RDTSC, QPC, and others). You can use the "<" operator to
+ * compare __itt_timestamp values.
+ */
+__itt_timestamp ITTAPI __itt_get_timestamp(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUB(ITTAPI, __itt_timestamp, get_timestamp, (void))
+#define __itt_get_timestamp      ITTNOTIFY_DATA(get_timestamp)
+#define __itt_get_timestamp_ptr  ITTNOTIFY_NAME(get_timestamp)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_get_timestamp()
+#define __itt_get_timestamp_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_get_timestamp_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} timestamps */
+/** @endcond */
+
+/** @cond exclude_from_gpa_documentation */
+
+/**
+ * @defgroup regions Regions
+ * @ingroup public
+ * Regions group
+ * @{
+ */
+/**
+ * @ingroup regions
+ * @brief Begin of region instance.
+ * Successive calls to __itt_region_begin with the same ID are ignored
+ * until a call to __itt_region_end with the same ID
+ * @param[in] domain The domain for this region instance
+ * @param[in] id The instance ID for this region instance. Must not be __itt_null
+ * @param[in] parentid The instance ID for the parent of this region instance, or __itt_null
+ * @param[in] name The name of this region
+ */
+void ITTAPI __itt_region_begin(const __itt_domain *domain, __itt_id id, __itt_id parentid, __itt_string_handle *name);
+
+/**
+ * @ingroup regions
+ * @brief End of region instance.
+ * The first call to __itt_region_end with a given ID ends the
+ * region. Successive calls with the same ID are ignored, as are
+ * calls that do not have a matching __itt_region_begin call.
+ * @param[in] domain The domain for this region instance
+ * @param[in] id The instance ID for this region instance
+ */
+void ITTAPI __itt_region_end(const __itt_domain *domain, __itt_id id);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, region_begin, (const __itt_domain *domain, __itt_id id, __itt_id parentid, __itt_string_handle *name))
+ITT_STUBV(ITTAPI, void, region_end,   (const __itt_domain *domain, __itt_id id))
+#define __itt_region_begin(d,x,y,z) ITTNOTIFY_VOID_D3(region_begin,d,x,y,z)
+#define __itt_region_begin_ptr      ITTNOTIFY_NAME(region_begin)
+#define __itt_region_end(d,x)       ITTNOTIFY_VOID_D1(region_end,d,x)
+#define __itt_region_end_ptr        ITTNOTIFY_NAME(region_end)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_region_begin(d,x,y,z)
+#define __itt_region_begin_ptr 0
+#define __itt_region_end(d,x)
+#define __itt_region_end_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_region_begin_ptr 0
+#define __itt_region_end_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} regions group */
+
+/**
+ * @defgroup frames Frames
+ * @ingroup public
+ * Frames are similar to regions, but are intended to be easier to use and to implement.
+ * In particular:
+ * - Frames always represent periods of elapsed time
+ * - By default, frames have no nesting relationships
+ * @{
+ */
+
+/**
+ * @ingroup frames
+ * @brief Begin a frame instance.
+ * Successive calls to __itt_frame_begin with the
+ * same ID are ignored until a call to __itt_frame_end with the same ID.
+ * @param[in] domain The domain for this frame instance
+ * @param[in] id The instance ID for this frame instance or NULL
+ */
+void ITTAPI __itt_frame_begin_v3(const __itt_domain *domain, __itt_id *id);
+
+/**
+ * @ingroup frames
+ * @brief End a frame instance.
+ * The first call to __itt_frame_end with a given ID
+ * ends the frame. Successive calls with the same ID are ignored, as are
+ * calls that do not have a matching __itt_frame_begin call.
+ * @param[in] domain The domain for this frame instance
+ * @param[in] id The instance ID for this frame instance or NULL for current
+ */
+void ITTAPI __itt_frame_end_v3(const __itt_domain *domain, __itt_id *id);
+
+/**
+ * @ingroup frames
+ * @brief Submits a frame instance.
+ * Successive calls to __itt_frame_begin or __itt_frame_submit with the
+ * same ID are ignored until a call to __itt_frame_end or __itt_frame_submit
+ * with the same ID.
+ * Passing special __itt_timestamp_none value as "end" argument means
+ * take the current timestamp as the end timestamp.
+ * @param[in] domain The domain for this frame instance
+ * @param[in] id The instance ID for this frame instance or NULL
+ * @param[in] begin Timestamp of the beginning of the frame
+ * @param[in] end Timestamp of the end of the frame
+ */
+void ITTAPI __itt_frame_submit_v3(const __itt_domain *domain, __itt_id *id,
+    __itt_timestamp begin, __itt_timestamp end);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, frame_begin_v3,  (const __itt_domain *domain, __itt_id *id))
+ITT_STUBV(ITTAPI, void, frame_end_v3,    (const __itt_domain *domain, __itt_id *id))
+ITT_STUBV(ITTAPI, void, frame_submit_v3, (const __itt_domain *domain, __itt_id *id, __itt_timestamp begin, __itt_timestamp end))
+#define __itt_frame_begin_v3(d,x)      ITTNOTIFY_VOID_D1(frame_begin_v3,d,x)
+#define __itt_frame_begin_v3_ptr       ITTNOTIFY_NAME(frame_begin_v3)
+#define __itt_frame_end_v3(d,x)        ITTNOTIFY_VOID_D1(frame_end_v3,d,x)
+#define __itt_frame_end_v3_ptr         ITTNOTIFY_NAME(frame_end_v3)
+#define __itt_frame_submit_v3(d,x,b,e) ITTNOTIFY_VOID_D3(frame_submit_v3,d,x,b,e)
+#define __itt_frame_submit_v3_ptr      ITTNOTIFY_NAME(frame_submit_v3)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_frame_begin_v3(domain,id)
+#define __itt_frame_begin_v3_ptr 0
+#define __itt_frame_end_v3(domain,id)
+#define __itt_frame_end_v3_ptr   0
+#define __itt_frame_submit_v3(domain,id,begin,end)
+#define __itt_frame_submit_v3_ptr   0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_frame_begin_v3_ptr 0
+#define __itt_frame_end_v3_ptr   0
+#define __itt_frame_submit_v3_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} frames group */
+/** @endcond */
+
+/**
+ * @defgroup taskgroup Task Group
+ * @ingroup public
+ * Task Group
+ * @{
+ */
+/**
+ * @ingroup task_groups
+ * @brief Denotes a task_group instance.
+ * Successive calls to __itt_task_group with the same ID are ignored.
+ * @param[in] domain The domain for this task_group instance
+ * @param[in] id The instance ID for this task_group instance. Must not be __itt_null.
+ * @param[in] parentid The instance ID for the parent of this task_group instance, or __itt_null.
+ * @param[in] name The name of this task_group
+ */
+void ITTAPI __itt_task_group(const __itt_domain *domain, __itt_id id, __itt_id parentid, __itt_string_handle *name);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, task_group, (const __itt_domain *domain, __itt_id id, __itt_id parentid, __itt_string_handle *name))
+#define __itt_task_group(d,x,y,z) ITTNOTIFY_VOID_D3(task_group,d,x,y,z)
+#define __itt_task_group_ptr      ITTNOTIFY_NAME(task_group)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_task_group(d,x,y,z)
+#define __itt_task_group_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_task_group_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} taskgroup group */
+
+/**
+ * @defgroup tasks Tasks
+ * @ingroup public
+ * A task instance represents a piece of work performed by a particular
+ * thread for a period of time. A call to __itt_task_begin creates a
+ * task instance. This becomes the current instance for that task on that
+ * thread. A following call to __itt_task_end on the same thread ends the
+ * instance. There may be multiple simultaneous instances of tasks with the
+ * same name on different threads. If an ID is specified, the task instance
+ * receives that ID. Nested tasks are allowed.
+ *
+ * Note: The task is defined by the bracketing of __itt_task_begin and
+ * __itt_task_end on the same thread. If some scheduling mechanism causes
+ * task switching (the thread executes a different user task) or task
+ * switching (the user task switches to a different thread) then this breaks
+ * the notion of  current instance. Additional API calls are required to
+ * deal with that possibility.
+ * @{
+ */
+
+/**
+ * @ingroup tasks
+ * @brief Begin a task instance.
+ * @param[in] domain The domain for this task
+ * @param[in] taskid The instance ID for this task instance, or __itt_null
+ * @param[in] parentid The parent instance to which this task instance belongs, or __itt_null
+ * @param[in] name The name of this task
+ */
+void ITTAPI __itt_task_begin(const __itt_domain *domain, __itt_id taskid, __itt_id parentid, __itt_string_handle *name);
+
+/**
+ * @ingroup tasks
+ * @brief Begin a task instance.
+ * @param[in] domain The domain for this task
+ * @param[in] taskid The identifier for this task instance (may be 0)
+ * @param[in] parentid The parent of this task (may be 0)
+ * @param[in] fn The pointer to the function you are tracing
+ */
+void ITTAPI __itt_task_begin_fn(const __itt_domain *domain, __itt_id taskid, __itt_id parentid, void* fn);
+
+/**
+ * @ingroup tasks
+ * @brief End the current task instance.
+ * @param[in] domain The domain for this task
+ */
+void ITTAPI __itt_task_end(const __itt_domain *domain);
+
+/**
+ * @ingroup tasks
+ * @brief Begin an overlapped task instance.
+ * @param[in] domain The domain for this task.
+ * @param[in] taskid The identifier for this task instance, *cannot* be __itt_null.
+ * @param[in] parentid The parent of this task, or __itt_null.
+ * @param[in] name The name of this task.
+ */
+void ITTAPI __itt_task_begin_overlapped(const __itt_domain* domain, __itt_id taskid, __itt_id parentid, __itt_string_handle* name);
+
+/**
+ * @ingroup tasks
+ * @brief End an overlapped task instance.
+ * @param[in] domain The domain for this task
+ * @param[in] taskid Explicit ID of finished task
+ */
+void ITTAPI __itt_task_end_overlapped(const __itt_domain *domain, __itt_id taskid);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, task_begin,    (const __itt_domain *domain, __itt_id id, __itt_id parentid, __itt_string_handle *name))
+ITT_STUBV(ITTAPI, void, task_begin_fn, (const __itt_domain *domain, __itt_id id, __itt_id parentid, void* fn))
+ITT_STUBV(ITTAPI, void, task_end,      (const __itt_domain *domain))
+ITT_STUBV(ITTAPI, void, task_begin_overlapped, (const __itt_domain *domain, __itt_id taskid, __itt_id parentid, __itt_string_handle *name))
+ITT_STUBV(ITTAPI, void, task_end_overlapped,   (const __itt_domain *domain, __itt_id taskid))
+#define __itt_task_begin(d,x,y,z)    ITTNOTIFY_VOID_D3(task_begin,d,x,y,z)
+#define __itt_task_begin_ptr         ITTNOTIFY_NAME(task_begin)
+#define __itt_task_begin_fn(d,x,y,z) ITTNOTIFY_VOID_D3(task_begin_fn,d,x,y,z)
+#define __itt_task_begin_fn_ptr      ITTNOTIFY_NAME(task_begin_fn)
+#define __itt_task_end(d)            ITTNOTIFY_VOID_D0(task_end,d)
+#define __itt_task_end_ptr           ITTNOTIFY_NAME(task_end)
+#define __itt_task_begin_overlapped(d,x,y,z) ITTNOTIFY_VOID_D3(task_begin_overlapped,d,x,y,z)
+#define __itt_task_begin_overlapped_ptr      ITTNOTIFY_NAME(task_begin_overlapped)
+#define __itt_task_end_overlapped(d,x)       ITTNOTIFY_VOID_D1(task_end_overlapped,d,x)
+#define __itt_task_end_overlapped_ptr        ITTNOTIFY_NAME(task_end_overlapped)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_task_begin(domain,id,parentid,name)
+#define __itt_task_begin_ptr    0
+#define __itt_task_begin_fn(domain,id,parentid,fn)
+#define __itt_task_begin_fn_ptr 0
+#define __itt_task_end(domain)
+#define __itt_task_end_ptr      0
+#define __itt_task_begin_overlapped(domain,taskid,parentid,name)
+#define __itt_task_begin_overlapped_ptr         0
+#define __itt_task_end_overlapped(domain,taskid)
+#define __itt_task_end_overlapped_ptr           0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_task_begin_ptr    0
+#define __itt_task_begin_fn_ptr 0
+#define __itt_task_end_ptr      0
+#define __itt_task_begin_overlapped_ptr 0
+#define __itt_task_end_overlapped_ptr   0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} tasks group */
+
+
+/**
+ * @defgroup markers Markers
+ * Markers represent a single discreet event in time. Markers have a scope,
+ * described by an enumerated type __itt_scope. Markers are created by
+ * the API call __itt_marker. A marker instance can be given an ID for use in
+ * adding metadata.
+ * @{
+ */
+
+/**
+ * @brief Describes the scope of an event object in the trace.
+ */
+typedef enum
+{
+    __itt_scope_unknown = 0,
+    __itt_scope_global,
+    __itt_scope_track_group,
+    __itt_scope_track,
+    __itt_scope_task,
+    __itt_scope_marker
+} __itt_scope;
+
+/** @cond exclude_from_documentation */
+#define __itt_marker_scope_unknown  __itt_scope_unknown
+#define __itt_marker_scope_global   __itt_scope_global
+#define __itt_marker_scope_process  __itt_scope_track_group
+#define __itt_marker_scope_thread   __itt_scope_track
+#define __itt_marker_scope_task     __itt_scope_task
+/** @endcond */
+
+/**
+ * @ingroup markers
+ * @brief Create a marker instance
+ * @param[in] domain The domain for this marker
+ * @param[in] id The instance ID for this marker or __itt_null
+ * @param[in] name The name for this marker
+ * @param[in] scope The scope for this marker
+ */
+void ITTAPI __itt_marker(const __itt_domain *domain, __itt_id id, __itt_string_handle *name, __itt_scope scope);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, marker, (const __itt_domain *domain, __itt_id id, __itt_string_handle *name, __itt_scope scope))
+#define __itt_marker(d,x,y,z) ITTNOTIFY_VOID_D3(marker,d,x,y,z)
+#define __itt_marker_ptr      ITTNOTIFY_NAME(marker)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_marker(domain,id,name,scope)
+#define __itt_marker_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_marker_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} markers group */
+
+/**
+ * @defgroup metadata Metadata
+ * The metadata API is used to attach extra information to named
+ * entities. Metadata can be attached to an identified named entity by ID,
+ * or to the current entity (which is always a task).
+ *
+ * Conceptually metadata has a type (what kind of metadata), a key (the
+ * name of the metadata), and a value (the actual data). The encoding of
+ * the value depends on the type of the metadata.
+ *
+ * The type of metadata is specified by an enumerated type __itt_metdata_type.
+ * @{
+ */
+
+/**
+ * @ingroup parameters
+ * @brief describes the type of metadata
+ */
+typedef enum {
+    __itt_metadata_unknown = 0,
+    __itt_metadata_u64,     /**< Unsigned 64-bit integer */
+    __itt_metadata_s64,     /**< Signed 64-bit integer */
+    __itt_metadata_u32,     /**< Unsigned 32-bit integer */
+    __itt_metadata_s32,     /**< Signed 32-bit integer */
+    __itt_metadata_u16,     /**< Unsigned 16-bit integer */
+    __itt_metadata_s16,     /**< Signed 16-bit integer */
+    __itt_metadata_float,   /**< Signed 32-bit floating-point */
+    __itt_metadata_double   /**< SIgned 64-bit floating-point */
+} __itt_metadata_type;
+
+/**
+ * @ingroup parameters
+ * @brief Add metadata to an instance of a named entity.
+ * @param[in] domain The domain controlling the call
+ * @param[in] id The identifier of the instance to which the metadata is to be added, or __itt_null to add to the current task
+ * @param[in] key The name of the metadata
+ * @param[in] type The type of the metadata
+ * @param[in] count The number of elements of the given type. If count == 0, no metadata will be added.
+ * @param[in] data The metadata itself
+*/
+void ITTAPI __itt_metadata_add(const __itt_domain *domain, __itt_id id, __itt_string_handle *key, __itt_metadata_type type, size_t count, void *data);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, metadata_add, (const __itt_domain *domain, __itt_id id, __itt_string_handle *key, __itt_metadata_type type, size_t count, void *data))
+#define __itt_metadata_add(d,x,y,z,a,b) ITTNOTIFY_VOID_D5(metadata_add,d,x,y,z,a,b)
+#define __itt_metadata_add_ptr          ITTNOTIFY_NAME(metadata_add)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_metadata_add(d,x,y,z,a,b)
+#define __itt_metadata_add_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_metadata_add_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup parameters
+ * @brief Add string metadata to an instance of a named entity.
+ * @param[in] domain The domain controlling the call
+ * @param[in] id The identifier of the instance to which the metadata is to be added, or __itt_null to add to the current task
+ * @param[in] key The name of the metadata
+ * @param[in] data The metadata itself
+ * @param[in] length The number of characters in the string, or -1 if the length is unknown but the string is null-terminated
+*/
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+void ITTAPI __itt_metadata_str_addA(const __itt_domain *domain, __itt_id id, __itt_string_handle *key, const char *data, size_t length);
+void ITTAPI __itt_metadata_str_addW(const __itt_domain *domain, __itt_id id, __itt_string_handle *key, const wchar_t *data, size_t length);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_metadata_str_add     __itt_metadata_str_addW
+#  define __itt_metadata_str_add_ptr __itt_metadata_str_addW_ptr
+#else /* UNICODE */
+#  define __itt_metadata_str_add     __itt_metadata_str_addA
+#  define __itt_metadata_str_add_ptr __itt_metadata_str_addA_ptr
+#endif /* UNICODE */
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+void ITTAPI __itt_metadata_str_add(const __itt_domain *domain, __itt_id id, __itt_string_handle *key, const char *data, size_t length);
+#endif
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUBV(ITTAPI, void, metadata_str_addA, (const __itt_domain *domain, __itt_id id, __itt_string_handle *key, const char *data, size_t length))
+ITT_STUBV(ITTAPI, void, metadata_str_addW, (const __itt_domain *domain, __itt_id id, __itt_string_handle *key, const wchar_t *data, size_t length))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUBV(ITTAPI, void, metadata_str_add, (const __itt_domain *domain, __itt_id id, __itt_string_handle *key, const char *data, size_t length))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_metadata_str_addA(d,x,y,z,a) ITTNOTIFY_VOID_D4(metadata_str_addA,d,x,y,z,a)
+#define __itt_metadata_str_addA_ptr        ITTNOTIFY_NAME(metadata_str_addA)
+#define __itt_metadata_str_addW(d,x,y,z,a) ITTNOTIFY_VOID_D4(metadata_str_addW,d,x,y,z,a)
+#define __itt_metadata_str_addW_ptr        ITTNOTIFY_NAME(metadata_str_addW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_metadata_str_add(d,x,y,z,a)  ITTNOTIFY_VOID_D4(metadata_str_add,d,x,y,z,a)
+#define __itt_metadata_str_add_ptr         ITTNOTIFY_NAME(metadata_str_add)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_metadata_str_addA(d,x,y,z,a)
+#define __itt_metadata_str_addA_ptr 0
+#define __itt_metadata_str_addW(d,x,y,z,a)
+#define __itt_metadata_str_addW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_metadata_str_add(d,x,y,z,a)
+#define __itt_metadata_str_add_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_metadata_str_addA_ptr 0
+#define __itt_metadata_str_addW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_metadata_str_add_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup parameters
+ * @brief Add metadata to an instance of a named entity.
+ * @param[in] domain The domain controlling the call
+ * @param[in] scope The scope of the instance to which the metadata is to be added
+
+ * @param[in] id The identifier of the instance to which the metadata is to be added, or __itt_null to add to the current task
+
+ * @param[in] key The name of the metadata
+ * @param[in] type The type of the metadata
+ * @param[in] count The number of elements of the given type. If count == 0, no metadata will be added.
+ * @param[in] data The metadata itself
+*/
+void ITTAPI __itt_metadata_add_with_scope(const __itt_domain *domain, __itt_scope scope, __itt_string_handle *key, __itt_metadata_type type, size_t count, void *data);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, metadata_add_with_scope, (const __itt_domain *domain, __itt_scope scope, __itt_string_handle *key, __itt_metadata_type type, size_t count, void *data))
+#define __itt_metadata_add_with_scope(d,x,y,z,a,b) ITTNOTIFY_VOID_D5(metadata_add_with_scope,d,x,y,z,a,b)
+#define __itt_metadata_add_with_scope_ptr          ITTNOTIFY_NAME(metadata_add_with_scope)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_metadata_add_with_scope(d,x,y,z,a,b)
+#define __itt_metadata_add_with_scope_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_metadata_add_with_scope_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup parameters
+ * @brief Add string metadata to an instance of a named entity.
+ * @param[in] domain The domain controlling the call
+ * @param[in] scope The scope of the instance to which the metadata is to be added
+
+ * @param[in] id The identifier of the instance to which the metadata is to be added, or __itt_null to add to the current task
+
+ * @param[in] key The name of the metadata
+ * @param[in] data The metadata itself
+ * @param[in] length The number of characters in the string, or -1 if the length is unknown but the string is null-terminated
+*/
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+void ITTAPI __itt_metadata_str_add_with_scopeA(const __itt_domain *domain, __itt_scope scope, __itt_string_handle *key, const char *data, size_t length);
+void ITTAPI __itt_metadata_str_add_with_scopeW(const __itt_domain *domain, __itt_scope scope, __itt_string_handle *key, const wchar_t *data, size_t length);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_metadata_str_add_with_scope     __itt_metadata_str_add_with_scopeW
+#  define __itt_metadata_str_add_with_scope_ptr __itt_metadata_str_add_with_scopeW_ptr
+#else /* UNICODE */
+#  define __itt_metadata_str_add_with_scope     __itt_metadata_str_add_with_scopeA
+#  define __itt_metadata_str_add_with_scope_ptr __itt_metadata_str_add_with_scopeA_ptr
+#endif /* UNICODE */
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+void ITTAPI __itt_metadata_str_add_with_scope(const __itt_domain *domain, __itt_scope scope, __itt_string_handle *key, const char *data, size_t length);
+#endif
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUBV(ITTAPI, void, metadata_str_add_with_scopeA, (const __itt_domain *domain, __itt_scope scope, __itt_string_handle *key, const char *data, size_t length))
+ITT_STUBV(ITTAPI, void, metadata_str_add_with_scopeW, (const __itt_domain *domain, __itt_scope scope, __itt_string_handle *key, const wchar_t *data, size_t length))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUBV(ITTAPI, void, metadata_str_add_with_scope, (const __itt_domain *domain, __itt_scope scope, __itt_string_handle *key, const char *data, size_t length))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_metadata_str_add_with_scopeA(d,x,y,z,a) ITTNOTIFY_VOID_D4(metadata_str_add_with_scopeA,d,x,y,z,a)
+#define __itt_metadata_str_add_with_scopeA_ptr        ITTNOTIFY_NAME(metadata_str_add_with_scopeA)
+#define __itt_metadata_str_add_with_scopeW(d,x,y,z,a) ITTNOTIFY_VOID_D4(metadata_str_add_with_scopeW,d,x,y,z,a)
+#define __itt_metadata_str_add_with_scopeW_ptr        ITTNOTIFY_NAME(metadata_str_add_with_scopeW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_metadata_str_add_with_scope(d,x,y,z,a)  ITTNOTIFY_VOID_D4(metadata_str_add_with_scope,d,x,y,z,a)
+#define __itt_metadata_str_add_with_scope_ptr         ITTNOTIFY_NAME(metadata_str_add_with_scope)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_metadata_str_add_with_scopeA(d,x,y,z,a)
+#define __itt_metadata_str_add_with_scopeA_ptr  0
+#define __itt_metadata_str_add_with_scopeW(d,x,y,z,a)
+#define __itt_metadata_str_add_with_scopeW_ptr  0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_metadata_str_add_with_scope(d,x,y,z,a)
+#define __itt_metadata_str_add_with_scope_ptr   0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_metadata_str_add_with_scopeA_ptr  0
+#define __itt_metadata_str_add_with_scopeW_ptr  0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_metadata_str_add_with_scope_ptr   0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @} metadata group */
+
+/**
+ * @defgroup relations Relations
+ * Instances of named entities can be explicitly associated with other
+ * instances using instance IDs and the relationship API calls.
+ *
+ * @{
+ */
+
+/**
+ * @ingroup relations
+ * @brief The kind of relation between two instances is specified by the enumerated type __itt_relation.
+ * Relations between instances can be added with an API call. The relation
+ * API uses instance IDs. Relations can be added before or after the actual
+ * instances are created and persist independently of the instances. This
+ * is the motivation for having different lifetimes for instance IDs and
+ * the actual instances.
+ */
+typedef enum
+{
+    __itt_relation_is_unknown = 0,
+    __itt_relation_is_dependent_on,         /**< "A is dependent on B" means that A cannot start until B completes */
+    __itt_relation_is_sibling_of,           /**< "A is sibling of B" means that A and B were created as a group */
+    __itt_relation_is_parent_of,            /**< "A is parent of B" means that A created B */
+    __itt_relation_is_continuation_of,      /**< "A is continuation of B" means that A assumes the dependencies of B */
+    __itt_relation_is_child_of,             /**< "A is child of B" means that A was created by B (inverse of is_parent_of) */
+    __itt_relation_is_continued_by,         /**< "A is continued by B" means that B assumes the dependencies of A (inverse of is_continuation_of) */
+    __itt_relation_is_predecessor_to        /**< "A is predecessor to B" means that B cannot start until A completes (inverse of is_dependent_on) */
+} __itt_relation;
+
+/**
+ * @ingroup relations
+ * @brief Add a relation to the current task instance.
+ * The current task instance is the head of the relation.
+ * @param[in] domain The domain controlling this call
+ * @param[in] relation The kind of relation
+ * @param[in] tail The ID for the tail of the relation
+ */
+void ITTAPI __itt_relation_add_to_current(const __itt_domain *domain, __itt_relation relation, __itt_id tail);
+
+/**
+ * @ingroup relations
+ * @brief Add a relation between two instance identifiers.
+ * @param[in] domain The domain controlling this call
+ * @param[in] head The ID for the head of the relation
+ * @param[in] relation The kind of relation
+ * @param[in] tail The ID for the tail of the relation
+ */
+void ITTAPI __itt_relation_add(const __itt_domain *domain, __itt_id head, __itt_relation relation, __itt_id tail);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, relation_add_to_current, (const __itt_domain *domain, __itt_relation relation, __itt_id tail))
+ITT_STUBV(ITTAPI, void, relation_add,            (const __itt_domain *domain, __itt_id head, __itt_relation relation, __itt_id tail))
+#define __itt_relation_add_to_current(d,x,y) ITTNOTIFY_VOID_D2(relation_add_to_current,d,x,y)
+#define __itt_relation_add_to_current_ptr    ITTNOTIFY_NAME(relation_add_to_current)
+#define __itt_relation_add(d,x,y,z)          ITTNOTIFY_VOID_D3(relation_add,d,x,y,z)
+#define __itt_relation_add_ptr               ITTNOTIFY_NAME(relation_add)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_relation_add_to_current(d,x,y)
+#define __itt_relation_add_to_current_ptr 0
+#define __itt_relation_add(d,x,y,z)
+#define __itt_relation_add_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_relation_add_to_current_ptr 0
+#define __itt_relation_add_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} relations group */
+
+/** @cond exclude_from_documentation */
+#pragma pack(push, 8)
+
+typedef struct ___itt_clock_info
+{
+    unsigned long long clock_freq; /*!< Clock domain frequency */
+    unsigned long long clock_base; /*!< Clock domain base timestamp */
+} __itt_clock_info;
+
+#pragma pack(pop)
+/** @endcond */
+
+/** @cond exclude_from_documentation */
+typedef void (ITTAPI *__itt_get_clock_info_fn)(__itt_clock_info* clock_info, void* data);
+/** @endcond */
+
+/** @cond exclude_from_documentation */
+#pragma pack(push, 8)
+
+typedef struct ___itt_clock_domain
+{
+    __itt_clock_info info;      /*!< Most recent clock domain info */
+    __itt_get_clock_info_fn fn; /*!< Callback function pointer */
+    void* fn_data;              /*!< Input argument for the callback function */
+    int   extra1;               /*!< Reserved. Must be zero */
+    void* extra2;               /*!< Reserved. Must be zero */
+    struct ___itt_clock_domain* next;
+} __itt_clock_domain;
+
+#pragma pack(pop)
+/** @endcond */
+
+/**
+ * @ingroup clockdomains
+ * @brief Create a clock domain.
+ * Certain applications require the capability to trace their application using
+ * a clock domain different than the CPU, for instance the instrumentation of events
+ * that occur on a GPU.
+ * Because the set of domains is expected to be static over the application's execution time,
+ * there is no mechanism to destroy a domain.
+ * Any domain can be accessed by any thread in the process, regardless of which thread created
+ * the domain. This call is thread-safe.
+ * @param[in] fn A pointer to a callback function which retrieves alternative CPU timestamps
+ * @param[in] fn_data Argument for a callback function; may be NULL
+ */
+__itt_clock_domain* ITTAPI __itt_clock_domain_create(__itt_get_clock_info_fn fn, void* fn_data);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUB(ITTAPI, __itt_clock_domain*, clock_domain_create, (__itt_get_clock_info_fn fn, void* fn_data))
+#define __itt_clock_domain_create     ITTNOTIFY_DATA(clock_domain_create)
+#define __itt_clock_domain_create_ptr ITTNOTIFY_NAME(clock_domain_create)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_clock_domain_create(fn,fn_data) (__itt_clock_domain*)0
+#define __itt_clock_domain_create_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_clock_domain_create_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup clockdomains
+ * @brief Recalculate clock domains frequences and clock base timestamps.
+ */
+void ITTAPI __itt_clock_domain_reset(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, clock_domain_reset, (void))
+#define __itt_clock_domain_reset     ITTNOTIFY_VOID(clock_domain_reset)
+#define __itt_clock_domain_reset_ptr ITTNOTIFY_NAME(clock_domain_reset)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_clock_domain_reset()
+#define __itt_clock_domain_reset_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_clock_domain_reset_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup clockdomain
+ * @brief Create an instance of identifier. This establishes the beginning of the lifetime of
+ * an instance of the given ID in the trace. Once this lifetime starts, the ID can be used to
+ * tag named entity instances in calls such as __itt_task_begin, and to specify relationships among
+ * identified named entity instances, using the \ref relations APIs.
+ * @param[in] domain The domain controlling the execution of this call.
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ * @param[in] id The ID to create.
+ */
+void ITTAPI __itt_id_create_ex(const __itt_domain* domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id id);
+
+/**
+ * @ingroup clockdomain
+ * @brief Destroy an instance of identifier. This ends the lifetime of the current instance of the
+ * given ID value in the trace. Any relationships that are established after this lifetime ends are
+ * invalid. This call must be performed before the given ID value can be reused for a different
+ * named entity instance.
+ * @param[in] domain The domain controlling the execution of this call.
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ * @param[in] id The ID to destroy.
+ */
+void ITTAPI __itt_id_destroy_ex(const __itt_domain* domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id id);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, id_create_ex,  (const __itt_domain *domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id id))
+ITT_STUBV(ITTAPI, void, id_destroy_ex, (const __itt_domain *domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id id))
+#define __itt_id_create_ex(d,x,y,z)  ITTNOTIFY_VOID_D3(id_create_ex,d,x,y,z)
+#define __itt_id_create_ex_ptr       ITTNOTIFY_NAME(id_create_ex)
+#define __itt_id_destroy_ex(d,x,y,z) ITTNOTIFY_VOID_D3(id_destroy_ex,d,x,y,z)
+#define __itt_id_destroy_ex_ptr      ITTNOTIFY_NAME(id_destroy_ex)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_id_create_ex(domain,clock_domain,timestamp,id)
+#define __itt_id_create_ex_ptr    0
+#define __itt_id_destroy_ex(domain,clock_domain,timestamp,id)
+#define __itt_id_destroy_ex_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_id_create_ex_ptr    0
+#define __itt_id_destroy_ex_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup clockdomain
+ * @brief Begin a task instance.
+ * @param[in] domain The domain for this task
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ * @param[in] taskid The instance ID for this task instance, or __itt_null
+ * @param[in] parentid The parent instance to which this task instance belongs, or __itt_null
+ * @param[in] name The name of this task
+ */
+void ITTAPI __itt_task_begin_ex(const __itt_domain* domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id taskid, __itt_id parentid, __itt_string_handle* name);
+
+/**
+ * @ingroup clockdomain
+ * @brief Begin a task instance.
+ * @param[in] domain The domain for this task
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ * @param[in] taskid The identifier for this task instance, or __itt_null
+ * @param[in] parentid The parent of this task, or __itt_null
+ * @param[in] fn The pointer to the function you are tracing
+ */
+void ITTAPI __itt_task_begin_fn_ex(const __itt_domain* domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id taskid, __itt_id parentid, void* fn);
+
+/**
+ * @ingroup clockdomain
+ * @brief End the current task instance.
+ * @param[in] domain The domain for this task
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ */
+void ITTAPI __itt_task_end_ex(const __itt_domain* domain, __itt_clock_domain* clock_domain, unsigned long long timestamp);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, task_begin_ex,        (const __itt_domain *domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id id, __itt_id parentid, __itt_string_handle *name))
+ITT_STUBV(ITTAPI, void, task_begin_fn_ex,     (const __itt_domain *domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id id, __itt_id parentid, void* fn))
+ITT_STUBV(ITTAPI, void, task_end_ex,          (const __itt_domain *domain, __itt_clock_domain* clock_domain, unsigned long long timestamp))
+#define __itt_task_begin_ex(d,x,y,z,a,b)      ITTNOTIFY_VOID_D5(task_begin_ex,d,x,y,z,a,b)
+#define __itt_task_begin_ex_ptr               ITTNOTIFY_NAME(task_begin_ex)
+#define __itt_task_begin_fn_ex(d,x,y,z,a,b)   ITTNOTIFY_VOID_D5(task_begin_fn_ex,d,x,y,z,a,b)
+#define __itt_task_begin_fn_ex_ptr            ITTNOTIFY_NAME(task_begin_fn_ex)
+#define __itt_task_end_ex(d,x,y)              ITTNOTIFY_VOID_D2(task_end_ex,d,x,y)
+#define __itt_task_end_ex_ptr                 ITTNOTIFY_NAME(task_end_ex)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_task_begin_ex(domain,clock_domain,timestamp,id,parentid,name)
+#define __itt_task_begin_ex_ptr          0
+#define __itt_task_begin_fn_ex(domain,clock_domain,timestamp,id,parentid,fn)
+#define __itt_task_begin_fn_ex_ptr       0
+#define __itt_task_end_ex(domain,clock_domain,timestamp)
+#define __itt_task_end_ex_ptr            0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_task_begin_ex_ptr          0
+#define __itt_task_begin_fn_ex_ptr       0
+#define __itt_task_end_ex_ptr            0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @defgroup counters Counters
+ * @ingroup public
+ * Counters are user-defined objects with a monotonically increasing
+ * value. Counter values are 64-bit unsigned integers.
+ * Counters have names that can be displayed in
+ * the tools.
+ * @{
+ */
+
+/**
+ * @brief opaque structure for counter identification
+ */
+/** @cond exclude_from_documentation */
+
+typedef struct ___itt_counter* __itt_counter;
+
+/**
+ * @brief Create an unsigned 64 bits integer counter with given name/domain
+ *
+ * After __itt_counter_create() is called, __itt_counter_inc(id), __itt_counter_inc_delta(id, delta),
+ * __itt_counter_set_value(id, value_ptr) or __itt_counter_set_value_ex(id, clock_domain, timestamp, value_ptr)
+ * can be used to change the value of the counter, where value_ptr is a pointer to an unsigned 64 bits integer
+ *
+ * The call is equal to __itt_counter_create_typed(name, domain, __itt_metadata_u64)
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+__itt_counter ITTAPI __itt_counter_createA(const char    *name, const char    *domain);
+__itt_counter ITTAPI __itt_counter_createW(const wchar_t *name, const wchar_t *domain);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_counter_create     __itt_counter_createW
+#  define __itt_counter_create_ptr __itt_counter_createW_ptr
+#else /* UNICODE */
+#  define __itt_counter_create     __itt_counter_createA
+#  define __itt_counter_create_ptr __itt_counter_createA_ptr
+#endif /* UNICODE */
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+__itt_counter ITTAPI __itt_counter_create(const char *name, const char *domain);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, __itt_counter, counter_createA, (const char    *name, const char    *domain))
+ITT_STUB(ITTAPI, __itt_counter, counter_createW, (const wchar_t *name, const wchar_t *domain))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, __itt_counter, counter_create,  (const char *name, const char *domain))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_counter_createA     ITTNOTIFY_DATA(counter_createA)
+#define __itt_counter_createA_ptr ITTNOTIFY_NAME(counter_createA)
+#define __itt_counter_createW     ITTNOTIFY_DATA(counter_createW)
+#define __itt_counter_createW_ptr ITTNOTIFY_NAME(counter_createW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_counter_create     ITTNOTIFY_DATA(counter_create)
+#define __itt_counter_create_ptr ITTNOTIFY_NAME(counter_create)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_counter_createA(name, domain)
+#define __itt_counter_createA_ptr 0
+#define __itt_counter_createW(name, domain)
+#define __itt_counter_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_counter_create(name, domain)
+#define __itt_counter_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_counter_createA_ptr 0
+#define __itt_counter_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_counter_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Increment the unsigned 64 bits integer counter value
+ *
+ * Calling this function to non-unsigned 64 bits integer counters has no effect
+ */
+void ITTAPI __itt_counter_inc(__itt_counter id);
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, counter_inc, (__itt_counter id))
+#define __itt_counter_inc     ITTNOTIFY_VOID(counter_inc)
+#define __itt_counter_inc_ptr ITTNOTIFY_NAME(counter_inc)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_counter_inc(id)
+#define __itt_counter_inc_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_counter_inc_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/**
+ * @brief Increment the unsigned 64 bits integer counter value with x
+ *
+ * Calling this function to non-unsigned 64 bits integer counters has no effect
+ */
+void ITTAPI __itt_counter_inc_delta(__itt_counter id, unsigned long long value);
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, counter_inc_delta, (__itt_counter id, unsigned long long value))
+#define __itt_counter_inc_delta     ITTNOTIFY_VOID(counter_inc_delta)
+#define __itt_counter_inc_delta_ptr ITTNOTIFY_NAME(counter_inc_delta)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_counter_inc_delta(id, value)
+#define __itt_counter_inc_delta_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_counter_inc_delta_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Decrement the unsigned 64 bits integer counter value
+ *
+ * Calling this function to non-unsigned 64 bits integer counters has no effect
+ */
+void ITTAPI __itt_counter_dec(__itt_counter id);
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, counter_dec, (__itt_counter id))
+#define __itt_counter_dec     ITTNOTIFY_VOID(counter_dec)
+#define __itt_counter_dec_ptr ITTNOTIFY_NAME(counter_dec)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_counter_dec(id)
+#define __itt_counter_dec_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_counter_dec_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/**
+ * @brief Decrement the unsigned 64 bits integer counter value with x
+ *
+ * Calling this function to non-unsigned 64 bits integer counters has no effect
+ */
+void ITTAPI __itt_counter_dec_delta(__itt_counter id, unsigned long long value);
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, counter_dec_delta, (__itt_counter id, unsigned long long value))
+#define __itt_counter_dec_delta     ITTNOTIFY_VOID(counter_dec_delta)
+#define __itt_counter_dec_delta_ptr ITTNOTIFY_NAME(counter_dec_delta)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_counter_dec_delta(id, value)
+#define __itt_counter_dec_delta_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_counter_dec_delta_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup counters
+ * @brief Increment a counter by one.
+ * The first call with a given name creates a counter by that name and sets its
+ * value to zero. Successive calls increment the counter value.
+ * @param[in] domain The domain controlling the call. Counter names are not domain specific.
+ *            The domain argument is used only to enable or disable the API calls.
+ * @param[in] name The name of the counter
+ */
+void ITTAPI __itt_counter_inc_v3(const __itt_domain *domain, __itt_string_handle *name);
+
+/**
+ * @ingroup counters
+ * @brief Increment a counter by the value specified in delta.
+ * @param[in] domain The domain controlling the call. Counter names are not domain specific.
+ *            The domain argument is used only to enable or disable the API calls.
+ * @param[in] name The name of the counter
+ * @param[in] delta The amount by which to increment the counter
+ */
+void ITTAPI __itt_counter_inc_delta_v3(const __itt_domain *domain, __itt_string_handle *name, unsigned long long delta);
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, counter_inc_v3,       (const __itt_domain *domain, __itt_string_handle *name))
+ITT_STUBV(ITTAPI, void, counter_inc_delta_v3, (const __itt_domain *domain, __itt_string_handle *name, unsigned long long delta))
+#define __itt_counter_inc_v3(d,x)         ITTNOTIFY_VOID_D1(counter_inc_v3,d,x)
+#define __itt_counter_inc_v3_ptr          ITTNOTIFY_NAME(counter_inc_v3)
+#define __itt_counter_inc_delta_v3(d,x,y) ITTNOTIFY_VOID_D2(counter_inc_delta_v3,d,x,y)
+#define __itt_counter_inc_delta_v3_ptr    ITTNOTIFY_NAME(counter_inc_delta_v3)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_counter_inc_v3(domain,name)
+#define __itt_counter_inc_v3_ptr       0
+#define __itt_counter_inc_delta_v3(domain,name,delta)
+#define __itt_counter_inc_delta_v3_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_counter_inc_v3_ptr       0
+#define __itt_counter_inc_delta_v3_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+
+/**
+ * @ingroup counters
+ * @brief Decrement a counter by one.
+ * The first call with a given name creates a counter by that name and sets its
+ * value to zero. Successive calls decrement the counter value.
+ * @param[in] domain The domain controlling the call. Counter names are not domain specific.
+ *            The domain argument is used only to enable or disable the API calls.
+ * @param[in] name The name of the counter
+ */
+void ITTAPI __itt_counter_dec_v3(const __itt_domain *domain, __itt_string_handle *name);
+
+/**
+ * @ingroup counters
+ * @brief Decrement a counter by the value specified in delta.
+ * @param[in] domain The domain controlling the call. Counter names are not domain specific.
+ *            The domain argument is used only to enable or disable the API calls.
+ * @param[in] name The name of the counter
+ * @param[in] delta The amount by which to decrement the counter
+ */
+void ITTAPI __itt_counter_dec_delta_v3(const __itt_domain *domain, __itt_string_handle *name, unsigned long long delta);
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, counter_dec_v3,       (const __itt_domain *domain, __itt_string_handle *name))
+ITT_STUBV(ITTAPI, void, counter_dec_delta_v3, (const __itt_domain *domain, __itt_string_handle *name, unsigned long long delta))
+#define __itt_counter_dec_v3(d,x)         ITTNOTIFY_VOID_D1(counter_dec_v3,d,x)
+#define __itt_counter_dec_v3_ptr          ITTNOTIFY_NAME(counter_dec_v3)
+#define __itt_counter_dec_delta_v3(d,x,y) ITTNOTIFY_VOID_D2(counter_dec_delta_v3,d,x,y)
+#define __itt_counter_dec_delta_v3_ptr    ITTNOTIFY_NAME(counter_dec_delta_v3)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_counter_dec_v3(domain,name)
+#define __itt_counter_dec_v3_ptr       0
+#define __itt_counter_dec_delta_v3(domain,name,delta)
+#define __itt_counter_dec_delta_v3_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_counter_dec_v3_ptr       0
+#define __itt_counter_dec_delta_v3_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @} counters group */
+
+
+/**
+ * @brief Set the counter value
+ */
+void ITTAPI __itt_counter_set_value(__itt_counter id, void *value_ptr);
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, counter_set_value, (__itt_counter id, void *value_ptr))
+#define __itt_counter_set_value     ITTNOTIFY_VOID(counter_set_value)
+#define __itt_counter_set_value_ptr ITTNOTIFY_NAME(counter_set_value)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_counter_set_value(id, value_ptr)
+#define __itt_counter_set_value_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_counter_set_value_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Set the counter value
+ */
+void ITTAPI __itt_counter_set_value_ex(__itt_counter id, __itt_clock_domain *clock_domain, unsigned long long timestamp, void *value_ptr);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, counter_set_value_ex, (__itt_counter id, __itt_clock_domain *clock_domain, unsigned long long timestamp, void *value_ptr))
+#define __itt_counter_set_value_ex     ITTNOTIFY_VOID(counter_set_value_ex)
+#define __itt_counter_set_value_ex_ptr ITTNOTIFY_NAME(counter_set_value_ex)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_counter_set_value_ex(id, clock_domain, timestamp, value_ptr)
+#define __itt_counter_set_value_ex_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_counter_set_value_ex_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Create a typed counter with given name/domain
+ *
+ * After __itt_counter_create_typed() is called, __itt_counter_inc(id), __itt_counter_inc_delta(id, delta),
+ * __itt_counter_set_value(id, value_ptr) or __itt_counter_set_value_ex(id, clock_domain, timestamp, value_ptr)
+ * can be used to change the value of the counter
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+__itt_counter ITTAPI __itt_counter_create_typedA(const char    *name, const char    *domain, __itt_metadata_type type);
+__itt_counter ITTAPI __itt_counter_create_typedW(const wchar_t *name, const wchar_t *domain, __itt_metadata_type type);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_counter_create_typed     __itt_counter_create_typedW
+#  define __itt_counter_create_typed_ptr __itt_counter_create_typedW_ptr
+#else /* UNICODE */
+#  define __itt_counter_create_typed     __itt_counter_create_typedA
+#  define __itt_counter_create_typed_ptr __itt_counter_create_typedA_ptr
+#endif /* UNICODE */
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+__itt_counter ITTAPI __itt_counter_create_typed(const char *name, const char *domain, __itt_metadata_type type);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, __itt_counter, counter_create_typedA, (const char    *name, const char    *domain, __itt_metadata_type type))
+ITT_STUB(ITTAPI, __itt_counter, counter_create_typedW, (const wchar_t *name, const wchar_t *domain, __itt_metadata_type type))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, __itt_counter, counter_create_typed,  (const char *name, const char *domain, __itt_metadata_type type))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_counter_create_typedA     ITTNOTIFY_DATA(counter_create_typedA)
+#define __itt_counter_create_typedA_ptr ITTNOTIFY_NAME(counter_create_typedA)
+#define __itt_counter_create_typedW     ITTNOTIFY_DATA(counter_create_typedW)
+#define __itt_counter_create_typedW_ptr ITTNOTIFY_NAME(counter_create_typedW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_counter_create_typed     ITTNOTIFY_DATA(counter_create_typed)
+#define __itt_counter_create_typed_ptr ITTNOTIFY_NAME(counter_create_typed)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_counter_create_typedA(name, domain, type)
+#define __itt_counter_create_typedA_ptr 0
+#define __itt_counter_create_typedW(name, domain, type)
+#define __itt_counter_create_typedW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_counter_create_typed(name, domain, type)
+#define __itt_counter_create_typed_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_counter_create_typedA_ptr 0
+#define __itt_counter_create_typedW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_counter_create_typed_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Destroy the counter identified by the pointer previously returned by __itt_counter_create() or
+ * __itt_counter_create_typed()
+ */
+void ITTAPI __itt_counter_destroy(__itt_counter id);
+
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, counter_destroy, (__itt_counter id))
+#define __itt_counter_destroy     ITTNOTIFY_VOID(counter_destroy)
+#define __itt_counter_destroy_ptr ITTNOTIFY_NAME(counter_destroy)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_counter_destroy(id)
+#define __itt_counter_destroy_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_counter_destroy_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} counters group */
+
+/**
+ * @ingroup markers
+ * @brief Create a marker instance.
+ * @param[in] domain The domain for this marker
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ * @param[in] id The instance ID for this marker, or __itt_null
+ * @param[in] name The name for this marker
+ * @param[in] scope The scope for this marker
+ */
+void ITTAPI __itt_marker_ex(const __itt_domain *domain,  __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id id, __itt_string_handle *name, __itt_scope scope);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, marker_ex,    (const __itt_domain *domain,  __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id id, __itt_string_handle *name, __itt_scope scope))
+#define __itt_marker_ex(d,x,y,z,a,b)    ITTNOTIFY_VOID_D5(marker_ex,d,x,y,z,a,b)
+#define __itt_marker_ex_ptr             ITTNOTIFY_NAME(marker_ex)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_marker_ex(domain,clock_domain,timestamp,id,name,scope)
+#define __itt_marker_ex_ptr    0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_marker_ex_ptr    0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @ingroup clockdomain
+ * @brief Add a relation to the current task instance.
+ * The current task instance is the head of the relation.
+ * @param[in] domain The domain controlling this call
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ * @param[in] relation The kind of relation
+ * @param[in] tail The ID for the tail of the relation
+ */
+void ITTAPI __itt_relation_add_to_current_ex(const __itt_domain *domain,  __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_relation relation, __itt_id tail);
+
+/**
+ * @ingroup clockdomain
+ * @brief Add a relation between two instance identifiers.
+ * @param[in] domain The domain controlling this call
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ * @param[in] head The ID for the head of the relation
+ * @param[in] relation The kind of relation
+ * @param[in] tail The ID for the tail of the relation
+ */
+void ITTAPI __itt_relation_add_ex(const __itt_domain *domain,  __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id head, __itt_relation relation, __itt_id tail);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, relation_add_to_current_ex, (const __itt_domain *domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_relation relation, __itt_id tail))
+ITT_STUBV(ITTAPI, void, relation_add_ex,            (const __itt_domain *domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id head, __itt_relation relation, __itt_id tail))
+#define __itt_relation_add_to_current_ex(d,x,y,z,a) ITTNOTIFY_VOID_D4(relation_add_to_current_ex,d,x,y,z,a)
+#define __itt_relation_add_to_current_ex_ptr        ITTNOTIFY_NAME(relation_add_to_current_ex)
+#define __itt_relation_add_ex(d,x,y,z,a,b)          ITTNOTIFY_VOID_D5(relation_add_ex,d,x,y,z,a,b)
+#define __itt_relation_add_ex_ptr                   ITTNOTIFY_NAME(relation_add_ex)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_relation_add_to_current_ex(domain,clock_domain,timestame,relation,tail)
+#define __itt_relation_add_to_current_ex_ptr 0
+#define __itt_relation_add_ex(domain,clock_domain,timestamp,head,relation,tail)
+#define __itt_relation_add_ex_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_relation_add_to_current_ex_ptr 0
+#define __itt_relation_add_ex_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @cond exclude_from_documentation */
+typedef enum ___itt_track_group_type
+{
+    __itt_track_group_type_normal = 0
+} __itt_track_group_type;
+/** @endcond */
+
+/** @cond exclude_from_documentation */
+#pragma pack(push, 8)
+
+typedef struct ___itt_track_group
+{
+    __itt_string_handle* name;     /*!< Name of the track group */
+    struct ___itt_track* track;    /*!< List of child tracks    */
+    __itt_track_group_type tgtype; /*!< Type of the track group */
+    int   extra1;                  /*!< Reserved. Must be zero  */
+    void* extra2;                  /*!< Reserved. Must be zero  */
+    struct ___itt_track_group* next;
+} __itt_track_group;
+
+#pragma pack(pop)
+/** @endcond */
+
+/**
+ * @brief Placeholder for custom track types. Currently, "normal" custom track
+ * is the only available track type.
+ */
+typedef enum ___itt_track_type
+{
+    __itt_track_type_normal = 0
+#ifdef INTEL_ITTNOTIFY_API_PRIVATE
+    , __itt_track_type_queue
+#endif /* INTEL_ITTNOTIFY_API_PRIVATE */
+} __itt_track_type;
+
+/** @cond exclude_from_documentation */
+#pragma pack(push, 8)
+
+typedef struct ___itt_track
+{
+    __itt_string_handle* name; /*!< Name of the track group */
+    __itt_track_group* group;  /*!< Parent group to a track */
+    __itt_track_type ttype;    /*!< Type of the track       */
+    int   extra1;              /*!< Reserved. Must be zero  */
+    void* extra2;              /*!< Reserved. Must be zero  */
+    struct ___itt_track* next;
+} __itt_track;
+
+#pragma pack(pop)
+/** @endcond */
+
+/**
+ * @brief Create logical track group.
+ */
+__itt_track_group* ITTAPI __itt_track_group_create(__itt_string_handle* name, __itt_track_group_type track_group_type);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUB(ITTAPI, __itt_track_group*, track_group_create, (__itt_string_handle* name, __itt_track_group_type track_group_type))
+#define __itt_track_group_create     ITTNOTIFY_DATA(track_group_create)
+#define __itt_track_group_create_ptr ITTNOTIFY_NAME(track_group_create)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_track_group_create(name)  (__itt_track_group*)0
+#define __itt_track_group_create_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_track_group_create_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Create logical track.
+ */
+__itt_track* ITTAPI __itt_track_create(__itt_track_group* track_group, __itt_string_handle* name, __itt_track_type track_type);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUB(ITTAPI, __itt_track*, track_create, (__itt_track_group* track_group,__itt_string_handle* name, __itt_track_type track_type))
+#define __itt_track_create     ITTNOTIFY_DATA(track_create)
+#define __itt_track_create_ptr ITTNOTIFY_NAME(track_create)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_track_create(track_group,name,track_type)  (__itt_track*)0
+#define __itt_track_create_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_track_create_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Set the logical track.
+ */
+void ITTAPI __itt_set_track(__itt_track* track);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, set_track, (__itt_track *track))
+#define __itt_set_track     ITTNOTIFY_VOID(set_track)
+#define __itt_set_track_ptr ITTNOTIFY_NAME(set_track)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_set_track(track)
+#define __itt_set_track_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_set_track_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/* ========================================================================== */
+/** @cond exclude_from_gpa_documentation */
+/**
+ * @defgroup events Events
+ * @ingroup public
+ * Events group
+ * @{
+ */
+/** @brief user event type */
+typedef int __itt_event;
+
+/**
+ * @brief Create an event notification
+ * @note name or namelen being null/name and namelen not matching, user event feature not enabled
+ * @return non-zero event identifier upon success and __itt_err otherwise
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+__itt_event LIBITTAPI __itt_event_createA(const char    *name, int namelen);
+__itt_event LIBITTAPI __itt_event_createW(const wchar_t *name, int namelen);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_event_create     __itt_event_createW
+#  define __itt_event_create_ptr __itt_event_createW_ptr
+#else
+#  define __itt_event_create     __itt_event_createA
+#  define __itt_event_create_ptr __itt_event_createA_ptr
+#endif /* UNICODE */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+__itt_event LIBITTAPI __itt_event_create(const char *name, int namelen);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(LIBITTAPI, __itt_event, event_createA, (const char    *name, int namelen))
+ITT_STUB(LIBITTAPI, __itt_event, event_createW, (const wchar_t *name, int namelen))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(LIBITTAPI, __itt_event, event_create,  (const char    *name, int namelen))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_event_createA     ITTNOTIFY_DATA(event_createA)
+#define __itt_event_createA_ptr ITTNOTIFY_NAME(event_createA)
+#define __itt_event_createW     ITTNOTIFY_DATA(event_createW)
+#define __itt_event_createW_ptr ITTNOTIFY_NAME(event_createW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_event_create      ITTNOTIFY_DATA(event_create)
+#define __itt_event_create_ptr  ITTNOTIFY_NAME(event_create)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_event_createA(name, namelen) (__itt_event)0
+#define __itt_event_createA_ptr 0
+#define __itt_event_createW(name, namelen) (__itt_event)0
+#define __itt_event_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_event_create(name, namelen)  (__itt_event)0
+#define __itt_event_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_event_createA_ptr 0
+#define __itt_event_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_event_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Record an event occurrence.
+ * @return __itt_err upon failure (invalid event id/user event feature not enabled)
+ */
+int LIBITTAPI __itt_event_start(__itt_event event);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUB(LIBITTAPI, int, event_start, (__itt_event event))
+#define __itt_event_start     ITTNOTIFY_DATA(event_start)
+#define __itt_event_start_ptr ITTNOTIFY_NAME(event_start)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_event_start(event) (int)0
+#define __itt_event_start_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_event_start_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Record an event end occurrence.
+ * @note It is optional if events do not have durations.
+ * @return __itt_err upon failure (invalid event id/user event feature not enabled)
+ */
+int LIBITTAPI __itt_event_end(__itt_event event);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUB(LIBITTAPI, int, event_end, (__itt_event event))
+#define __itt_event_end     ITTNOTIFY_DATA(event_end)
+#define __itt_event_end_ptr ITTNOTIFY_NAME(event_end)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_event_end(event) (int)0
+#define __itt_event_end_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_event_end_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} events group */
+
+
+/**
+ * @defgroup arrays Arrays Visualizer
+ * @ingroup public
+ * Visualize arrays
+ * @{
+ */
+
+/**
+ * @enum __itt_av_data_type
+ * @brief Defines types of arrays data (for C/C++ intrinsic types)
+ */
+typedef enum
+{
+    __itt_e_first = 0,
+    __itt_e_char = 0,  /* 1-byte integer */
+    __itt_e_uchar,     /* 1-byte unsigned integer */
+    __itt_e_int16,     /* 2-byte integer */
+    __itt_e_uint16,    /* 2-byte unsigned integer  */
+    __itt_e_int32,     /* 4-byte integer */
+    __itt_e_uint32,    /* 4-byte unsigned integer */
+    __itt_e_int64,     /* 8-byte integer */
+    __itt_e_uint64,    /* 8-byte unsigned integer */
+    __itt_e_float,     /* 4-byte floating */
+    __itt_e_double,    /* 8-byte floating */
+    __itt_e_last = __itt_e_double
+} __itt_av_data_type;
+
+/**
+ * @brief Save an array data to a file.
+ * Output format is defined by the file extension. The csv and bmp formats are supported (bmp - for 2-dimensional array only).
+ * @param[in] data - pointer to the array data
+ * @param[in] rank - the rank of the array
+ * @param[in] dimensions - pointer to an array of integers, which specifies the array dimensions.
+ * The size of dimensions must be equal to the rank
+ * @param[in] type - the type of the array, specified as one of the __itt_av_data_type values (for intrinsic types)
+ * @param[in] filePath - the file path; the output format is defined by the file extension
+ * @param[in] columnOrder - defines how the array is stored in the linear memory.
+ * It should be 1 for column-major order (e.g. in FORTRAN) or 0 - for row-major order (e.g. in C).
+ */
+
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+int ITTAPI __itt_av_saveA(void *data, int rank, const int *dimensions, int type, const char *filePath, int columnOrder);
+int ITTAPI __itt_av_saveW(void *data, int rank, const int *dimensions, int type, const wchar_t *filePath, int columnOrder);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_av_save     __itt_av_saveW
+#  define __itt_av_save_ptr __itt_av_saveW_ptr
+#else /* UNICODE */
+#  define __itt_av_save     __itt_av_saveA
+#  define __itt_av_save_ptr __itt_av_saveA_ptr
+#endif /* UNICODE */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+int ITTAPI __itt_av_save(void *data, int rank, const int *dimensions, int type, const char *filePath, int columnOrder);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, int, av_saveA, (void *data, int rank, const int *dimensions, int type, const char *filePath, int columnOrder))
+ITT_STUB(ITTAPI, int, av_saveW, (void *data, int rank, const int *dimensions, int type, const wchar_t *filePath, int columnOrder))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, int, av_save,  (void *data, int rank, const int *dimensions, int type, const char *filePath, int columnOrder))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_av_saveA     ITTNOTIFY_DATA(av_saveA)
+#define __itt_av_saveA_ptr ITTNOTIFY_NAME(av_saveA)
+#define __itt_av_saveW     ITTNOTIFY_DATA(av_saveW)
+#define __itt_av_saveW_ptr ITTNOTIFY_NAME(av_saveW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_av_save     ITTNOTIFY_DATA(av_save)
+#define __itt_av_save_ptr ITTNOTIFY_NAME(av_save)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_av_saveA(name)
+#define __itt_av_saveA_ptr 0
+#define __itt_av_saveW(name)
+#define __itt_av_saveW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_av_save(name)
+#define __itt_av_save_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_av_saveA_ptr 0
+#define __itt_av_saveW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_av_save_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+void ITTAPI __itt_enable_attach(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, enable_attach, (void))
+#define __itt_enable_attach     ITTNOTIFY_VOID(enable_attach)
+#define __itt_enable_attach_ptr ITTNOTIFY_NAME(enable_attach)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_enable_attach()
+#define __itt_enable_attach_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_enable_attach_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @cond exclude_from_gpa_documentation */
+
+/** @} arrays group */
+
+/** @endcond */
+
+/**
+ * @brief Module load info
+ * This API is used to report necessary information in case of module relocation
+ * @param[in] start_addr - relocated module start address
+ * @param[in] end_addr - relocated module end address
+ * @param[in] path - file system path to the module
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+void ITTAPI __itt_module_loadA(void *start_addr, void *end_addr, const char *path);
+void ITTAPI __itt_module_loadW(void *start_addr, void *end_addr, const wchar_t *path);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_module_load     __itt_module_loadW
+#  define __itt_module_load_ptr __itt_module_loadW_ptr
+#else /* UNICODE */
+#  define __itt_module_load     __itt_module_loadA
+#  define __itt_module_load_ptr __itt_module_loadA_ptr
+#endif /* UNICODE */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+void ITTAPI __itt_module_load(void *start_addr, void *end_addr, const char *path);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, void, module_loadA, (void *start_addr, void *end_addr, const char *path))
+ITT_STUB(ITTAPI, void, module_loadW, (void *start_addr, void *end_addr, const wchar_t *path))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, void, module_load,  (void *start_addr, void *end_addr, const char *path))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_module_loadA     ITTNOTIFY_VOID(module_loadA)
+#define __itt_module_loadA_ptr ITTNOTIFY_NAME(module_loadA)
+#define __itt_module_loadW     ITTNOTIFY_VOID(module_loadW)
+#define __itt_module_loadW_ptr ITTNOTIFY_NAME(module_loadW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_module_load     ITTNOTIFY_VOID(module_load)
+#define __itt_module_load_ptr ITTNOTIFY_NAME(module_load)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_module_loadA(start_addr, end_addr, path)
+#define __itt_module_loadA_ptr 0
+#define __itt_module_loadW(start_addr, end_addr, path)
+#define __itt_module_loadW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_module_load(start_addr, end_addr, path)
+#define __itt_module_load_ptr 0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_module_loadA_ptr 0
+#define __itt_module_loadW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_module_load_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* _ITTNOTIFY_H_ */
+
+#ifdef INTEL_ITTNOTIFY_API_PRIVATE
+
+#ifndef _ITTNOTIFY_PRIVATE_
+#define _ITTNOTIFY_PRIVATE_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/**
+ * @ingroup clockdomain
+ * @brief Begin an overlapped task instance.
+ * @param[in] domain The domain for this task
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ * @param[in] taskid The identifier for this task instance, *cannot* be __itt_null.
+ * @param[in] parentid The parent of this task, or __itt_null.
+ * @param[in] name The name of this task.
+ */
+void ITTAPI __itt_task_begin_overlapped_ex(const __itt_domain* domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id taskid, __itt_id parentid, __itt_string_handle* name);
+
+/**
+ * @ingroup clockdomain
+ * @brief End an overlapped task instance.
+ * @param[in] domain The domain for this task
+ * @param[in] clock_domain The clock domain controlling the execution of this call.
+ * @param[in] timestamp The user defined timestamp.
+ * @param[in] taskid Explicit ID of finished task
+ */
+void ITTAPI __itt_task_end_overlapped_ex(const __itt_domain* domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id taskid);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, task_begin_overlapped_ex,       (const __itt_domain* domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id taskid, __itt_id parentid, __itt_string_handle* name))
+ITT_STUBV(ITTAPI, void, task_end_overlapped_ex,         (const __itt_domain* domain, __itt_clock_domain* clock_domain, unsigned long long timestamp, __itt_id taskid))
+#define __itt_task_begin_overlapped_ex(d,x,y,z,a,b)     ITTNOTIFY_VOID_D5(task_begin_overlapped_ex,d,x,y,z,a,b)
+#define __itt_task_begin_overlapped_ex_ptr              ITTNOTIFY_NAME(task_begin_overlapped_ex)
+#define __itt_task_end_overlapped_ex(d,x,y,z)           ITTNOTIFY_VOID_D3(task_end_overlapped_ex,d,x,y,z)
+#define __itt_task_end_overlapped_ex_ptr                ITTNOTIFY_NAME(task_end_overlapped_ex)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_task_begin_overlapped_ex(domain,clock_domain,timestamp,taskid,parentid,name)
+#define __itt_task_begin_overlapped_ex_ptr      0
+#define __itt_task_end_overlapped_ex(domain,clock_domain,timestamp,taskid)
+#define __itt_task_end_overlapped_ex_ptr        0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_task_begin_overlapped_ex_ptr      0
+#define __itt_task_end_overlapped_ptr           0
+#define __itt_task_end_overlapped_ex_ptr        0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @defgroup makrs_internal Marks
+ * @ingroup internal
+ * Marks group
+ * @warning Internal API:
+ *   - It is not shipped to outside of Intel
+ *   - It is delivered to internal Intel teams using e-mail or SVN access only
+ * @{
+ */
+/** @brief user mark type */
+typedef int __itt_mark_type;
+
+/**
+ * @brief Creates a user mark type with the specified name using char or Unicode string.
+ * @param[in] name - name of mark to create
+ * @return Returns a handle to the mark type
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+__itt_mark_type ITTAPI __itt_mark_createA(const char    *name);
+__itt_mark_type ITTAPI __itt_mark_createW(const wchar_t *name);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_mark_create     __itt_mark_createW
+#  define __itt_mark_create_ptr __itt_mark_createW_ptr
+#else /* UNICODE */
+#  define __itt_mark_create     __itt_mark_createA
+#  define __itt_mark_create_ptr __itt_mark_createA_ptr
+#endif /* UNICODE */
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+__itt_mark_type ITTAPI __itt_mark_create(const char *name);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, __itt_mark_type, mark_createA, (const char    *name))
+ITT_STUB(ITTAPI, __itt_mark_type, mark_createW, (const wchar_t *name))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, __itt_mark_type, mark_create,  (const char *name))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_mark_createA     ITTNOTIFY_DATA(mark_createA)
+#define __itt_mark_createA_ptr ITTNOTIFY_NAME(mark_createA)
+#define __itt_mark_createW     ITTNOTIFY_DATA(mark_createW)
+#define __itt_mark_createW_ptr ITTNOTIFY_NAME(mark_createW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_mark_create      ITTNOTIFY_DATA(mark_create)
+#define __itt_mark_create_ptr  ITTNOTIFY_NAME(mark_create)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_mark_createA(name) (__itt_mark_type)0
+#define __itt_mark_createA_ptr 0
+#define __itt_mark_createW(name) (__itt_mark_type)0
+#define __itt_mark_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_mark_create(name)  (__itt_mark_type)0
+#define __itt_mark_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_mark_createA_ptr 0
+#define __itt_mark_createW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_mark_create_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Creates a "discrete" user mark type of the specified type and an optional parameter using char or Unicode string.
+ *
+ * - The mark of "discrete" type is placed to collection results in case of success. It appears in overtime view(s) as a special tick sign.
+ * - The call is "synchronous" - function returns after mark is actually added to results.
+ * - This function is useful, for example, to mark different phases of application
+ *   (beginning of the next mark automatically meand end of current region).
+ * - Can be used together with "continuous" marks (see below) at the same collection session
+ * @param[in] mt - mark, created by __itt_mark_create(const char* name) function
+ * @param[in] parameter - string parameter of mark
+ * @return Returns zero value in case of success, non-zero value otherwise.
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+int ITTAPI __itt_markA(__itt_mark_type mt, const char    *parameter);
+int ITTAPI __itt_markW(__itt_mark_type mt, const wchar_t *parameter);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_mark     __itt_markW
+#  define __itt_mark_ptr __itt_markW_ptr
+#else /* UNICODE  */
+#  define __itt_mark     __itt_markA
+#  define __itt_mark_ptr __itt_markA_ptr
+#endif /* UNICODE */
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+int ITTAPI __itt_mark(__itt_mark_type mt, const char *parameter);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, int, markA, (__itt_mark_type mt, const char    *parameter))
+ITT_STUB(ITTAPI, int, markW, (__itt_mark_type mt, const wchar_t *parameter))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, int, mark,  (__itt_mark_type mt, const char *parameter))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_markA     ITTNOTIFY_DATA(markA)
+#define __itt_markA_ptr ITTNOTIFY_NAME(markA)
+#define __itt_markW     ITTNOTIFY_DATA(markW)
+#define __itt_markW_ptr ITTNOTIFY_NAME(markW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_mark      ITTNOTIFY_DATA(mark)
+#define __itt_mark_ptr  ITTNOTIFY_NAME(mark)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_markA(mt, parameter) (int)0
+#define __itt_markA_ptr 0
+#define __itt_markW(mt, parameter) (int)0
+#define __itt_markW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_mark(mt, parameter)  (int)0
+#define __itt_mark_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_markA_ptr 0
+#define __itt_markW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_mark_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Use this if necessary to create a "discrete" user event type (mark) for process
+ * rather then for one thread
+ * @see int __itt_mark(__itt_mark_type mt, const char* parameter);
+ */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+int ITTAPI __itt_mark_globalA(__itt_mark_type mt, const char    *parameter);
+int ITTAPI __itt_mark_globalW(__itt_mark_type mt, const wchar_t *parameter);
+#if defined(UNICODE) || defined(_UNICODE)
+#  define __itt_mark_global     __itt_mark_globalW
+#  define __itt_mark_global_ptr __itt_mark_globalW_ptr
+#else /* UNICODE  */
+#  define __itt_mark_global     __itt_mark_globalA
+#  define __itt_mark_global_ptr __itt_mark_globalA_ptr
+#endif /* UNICODE */
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+int ITTAPI __itt_mark_global(__itt_mark_type mt, const char *parameter);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+ITT_STUB(ITTAPI, int, mark_globalA, (__itt_mark_type mt, const char    *parameter))
+ITT_STUB(ITTAPI, int, mark_globalW, (__itt_mark_type mt, const wchar_t *parameter))
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+ITT_STUB(ITTAPI, int, mark_global,  (__itt_mark_type mt, const char *parameter))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_mark_globalA     ITTNOTIFY_DATA(mark_globalA)
+#define __itt_mark_globalA_ptr ITTNOTIFY_NAME(mark_globalA)
+#define __itt_mark_globalW     ITTNOTIFY_DATA(mark_globalW)
+#define __itt_mark_globalW_ptr ITTNOTIFY_NAME(mark_globalW)
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_mark_global      ITTNOTIFY_DATA(mark_global)
+#define __itt_mark_global_ptr  ITTNOTIFY_NAME(mark_global)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_mark_globalA(mt, parameter) (int)0
+#define __itt_mark_globalA_ptr 0
+#define __itt_mark_globalW(mt, parameter) (int)0
+#define __itt_mark_globalW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_mark_global(mt, parameter)  (int)0
+#define __itt_mark_global_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_mark_globalA_ptr 0
+#define __itt_mark_globalW_ptr 0
+#else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define __itt_mark_global_ptr  0
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Creates an "end" point for "continuous" mark with specified name.
+ *
+ * - Returns zero value in case of success, non-zero value otherwise.
+ *   Also returns non-zero value when preceding "begin" point for the
+ *   mark with the same name failed to be created or not created.
+ * - The mark of "continuous" type is placed to collection results in
+ *   case of success. It appears in overtime view(s) as a special tick
+ *   sign (different from "discrete" mark) together with line from
+ *   corresponding "begin" mark to "end" mark.
+ * @note Continuous marks can overlap and be nested inside each other.
+ * Discrete mark can be nested inside marked region
+ * @param[in] mt - mark, created by __itt_mark_create(const char* name) function
+ * @return Returns zero value in case of success, non-zero value otherwise.
+ */
+int ITTAPI __itt_mark_off(__itt_mark_type mt);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUB(ITTAPI, int, mark_off, (__itt_mark_type mt))
+#define __itt_mark_off     ITTNOTIFY_DATA(mark_off)
+#define __itt_mark_off_ptr ITTNOTIFY_NAME(mark_off)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_mark_off(mt) (int)0
+#define __itt_mark_off_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_mark_off_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Use this if necessary to create an "end" point for mark of process
+ * @see int __itt_mark_off(__itt_mark_type mt);
+ */
+int ITTAPI __itt_mark_global_off(__itt_mark_type mt);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUB(ITTAPI, int, mark_global_off, (__itt_mark_type mt))
+#define __itt_mark_global_off     ITTNOTIFY_DATA(mark_global_off)
+#define __itt_mark_global_off_ptr ITTNOTIFY_NAME(mark_global_off)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_mark_global_off(mt) (int)0
+#define __itt_mark_global_off_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_mark_global_off_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+/** @} marks group */
+
+/**
+ * @defgroup counters_internal Counters
+ * @ingroup internal
+ * Counters group
+ * @{
+ */
+
+
+/**
+ * @defgroup stitch Stack Stitching
+ * @ingroup internal
+ * Stack Stitching group
+ * @{
+ */
+/**
+ * @brief opaque structure for counter identification
+ */
+typedef struct ___itt_caller *__itt_caller;
+
+/**
+ * @brief Create the stitch point e.g. a point in call stack where other stacks should be stitched to.
+ * The function returns a unique identifier which is used to match the cut points with corresponding stitch points.
+ */
+__itt_caller ITTAPI __itt_stack_caller_create(void);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUB(ITTAPI, __itt_caller, stack_caller_create, (void))
+#define __itt_stack_caller_create     ITTNOTIFY_DATA(stack_caller_create)
+#define __itt_stack_caller_create_ptr ITTNOTIFY_NAME(stack_caller_create)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_stack_caller_create() (__itt_caller)0
+#define __itt_stack_caller_create_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_stack_caller_create_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Destroy the inforamtion about stitch point identified by the pointer previously returned by __itt_stack_caller_create()
+ */
+void ITTAPI __itt_stack_caller_destroy(__itt_caller id);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, stack_caller_destroy, (__itt_caller id))
+#define __itt_stack_caller_destroy     ITTNOTIFY_VOID(stack_caller_destroy)
+#define __itt_stack_caller_destroy_ptr ITTNOTIFY_NAME(stack_caller_destroy)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_stack_caller_destroy(id)
+#define __itt_stack_caller_destroy_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_stack_caller_destroy_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief Sets the cut point. Stack from each event which occurs after this call will be cut
+ * at the same stack level the function was called and stitched to the corresponding stitch point.
+ */
+void ITTAPI __itt_stack_callee_enter(__itt_caller id);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, stack_callee_enter, (__itt_caller id))
+#define __itt_stack_callee_enter     ITTNOTIFY_VOID(stack_callee_enter)
+#define __itt_stack_callee_enter_ptr ITTNOTIFY_NAME(stack_callee_enter)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_stack_callee_enter(id)
+#define __itt_stack_callee_enter_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_stack_callee_enter_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/**
+ * @brief This function eliminates the cut point which was set by latest __itt_stack_callee_enter().
+ */
+void ITTAPI __itt_stack_callee_leave(__itt_caller id);
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+ITT_STUBV(ITTAPI, void, stack_callee_leave, (__itt_caller id))
+#define __itt_stack_callee_leave     ITTNOTIFY_VOID(stack_callee_leave)
+#define __itt_stack_callee_leave_ptr ITTNOTIFY_NAME(stack_callee_leave)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_stack_callee_leave(id)
+#define __itt_stack_callee_leave_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_stack_callee_leave_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+/** @} stitch group */
+
+/* ***************************************************************************************************************************** */
+
+#include <stdarg.h>
+
+/** @cond exclude_from_documentation */
+typedef enum __itt_error_code
+{
+    __itt_error_success       = 0, /*!< no error */
+    __itt_error_no_module     = 1, /*!< module can't be loaded */
+    /* %1$s -- library name; win: %2$d -- system error code; unx: %2$s -- system error message. */
+    __itt_error_no_symbol     = 2, /*!< symbol not found */
+    /* %1$s -- library name, %2$s -- symbol name. */
+    __itt_error_unknown_group = 3, /*!< unknown group specified */
+    /* %1$s -- env var name, %2$s -- group name. */
+    __itt_error_cant_read_env = 4, /*!< GetEnvironmentVariable() failed */
+    /* %1$s -- env var name, %2$d -- system error. */
+    __itt_error_env_too_long  = 5, /*!< variable value too long */
+    /* %1$s -- env var name, %2$d -- actual length of the var, %3$d -- max allowed length. */
+    __itt_error_system        = 6  /*!< pthread_mutexattr_init or pthread_mutex_init failed */
+    /* %1$s -- function name, %2$d -- errno. */
+} __itt_error_code;
+
+typedef void (__itt_error_handler_t)(__itt_error_code code, va_list);
+__itt_error_handler_t* __itt_set_error_handler(__itt_error_handler_t*);
+
+const char* ITTAPI __itt_api_version(void);
+/** @endcond */
+
+/** @cond exclude_from_documentation */
+#ifndef INTEL_NO_MACRO_BODY
+#ifndef INTEL_NO_ITTNOTIFY_API
+#define __itt_error_handler ITT_JOIN(INTEL_ITTNOTIFY_PREFIX, error_handler)
+void __itt_error_handler(__itt_error_code code, va_list args);
+extern const int ITTNOTIFY_NAME(err);
+#define __itt_err ITTNOTIFY_NAME(err)
+ITT_STUB(ITTAPI, const char*, api_version, (void))
+#define __itt_api_version     ITTNOTIFY_DATA(api_version)
+#define __itt_api_version_ptr ITTNOTIFY_NAME(api_version)
+#else  /* INTEL_NO_ITTNOTIFY_API */
+#define __itt_api_version()   (const char*)0
+#define __itt_api_version_ptr 0
+#endif /* INTEL_NO_ITTNOTIFY_API */
+#else  /* INTEL_NO_MACRO_BODY */
+#define __itt_api_version_ptr 0
+#endif /* INTEL_NO_MACRO_BODY */
+/** @endcond */
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* _ITTNOTIFY_PRIVATE_ */
+
+#endif /* INTEL_ITTNOTIFY_API_PRIVATE */
diff --git a/tools/profiler/docs/buffer.rst b/tools/profiler/docs/buffer.rst
new file mode 100644
index 0000000000..dd7ef30dfd
--- /dev/null
+++ b/tools/profiler/docs/buffer.rst
@@ -0,0 +1,70 @@
+Buffers and Memory Management
+=============================
+
+In a post-Fission world, precise memory management across many threads and processes is
+especially important. In order for the profiler to achieve this, it uses a chunked buffer
+strategy.
+
+The `ProfileBuffer`_ is the overall buffer class that controls the memory and storage
+for the profile, it allows allocating objects into it. This can be used freely
+by things like markers and samples to store data as entries, without needing to know
+about the general strategy for how the memory is managed.
+
+The `ProfileBuffer`_ is then backed by the `ProfileChunkedBuffer`_. This specialized
+buffer grows incrementally, by allocating additional `ProfileBufferChunk`_ objects.
+More and more chunks will be allocated until a memory limit is reached, where they will
+be released. After releasing, the chunk will either be recycled or freed.
+
+The limiting of memory usage is coordinated by the `ProfilerParent`_ in the parent
+process. The `ProfilerParent`_ and `ProfilerChild`_ exchange IPC messages with information
+about how much memory is being used.  When the maximum byte threshold is passed,
+the ProfileChunkManager in the parent process removes the oldest chunk, and then the
+`ProfilerParent`_ sends a `DestroyReleasedChunksAtOrBefore`_ message to all of child
+processes so that the oldest chunks in the profile are released. This helps long profiles
+to keep having data in a similar time frame.
+
+Profile Buffer Terminology
+##########################
+
+ProfilerParent
+  The main profiler machinery is installed in the parent process. It uses IPC to
+  communicate to the child processes. The PProfiler is the actor which is used
+  to communicate across processes to coordinate things. See `ProfilerParent.h`_. The
+  ProfilerParent uses the DestroyReleasedChunksAtOrBefore meessage to control the
+  overall chunk limit.
+
+ProfilerChild
+  ProfilerChild is installed in every child process, it will receive requests from
+  DestroyReleasedChunksAtOrBefore.
+
+Entry
+  This is an individual entry in the `ProfileBuffer.h`_,. These entry sizes are not
+  related to the chunks sizes. An individual entry can straddle two different chunks.
+  An entry can contain various pieces of data, like markers, samples, and stacks.
+
+Chunk
+  An arbitrary sized chunk of memory, managed by the `ProfileChunkedBuffer`_, and
+  IPC calls from the ProfilerParent.
+
+Unreleased Chunk
+  This chunk is currently being used to write entries into.
+
+Released chunk
+  This chunk is full of data. When memory limits happen, it can either be recycled
+  or freed.
+
+Recycled chunk
+  This is a chunk that was previously written into, and full. When memory limits occur,
+  rather than freeing the memory, it is re-used as the next chunk.
+
+.. _ProfileChunkedBuffer: https://searchfox.org/mozilla-central/search?q=ProfileChunkedBuffer&path=&case=true&regexp=false
+.. _ProfileChunkManager: https://searchfox.org/mozilla-central/search?q=ProfileBufferChunkManager.h&path=&case=true&regexp=false
+.. _ProfileBufferChunk: https://searchfox.org/mozilla-central/search?q=ProfileBufferChunk&path=&case=true&regexp=false
+.. _ProfileBufferChunkManagerWithLocalLimit: https://searchfox.org/mozilla-central/search?q=ProfileBufferChunkManagerWithLocalLimit&case=true&path=
+.. _ProfilerParent.h: https://searchfox.org/mozilla-central/source/tools/profiler/public/ProfilerParent.h
+.. _ProfilerChild.h: https://searchfox.org/mozilla-central/source/tools/profiler/public/ProfilerChild.h
+.. _ProfileBuffer.h: https://searchfox.org/mozilla-central/source/tools/profiler/core/ProfileBuffer.h
+.. _ProfileBuffer: https://searchfox.org/mozilla-central/search?q=ProfileBuffer&path=&case=true&regexp=false
+.. _ProfilerParent: https://searchfox.org/mozilla-central/search?q=ProfilerParent&path=&case=true&regexp=false
+.. _ProfilerChild: https://searchfox.org/mozilla-central/search?q=ProfilerChild&path=&case=true&regexp=false
+.. _DestroyReleasedChunksAtOrBefore: https://searchfox.org/mozilla-central/search?q=DestroyReleasedChunksAtOrBefore&path=&case=true&regexp=false
diff --git a/tools/profiler/docs/index.rst b/tools/profiler/docs/index.rst
new file mode 100644
index 0000000000..e7a99f2df7
--- /dev/null
+++ b/tools/profiler/docs/index.rst
@@ -0,0 +1,36 @@
+Gecko Profiler
+==============
+
+The Firefox Profiler is the collection of tools used to profile Firefox. This is backed
+by the Gecko Profiler, which is the primarily C++ component that instruments Gecko. It
+is configurable, and supports a variety of data sources and recording modes. Primarily,
+it is used as a stastical profiler, where the execution of threads that have been
+registered with the profile is paused, and a sample is taken. Generally, this includes
+a stackwalk with combined native stack frame, JavaScript stack frames, and custom stack
+frame labels.
+
+In addition to the sampling, the profiler can collect markers, which are collected
+deterministically (as opposed to statistically, like samples). These include some
+kind of text description, and optionally a payload with more information.
+
+This documentation serves to document the Gecko Profiler and Base Profiler components,
+while the profiler.firefox.com interface is documented at `profiler.firefox.com/docs/ <https://profiler.firefox.com/docs/>`_
+
+.. toctree::
+   :maxdepth: 1
+
+   buffer
+   instrumenting-javascript
+   markers-guide
+   memory
+
+The following areas still need documentation:
+
+ * LUL
+ * Instrumenting Java
+ * Instrumenting Rust
+ * Registering Threads
+ * Samples and Stack Walking
+ * Triggering Gecko Profiles in Automation
+ * JS Tracer
+ * Serialization
diff --git a/tools/profiler/docs/instrumenting-javascript.rst b/tools/profiler/docs/instrumenting-javascript.rst
new file mode 100644
index 0000000000..91575b9198
--- /dev/null
+++ b/tools/profiler/docs/instrumenting-javascript.rst
@@ -0,0 +1,55 @@
+Instrumenting JavaScript
+========================
+
+There are multiple ways to use the profiler with JavaScript. There is the "JavaScript"
+profiler feature (via about:profiling), which enables stack walking for JavaScript code.
+This is most likely turned on already for every profiler preset.
+
+In addition, markers can be created to specifically marker an instant in time, or a
+duration. This can be helpful to make sense of a particular piece of the front-end,
+or record events that normally wouldn't show up in samples.
+
+Markers in Browser Chrome
+*************************
+
+If you have access to ChromeUtils, then adding a marker is relatively easily.
+
+.. code-block:: javascript
+
+  // Add an instant marker, representing a single point in time
+  ChromeUtils.addProfilerMarker("MarkerName");
+
+  // Add a duration marker, representing a span of time.
+  const startTime = Cu.now();
+  doWork();
+  ChromeUtils.addProfilerMarker("MarkerName", startTime);
+
+  // Add a duration marker, representing a span of time, with some additional tex
+  const startTime = Cu.now();
+  doWork();
+  ChromeUtils.addProfilerMarker("MarkerName", startTime, "Details about this event");
+
+  // Add an instant marker, with some additional tex
+  const startTime = Cu.now();
+  doWork();
+  ChromeUtils.addProfilerMarker("MarkerName", undefined, "Details about this event");
+
+Markers in Content Code
+***********************
+
+If instrumenting content code, then the `UserTiming`_ API is the best bet.
+:code:`performance.mark` will create an instant marker, and a :code:`performance.measure`
+will create a duration marker. These markers will show up under UserTiming in
+the profiler UI.
+
+.. code-block:: javascript
+
+  // Create an instant marker.
+  performance.mark("InstantMarkerName");
+
+  doWork();
+
+  // Measuring with the performance API will also create duration markers.
+  performance.measure("DurationMarkerName", "InstantMarkerName");
+
+.. _UserTiming: https://developer.mozilla.org/en-US/docs/Web/API/User_Timing_API
diff --git a/tools/profiler/docs/markers-guide.rst b/tools/profiler/docs/markers-guide.rst
new file mode 100644
index 0000000000..a4d431fa48
--- /dev/null
+++ b/tools/profiler/docs/markers-guide.rst
@@ -0,0 +1,477 @@
+Markers
+=======
+
+Markers are packets of arbitrary data that are added to a profile by the Firefox code, usually to
+indicate something important happening at a point in time, or during an interval of time.
+
+Each marker has a name, a category, some common optional information (timing, backtrace, etc.),
+and an optional payload of a specific type (containing arbitrary data relevant to that type).
+
+
+Example
+-------
+
+Short example, details below.
+
+Note: Most marker-related identifiers are in the ``mozilla`` namespace, to be added where necessary.
+
+.. code-block:: c++
+
+    // Record a simple marker with the category of DOM.
+    PROFILER_MARKER_UNTYPED("Marker Name", DOM);
+
+    // Create a marker with some additional text information. (Be wary of printf!)
+    PROFILER_MARKER_TEXT("Marker Name", JS, MarkerOptions{}, "Additional text information.");
+
+    // Record a custom marker of type `ExampleNumberMarker` (see definition below).
+    PROFILER_MARKER("Number", OTHER, MarkerOptions{}, ExampleNumberMarker, 42);
+
+.. code-block:: c++
+
+    // Marker type definition.
+    struct ExampleNumberMarker {
+      // Unique marker type name.
+      static constexpr Span<const char> MarkerTypeName() { return MakeStringSpan("number"); }
+      // Data specific to this marker type, serialized to JSON for profiler.firefox.com.
+      static void StreamJSONMarkerData(SpliceableJSONWriter& aWriter, int aNumber) {
+        aWriter.IntProperty("number", aNumber);
+      }
+      // Where and how to display the marker and its data.
+      static MarkerSchema MarkerTypeDisplay() {
+        using MS = MarkerSchema;
+        MS schema(MS::Location::markerChart, MS::Location::markerTable);
+        schema.SetChartLabel("Number: {marker.data.number}");
+        schema.AddKeyLabelFormat("number", "Number", MS::Format::number);
+        return schema;
+      }
+    };
+
+
+How to Record Markers
+---------------------
+
+Header to Include
+^^^^^^^^^^^^^^^^^
+
+If the compilation unit only defines and records untyped, text, and/or its own markers, include
+`the main profiler markers header <https://searchfox.org/mozilla-central/source/tools/profiler/public/ProfilerMarkers.h>`_:
+
+.. code-block:: c++
+
+    #include "mozilla/ProfilerMarkers.h"
+
+If it also records one of the other common markers defined in
+`ProfilerMarkerTypes.h <https://searchfox.org/mozilla-central/source/tools/profiler/public/ProfilerMarkerTypes.h>`_,
+include that one instead:
+
+.. code-block:: c++
+
+    #include "mozilla/ProfilerMarkerTypes.h"
+
+And if it uses any other profiler functions (e.g., labels), use
+`the main Gecko Profiler header <https://searchfox.org/mozilla-central/source/tools/profiler/public/GeckoProfiler.h>`_
+instead:
+
+.. code-block:: c++
+
+    #include "GeckoProfiler.h"
+
+The above works from source files that end up in libxul, which is true for the majority
+of Firefox source code. But some files live outside of libxul, such as mfbt, in which
+case the advice is the same but the equivalent headers are from the Base Profiler instead:
+
+.. code-block:: c++
+
+    #include "mozilla/BaseProfilerMarkers.h" // Only own/untyped/text markers
+    #include "mozilla/BaseProfilerMarkerTypes.h" // Only common markers
+    #include "BaseProfiler.h" // Markers and other profiler functions
+
+Untyped Markers
+^^^^^^^^^^^^^^^
+
+Untyped markers don't carry any information apart from common marker data:
+Name, category, options.
+
+.. code-block:: c++
+
+    PROFILER_MARKER_UNTYPED(
+        // Name, and category pair.
+        "Marker Name", OTHER,
+        // Marker options, may be omitted if all defaults are acceptable.
+        MarkerOptions(MarkerStack::Capture(), ...));
+
+``PROFILER_MARKER_UNTYPED`` is a macro that simplifies the use of the main
+``profiler_add_marker`` function, by adding the appropriate namespaces, and a surrounding
+``#ifdef MOZ_GECKO_PROFILER`` guard.
+
+1. Marker name
+    The first argument is the name of this marker. This will be displayed in most places
+    the marker is shown. It can be a literal C string, or any dynamic string object.
+2. `Category pair name <https://searchfox.org/mozilla-central/define?q=M_174bb0de187ee7d9>`_
+    Choose a category + subcategory from the `the list of categories <https://searchfox.org/mozilla-central/define?q=M_174bb0de187ee7d9>`_.
+    This is the second parameter of each ``SUBCATEGORY`` line, for instance ``LAYOUT_Reflow``.
+    (Internally, this is really a `MarkerCategory <https://searchfox.org/mozilla-central/define?q=T_mozilla%3A%3AMarkerCategory>`_
+    object, in case you need to construct it elsewhere.)
+3. `MarkerOptions <https://searchfox.org/mozilla-central/define?q=T_mozilla%3A%3AMarkerOptions>`_
+    See the options below. It can be omitted if there are no other arguments, ``{}``, or
+    ``MarkerOptions()`` (no specified options); only one of the following option types
+    alone; or ``MarkerOptions(...)`` with one or more of the following options types:
+
+    * `MarkerThreadId <https://searchfox.org/mozilla-central/define?q=T_mozilla%3A%3AMarkerThreadId>`_
+        Rarely used, as it defaults to the current thread. Otherwise it specifies the target
+        "thread id" (aka "track") where the marker should appear; This may be useful when
+        referring to something that happened on another thread (use ``profiler_current_thread_id()``
+        from the original thread to get its id); or for some important markers, they may be
+        sent to the "main thread", which can be specified with ``MarkerThreadId::MainThread()``.
+    * `MarkerTiming <https://searchfox.org/mozilla-central/define?q=T_mozilla%3A%3AMarkerTiming>`_
+        This specifies an instant or interval of time. It defaults to the current instant if
+        left unspecified. Otherwise use ``MarkerTiming::InstantAt(timestamp)`` or
+        ``MarkerTiming::Interval(ts1, ts2)``; timestamps are usually captured with
+        ``TimeStamp::Now()``. It is also possible to record only the start or the end of an
+        interval, pairs of start/end markers will be matched by their name. *Note: The
+        upcoming "marker sets" feature will make this pairing more reliable, and also
+        allow more than two markers to be connected*.
+    * `MarkerStack <https://searchfox.org/mozilla-central/define?q=T_mozilla%3A%3AMarkerStack>`_
+        By default, markers do not record a "stack" (or "backtrace"). To record a stack at
+        this point, in the most efficient manner, specify ``MarkerStack::Capture()``. To
+        record a previously captured stack, first store a stack into a
+        ``UniquePtr<ProfileChunkedBuffer>`` with ``profiler_capture_backtrace()``, then pass
+        it to the marker with ``MarkerStack::TakeBacktrace(std::move(stack))``.
+    * `MarkerInnerWindowId <https://searchfox.org/mozilla-central/define?q=T_mozilla%3A%3AMarkerInnerWindowId>`_
+        If you have access to an "inner window id", consider specifying it as an option, to
+        help profiler.firefox.com to classify them by tab.
+
+Text Markers
+^^^^^^^^^^^^
+
+Text markers are very common, they carry an extra text as a fourth argument, in addition to
+the marker name. Use the following macro:
+
+.. code-block:: c++
+
+    PROFILER_MARKER_TEXT(
+        // Name, category pair, options.
+        "Marker Name", OTHER, {},
+        // Text string.
+        "Here are some more details."
+    );
+
+As useful as it is, using an expensive ``printf`` operation to generate a complex text
+comes with a variety of issues string. It can leak potentially sensitive information
+such as URLs can be leaked during the profile sharing step. profiler.firefox.com cannot
+access the information programmatically. It won't get the formatting benefits of the
+built-in marker schema. Please consider using a custom marker type to separate and
+better present the data.
+
+Other Typed Markers
+^^^^^^^^^^^^^^^^^^^
+
+From C++ code, a marker of some type ``YourMarker`` (details about type definition follow) can be
+recorded like this:
+
+.. code-block:: c++
+
+    PROFILER_MARKER(
+        "YourMarker name", OTHER,
+        MarkerOptions(MarkerTiming::IntervalUntilNowFrom(someStartTimestamp),
+                      MarkerInnerWindowId(innerWindowId))),
+        YourMarker, "some string", 12345, "http://example.com", someTimeStamp);
+
+After the first three common arguments (like in ``PROFILER_MARKER_UNTYPED``), there are:
+
+4. The marker type, which is the name of the C++ ``struct`` that defines that type.
+5. A variadic list of type-specific argument. They must match the number of, and must
+   be convertible to, ``StreamJSONMarkerData`` parameters as specified in the marker type definition.
+
+"Auto" Scoped Interval Markers
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To capture time intervals around some important operations, it is common to store a timestamp, do the work,
+and then record a marker, e.g.:
+
+.. code-block:: c++
+
+    void DoTimedWork() {
+      TimeStamp start = TimeStamp::Now();
+      DoWork();
+      PROFILER_MARKER_TEXT("Timed work", OTHER, MarkerTiming::IntervalUntilNowFrom(start), "Details");
+    }
+
+`RAII <https://en.cppreference.com/w/cpp/language/raii>`_ objects automate this, by recording the time
+when the object is constructed, and later recording the marker when the object is destroyed at the end
+of its C++ scope.
+This is especially useful if there are multiple scope exit points.
+
+``AUTO_PROFILER_MARKER_TEXT`` is `the only one implemented <https://searchfox.org/mozilla-central/define?q=M_ac7b392646edf5a5>`_ at this time.
+
+.. code-block:: c++
+
+    void MaybeDoTimedWork(bool aDoIt) {
+      AUTO_PROFILER_MARKER_TEXT("Timed work", OTHER, "Details");
+      if (!aDoIt) { /* Marker recorded here... */ return; }
+      DoWork();
+      /* ... or here. */
+    }
+
+Note that these RAII objects only record one marker. In some situation, a very long
+operation could be missed if it hasn't completed by the end of the profiling session.
+In this case, consider recording two distinct markers, using
+``MarkerTiming::IntervalStart()`` and ``MarkerTiming::IntervalEnd()``.
+
+Where to Define New Marker Types
+--------------------------------
+
+The first step is to determine the location of the marker type definition:
+
+* If this type is only used in one function, or a component, it can be defined in a
+  local common place relative to its use.
+* For a more common type that could be used from multiple locations:
+
+  * If there is no dependency on XUL, it can be defined in the Base Profiler, which can
+    be used in most locations in the codebase:
+    `mozglue/baseprofiler/public/BaseProfilerMarkerTypes.h <https://searchfox.org/mozilla-central/source/mozglue/baseprofiler/public/BaseProfilerMarkerTypes.h>`__
+
+  * However, if there is a XUL dependency, then it needs to be defined in the Gecko Profiler:
+    `tools/profiler/public/ProfilerMarkerTypes.h <https://searchfox.org/mozilla-central/source/tools/profiler/public/ProfilerMarkerTypes.h>`__
+
+How to Define New Marker Types
+------------------------------
+
+Each marker type must be defined once and only once.
+The definition is a C++ ``struct``, its identifier is used when recording
+markers of that type in C++.
+By convention, the suffix "Marker" is recommended to better distinguish them
+from non-profiler entities in the source.
+
+.. code-block:: c++
+
+    struct YourMarker {
+
+Marker Type Name
+^^^^^^^^^^^^^^^^
+
+A marker type must have a unique name, it is used to keep track of the type of
+markers in the profiler storage, and to identify them uniquely on profiler.firefox.com.
+(It does not need to be the same as the ``struct``'s name.)
+
+This name is defined in a special static member function ``MarkerTypeName``:
+
+.. code-block:: c++
+
+    // …
+      static constexpr Span<const char> MarkerTypeName() {
+        return MakeStringSpan("YourMarker");
+      }
+
+Marker Type Data
+^^^^^^^^^^^^^^^^
+
+All markers of any type have some common data: A name, a category, options like
+timing, etc. as previously explained.
+
+In addition, a certain marker type may carry zero of more arbitrary pieces of
+information, and they are always the same for all markers of that type.
+
+These are defined in a special static member function ``StreamJSONMarkerData``.
+
+The first function parameters is always ``SpliceableJSONWriter& aWriter``,
+it will be used to stream the data as JSON, to later be read by
+profiler.firefox.com.
+
+.. code-block:: c++
+
+    // …
+      static void StreamJSONMarkerData(SpliceableJSONWriter& aWriter,
+
+The following function parameters is how the data is received as C++ objects
+from the call sites.
+
+* Most C/C++ `POD (Plain Old Data) <https://en.cppreference.com/w/cpp/named_req/PODType>`_
+  and `trivially-copyable <https://en.cppreference.com/w/cpp/named_req/TriviallyCopyable>`_
+  types should work as-is, including ``TimeStamp``.
+* Character strings should be passed using ``const ProfilerString8View&`` (this handles
+  literal strings, and various ``std::string`` and ``nsCString`` types, and spans with or
+  without null terminator). Use ``const ProfilerString16View&`` for 16-bit strings such as
+  ``nsString``.
+* Other types can be used if they define specializations for ``ProfileBufferEntryWriter::Serializer``
+  and ``ProfileBufferEntryReader::Deserializer``. You should rarely need to define new
+  ones, but if needed see how existing specializations are written, or contact the
+  `perf-tools team for help <https://chat.mozilla.org/#/room/#profiler:mozilla.org>`_.
+
+Passing by value or by reference-to-const is recommended, because arguments are serialized
+in binary form (i.e., there are no optimizable ``move`` operations).
+
+For example, here's how to handle a string, a 64-bit number, another string, and
+a timestamp:
+
+.. code-block:: c++
+
+    // …
+                                       const ProfilerString8View& aString,
+                                       const int64_t aBytes,
+                                       const ProfilerString8View& aURL,
+                                       const TimeStamp& aTime) {
+
+Then the body of the function turns these parameters into a JSON stream.
+
+When this function is called, the writer has just started a JSON object, so
+everything that is written should be a named object property. Use
+``SpliceableJSONWriter`` functions, in most cases ``...Property`` functions
+from its parent class ``JSONWriter``: ``NullProperty``, ``BoolProperty``,
+``IntProperty``, ``DoubleProperty``, ``StringProperty``. (Other nested JSON
+types like arrays or objects are not supported by the profiler.)
+
+As a special case, ``TimeStamps`` must be streamed using ``aWriter.TimeProperty(timestamp)``.
+
+The property names will be used to identify where each piece of data is stored and
+how it should be displayed on profiler.firefox.com (see next section).
+
+Here's how the above functions parameters could be streamed:
+
+.. code-block:: c++
+
+    // …
+        aWriter.StringProperty("myString", aString);
+        aWriter.IntProperty("myBytes", aBytes);
+        aWriter.StringProperty("myURL", aURL);
+        aWriter.TimeProperty("myTime", aTime);
+      }
+
+Marker Type Display Schema
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Now that we have defined how to stream type-specific data (from Firefox to
+profiler.firefox.com), we need to describe where and how this data will be
+displayed on profiler.firefox.com.
+
+The static member function ``MarkerTypeDisplay`` returns an opaque ``MarkerSchema``
+object, which will be forwarded to profiler.firefox.com.
+
+.. code-block:: c++
+
+    // …
+      static MarkerSchema MarkerTypeDisplay() {
+
+The ``MarkerSchema`` type will be used repeatedly, so for convenience we can define
+a local type alias:
+
+.. code-block:: c++
+
+    // …
+        using MS = MarkerSchema;
+
+First, we construct the ``MarkerSchema`` object to be returned at the end.
+
+One or more constructor arguments determine where this marker will be displayed in
+the profiler.firefox.com UI. See the `MarkerSchema::Location enumeration for the
+full list <https://searchfox.org/mozilla-central/define?q=T_mozilla%3A%3AMarkerSchema%3A%3ALocation>`_.
+
+Here is the most common set of locations, showing markers of that type in both the
+Marker Chart and the Marker Table panels:
+
+.. code-block:: c++
+
+    // …
+        MS schema(MS::Location::markerChart, MS::Location::markerTable);
+
+Some labels can optionally be specified, to display certain information in different
+locations: ``SetChartLabel``, ``SetTooltipLabel``, and ``SetTableLabel``; or
+``SetAllLabels`` to define all of them the same way.
+
+The arguments is a string that may refer to marker data within braces:
+
+* ``{marker.name}``: Marker name.
+* ``{marker.data.X}``: Type-specific data, as streamed with property name "X" from ``StreamJSONMarkerData`` (e.g., ``aWriter.IntProperty("X", aNumber);``
+
+For example, here's how to set the Marker Chart label to show the marker name and the
+``myBytes`` number of bytes:
+
+.. code-block:: c++
+
+    // …
+        schema.SetChartLabel("{marker.name} – {marker.data.myBytes}");
+
+profiler.firefox.com will apply the label with the data in a consistent manner. For
+example, with this label definition, it could display marker information like the
+following in the Firefox Profiler's Marker Chart:
+
+ * "Marker Name – 10B"
+ * "Marker Name – 25.204KB"
+ * "Marker Name – 512.54MB"
+
+For implementation details on this processing, see `src/profiler-logic/marker-schema.js <https://github.com/firefox-devtools/profiler/blob/main/src/profile-logic/marker-schema.js>`_
+in the profiler's front-end.
+
+Next, define the main display of marker data, which will appear in the Marker
+Chart tooltips and the Marker Table sidebar.
+
+Each row may either be:
+
+* A dynamic key-value pair, using one of the ``MarkerSchema::AddKey...`` functions. Each function is given:
+
+  * Key: Element property name as streamed in ``StreamJSONMarkerData``.
+  * Label: Optional prefix. Defaults to the key name.
+  * Format: How to format the data element value, see `MarkerSchema::Format for details <https://searchfox.org/mozilla-central/define?q=T_mozilla%3A%3AMarkerSchema%3A%3AFormat>`_.
+  * Searchable: Optional boolean, indicates if the value is used in searches, defaults to false.
+
+* Or a fixed label and value strings, using ``MarkerSchema::AddStaticLabelValue``.
+
+.. code-block:: c++
+
+    // …
+        schema.AddKeyLabelFormatSearchable(
+            "myString", "My String", MS::Format::string, true);
+        schema.AddKeyLabelFormat(
+            "myBytes", "My Bytes", MS::Format::bytes);
+        schema.AddKeyLabelFormat(
+            "myUrl", "My URL", MS::Format::url);
+        schema.AddKeyLabelFormat(
+            "myTime", "Event time", MS::Format::time);
+
+Finally the ``schema`` object is returned from the function:
+
+.. code-block:: c++
+
+    // …
+        return schema;
+      }
+
+Any other ``struct`` member function is ignored. There could be utility functions used by the above
+compulsory functions, to make the code clearer.
+
+And that is the end of the marker definition ``struct``.
+
+.. code-block:: c++
+
+    // …
+    };
+
+Performance Considerations
+--------------------------
+
+During profiling, it is best to reduce the amount of work spent doing profiler
+operations, as they can influence the performance of the code that you want to profile.
+
+Whenever possible, consider passing simple types to marker functions, such that
+``StreamJSONMarkerData`` will do the minimum amount of work necessary to serialize
+the marker type-specific arguments to its internal buffer representation. POD types
+(numbers) and strings are the easiest and cheapest to serialize. Look at the
+corresponding ``ProfileBufferEntryWriter::Serializer`` specializations if you
+want to better understand the work done.
+
+Avoid doing expensive operations when recording markers. E.g.: ``printf`` of
+different things into a string, or complex computations; instead pass the
+``printf``/computation arguments straight through to the marker function, so that
+``StreamJSONMarkerData`` can do the expensive work at the end of the profiling session.
+
+Marker Architecture Description
+-------------------------------
+
+The above sections should give all the information needed for adding your own marker
+types. However, if you are wanting to work on the marker architecture itself, this
+section will describe how the system works.
+
+TODO:
+ * Briefly describe the buffer and serialization.
+ * Describe the template strategy for generating marker types
+ * Describe the serialization and link to profiler front-end docs on marker processing (if they exist)
diff --git a/tools/profiler/docs/memory.rst b/tools/profiler/docs/memory.rst
new file mode 100644
index 0000000000..347a91f9e7
--- /dev/null
+++ b/tools/profiler/docs/memory.rst
@@ -0,0 +1,46 @@
+Profiling Memory
+================
+
+Sampling stacks from native allocations
+---------------------------------------
+
+The profiler can sample allocations and de-allocations from malloc using the
+"Native Allocations" feature. This can be enabled by going to `about:profiling` and
+enabling the "Native Allocations" checkbox. It is only available in Nightly, as it
+uses a technique of hooking into malloc that could be a little more risky to apply to
+the broader population of Firefox users.
+
+This implementation is located in: `tools/profiler/core/memory_hooks.cpp
+<https://searchfox.org/mozilla-central/source/tools/profiler/core/memory_hooks.cpp>`_
+
+It works by hooking into all of the malloc calls. When the profiler is running, it
+performs a `Bernoulli trial`_, that will pass for a given probability of per-byte
+allocated. What this means is that larger allocations have a higher chance of being
+recorded compared to smaller allocations. Currently, there is no way to configure
+the per-byte probability. This means that sampled allocation sizes will be closer
+to the actual allocated bytes.
+
+This infrastructure is quite similar to DMD, but with the additional motiviations of
+making it easy to turn on and use with the profiler. The overhead is quite high,
+especially on systems with more expensive stack walking, like Linux. Turning off
+thee "Native Stacks" feature can help lower overhead, but will give less information.
+
+For more information on analyzing these profiles, see the `Firefox Profiler docs`_.
+
+Memory counters
+---------------
+
+Similar to the Native Allocations feature, memory counters use the malloc memory hook
+that is only available in Nightly. When it's available, the memory counters are always
+turned on. This is a lightweight way to count in a very granular fashion how much
+memory is being allocated and deallocated during the profiling session.
+
+This information is then visualized in the `Firefox Profiler memory track`_.
+
+This feature uses the `Profiler Counters`_, which can be used to create other types
+of cheap counting instrumentation.
+
+.. _Bernoulli trial: https://en.wikipedia.org/wiki/Bernoulli_trial
+.. _Firefox Profiler docs: https://profiler.firefox.com/docs/#/./memory-allocations
+.. _Firefox Profiler memory track: https://profiler.firefox.com/docs/#/./memory-allocations?id=memory-track
+.. _Profiler Counters: https://searchfox.org/mozilla-central/source/tools/profiler/public/ProfilerCounts.h
diff --git a/tools/profiler/gecko/ChildProfilerController.cpp b/tools/profiler/gecko/ChildProfilerController.cpp
new file mode 100644
index 0000000000..d3915b3e0b
--- /dev/null
+++ b/tools/profiler/gecko/ChildProfilerController.cpp
@@ -0,0 +1,100 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ChildProfilerController.h"
+
+#include "ProfilerChild.h"
+
+#include "mozilla/ipc/Endpoint.h"
+#include "nsThreadUtils.h"
+
+using namespace mozilla::ipc;
+
+namespace mozilla {
+
+/* static */
+already_AddRefed<ChildProfilerController> ChildProfilerController::Create(
+    mozilla::ipc::Endpoint<PProfilerChild>&& aEndpoint) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  RefPtr<ChildProfilerController> cpc = new ChildProfilerController();
+  cpc->Init(std::move(aEndpoint));
+  return cpc.forget();
+}
+
+ChildProfilerController::ChildProfilerController() {
+  MOZ_COUNT_CTOR(ChildProfilerController);
+}
+
+void ChildProfilerController::Init(Endpoint<PProfilerChild>&& aEndpoint) {
+  if (NS_SUCCEEDED(
+          NS_NewNamedThread("ProfilerChild", getter_AddRefs(mThread)))) {
+    // Now that mThread has been set, run SetupProfilerChild on the thread.
+    mThread->Dispatch(
+        NewRunnableMethod<Endpoint<PProfilerChild>&&>(
+            "ChildProfilerController::SetupProfilerChild", this,
+            &ChildProfilerController::SetupProfilerChild, std::move(aEndpoint)),
+        NS_DISPATCH_NORMAL);
+  }
+}
+
+nsCString ChildProfilerController::GrabShutdownProfileAndShutdown() {
+  nsCString shutdownProfile;
+  ShutdownAndMaybeGrabShutdownProfileFirst(&shutdownProfile);
+  return shutdownProfile;
+}
+
+void ChildProfilerController::Shutdown() {
+  ShutdownAndMaybeGrabShutdownProfileFirst(nullptr);
+}
+
+void ChildProfilerController::ShutdownAndMaybeGrabShutdownProfileFirst(
+    nsCString* aOutShutdownProfile) {
+  if (mThread) {
+    mThread->Dispatch(NewRunnableMethod<nsCString*>(
+                          "ChildProfilerController::ShutdownProfilerChild",
+                          this, &ChildProfilerController::ShutdownProfilerChild,
+                          aOutShutdownProfile),
+                      NS_DISPATCH_NORMAL);
+    // Shut down the thread. This call will spin until all runnables (including
+    // the ShutdownProfilerChild runnable) have been processed.
+    mThread->Shutdown();
+    mThread = nullptr;
+  }
+}
+
+ChildProfilerController::~ChildProfilerController() {
+  MOZ_COUNT_DTOR(ChildProfilerController);
+
+  MOZ_ASSERT(!mThread,
+             "Please call Shutdown before destroying ChildProfilerController");
+  MOZ_ASSERT(!mProfilerChild);
+}
+
+void ChildProfilerController::SetupProfilerChild(
+    Endpoint<PProfilerChild>&& aEndpoint) {
+  MOZ_RELEASE_ASSERT(mThread == NS_GetCurrentThread());
+  MOZ_ASSERT(aEndpoint.IsValid());
+
+  mProfilerChild = new ProfilerChild();
+  Endpoint<PProfilerChild> endpoint = std::move(aEndpoint);
+
+  if (!endpoint.Bind(mProfilerChild)) {
+    MOZ_CRASH("Failed to bind ProfilerChild!");
+  }
+}
+
+void ChildProfilerController::ShutdownProfilerChild(
+    nsCString* aOutShutdownProfile) {
+  MOZ_RELEASE_ASSERT(mThread == NS_GetCurrentThread());
+
+  if (aOutShutdownProfile) {
+    *aOutShutdownProfile = mProfilerChild->GrabShutdownProfile();
+  }
+  mProfilerChild->Destroy();
+  mProfilerChild = nullptr;
+}
+
+}  // namespace mozilla
diff --git a/tools/profiler/gecko/PProfiler.ipdl b/tools/profiler/gecko/PProfiler.ipdl
new file mode 100644
index 0000000000..85d47bc921
--- /dev/null
+++ b/tools/profiler/gecko/PProfiler.ipdl
@@ -0,0 +1,37 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include ProfilerTypes;
+
+namespace mozilla {
+
+// PProfiler is a top-level protocol. It is used to let the main process
+// control the Gecko Profiler in other processes, and request profiles from
+// those processes.
+// It is a top-level protocol so that its child endpoint can be on a
+// background thread, so that profiles can be gathered even if the main thread
+// is unresponsive.
+async protocol PProfiler
+{
+child:
+  async Start(ProfilerInitParams params);
+  async EnsureStarted(ProfilerInitParams params);
+  async Stop();
+  async Pause();
+  async Resume();
+  async PauseSampling();
+  async ResumeSampling();
+
+  async AwaitNextChunkManagerUpdate() returns (ProfileBufferChunkManagerUpdate update);
+  async DestroyReleasedChunksAtOrBefore(TimeStamp timeStamp);
+
+  async GatherProfile() returns (Shmem profile);
+
+  async ClearAllPages();
+};
+
+} // namespace mozilla
+
diff --git a/tools/profiler/gecko/ProfilerChild.cpp b/tools/profiler/gecko/ProfilerChild.cpp
new file mode 100644
index 0000000000..748f88ccfa
--- /dev/null
+++ b/tools/profiler/gecko/ProfilerChild.cpp
@@ -0,0 +1,295 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProfilerChild.h"
+
+#include "GeckoProfiler.h"
+#include "platform.h"
+#include "ProfilerParent.h"
+
+#include "nsThreadUtils.h"
+
+namespace mozilla {
+
+/* static */ DataMutexBase<ProfilerChild::ProfilerChildAndUpdate,
+                           baseprofiler::detail::BaseProfilerMutex>
+    ProfilerChild::sPendingChunkManagerUpdate{
+        "ProfilerChild::sPendingChunkManagerUpdate"};
+
+ProfilerChild::ProfilerChild()
+    : mThread(NS_GetCurrentThread()), mDestroyed(false) {
+  MOZ_COUNT_CTOR(ProfilerChild);
+}
+
+ProfilerChild::~ProfilerChild() { MOZ_COUNT_DTOR(ProfilerChild); }
+
+void ProfilerChild::ResolveChunkUpdate(
+    PProfilerChild::AwaitNextChunkManagerUpdateResolver& aResolve) {
+  MOZ_ASSERT(!!aResolve,
+             "ResolveChunkUpdate should only be called when there's a pending "
+             "resolver");
+  MOZ_ASSERT(
+      !mChunkManagerUpdate.IsNotUpdate(),
+      "ResolveChunkUpdate should only be called with a real or final update");
+  MOZ_ASSERT(
+      !mDestroyed,
+      "ResolveChunkUpdate should not be called if the actor was destroyed");
+  if (mChunkManagerUpdate.IsFinal()) {
+    // Final update, send a special "unreleased value", but don't clear the
+    // local copy so we know we got the final update.
+    std::move(aResolve)(ProfilerParent::MakeFinalUpdate());
+  } else {
+    // Optimization note: The ProfileBufferChunkManagerUpdate constructor takes
+    // the newly-released chunks nsTArray by reference-to-const, therefore
+    // constructing and then moving the array here would make a copy. So instead
+    // we first give it an empty array, and then we can write the data directly
+    // into the update's array.
+    ProfileBufferChunkManagerUpdate update{
+        mChunkManagerUpdate.UnreleasedBytes(),
+        mChunkManagerUpdate.ReleasedBytes(),
+        mChunkManagerUpdate.OldestDoneTimeStamp(),
+        {}};
+    update.newlyReleasedChunks().SetCapacity(
+        mChunkManagerUpdate.NewlyReleasedChunksRef().size());
+    for (const ProfileBufferControlledChunkManager::ChunkMetadata& chunk :
+         mChunkManagerUpdate.NewlyReleasedChunksRef()) {
+      update.newlyReleasedChunks().EmplaceBack(chunk.mDoneTimeStamp,
+                                               chunk.mBufferBytes);
+    }
+
+    std::move(aResolve)(update);
+
+    // Clear the update we just sent, so it's ready for later updates to be
+    // folded into it.
+    mChunkManagerUpdate.Clear();
+  }
+
+  // Discard the resolver, so it's empty next time there's a new request.
+  aResolve = nullptr;
+}
+
+void ProfilerChild::ProcessChunkManagerUpdate(
+    ProfileBufferControlledChunkManager::Update&& aUpdate) {
+  if (mDestroyed) {
+    return;
+  }
+  // Always store the data, it could be the final update.
+  mChunkManagerUpdate.Fold(std::move(aUpdate));
+  if (mAwaitNextChunkManagerUpdateResolver) {
+    // There is already a pending resolver, give it the info now.
+    ResolveChunkUpdate(mAwaitNextChunkManagerUpdateResolver);
+  }
+}
+
+/* static */ void ProfilerChild::ProcessPendingUpdate() {
+  auto lockedUpdate = sPendingChunkManagerUpdate.Lock();
+  if (!lockedUpdate->mProfilerChild || lockedUpdate->mUpdate.IsNotUpdate()) {
+    return;
+  }
+  lockedUpdate->mProfilerChild->mThread->Dispatch(NS_NewRunnableFunction(
+      "ProfilerChild::ProcessPendingUpdate", []() mutable {
+        auto lockedUpdate = sPendingChunkManagerUpdate.Lock();
+        if (!lockedUpdate->mProfilerChild ||
+            lockedUpdate->mUpdate.IsNotUpdate()) {
+          return;
+        }
+        lockedUpdate->mProfilerChild->ProcessChunkManagerUpdate(
+            std::move(lockedUpdate->mUpdate));
+        lockedUpdate->mUpdate.Clear();
+      }));
+}
+
+/* static */ bool ProfilerChild::IsLockedOnCurrentThread() {
+  return sPendingChunkManagerUpdate.Mutex().IsLockedOnCurrentThread();
+}
+
+void ProfilerChild::SetupChunkManager() {
+  mChunkManager = profiler_get_controlled_chunk_manager();
+  if (NS_WARN_IF(!mChunkManager)) {
+    return;
+  }
+
+  // Make sure there are no updates (from a previous run).
+  mChunkManagerUpdate.Clear();
+  {
+    auto lockedUpdate = sPendingChunkManagerUpdate.Lock();
+    lockedUpdate->mProfilerChild = this;
+    lockedUpdate->mUpdate.Clear();
+  }
+
+  mChunkManager->SetUpdateCallback(
+      [](ProfileBufferControlledChunkManager::Update&& aUpdate) {
+        // Updates from the chunk manager are stored for later processing.
+        // We avoid dispatching a task, as this could deadlock (if the queueing
+        // mutex is held elsewhere).
+        auto lockedUpdate = sPendingChunkManagerUpdate.Lock();
+        if (!lockedUpdate->mProfilerChild) {
+          return;
+        }
+        lockedUpdate->mUpdate.Fold(std::move(aUpdate));
+      });
+}
+
+void ProfilerChild::ResetChunkManager() {
+  if (!mChunkManager) {
+    return;
+  }
+
+  // We have a chunk manager, reset the callback, which will add a final
+  // pending update.
+  mChunkManager->SetUpdateCallback({});
+
+  // Clear the pending update.
+  auto lockedUpdate = sPendingChunkManagerUpdate.Lock();
+  lockedUpdate->mProfilerChild = nullptr;
+  lockedUpdate->mUpdate.Clear();
+  // And process a final update right now.
+  ProcessChunkManagerUpdate(
+      ProfileBufferControlledChunkManager::Update(nullptr));
+
+  mChunkManager = nullptr;
+  mAwaitNextChunkManagerUpdateResolver = nullptr;
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvStart(
+    const ProfilerInitParams& params) {
+  nsTArray<const char*> filterArray;
+  for (size_t i = 0; i < params.filters().Length(); ++i) {
+    filterArray.AppendElement(params.filters()[i].get());
+  }
+
+  profiler_start(PowerOfTwo32(params.entries()), params.interval(),
+                 params.features(), filterArray.Elements(),
+                 filterArray.Length(), params.activeBrowsingContextID(),
+                 params.duration());
+
+  SetupChunkManager();
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvEnsureStarted(
+    const ProfilerInitParams& params) {
+  nsTArray<const char*> filterArray;
+  for (size_t i = 0; i < params.filters().Length(); ++i) {
+    filterArray.AppendElement(params.filters()[i].get());
+  }
+
+  profiler_ensure_started(PowerOfTwo32(params.entries()), params.interval(),
+                          params.features(), filterArray.Elements(),
+                          filterArray.Length(),
+                          params.activeBrowsingContextID(), params.duration());
+
+  SetupChunkManager();
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvStop() {
+  ResetChunkManager();
+  profiler_stop();
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvPause() {
+  profiler_pause();
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvResume() {
+  profiler_resume();
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvPauseSampling() {
+  profiler_pause_sampling();
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvResumeSampling() {
+  profiler_resume_sampling();
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvClearAllPages() {
+  profiler_clear_all_pages();
+  return IPC_OK();
+}
+
+static nsCString CollectProfileOrEmptyString(bool aIsShuttingDown) {
+  nsCString profileCString;
+  UniquePtr<char[]> profile =
+      profiler_get_profile(/* aSinceTime */ 0, aIsShuttingDown);
+  if (profile) {
+    size_t len = strlen(profile.get());
+    profileCString.Adopt(profile.release(), len);
+  }
+  return profileCString;
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvAwaitNextChunkManagerUpdate(
+    AwaitNextChunkManagerUpdateResolver&& aResolve) {
+  MOZ_ASSERT(!mDestroyed,
+             "Recv... should not be called if the actor was destroyed");
+  // Pick up pending updates if any.
+  {
+    auto lockedUpdate = sPendingChunkManagerUpdate.Lock();
+    if (lockedUpdate->mProfilerChild && !lockedUpdate->mUpdate.IsNotUpdate()) {
+      mChunkManagerUpdate.Fold(std::move(lockedUpdate->mUpdate));
+      lockedUpdate->mUpdate.Clear();
+    }
+  }
+  if (mChunkManagerUpdate.IsNotUpdate()) {
+    // No data yet, store the resolver for later.
+    mAwaitNextChunkManagerUpdateResolver = std::move(aResolve);
+  } else {
+    // We have data, send it now.
+    ResolveChunkUpdate(aResolve);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvDestroyReleasedChunksAtOrBefore(
+    const TimeStamp& aTimeStamp) {
+  if (mChunkManager) {
+    mChunkManager->DestroyChunksAtOrBefore(aTimeStamp);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ProfilerChild::RecvGatherProfile(
+    GatherProfileResolver&& aResolve) {
+  mozilla::ipc::Shmem shmem;
+  profiler_get_profile_json_into_lazily_allocated_buffer(
+      [&](size_t allocationSize) -> char* {
+        if (AllocShmem(allocationSize,
+                       mozilla::ipc::Shmem::SharedMemory::TYPE_BASIC, &shmem)) {
+          return shmem.get<char>();
+        }
+        return nullptr;
+      },
+      /* aSinceTime */ 0,
+      /* aIsShuttingDown */ false);
+  aResolve(std::move(shmem));
+  return IPC_OK();
+}
+
+void ProfilerChild::ActorDestroy(ActorDestroyReason aActorDestroyReason) {
+  mDestroyed = true;
+}
+
+void ProfilerChild::Destroy() {
+  ResetChunkManager();
+  if (!mDestroyed) {
+    Close();
+  }
+}
+
+nsCString ProfilerChild::GrabShutdownProfile() {
+  return CollectProfileOrEmptyString(/* aIsShuttingDown */ true);
+}
+
+}  // namespace mozilla
diff --git a/tools/profiler/gecko/ProfilerIOInterposeObserver.cpp b/tools/profiler/gecko/ProfilerIOInterposeObserver.cpp
new file mode 100644
index 0000000000..e1007c39fa
--- /dev/null
+++ b/tools/profiler/gecko/ProfilerIOInterposeObserver.cpp
@@ -0,0 +1,200 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProfilerIOInterposeObserver.h"
+#include "GeckoProfiler.h"
+
+using namespace mozilla;
+
+namespace geckoprofiler::markers {
+struct FileIOMarker {
+  static constexpr Span<const char> MarkerTypeName() {
+    return MakeStringSpan("FileIO");
+  }
+  static void StreamJSONMarkerData(baseprofiler::SpliceableJSONWriter& aWriter,
+                                   const ProfilerString8View& aOperation,
+                                   const ProfilerString8View& aSource,
+                                   const ProfilerString8View& aFilename,
+                                   MarkerThreadId aOperationThreadId) {
+    aWriter.StringProperty("operation", aOperation);
+    aWriter.StringProperty("source", aSource);
+    if (aFilename.Length() != 0) {
+      aWriter.StringProperty("filename", aFilename);
+    }
+    if (!aOperationThreadId.IsUnspecified()) {
+      aWriter.IntProperty("threadId", aOperationThreadId.ThreadId());
+    }
+  }
+  static MarkerSchema MarkerTypeDisplay() {
+    using MS = MarkerSchema;
+    MS schema{MS::Location::markerChart, MS::Location::markerTable,
+              MS::Location::timelineFileIO};
+    schema.AddKeyLabelFormatSearchable("operation", "Operation",
+                                       MS::Format::string,
+                                       MS::Searchable::searchable);
+    schema.AddKeyLabelFormatSearchable("source", "Source", MS::Format::string,
+                                       MS::Searchable::searchable);
+    schema.AddKeyLabelFormatSearchable("filename", "Filename",
+                                       MS::Format::filePath,
+                                       MS::Searchable::searchable);
+    return schema;
+  }
+};
+}  // namespace geckoprofiler::markers
+
+static auto GetFilename(IOInterposeObserver::Observation& aObservation) {
+  AUTO_PROFILER_STATS(IO_filename);
+  constexpr size_t scExpectedMaxFilename = 512;
+  nsAutoStringN<scExpectedMaxFilename> filename16;
+  aObservation.Filename(filename16);
+  nsAutoCStringN<scExpectedMaxFilename> filename8;
+  if (!filename16.IsEmpty()) {
+    CopyUTF16toUTF8(filename16, filename8);
+  }
+  return filename8;
+}
+
+void ProfilerIOInterposeObserver::Observe(Observation& aObservation) {
+  if (profiler_is_locked_on_current_thread()) {
+    // Don't observe I/Os originating from the profiler itself (when internally
+    // locked) to avoid deadlocks when calling profiler functions.
+    AUTO_PROFILER_STATS(IO_profiler_locked);
+    return;
+  }
+
+  Maybe<uint32_t> maybeFeatures = profiler_features_if_active_and_unpaused();
+  if (maybeFeatures.isNothing()) {
+    return;
+  }
+  uint32_t features = *maybeFeatures;
+
+  if (!profiler_can_accept_markers()) {
+    return;
+  }
+
+  const bool doCaptureStack = !(features & ProfilerFeature::NoIOStacks);
+  if (IsMainThread()) {
+    // This is the main thread.
+    // Capture a marker if any "IO" feature is on.
+    // If it's not being profiled, we have nowhere to store FileIO markers.
+    if (!profiler_thread_is_being_profiled() ||
+        !(features & ProfilerFeature::MainThreadIO)) {
+      return;
+    }
+    AUTO_PROFILER_STATS(IO_MT);
+    nsAutoCString type{aObservation.FileType()};
+    type.AppendLiteral("IO");
+
+    // Store the marker in the current thread.
+    PROFILER_MARKER(
+        type, OTHER,
+        MarkerOptions(
+            MarkerTiming::Interval(aObservation.Start(), aObservation.End()),
+            MarkerStack::MaybeCapture(doCaptureStack)),
+        FileIOMarker,
+        // aOperation
+        ProfilerString8View::WrapNullTerminatedString(
+            aObservation.ObservedOperationString()),
+        // aSource
+        ProfilerString8View::WrapNullTerminatedString(aObservation.Reference()),
+        // aFilename
+        GetFilename(aObservation),
+        // aOperationThreadId - Do not include a thread ID, as it's the same as
+        // the markers. Only include this field when the marker is being sent
+        // from another thread.
+        MarkerThreadId{});
+
+  } else if (profiler_thread_is_being_profiled()) {
+    // This is a non-main thread that is being profiled.
+    if (!(features & ProfilerFeature::FileIO)) {
+      return;
+    }
+    AUTO_PROFILER_STATS(IO_off_MT);
+
+    nsAutoCString type{aObservation.FileType()};
+    type.AppendLiteral("IO");
+
+    // Share a backtrace between the marker on this thread, and the marker on
+    // the main thread.
+    UniquePtr<ProfileChunkedBuffer> backtrace =
+        doCaptureStack ? profiler_capture_backtrace() : nullptr;
+
+    // Store the marker in the current thread.
+    PROFILER_MARKER(
+        type, OTHER,
+        MarkerOptions(
+            MarkerTiming::Interval(aObservation.Start(), aObservation.End()),
+            backtrace ? MarkerStack::UseBacktrace(*backtrace)
+                      : MarkerStack::NoStack()),
+        FileIOMarker,
+        // aOperation
+        ProfilerString8View::WrapNullTerminatedString(
+            aObservation.ObservedOperationString()),
+        // aSource
+        ProfilerString8View::WrapNullTerminatedString(aObservation.Reference()),
+        // aFilename
+        GetFilename(aObservation),
+        // aOperationThreadId - Do not include a thread ID, as it's the same as
+        // the markers. Only include this field when the marker is being sent
+        // from another thread.
+        MarkerThreadId{});
+
+    // Store the marker in the main thread as well, with a distinct marker name
+    // and thread id.
+    type.AppendLiteral(" (non-main thread)");
+    PROFILER_MARKER(
+        type, OTHER,
+        MarkerOptions(
+            MarkerTiming::Interval(aObservation.Start(), aObservation.End()),
+            backtrace ? MarkerStack::UseBacktrace(*backtrace)
+                      : MarkerStack::NoStack(),
+            // This is the important piece that changed.
+            // It will send a marker to the main thread.
+            MarkerThreadId::MainThread()),
+        FileIOMarker,
+        // aOperation
+        ProfilerString8View::WrapNullTerminatedString(
+            aObservation.ObservedOperationString()),
+        // aSource
+        ProfilerString8View::WrapNullTerminatedString(aObservation.Reference()),
+        // aFilename
+        GetFilename(aObservation),
+        // aOperationThreadId - Include the thread ID in the payload.
+        MarkerThreadId::CurrentThread());
+
+  } else {
+    // This is a thread that is not being profiled. We still want to capture
+    // file I/Os (to the main thread) if the "FileIOAll" feature is on.
+    if (!(features & ProfilerFeature::FileIOAll)) {
+      return;
+    }
+    AUTO_PROFILER_STATS(IO_other);
+    nsAutoCString type{aObservation.FileType()};
+    if (profiler_is_active_and_thread_is_registered()) {
+      type.AppendLiteral("IO (non-profiled thread)");
+    } else {
+      type.AppendLiteral("IO (unregistered thread)");
+    }
+
+    // Only store this marker on the main thread, as this thread was not being
+    // profiled.
+    PROFILER_MARKER(
+        type, OTHER,
+        MarkerOptions(
+            MarkerTiming::Interval(aObservation.Start(), aObservation.End()),
+            doCaptureStack ? MarkerStack::Capture() : MarkerStack::NoStack(),
+            // Store this marker on the main thread.
+            MarkerThreadId::MainThread()),
+        FileIOMarker,
+        // aOperation
+        ProfilerString8View::WrapNullTerminatedString(
+            aObservation.ObservedOperationString()),
+        // aSource
+        ProfilerString8View::WrapNullTerminatedString(aObservation.Reference()),
+        // aFilename
+        GetFilename(aObservation),
+        // aOperationThreadId - Note which thread this marker is coming from.
+        MarkerThreadId::CurrentThread());
+  }
+}
diff --git a/tools/profiler/gecko/ProfilerIOInterposeObserver.h b/tools/profiler/gecko/ProfilerIOInterposeObserver.h
new file mode 100644
index 0000000000..13a3c84562
--- /dev/null
+++ b/tools/profiler/gecko/ProfilerIOInterposeObserver.h
@@ -0,0 +1,29 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef PROFILERIOINTERPOSEOBSERVER_H
+#define PROFILERIOINTERPOSEOBSERVER_H
+
+#include "mozilla/IOInterposer.h"
+#include "nsISupportsImpl.h"
+
+namespace mozilla {
+
+/**
+ * This class is the observer that calls into the profiler whenever
+ * main thread I/O occurs.
+ */
+class ProfilerIOInterposeObserver final : public IOInterposeObserver {
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(ProfilerIOInterposeObserver)
+
+ public:
+  virtual void Observe(Observation& aObservation) override;
+
+ protected:
+  virtual ~ProfilerIOInterposeObserver() {}
+};
+
+}  // namespace mozilla
+
+#endif  // PROFILERIOINTERPOSEOBSERVER_H
diff --git a/tools/profiler/gecko/ProfilerParent.cpp b/tools/profiler/gecko/ProfilerParent.cpp
new file mode 100644
index 0000000000..e5cc324a91
--- /dev/null
+++ b/tools/profiler/gecko/ProfilerParent.cpp
@@ -0,0 +1,795 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProfilerParent.h"
+
+#include "nsProfiler.h"
+
+#include "mozilla/BaseProfilerDetail.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "mozilla/DataMutex.h"
+#include "mozilla/IOInterposer.h"
+#include "mozilla/ipc/Endpoint.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/ProfileBufferControlledChunkManager.h"
+#include "mozilla/RefPtr.h"
+#include "mozilla/Unused.h"
+#include "nsTArray.h"
+#include "nsThreadUtils.h"
+
+#include <utility>
+
+namespace mozilla {
+
+using namespace ipc;
+
+class ProfilerParentTracker;
+
+// This class is responsible for gathering updates from chunk managers in
+// different process, and request for the oldest chunks to be destroyed whenever
+// the given memory limit is reached.
+class ProfileBufferGlobalController final {
+ public:
+  explicit ProfileBufferGlobalController(size_t aMaximumBytes);
+
+  ~ProfileBufferGlobalController();
+
+  void HandleChildChunkManagerUpdate(
+      base::ProcessId aProcessId,
+      ProfileBufferControlledChunkManager::Update&& aUpdate);
+
+  static bool IsLockedOnCurrentThread();
+
+ private:
+  void HandleChunkManagerNonFinalUpdate(
+      base::ProcessId aProcessId,
+      ProfileBufferControlledChunkManager::Update&& aUpdate,
+      ProfileBufferControlledChunkManager& aParentChunkManager);
+
+  const size_t mMaximumBytes;
+
+  const base::ProcessId mParentProcessId = base::GetCurrentProcId();
+
+  struct ParentChunkManagerAndPendingUpdate {
+    ProfileBufferControlledChunkManager* mChunkManager = nullptr;
+    ProfileBufferControlledChunkManager::Update mPendingUpdate;
+  };
+
+  static DataMutexBase<ParentChunkManagerAndPendingUpdate,
+                       baseprofiler::detail::BaseProfilerMutex>
+      sParentChunkManagerAndPendingUpdate;
+
+  size_t mUnreleasedTotalBytes = 0;
+
+  struct PidAndBytes {
+    base::ProcessId mProcessId;
+    size_t mBytes;
+
+    // For searching and sorting.
+    bool operator==(base::ProcessId aSearchedProcessId) const {
+      return mProcessId == aSearchedProcessId;
+    }
+    bool operator==(const PidAndBytes& aOther) const {
+      return mProcessId == aOther.mProcessId;
+    }
+    bool operator<(base::ProcessId aSearchedProcessId) const {
+      return mProcessId < aSearchedProcessId;
+    }
+    bool operator<(const PidAndBytes& aOther) const {
+      return mProcessId < aOther.mProcessId;
+    }
+  };
+  using PidAndBytesArray = nsTArray<PidAndBytes>;
+  PidAndBytesArray mUnreleasedBytesByPid;
+
+  size_t mReleasedTotalBytes = 0;
+
+  struct TimeStampAndBytesAndPid {
+    TimeStamp mTimeStamp;
+    size_t mBytes;
+    base::ProcessId mProcessId;
+
+    // For searching and sorting.
+    bool operator==(const TimeStampAndBytesAndPid& aOther) const {
+      // Sort first by timestamps, and then by pid in rare cases with the same
+      // timestamps.
+      return mTimeStamp == aOther.mTimeStamp && mProcessId == aOther.mProcessId;
+    }
+    bool operator<(const TimeStampAndBytesAndPid& aOther) const {
+      // Sort first by timestamps, and then by pid in rare cases with the same
+      // timestamps.
+      return mTimeStamp < aOther.mTimeStamp ||
+             (MOZ_UNLIKELY(mTimeStamp == aOther.mTimeStamp) &&
+              mProcessId < aOther.mProcessId);
+    }
+  };
+  using TimeStampAndBytesAndPidArray = nsTArray<TimeStampAndBytesAndPid>;
+  TimeStampAndBytesAndPidArray mReleasedChunksByTime;
+};
+
+/* static */
+DataMutexBase<ProfileBufferGlobalController::ParentChunkManagerAndPendingUpdate,
+              baseprofiler::detail::BaseProfilerMutex>
+    ProfileBufferGlobalController::sParentChunkManagerAndPendingUpdate{
+        "ProfileBufferGlobalController::sParentChunkManagerAndPendingUpdate"};
+
+// This singleton class tracks live ProfilerParent's (meaning there's a current
+// connection with a child process).
+// It also knows when the local profiler is running.
+// And when both the profiler is running and at least one child is present, it
+// creates a ProfileBufferGlobalController and forwards chunk updates to it.
+class ProfilerParentTracker final {
+ public:
+  static void StartTracking(ProfilerParent* aParent);
+  static void StopTracking(ProfilerParent* aParent);
+
+  static void ProfilerStarted(uint32_t aEntries);
+  static void ProfilerWillStopIfStarted();
+
+  template <typename FuncType>
+  static void Enumerate(FuncType&& aIterFunc);
+
+  template <typename FuncType>
+  static void ForChild(base::ProcessId aChildPid, FuncType&& aIterFunc);
+
+  static void ForwardChildChunkManagerUpdate(
+      base::ProcessId aProcessId,
+      ProfileBufferControlledChunkManager::Update&& aUpdate);
+
+  ProfilerParentTracker();
+  ~ProfilerParentTracker();
+
+ private:
+  static void EnsureInstance();
+
+  // List of parents for currently-connected child processes.
+  nsTArray<ProfilerParent*> mProfilerParents;
+
+  // If non-0, the parent profiler is running, with this limit (in number of
+  // entries.) This is needed here, because the parent profiler may start
+  // running before child processes are known (e.g., startup profiling).
+  uint32_t mEntries = 0;
+
+  // When the profiler is running and there is at least one parent-child
+  // connection, this is the controller that should receive chunk updates.
+  Maybe<ProfileBufferGlobalController> mMaybeController;
+
+  // Singleton instance, created when first needed, destroyed at Firefox
+  // shutdown.
+  static UniquePtr<ProfilerParentTracker> sInstance;
+};
+
+ProfileBufferGlobalController::ProfileBufferGlobalController(
+    size_t aMaximumBytes)
+    : mMaximumBytes(aMaximumBytes) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+
+  // This is the local chunk manager for this parent process, so updates can be
+  // handled here.
+  ProfileBufferControlledChunkManager* parentChunkManager =
+      profiler_get_controlled_chunk_manager();
+
+  if (NS_WARN_IF(!parentChunkManager)) {
+    return;
+  }
+
+  {
+    auto lockedParentChunkManagerAndPendingUpdate =
+        sParentChunkManagerAndPendingUpdate.Lock();
+    lockedParentChunkManagerAndPendingUpdate->mChunkManager =
+        parentChunkManager;
+  }
+
+  parentChunkManager->SetUpdateCallback(
+      [this](ProfileBufferControlledChunkManager::Update&& aUpdate) {
+        MOZ_ASSERT(!aUpdate.IsNotUpdate(),
+                   "Update callback should never be given a non-update");
+        auto lockedParentChunkManagerAndPendingUpdate =
+            sParentChunkManagerAndPendingUpdate.Lock();
+        if (aUpdate.IsFinal()) {
+          // Final update of the parent.
+          // We cannot keep the chunk manager, and there's no point handling
+          // updates anymore. Do some cleanup now, to free resources before
+          // we're destroyed.
+          lockedParentChunkManagerAndPendingUpdate->mChunkManager = nullptr;
+          lockedParentChunkManagerAndPendingUpdate->mPendingUpdate.Clear();
+          mUnreleasedTotalBytes = 0;
+          mUnreleasedBytesByPid.Clear();
+          mReleasedTotalBytes = 0;
+          mReleasedChunksByTime.Clear();
+          return;
+        }
+        if (!lockedParentChunkManagerAndPendingUpdate->mChunkManager) {
+          // No chunk manager, ignore updates.
+          return;
+        }
+        // Special handling of parent non-final updates:
+        // These updates are coming from *this* process, and may originate from
+        // scopes in any thread where any lock is held, so using other locks (to
+        // e.g., dispatch tasks or send IPCs) could trigger a deadlock. Instead,
+        // parent updates are stored locally and handled when the next
+        // non-parent update needs handling, see HandleChildChunkManagerUpdate.
+        lockedParentChunkManagerAndPendingUpdate->mPendingUpdate.Fold(
+            std::move(aUpdate));
+      });
+}
+
+ProfileBufferGlobalController ::~ProfileBufferGlobalController() {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  // Extract the parent chunk manager (if still set).
+  // This means any update after this will be ignored.
+  ProfileBufferControlledChunkManager* parentChunkManager = []() {
+    auto lockedParentChunkManagerAndPendingUpdate =
+        sParentChunkManagerAndPendingUpdate.Lock();
+    lockedParentChunkManagerAndPendingUpdate->mPendingUpdate.Clear();
+    return std::exchange(
+        lockedParentChunkManagerAndPendingUpdate->mChunkManager, nullptr);
+  }();
+  if (parentChunkManager) {
+    // We had not received a final update yet, so the chunk manager is still
+    // valid. Reset the callback in the chunk manager, this will immediately
+    // invoke the callback with the final empty update; see handling above.
+    parentChunkManager->SetUpdateCallback({});
+  }
+}
+
+void ProfileBufferGlobalController::HandleChildChunkManagerUpdate(
+    base::ProcessId aProcessId,
+    ProfileBufferControlledChunkManager::Update&& aUpdate) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+
+  MOZ_ASSERT(aProcessId != mParentProcessId);
+
+  MOZ_ASSERT(!aUpdate.IsNotUpdate(),
+             "HandleChildChunkManagerUpdate should not be given a non-update");
+
+  auto lockedParentChunkManagerAndPendingUpdate =
+      sParentChunkManagerAndPendingUpdate.Lock();
+  if (!lockedParentChunkManagerAndPendingUpdate->mChunkManager) {
+    // No chunk manager, ignore updates.
+    return;
+  }
+
+  if (aUpdate.IsFinal()) {
+    // Final update in a child process, remove all traces of that process.
+    size_t index = mUnreleasedBytesByPid.BinaryIndexOf(aProcessId);
+    if (index != PidAndBytesArray::NoIndex) {
+      // We already have a value for this pid.
+      PidAndBytes& pidAndBytes = mUnreleasedBytesByPid[index];
+      mUnreleasedTotalBytes -= pidAndBytes.mBytes;
+      mUnreleasedBytesByPid.RemoveElementAt(index);
+    }
+
+    size_t released = 0;
+    mReleasedChunksByTime.RemoveElementsBy(
+        [&released, aProcessId](const auto& chunk) {
+          const bool match = chunk.mProcessId == aProcessId;
+          if (match) {
+            released += chunk.mBytes;
+          }
+          return match;
+        });
+    if (released != 0) {
+      mReleasedTotalBytes -= released;
+    }
+
+    // Total can only have gone down, so there's no need to check the limit.
+    return;
+  }
+
+  // Non-final update in child process.
+
+  // Before handling the child update, we may have pending updates from the
+  // parent, which can be processed now since we're in an IPC callback outside
+  // of any profiler-related scope.
+  if (!lockedParentChunkManagerAndPendingUpdate->mPendingUpdate.IsNotUpdate()) {
+    MOZ_ASSERT(
+        !lockedParentChunkManagerAndPendingUpdate->mPendingUpdate.IsFinal());
+    HandleChunkManagerNonFinalUpdate(
+        mParentProcessId,
+        std::move(lockedParentChunkManagerAndPendingUpdate->mPendingUpdate),
+        *lockedParentChunkManagerAndPendingUpdate->mChunkManager);
+    lockedParentChunkManagerAndPendingUpdate->mPendingUpdate.Clear();
+  }
+
+  HandleChunkManagerNonFinalUpdate(
+      aProcessId, std::move(aUpdate),
+      *lockedParentChunkManagerAndPendingUpdate->mChunkManager);
+}
+
+/* static */
+bool ProfileBufferGlobalController::IsLockedOnCurrentThread() {
+  return sParentChunkManagerAndPendingUpdate.Mutex().IsLockedOnCurrentThread();
+}
+
+void ProfileBufferGlobalController::HandleChunkManagerNonFinalUpdate(
+    base::ProcessId aProcessId,
+    ProfileBufferControlledChunkManager::Update&& aUpdate,
+    ProfileBufferControlledChunkManager& aParentChunkManager) {
+  MOZ_ASSERT(!aUpdate.IsFinal());
+
+  size_t index = mUnreleasedBytesByPid.BinaryIndexOf(aProcessId);
+  if (index != PidAndBytesArray::NoIndex) {
+    // We already have a value for this pid.
+    PidAndBytes& pidAndBytes = mUnreleasedBytesByPid[index];
+    mUnreleasedTotalBytes =
+        mUnreleasedTotalBytes - pidAndBytes.mBytes + aUpdate.UnreleasedBytes();
+    pidAndBytes.mBytes = aUpdate.UnreleasedBytes();
+  } else {
+    // New pid.
+    mUnreleasedBytesByPid.InsertElementSorted(
+        PidAndBytes{aProcessId, aUpdate.UnreleasedBytes()});
+    mUnreleasedTotalBytes += aUpdate.UnreleasedBytes();
+  }
+
+  size_t destroyedReleased = 0;
+  if (!aUpdate.OldestDoneTimeStamp().IsNull()) {
+    size_t i = 0;
+    for (; i < mReleasedChunksByTime.Length(); ++i) {
+      if (mReleasedChunksByTime[i].mTimeStamp >=
+          aUpdate.OldestDoneTimeStamp()) {
+        break;
+      }
+    }
+    // Here, i is the index of the first item that's at or after
+    // aUpdate.mOldestDoneTimeStamp, so chunks from aProcessId before that have
+    // been destroyed.
+    while (i != 0) {
+      --i;
+      const TimeStampAndBytesAndPid& item = mReleasedChunksByTime[i];
+      if (item.mProcessId == aProcessId) {
+        destroyedReleased += item.mBytes;
+        mReleasedChunksByTime.RemoveElementAt(i);
+      }
+    }
+  }
+
+  size_t newlyReleased = 0;
+  for (const ProfileBufferControlledChunkManager::ChunkMetadata& chunk :
+       aUpdate.NewlyReleasedChunksRef()) {
+    newlyReleased += chunk.mBufferBytes;
+    mReleasedChunksByTime.InsertElementSorted(TimeStampAndBytesAndPid{
+        chunk.mDoneTimeStamp, chunk.mBufferBytes, aProcessId});
+  }
+
+  mReleasedTotalBytes = mReleasedTotalBytes - destroyedReleased + newlyReleased;
+
+#ifdef DEBUG
+  size_t totalReleased = 0;
+  for (const TimeStampAndBytesAndPid& item : mReleasedChunksByTime) {
+    totalReleased += item.mBytes;
+  }
+  MOZ_ASSERT(mReleasedTotalBytes == totalReleased);
+#endif  // DEBUG
+
+  std::vector<ProfileBufferControlledChunkManager::ChunkMetadata> toDestroy;
+  while (mUnreleasedTotalBytes + mReleasedTotalBytes > mMaximumBytes &&
+         !mReleasedChunksByTime.IsEmpty()) {
+    // We have reached the global memory limit, and there *are* released chunks
+    // that can be destroyed. Start with the first one, which is the oldest.
+    const TimeStampAndBytesAndPid& oldest = mReleasedChunksByTime[0];
+    mReleasedTotalBytes -= oldest.mBytes;
+    if (oldest.mProcessId == mParentProcessId) {
+      aParentChunkManager.DestroyChunksAtOrBefore(oldest.mTimeStamp);
+    } else {
+      ProfilerParentTracker::ForChild(
+          oldest.mProcessId,
+          [timestamp = oldest.mTimeStamp](ProfilerParent* profilerParent) {
+            Unused << profilerParent->SendDestroyReleasedChunksAtOrBefore(
+                timestamp);
+          });
+    }
+    mReleasedChunksByTime.RemoveElementAt(0);
+  }
+}
+
+UniquePtr<ProfilerParentTracker> ProfilerParentTracker::sInstance;
+
+/* static */
+void ProfilerParentTracker::EnsureInstance() {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  if (sInstance) {
+    return;
+  }
+
+  sInstance = MakeUnique<ProfilerParentTracker>();
+
+  // The tracker should get destroyed before threads are shutdown, because its
+  // destruction closes extant channels, which could trigger promise rejections
+  // that need to be dispatched to other threads.
+  ClearOnShutdown(&sInstance, ShutdownPhase::ShutdownThreads);
+}
+
+/* static */
+void ProfilerParentTracker::StartTracking(ProfilerParent* aProfilerParent) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  EnsureInstance();
+
+  if (sInstance->mMaybeController.isNothing() && sInstance->mEntries != 0) {
+    // There is no controller yet, but the profiler has started.
+    // Since we're adding a ProfilerParent, it's a good time to start
+    // controlling the global memory usage of the profiler.
+    // (And this helps delay the Controller startup, because the parent profiler
+    // can start *very* early in the process, when some resources like threads
+    // are not ready yet.)
+    sInstance->mMaybeController.emplace(size_t(sInstance->mEntries) * 8u);
+  }
+
+  sInstance->mProfilerParents.AppendElement(aProfilerParent);
+}
+
+/* static */
+void ProfilerParentTracker::StopTracking(ProfilerParent* aParent) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  if (!sInstance) {
+    return;
+  }
+
+  sInstance->mProfilerParents.RemoveElement(aParent);
+}
+
+/* static */
+void ProfilerParentTracker::ProfilerStarted(uint32_t aEntries) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  EnsureInstance();
+
+  sInstance->mEntries = aEntries;
+
+  if (sInstance->mMaybeController.isNothing() &&
+      !sInstance->mProfilerParents.IsEmpty()) {
+    // We are already tracking child processes, so it's a good time to start
+    // controlling the global memory usage of the profiler.
+    sInstance->mMaybeController.emplace(size_t(sInstance->mEntries) * 8u);
+  }
+}
+
+/* static */
+void ProfilerParentTracker::ProfilerWillStopIfStarted() {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  if (!sInstance) {
+    return;
+  }
+
+  sInstance->mEntries = 0;
+  sInstance->mMaybeController = Nothing{};
+}
+
+template <typename FuncType>
+/* static */
+void ProfilerParentTracker::Enumerate(FuncType&& aIterFunc) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  if (!sInstance) {
+    return;
+  }
+
+  for (ProfilerParent* profilerParent : sInstance->mProfilerParents) {
+    if (!profilerParent->mDestroyed) {
+      aIterFunc(profilerParent);
+    }
+  }
+}
+
+template <typename FuncType>
+/* static */
+void ProfilerParentTracker::ForChild(base::ProcessId aChildPid,
+                                     FuncType&& aIterFunc) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  if (!sInstance) {
+    return;
+  }
+
+  for (ProfilerParent* profilerParent : sInstance->mProfilerParents) {
+    if (profilerParent->mChildPid == aChildPid) {
+      if (!profilerParent->mDestroyed) {
+        std::forward<FuncType>(aIterFunc)(profilerParent);
+      }
+      return;
+    }
+  }
+}
+
+/* static */
+void ProfilerParentTracker::ForwardChildChunkManagerUpdate(
+    base::ProcessId aProcessId,
+    ProfileBufferControlledChunkManager::Update&& aUpdate) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  if (!sInstance || sInstance->mMaybeController.isNothing()) {
+    return;
+  }
+
+  MOZ_ASSERT(!aUpdate.IsNotUpdate(),
+             "No process should ever send a non-update");
+  sInstance->mMaybeController->HandleChildChunkManagerUpdate(
+      aProcessId, std::move(aUpdate));
+}
+
+ProfilerParentTracker::ProfilerParentTracker() {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_CTOR(ProfilerParentTracker);
+}
+
+ProfilerParentTracker::~ProfilerParentTracker() {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_DTOR(ProfilerParentTracker);
+
+  // Close the channels of any profiler parents that haven't been destroyed.
+  for (ProfilerParent* profilerParent : mProfilerParents.Clone()) {
+    if (!profilerParent->mDestroyed) {
+      // Keep the object alive until the call to Close() has completed.
+      // Close() will trigger a call to DeallocPProfilerParent.
+      RefPtr<ProfilerParent> actor = profilerParent;
+      actor->Close();
+    }
+  }
+}
+
+/* static */
+Endpoint<PProfilerChild> ProfilerParent::CreateForProcess(
+    base::ProcessId aOtherPid) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  Endpoint<PProfilerParent> parent;
+  Endpoint<PProfilerChild> child;
+  nsresult rv = PProfiler::CreateEndpoints(base::GetCurrentProcId(), aOtherPid,
+                                           &parent, &child);
+
+  if (NS_FAILED(rv)) {
+    MOZ_CRASH("Failed to create top level actor for PProfiler!");
+  }
+
+  RefPtr<ProfilerParent> actor = new ProfilerParent(aOtherPid);
+  if (!parent.Bind(actor)) {
+    MOZ_CRASH("Failed to bind parent actor for PProfiler!");
+  }
+
+  // mSelfRef will be cleared in DeallocPProfilerParent.
+  actor->mSelfRef = actor;
+  actor->Init();
+
+  return child;
+}
+
+ProfilerParent::ProfilerParent(base::ProcessId aChildPid)
+    : mChildPid(aChildPid), mDestroyed(false) {
+  MOZ_COUNT_CTOR(ProfilerParent);
+
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+}
+
+void ProfilerParent::Init() {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+
+  ProfilerParentTracker::StartTracking(this);
+
+  // We propagated the profiler state from the parent process to the child
+  // process through MOZ_PROFILER_STARTUP* environment variables.
+  // However, the profiler state might have changed in this process since then,
+  // and now that an active communication channel has been established with the
+  // child process, it's a good time to sync up the two profilers again.
+
+  int entries = 0;
+  Maybe<double> duration = Nothing();
+  double interval = 0;
+  mozilla::Vector<const char*> filters;
+  uint32_t features;
+  uint64_t activeBrowsingContextID;
+  profiler_get_start_params(&entries, &duration, &interval, &features, &filters,
+                            &activeBrowsingContextID);
+
+  if (entries != 0) {
+    ProfilerInitParams ipcParams;
+    ipcParams.enabled() = true;
+    ipcParams.entries() = entries;
+    ipcParams.duration() = duration;
+    ipcParams.interval() = interval;
+    ipcParams.features() = features;
+    ipcParams.activeBrowsingContextID() = activeBrowsingContextID;
+
+    for (uint32_t i = 0; i < filters.length(); ++i) {
+      ipcParams.filters().AppendElement(filters[i]);
+    }
+
+    Unused << SendEnsureStarted(ipcParams);
+    RequestChunkManagerUpdate();
+  } else {
+    Unused << SendStop();
+  }
+}
+
+ProfilerParent::~ProfilerParent() {
+  MOZ_COUNT_DTOR(ProfilerParent);
+
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  ProfilerParentTracker::StopTracking(this);
+}
+
+/* static */
+nsTArray<RefPtr<ProfilerParent::SingleProcessProfilePromise>>
+ProfilerParent::GatherProfiles() {
+  if (!NS_IsMainThread()) {
+    return nsTArray<RefPtr<ProfilerParent::SingleProcessProfilePromise>>();
+  }
+
+  nsTArray<RefPtr<SingleProcessProfilePromise>> results;
+  ProfilerParentTracker::Enumerate([&](ProfilerParent* profilerParent) {
+    results.AppendElement(profilerParent->SendGatherProfile());
+  });
+  return results;
+}
+
+// Magic value for ProfileBufferChunkManagerUpdate::unreleasedBytes meaning
+// that this is a final update from a child.
+constexpr static uint64_t scUpdateUnreleasedBytesFINAL = uint64_t(-1);
+
+/* static */
+ProfileBufferChunkManagerUpdate ProfilerParent::MakeFinalUpdate() {
+  return ProfileBufferChunkManagerUpdate{
+      uint64_t(scUpdateUnreleasedBytesFINAL), 0, TimeStamp{},
+      nsTArray<ProfileBufferChunkMetadata>{}};
+}
+
+/* static */
+bool ProfilerParent::IsLockedOnCurrentThread() {
+  return ProfileBufferGlobalController::IsLockedOnCurrentThread();
+}
+
+void ProfilerParent::RequestChunkManagerUpdate() {
+  if (mDestroyed) {
+    return;
+  }
+
+  RefPtr<AwaitNextChunkManagerUpdatePromise> updatePromise =
+      SendAwaitNextChunkManagerUpdate();
+  updatePromise->Then(
+      GetMainThreadSerialEventTarget(), __func__,
+      [self = RefPtr<ProfilerParent>(this)](
+          const ProfileBufferChunkManagerUpdate& aUpdate) {
+        if (aUpdate.unreleasedBytes() == scUpdateUnreleasedBytesFINAL) {
+          // Special value meaning it's the final update from that child.
+          ProfilerParentTracker::ForwardChildChunkManagerUpdate(
+              self->mChildPid,
+              ProfileBufferControlledChunkManager::Update(nullptr));
+        } else {
+          // Not the final update, translate it.
+          std::vector<ProfileBufferControlledChunkManager::ChunkMetadata>
+              chunks;
+          if (!aUpdate.newlyReleasedChunks().IsEmpty()) {
+            chunks.reserve(aUpdate.newlyReleasedChunks().Length());
+            for (const ProfileBufferChunkMetadata& chunk :
+                 aUpdate.newlyReleasedChunks()) {
+              chunks.emplace_back(chunk.doneTimeStamp(), chunk.bufferBytes());
+            }
+          }
+          // Let the tracker handle it.
+          ProfilerParentTracker::ForwardChildChunkManagerUpdate(
+              self->mChildPid,
+              ProfileBufferControlledChunkManager::Update(
+                  aUpdate.unreleasedBytes(), aUpdate.releasedBytes(),
+                  aUpdate.oldestDoneTimeStamp(), std::move(chunks)));
+          // This was not a final update, so start a new request.
+          self->RequestChunkManagerUpdate();
+        }
+      },
+      [self = RefPtr<ProfilerParent>(this)](
+          mozilla::ipc::ResponseRejectReason aReason) {
+        // Rejection could be for a number of reasons, assume the child will
+        // not respond anymore, so we pretend we received a final update.
+        ProfilerParentTracker::ForwardChildChunkManagerUpdate(
+            self->mChildPid,
+            ProfileBufferControlledChunkManager::Update(nullptr));
+      });
+}
+
+/* static */
+void ProfilerParent::ProfilerStarted(nsIProfilerStartParams* aParams) {
+  if (!NS_IsMainThread()) {
+    return;
+  }
+
+  ProfilerInitParams ipcParams;
+  double duration;
+  ipcParams.enabled() = true;
+  aParams->GetEntries(&ipcParams.entries());
+  aParams->GetDuration(&duration);
+  if (duration > 0.0) {
+    ipcParams.duration() = Some(duration);
+  } else {
+    ipcParams.duration() = Nothing();
+  }
+  aParams->GetInterval(&ipcParams.interval());
+  aParams->GetFeatures(&ipcParams.features());
+  ipcParams.filters() = aParams->GetFilters().Clone();
+  aParams->GetActiveBrowsingContextID(&ipcParams.activeBrowsingContextID());
+
+  ProfilerParentTracker::ProfilerStarted(ipcParams.entries());
+  ProfilerParentTracker::Enumerate([&](ProfilerParent* profilerParent) {
+    Unused << profilerParent->SendStart(ipcParams);
+    profilerParent->RequestChunkManagerUpdate();
+  });
+}
+
+/* static */
+void ProfilerParent::ProfilerWillStopIfStarted() {
+  if (!NS_IsMainThread()) {
+    return;
+  }
+
+  ProfilerParentTracker::ProfilerWillStopIfStarted();
+}
+
+/* static */
+void ProfilerParent::ProfilerStopped() {
+  if (!NS_IsMainThread()) {
+    return;
+  }
+
+  ProfilerParentTracker::Enumerate([](ProfilerParent* profilerParent) {
+    Unused << profilerParent->SendStop();
+  });
+}
+
+/* static */
+void ProfilerParent::ProfilerPaused() {
+  if (!NS_IsMainThread()) {
+    return;
+  }
+
+  ProfilerParentTracker::Enumerate([](ProfilerParent* profilerParent) {
+    Unused << profilerParent->SendPause();
+  });
+}
+
+/* static */
+void ProfilerParent::ProfilerResumed() {
+  if (!NS_IsMainThread()) {
+    return;
+  }
+
+  ProfilerParentTracker::Enumerate([](ProfilerParent* profilerParent) {
+    Unused << profilerParent->SendResume();
+  });
+}
+
+/* static */
+void ProfilerParent::ProfilerPausedSampling() {
+  if (!NS_IsMainThread()) {
+    return;
+  }
+
+  ProfilerParentTracker::Enumerate([](ProfilerParent* profilerParent) {
+    Unused << profilerParent->SendPauseSampling();
+  });
+}
+
+/* static */
+void ProfilerParent::ProfilerResumedSampling() {
+  if (!NS_IsMainThread()) {
+    return;
+  }
+
+  ProfilerParentTracker::Enumerate([](ProfilerParent* profilerParent) {
+    Unused << profilerParent->SendResumeSampling();
+  });
+}
+
+/* static */
+void ProfilerParent::ClearAllPages() {
+  if (!NS_IsMainThread()) {
+    return;
+  }
+
+  ProfilerParentTracker::Enumerate([](ProfilerParent* profilerParent) {
+    Unused << profilerParent->SendClearAllPages();
+  });
+}
+
+void ProfilerParent::ActorDestroy(ActorDestroyReason aActorDestroyReason) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  mDestroyed = true;
+}
+
+void ProfilerParent::ActorDealloc() { mSelfRef = nullptr; }
+
+}  // namespace mozilla
diff --git a/tools/profiler/gecko/ProfilerTypes.ipdlh b/tools/profiler/gecko/ProfilerTypes.ipdlh
new file mode 100644
index 0000000000..b78225b6c4
--- /dev/null
+++ b/tools/profiler/gecko/ProfilerTypes.ipdlh
@@ -0,0 +1,32 @@
+/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+using class mozilla::TimeStamp from "mozilla/TimeStamp.h";
+
+namespace mozilla {
+
+struct ProfilerInitParams {
+  bool enabled;
+  uint32_t entries;
+  double? duration;
+  double interval;
+  uint32_t features;
+  uint64_t activeBrowsingContextID;
+  nsCString[] filters;
+};
+
+struct ProfileBufferChunkMetadata {
+  TimeStamp doneTimeStamp;
+  uint32_t bufferBytes;
+};
+
+struct ProfileBufferChunkManagerUpdate {
+  uint64_t unreleasedBytes;
+  uint64_t releasedBytes;
+  TimeStamp oldestDoneTimeStamp;
+  ProfileBufferChunkMetadata[] newlyReleasedChunks;
+};
+
+} // namespace mozilla
diff --git a/tools/profiler/gecko/components.conf b/tools/profiler/gecko/components.conf
new file mode 100644
index 0000000000..b1775c37ab
--- /dev/null
+++ b/tools/profiler/gecko/components.conf
@@ -0,0 +1,17 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+Classes = [
+    {
+        'js_name': 'profiler',
+        'cid': '{25db9b8e-8123-4de1-b66d-8bbbedf2cdf4}',
+        'contract_ids': ['@mozilla.org/tools/profiler;1'],
+        'interfaces': ['nsIProfiler'],
+        'type': 'nsProfiler',
+        'headers': ['/tools/profiler/gecko/nsProfiler.h'],
+        'init_method': 'Init',
+    },
+]
diff --git a/tools/profiler/gecko/nsIProfiler.idl b/tools/profiler/gecko/nsIProfiler.idl
new file mode 100644
index 0000000000..d767189c13
--- /dev/null
+++ b/tools/profiler/gecko/nsIProfiler.idl
@@ -0,0 +1,184 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+%{C++
+#include "mozilla/Maybe.h"
+#include "nsTArrayForwardDeclare.h"
+#include "nsStringFwd.h"
+%}
+
+[ref] native nsCString(const nsCString);
+[ref] native StringArrayRef(const nsTArray<nsCString>);
+
+/**
+ * Start-up parameters for subprocesses are passed through nsIObserverService,
+ * which, unfortunately, means we need to implement nsISupports in order to
+ * go through it.
+ */
+[scriptable, builtinclass, uuid(0a175ba7-8fcf-4ce9-9c4b-ccc6272f4425)]
+interface nsIProfilerStartParams : nsISupports
+{
+  readonly attribute uint32_t entries;
+  readonly attribute double duration;
+  readonly attribute double interval;
+  readonly attribute uint32_t features;
+  readonly attribute uint64_t activeBrowsingContextID;
+
+  [noscript, notxpcom, nostdcall] StringArrayRef getFilters();
+};
+
+[scriptable, builtinclass, uuid(ead3f75c-0e0e-4fbb-901c-1e5392ef5b2a)]
+interface nsIProfiler : nsISupports
+{
+  boolean CanProfile();
+  void StartProfiler(in uint32_t aEntries, in double aInterval,
+                     in Array<AUTF8String> aFeatures,
+                     [optional] in Array<AUTF8String> aFilters,
+                     [optional] in uint64_t aActiveBrowsingContextID,
+                     [optional] in double aDuration);
+  void StopProfiler();
+  boolean IsPaused();
+  void Pause();
+  void Resume();
+  boolean IsSamplingPaused();
+  void PauseSampling();
+  void ResumeSampling();
+
+  /*
+   * Resolves the returned promise after at least one full periodic sampling.
+   * Rejects the promise if sampler is not running (yet, or anymore, or paused).
+   * This is mainly useful in tests, to wait just long enough to guarantee that
+   * one sample was taken in the main process.
+   */
+  [implicit_jscontext]
+  Promise waitOnePeriodicSampling();
+
+  /*
+   * Returns the JSON string of the profile. If aSinceTime is passed, only
+   * report samples taken at >= aSinceTime.
+   */
+  string GetProfile([optional] in double aSinceTime);
+
+  /*
+   * Returns a JS object of the profile. If aSinceTime is passed, only report
+   * samples taken at >= aSinceTime.
+   */
+  [implicit_jscontext]
+  jsval getProfileData([optional] in double aSinceTime);
+
+  [implicit_jscontext]
+  Promise getProfileDataAsync([optional] in double aSinceTime);
+
+  [implicit_jscontext]
+  Promise getProfileDataAsArrayBuffer([optional] in double aSinceTime);
+
+  [implicit_jscontext]
+  Promise getProfileDataAsGzippedArrayBuffer([optional] in double aSinceTime);
+
+  /**
+   * Returns a promise that resolves once the file has been written.
+   */
+  [implicit_jscontext]
+  Promise dumpProfileToFileAsync(in ACString aFilename,
+                                 [optional] in double aSinceTime);
+
+  boolean IsActive();
+
+  /**
+   * Clear all registered and unregistered page information in prifiler.
+   */
+  void ClearAllPages();
+
+  /**
+   * Returns an array of the features that are supported in this build.
+   * Features may vary depending on platform and build flags.
+   */
+  Array<AUTF8String> GetFeatures();
+
+  /**
+   * Returns a JavaScript object that contains a description of the currently configured
+   * state of the profiler when the profiler is active. This can be useful to assert
+   * the UI of the profiler's recording panel in tests. It returns null when the profiler
+   * is not active.
+   */
+  [implicit_jscontext]
+  readonly attribute jsval activeConfiguration;
+
+  /**
+   * Returns an array of all features that are supported by the profiler.
+   * The array may contain features that are not supported in this build.
+   */
+  Array<AUTF8String> GetAllFeatures();
+
+  void GetBufferInfo(out uint32_t aCurrentPosition, out uint32_t aTotalSize,
+                     out uint32_t aGeneration);
+
+  /**
+   * Returns the elapsed time, in milliseconds, since the profiler's epoch.
+   * The epoch is guaranteed to be constant for the duration of the
+   * process, but is otherwise arbitrary.
+   */
+  double getElapsedTime();
+
+  /**
+   * Contains an array of shared library objects.
+   * Every object has the properties:
+   *  - start:      The start address of the memory region occupied by this library.
+   *  - end:        The end address of the memory region occupied by this library.
+   *  - offset:     Usually zero, except on Linux / Android if the first mapped
+   *                section of the library has been mapped to an address that's
+   *                different from the library's base address.
+   *                Then offset = start - baseAddress.
+   *  - name:       The name (file basename) of the binary.
+   *  - path:       The full absolute path to the binary.
+   *  - debugName:  On Windows, the name of the pdb file for the binary. On other
+   *                platforms, the same as |name|.
+   *  - debugPath:  On Windows, the full absolute path of the pdb file for the
+   *                binary. On other platforms, the same as |path|.
+   *  - arch:       On Mac, the name of the architecture that identifies the right
+   *                binary image of a fat binary. Example values are "i386", "x86_64",
+   *                and "x86_64h". (x86_64h is used for binaries that contain
+   *                instructions that are specific to the Intel Haswell microarchitecture.)
+   *                On non-Mac platforms, arch is "".
+   *  - breakpadId: A unique identifier string for this library, as used by breakpad.
+   */
+  [implicit_jscontext]
+  readonly attribute jsval sharedLibraries;
+
+  /**
+   * Returns a promise that resolves to a SymbolTableAsTuple for the binary at
+   * the given path.
+   *
+   * SymbolTable as tuple: [addrs, index, buffer]
+   * Contains a symbol table, which can be used to map addresses to strings.
+   *
+   * The first element of this tuple, commonly named "addrs", is a sorted array of
+   * symbol addresses, as library-relative offsets in bytes, in ascending order.
+   * The third element of this tuple, commonly named "buffer", is a buffer of
+   * bytes that contains all strings from this symbol table, in the order of the
+   * addresses they correspond to, in utf-8 encoded form, all concatenated
+   * together.
+   * The second element of this tuple, commonly named "index", contains positions
+   * into "buffer". For every address, that position is where the string for that
+   * address starts in the buffer.
+   * index.length == addrs.length + 1.
+   * index[addrs.length] is the end position of the last string in the buffer.
+   *
+   * The string for the address addrs[i] is
+   * (new TextDecoder()).decode(buffer.subarray(index[i], index[i + 1]))
+   */
+  [implicit_jscontext]
+  Promise getSymbolTable(in ACString aDebugPath, in ACString aBreakpadID);
+
+  /**
+   * Dump the collected profile to a file.
+   */
+  void dumpProfileToFile(in string aFilename);
+
+  [noscript, notxpcom, nostdcall]
+  void receiveShutdownProfile(in nsCString aProfile);
+};
diff --git a/tools/profiler/gecko/nsProfiler.cpp b/tools/profiler/gecko/nsProfiler.cpp
new file mode 100644
index 0000000000..1edad8ea90
--- /dev/null
+++ b/tools/profiler/gecko/nsProfiler.cpp
@@ -0,0 +1,1038 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsProfiler.h"
+
+#include <sstream>
+#include <string>
+#include <utility>
+
+#include "GeckoProfiler.h"
+#include "ProfilerParent.h"
+#include "js/Array.h"  // JS::NewArrayObject
+#include "js/JSON.h"
+#include "js/Value.h"
+#include "mozilla/ErrorResult.h"
+#include "mozilla/SchedulerGroup.h"
+#include "mozilla/Services.h"
+#include "mozilla/dom/Promise.h"
+#include "mozilla/dom/TypedArray.h"
+#include "mozilla/Preferences.h"
+#include "nsComponentManagerUtils.h"
+#include "nsIFileStreams.h"
+#include "nsIInterfaceRequestor.h"
+#include "nsIInterfaceRequestorUtils.h"
+#include "nsILoadContext.h"
+#include "nsIObserverService.h"
+#include "nsIWebNavigation.h"
+#include "nsLocalFile.h"
+#include "nsMemory.h"
+#include "nsProfilerStartParams.h"
+#include "nsProxyRelease.h"
+#include "nsString.h"
+#include "nsThreadUtils.h"
+#include "platform.h"
+#include "shared-libraries.h"
+#include "zlib.h"
+
+using namespace mozilla;
+
+using dom::AutoJSAPI;
+using dom::Promise;
+using std::string;
+
+NS_IMPL_ISUPPORTS(nsProfiler, nsIProfiler, nsIObserver)
+
+nsProfiler::nsProfiler()
+    : mLockedForPrivateBrowsing(false),
+      mPendingProfiles(0),
+      mGathering(false) {}
+
+nsProfiler::~nsProfiler() {
+  nsCOMPtr<nsIObserverService> observerService =
+      mozilla::services::GetObserverService();
+  if (observerService) {
+    observerService->RemoveObserver(this, "chrome-document-global-created");
+    observerService->RemoveObserver(this, "last-pb-context-exited");
+  }
+  if (mSymbolTableThread) {
+    mSymbolTableThread->Shutdown();
+  }
+  ResetGathering();
+}
+
+nsresult nsProfiler::Init() {
+  nsCOMPtr<nsIObserverService> observerService =
+      mozilla::services::GetObserverService();
+  if (observerService) {
+    observerService->AddObserver(this, "chrome-document-global-created", false);
+    observerService->AddObserver(this, "last-pb-context-exited", false);
+  }
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::Observe(nsISupports* aSubject, const char* aTopic,
+                    const char16_t* aData) {
+  // The profiler's handling of private browsing is as simple as possible: it
+  // is stopped when the first PB window opens, and left stopped when the last
+  // PB window closes.
+  if (strcmp(aTopic, "chrome-document-global-created") == 0) {
+    nsCOMPtr<nsIInterfaceRequestor> requestor = do_QueryInterface(aSubject);
+    nsCOMPtr<nsIWebNavigation> parentWebNav = do_GetInterface(requestor);
+    nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(parentWebNav);
+    if (loadContext && loadContext->UsePrivateBrowsing() &&
+        !mLockedForPrivateBrowsing) {
+      mLockedForPrivateBrowsing = true;
+      // Allow profiling tests that trigger private browsing.
+      if (!xpc::IsInAutomation()) {
+        profiler_stop();
+      }
+    }
+  } else if (strcmp(aTopic, "last-pb-context-exited") == 0) {
+    mLockedForPrivateBrowsing = false;
+  }
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::CanProfile(bool* aCanProfile) {
+  *aCanProfile = !mLockedForPrivateBrowsing;
+  return NS_OK;
+}
+
+static nsresult FillVectorFromStringArray(Vector<const char*>& aVector,
+                                          const nsTArray<nsCString>& aArray) {
+  if (NS_WARN_IF(!aVector.reserve(aArray.Length()))) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  for (auto& entry : aArray) {
+    aVector.infallibleAppend(entry.get());
+  }
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::StartProfiler(uint32_t aEntries, double aInterval,
+                          const nsTArray<nsCString>& aFeatures,
+                          const nsTArray<nsCString>& aFilters,
+                          uint64_t aActiveBrowsingContextID, double aDuration) {
+  if (mLockedForPrivateBrowsing) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  ResetGathering();
+
+  Vector<const char*> featureStringVector;
+  nsresult rv = FillVectorFromStringArray(featureStringVector, aFeatures);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  uint32_t features = ParseFeaturesFromStringArray(
+      featureStringVector.begin(), featureStringVector.length());
+  Maybe<double> duration = aDuration > 0.0 ? Some(aDuration) : Nothing();
+
+  Vector<const char*> filterStringVector;
+  rv = FillVectorFromStringArray(filterStringVector, aFilters);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  profiler_start(PowerOfTwo32(aEntries), aInterval, features,
+                 filterStringVector.begin(), filterStringVector.length(),
+                 aActiveBrowsingContextID, duration);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::StopProfiler() {
+  ResetGathering();
+
+  profiler_stop();
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::IsPaused(bool* aIsPaused) {
+  *aIsPaused = profiler_is_paused();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::Pause() {
+  profiler_pause();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::Resume() {
+  profiler_resume();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::IsSamplingPaused(bool* aIsSamplingPaused) {
+  *aIsSamplingPaused = profiler_is_sampling_paused();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::PauseSampling() {
+  profiler_pause_sampling();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::ResumeSampling() {
+  profiler_resume_sampling();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::ClearAllPages() {
+  profiler_clear_all_pages();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::WaitOnePeriodicSampling(JSContext* aCx, Promise** aPromise) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (NS_WARN_IF(!aCx)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsIGlobalObject* globalObject = xpc::CurrentNativeGlobal(aCx);
+  if (NS_WARN_IF(!globalObject)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  ErrorResult result;
+  RefPtr<Promise> promise = Promise::Create(globalObject, result);
+  if (NS_WARN_IF(result.Failed())) {
+    return result.StealNSResult();
+  }
+
+  // The callback cannot officially own the promise RefPtr directly, because
+  // `Promise` doesn't support multi-threading, and the callback could destroy
+  // the promise in the sampler thread.
+  // `nsMainThreadPtrHandle` ensures that the promise can only be destroyed on
+  // the main thread. And the invocation from the Sampler thread immediately
+  // dispatches a task back to the main thread, to resolve/reject the promise.
+  // The lambda needs to be `mutable`, to allow moving-from
+  // `promiseHandleInSampler`.
+  if (!profiler_callback_after_sampling(
+          [promiseHandleInSampler = nsMainThreadPtrHandle<Promise>(
+               new nsMainThreadPtrHolder<Promise>(
+                   "WaitOnePeriodicSampling promise for Sampler", promise))](
+              SamplingState aSamplingState) mutable {
+            SchedulerGroup::Dispatch(
+                TaskCategory::Other,
+                NS_NewRunnableFunction(
+                    "nsProfiler::WaitOnePeriodicSampling result on main thread",
+                    [promiseHandleInMT = std::move(promiseHandleInSampler),
+                     aSamplingState]() {
+                      AutoJSAPI jsapi;
+                      if (NS_WARN_IF(!jsapi.Init(
+                              promiseHandleInMT->GetGlobalObject()))) {
+                        // We're really hosed if we can't get a JS context for
+                        // some reason.
+                        promiseHandleInMT->MaybeReject(
+                            NS_ERROR_DOM_UNKNOWN_ERR);
+                        return;
+                      }
+
+                      switch (aSamplingState) {
+                        case SamplingState::JustStopped:
+                        case SamplingState::SamplingPaused:
+                          promiseHandleInMT->MaybeReject(NS_ERROR_FAILURE);
+                          break;
+
+                        case SamplingState::NoStackSamplingCompleted:
+                        case SamplingState::SamplingCompleted: {
+                          JS::RootedValue val(jsapi.cx());
+                          promiseHandleInMT->MaybeResolve(val);
+                        } break;
+
+                        default:
+                          MOZ_ASSERT(false, "Unexpected SamplingState value");
+                          promiseHandleInMT->MaybeReject(
+                              NS_ERROR_DOM_UNKNOWN_ERR);
+                          break;
+                      }
+                    }));
+          })) {
+    // Callback was not added (e.g., profiler is not running) and will never be
+    // invoked, so we need to resolve the promise here.
+    promise->MaybeReject(NS_ERROR_DOM_UNKNOWN_ERR);
+  }
+
+  promise.forget(aPromise);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetProfile(double aSinceTime, char** aProfile) {
+  mozilla::UniquePtr<char[]> profile = profiler_get_profile(aSinceTime);
+  *aProfile = profile.release();
+  return NS_OK;
+}
+
+namespace {
+struct StringWriteFunc : public JSONWriteFunc {
+  nsAString& mBuffer;  // This struct must not outlive this buffer
+  explicit StringWriteFunc(nsAString& buffer) : mBuffer(buffer) {}
+
+  void Write(const Span<const char>& aStr) override {
+    mBuffer.Append(NS_ConvertUTF8toUTF16(aStr.data(), aStr.size()));
+  }
+};
+}  // namespace
+
+NS_IMETHODIMP
+nsProfiler::GetSharedLibraries(JSContext* aCx,
+                               JS::MutableHandle<JS::Value> aResult) {
+  JS::RootedValue val(aCx);
+  {
+    nsString buffer;
+    JSONWriter w(MakeUnique<StringWriteFunc>(buffer));
+    w.StartArrayElement();
+    AppendSharedLibraries(w);
+    w.EndArray();
+    MOZ_ALWAYS_TRUE(JS_ParseJSON(aCx,
+                                 static_cast<const char16_t*>(buffer.get()),
+                                 buffer.Length(), &val));
+  }
+  JS::RootedObject obj(aCx, &val.toObject());
+  if (!obj) {
+    return NS_ERROR_FAILURE;
+  }
+  aResult.setObject(*obj);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetActiveConfiguration(JSContext* aCx,
+                                   JS::MutableHandle<JS::Value> aResult) {
+  JS::RootedValue jsValue(aCx);
+  {
+    nsString buffer;
+    JSONWriter writer(MakeUnique<StringWriteFunc>(buffer));
+    profiler_write_active_configuration(writer);
+    MOZ_ALWAYS_TRUE(JS_ParseJSON(aCx,
+                                 static_cast<const char16_t*>(buffer.get()),
+                                 buffer.Length(), &jsValue));
+  }
+  if (jsValue.isNull()) {
+    aResult.setNull();
+  } else {
+    JS::RootedObject obj(aCx, &jsValue.toObject());
+    if (!obj) {
+      return NS_ERROR_FAILURE;
+    }
+    aResult.setObject(*obj);
+  }
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::DumpProfileToFile(const char* aFilename) {
+  profiler_save_profile_to_file(aFilename);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetProfileData(double aSinceTime, JSContext* aCx,
+                           JS::MutableHandle<JS::Value> aResult) {
+  mozilla::UniquePtr<char[]> profile = profiler_get_profile(aSinceTime);
+  if (!profile) {
+    return NS_ERROR_FAILURE;
+  }
+
+  NS_ConvertUTF8toUTF16 js_string(nsDependentCString(profile.get()));
+  auto profile16 = static_cast<const char16_t*>(js_string.get());
+
+  JS::RootedValue val(aCx);
+  MOZ_ALWAYS_TRUE(JS_ParseJSON(aCx, profile16, js_string.Length(), &val));
+
+  aResult.set(val);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetProfileDataAsync(double aSinceTime, JSContext* aCx,
+                                Promise** aPromise) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (!profiler_is_active()) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (NS_WARN_IF(!aCx)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsIGlobalObject* globalObject = xpc::CurrentNativeGlobal(aCx);
+  if (NS_WARN_IF(!globalObject)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  ErrorResult result;
+  RefPtr<Promise> promise = Promise::Create(globalObject, result);
+  if (NS_WARN_IF(result.Failed())) {
+    return result.StealNSResult();
+  }
+
+  StartGathering(aSinceTime)
+      ->Then(
+          GetMainThreadSerialEventTarget(), __func__,
+          [promise](nsCString aResult) {
+            AutoJSAPI jsapi;
+            if (NS_WARN_IF(!jsapi.Init(promise->GetGlobalObject()))) {
+              // We're really hosed if we can't get a JS context for some
+              // reason.
+              promise->MaybeReject(NS_ERROR_DOM_UNKNOWN_ERR);
+              return;
+            }
+
+            JSContext* cx = jsapi.cx();
+
+            // Now parse the JSON so that we resolve with a JS Object.
+            JS::RootedValue val(cx);
+            {
+              NS_ConvertUTF8toUTF16 js_string(aResult);
+              if (!JS_ParseJSON(cx,
+                                static_cast<const char16_t*>(js_string.get()),
+                                js_string.Length(), &val)) {
+                if (!jsapi.HasException()) {
+                  promise->MaybeReject(NS_ERROR_DOM_UNKNOWN_ERR);
+                } else {
+                  JS::RootedValue exn(cx);
+                  DebugOnly<bool> gotException = jsapi.StealException(&exn);
+                  MOZ_ASSERT(gotException);
+
+                  jsapi.ClearException();
+                  promise->MaybeReject(exn);
+                }
+              } else {
+                promise->MaybeResolve(val);
+              }
+            }
+          },
+          [promise](nsresult aRv) { promise->MaybeReject(aRv); });
+
+  promise.forget(aPromise);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetProfileDataAsArrayBuffer(double aSinceTime, JSContext* aCx,
+                                        Promise** aPromise) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (!profiler_is_active()) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (NS_WARN_IF(!aCx)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsIGlobalObject* globalObject = xpc::CurrentNativeGlobal(aCx);
+  if (NS_WARN_IF(!globalObject)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  ErrorResult result;
+  RefPtr<Promise> promise = Promise::Create(globalObject, result);
+  if (NS_WARN_IF(result.Failed())) {
+    return result.StealNSResult();
+  }
+
+  StartGathering(aSinceTime)
+      ->Then(
+          GetMainThreadSerialEventTarget(), __func__,
+          [promise](nsCString aResult) {
+            AutoJSAPI jsapi;
+            if (NS_WARN_IF(!jsapi.Init(promise->GetGlobalObject()))) {
+              // We're really hosed if we can't get a JS context for some
+              // reason.
+              promise->MaybeReject(NS_ERROR_DOM_UNKNOWN_ERR);
+              return;
+            }
+
+            JSContext* cx = jsapi.cx();
+            JSObject* typedArray = dom::ArrayBuffer::Create(
+                cx, aResult.Length(),
+                reinterpret_cast<const uint8_t*>(aResult.Data()));
+            if (typedArray) {
+              JS::RootedValue val(cx, JS::ObjectValue(*typedArray));
+              promise->MaybeResolve(val);
+            } else {
+              promise->MaybeReject(NS_ERROR_OUT_OF_MEMORY);
+            }
+          },
+          [promise](nsresult aRv) { promise->MaybeReject(aRv); });
+
+  promise.forget(aPromise);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetProfileDataAsGzippedArrayBuffer(double aSinceTime,
+                                               JSContext* aCx,
+                                               Promise** aPromise) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (!profiler_is_active()) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (NS_WARN_IF(!aCx)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsIGlobalObject* globalObject = xpc::CurrentNativeGlobal(aCx);
+  if (NS_WARN_IF(!globalObject)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  ErrorResult result;
+  RefPtr<Promise> promise = Promise::Create(globalObject, result);
+  if (NS_WARN_IF(result.Failed())) {
+    return result.StealNSResult();
+  }
+
+  StartGathering(aSinceTime)
+      ->Then(
+          GetMainThreadSerialEventTarget(), __func__,
+          [promise](nsCString aResult) {
+            AutoJSAPI jsapi;
+            if (NS_WARN_IF(!jsapi.Init(promise->GetGlobalObject()))) {
+              // We're really hosed if we can't get a JS context for some
+              // reason.
+              promise->MaybeReject(NS_ERROR_DOM_UNKNOWN_ERR);
+              return;
+            }
+
+            // Compress a buffer via zlib (as with `compress()`), but emit a
+            // gzip header as well. Like `compress()`, this is limited to 4GB in
+            // size, but that shouldn't be an issue for our purposes.
+            uLongf outSize = compressBound(aResult.Length());
+            FallibleTArray<uint8_t> outBuff;
+            if (!outBuff.SetLength(outSize, fallible)) {
+              promise->MaybeReject(NS_ERROR_OUT_OF_MEMORY);
+              return;
+            }
+
+            int zerr;
+            z_stream stream;
+            stream.zalloc = nullptr;
+            stream.zfree = nullptr;
+            stream.opaque = nullptr;
+            stream.next_out = (Bytef*)outBuff.Elements();
+            stream.avail_out = outBuff.Length();
+            stream.next_in = (z_const Bytef*)aResult.Data();
+            stream.avail_in = aResult.Length();
+
+            // A windowBits of 31 is the default (15) plus 16 for emitting a
+            // gzip header; a memLevel of 8 is the default.
+            zerr = deflateInit2(&stream, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
+                                /* windowBits */ 31, /* memLevel */ 8,
+                                Z_DEFAULT_STRATEGY);
+            if (zerr != Z_OK) {
+              promise->MaybeReject(NS_ERROR_FAILURE);
+              return;
+            }
+
+            zerr = deflate(&stream, Z_FINISH);
+            outSize = stream.total_out;
+            deflateEnd(&stream);
+
+            if (zerr != Z_STREAM_END) {
+              promise->MaybeReject(NS_ERROR_FAILURE);
+              return;
+            }
+
+            outBuff.TruncateLength(outSize);
+
+            JSContext* cx = jsapi.cx();
+            JSObject* typedArray = dom::ArrayBuffer::Create(
+                cx, outBuff.Length(), outBuff.Elements());
+            if (typedArray) {
+              JS::RootedValue val(cx, JS::ObjectValue(*typedArray));
+              promise->MaybeResolve(val);
+            } else {
+              promise->MaybeReject(NS_ERROR_OUT_OF_MEMORY);
+            }
+          },
+          [promise](nsresult aRv) { promise->MaybeReject(aRv); });
+
+  promise.forget(aPromise);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::DumpProfileToFileAsync(const nsACString& aFilename,
+                                   double aSinceTime, JSContext* aCx,
+                                   Promise** aPromise) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (!profiler_is_active()) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (NS_WARN_IF(!aCx)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsIGlobalObject* globalObject = xpc::CurrentNativeGlobal(aCx);
+  if (NS_WARN_IF(!globalObject)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  ErrorResult result;
+  RefPtr<Promise> promise = Promise::Create(globalObject, result);
+  if (NS_WARN_IF(result.Failed())) {
+    return result.StealNSResult();
+  }
+
+  nsCString filename(aFilename);
+
+  StartGathering(aSinceTime)
+      ->Then(
+          GetMainThreadSerialEventTarget(), __func__,
+          [filename, promise](const nsCString& aResult) {
+            nsCOMPtr<nsIFile> file =
+                do_CreateInstance(NS_LOCAL_FILE_CONTRACTID);
+            nsresult rv = file->InitWithNativePath(filename);
+            if (NS_FAILED(rv)) {
+              MOZ_CRASH();
+            }
+            nsCOMPtr<nsIFileOutputStream> of =
+                do_CreateInstance("@mozilla.org/network/file-output-stream;1");
+            of->Init(file, -1, -1, 0);
+            uint32_t sz;
+            of->Write(aResult.get(), aResult.Length(), &sz);
+            of->Close();
+
+            promise->MaybeResolveWithUndefined();
+          },
+          [promise](nsresult aRv) { promise->MaybeReject(aRv); });
+
+  promise.forget(aPromise);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetSymbolTable(const nsACString& aDebugPath,
+                           const nsACString& aBreakpadID, JSContext* aCx,
+                           Promise** aPromise) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (NS_WARN_IF(!aCx)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsIGlobalObject* globalObject =
+      xpc::NativeGlobal(JS::CurrentGlobalOrNull(aCx));
+
+  if (NS_WARN_IF(!globalObject)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  ErrorResult result;
+  RefPtr<Promise> promise = Promise::Create(globalObject, result);
+  if (NS_WARN_IF(result.Failed())) {
+    return result.StealNSResult();
+  }
+
+  GetSymbolTableMozPromise(aDebugPath, aBreakpadID)
+      ->Then(
+          GetMainThreadSerialEventTarget(), __func__,
+          [promise](const SymbolTable& aSymbolTable) {
+            AutoJSAPI jsapi;
+            if (NS_WARN_IF(!jsapi.Init(promise->GetGlobalObject()))) {
+              // We're really hosed if we can't get a JS context for some
+              // reason.
+              promise->MaybeReject(NS_ERROR_DOM_UNKNOWN_ERR);
+              return;
+            }
+
+            JSContext* cx = jsapi.cx();
+
+            JS::RootedObject addrsArray(
+                cx, dom::Uint32Array::Create(cx, aSymbolTable.mAddrs.Length(),
+                                             aSymbolTable.mAddrs.Elements()));
+            JS::RootedObject indexArray(
+                cx, dom::Uint32Array::Create(cx, aSymbolTable.mIndex.Length(),
+                                             aSymbolTable.mIndex.Elements()));
+            JS::RootedObject bufferArray(
+                cx, dom::Uint8Array::Create(cx, aSymbolTable.mBuffer.Length(),
+                                            aSymbolTable.mBuffer.Elements()));
+
+            if (addrsArray && indexArray && bufferArray) {
+              JS::RootedObject tuple(cx, JS::NewArrayObject(cx, 3));
+              JS_SetElement(cx, tuple, 0, addrsArray);
+              JS_SetElement(cx, tuple, 1, indexArray);
+              JS_SetElement(cx, tuple, 2, bufferArray);
+              promise->MaybeResolve(tuple);
+            } else {
+              promise->MaybeReject(NS_ERROR_FAILURE);
+            }
+          },
+          [promise](nsresult aRv) { promise->MaybeReject(aRv); });
+
+  promise.forget(aPromise);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetElapsedTime(double* aElapsedTime) {
+  *aElapsedTime = profiler_time();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::IsActive(bool* aIsActive) {
+  *aIsActive = profiler_is_active();
+  return NS_OK;
+}
+
+static void GetArrayOfStringsForFeatures(uint32_t aFeatures,
+                                         nsTArray<nsCString>& aFeatureList) {
+#define COUNT_IF_SET(n_, str_, Name_, desc_)    \
+  if (ProfilerFeature::Has##Name_(aFeatures)) { \
+    len++;                                      \
+  }
+
+  // Count the number of features in use.
+  uint32_t len = 0;
+  PROFILER_FOR_EACH_FEATURE(COUNT_IF_SET)
+
+#undef COUNT_IF_SET
+
+  aFeatureList.SetCapacity(len);
+
+#define DUP_IF_SET(n_, str_, Name_, desc_)      \
+  if (ProfilerFeature::Has##Name_(aFeatures)) { \
+    aFeatureList.AppendElement(str_);           \
+  }
+
+  // Insert the strings for the features in use.
+  PROFILER_FOR_EACH_FEATURE(DUP_IF_SET)
+
+#undef DUP_IF_SET
+}
+
+NS_IMETHODIMP
+nsProfiler::GetFeatures(nsTArray<nsCString>& aFeatureList) {
+  uint32_t features = profiler_get_available_features();
+  GetArrayOfStringsForFeatures(features, aFeatureList);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetAllFeatures(nsTArray<nsCString>& aFeatureList) {
+  GetArrayOfStringsForFeatures((uint32_t)-1, aFeatureList);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfiler::GetBufferInfo(uint32_t* aCurrentPosition, uint32_t* aTotalSize,
+                          uint32_t* aGeneration) {
+  MOZ_ASSERT(aCurrentPosition);
+  MOZ_ASSERT(aTotalSize);
+  MOZ_ASSERT(aGeneration);
+  Maybe<ProfilerBufferInfo> info = profiler_get_buffer_info();
+  if (info) {
+    *aCurrentPosition = info->mRangeEnd % info->mEntryCount;
+    *aTotalSize = info->mEntryCount;
+    *aGeneration = info->mRangeEnd / info->mEntryCount;
+  } else {
+    *aCurrentPosition = 0;
+    *aTotalSize = 0;
+    *aGeneration = 0;
+  }
+  return NS_OK;
+}
+
+/* static */ void nsProfiler::GatheringTimerCallback(nsITimer* aTimer,
+                                                     void* aClosure) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  nsCOMPtr<nsIProfiler> profiler(
+      do_GetService("@mozilla.org/tools/profiler;1"));
+  if (!profiler) {
+    // No (more) profiler service.
+    return;
+  }
+  nsProfiler* self = static_cast<nsProfiler*>(profiler.get());
+  if (self != aClosure) {
+    // Different service object!?
+    return;
+  }
+  if (aTimer != self->mGatheringTimer) {
+    // This timer was cancelled after this callback was queued.
+    return;
+  }
+  self->mGatheringTimer = nullptr;
+  if (!profiler_is_active() || !self->mGathering) {
+    // Not gathering anymore.
+    return;
+  }
+  NS_WARNING("Profiler failed to gather profiles from all sub-processes");
+  // We have really reached a timeout while gathering, finish now.
+  // TODO: Add information about missing processes.
+  self->FinishGathering();
+}
+
+void nsProfiler::GatheredOOPProfile(const nsACString& aProfile) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+
+  if (!profiler_is_active()) {
+    return;
+  }
+
+  if (!mGathering) {
+    // If we're not actively gathering, then we don't actually care that we
+    // gathered a profile here. This can happen for processes that exit while
+    // profiling.
+    return;
+  }
+
+  MOZ_RELEASE_ASSERT(mWriter.isSome(),
+                     "Should always have a writer if mGathering is true");
+
+  if (!aProfile.IsEmpty()) {
+    // TODO: Remove PromiseFlatCString, see bug 1657033.
+    mWriter->Splice(PromiseFlatCString(aProfile));
+  }
+
+  mPendingProfiles--;
+
+  if (mPendingProfiles == 0) {
+    // We've got all of the async profiles now. Let's
+    // finish off the profile and resolve the Promise.
+    FinishGathering();
+  }
+
+  // Not finished yet, restart the timer to let any remaining child enough time
+  // to do their profile-streaming.
+  if (mGatheringTimer) {
+    uint32_t delayMs = 0;
+    const nsresult r = mGatheringTimer->GetDelay(&delayMs);
+    mGatheringTimer->Cancel();
+    mGatheringTimer = nullptr;
+    if (NS_SUCCEEDED(r) && delayMs != 0) {
+      Unused << NS_NewTimerWithFuncCallback(
+          getter_AddRefs(mGatheringTimer), GatheringTimerCallback, this,
+          delayMs, nsITimer::TYPE_ONE_SHOT_LOW_PRIORITY, "",
+          GetMainThreadSerialEventTarget());
+    }
+  }
+}
+
+void nsProfiler::ReceiveShutdownProfile(const nsCString& aProfile) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  profiler_received_exit_profile(aProfile);
+}
+
+RefPtr<nsProfiler::GatheringPromise> nsProfiler::StartGathering(
+    double aSinceTime) {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+
+  if (mGathering) {
+    // If we're already gathering, return a rejected promise - this isn't
+    // going to end well.
+    return GatheringPromise::CreateAndReject(NS_ERROR_NOT_AVAILABLE, __func__);
+  }
+
+  mGathering = true;
+
+  if (mGatheringTimer) {
+    mGatheringTimer->Cancel();
+    mGatheringTimer = nullptr;
+  }
+
+  // Request profiles from the other processes. This will trigger asynchronous
+  // calls to ProfileGatherer::GatheredOOPProfile as the profiles arrive.
+  //
+  // Do this before the call to profiler_stream_json_for_this_process() because
+  // that call is slow and we want to let the other processes grab their
+  // profiles as soon as possible.
+  nsTArray<RefPtr<ProfilerParent::SingleProcessProfilePromise>> profiles =
+      ProfilerParent::GatherProfiles();
+
+  mWriter.emplace();
+
+  TimeStamp streamingStart = TimeStamp::NowUnfuzzed();
+
+  UniquePtr<ProfilerCodeAddressService> service =
+      profiler_code_address_service_for_presymbolication();
+
+  // Start building up the JSON result and grab the profile from this process.
+  mWriter->Start();
+  if (!profiler_stream_json_for_this_process(*mWriter, aSinceTime,
+                                             /* aIsShuttingDown */ false,
+                                             service.get())) {
+    // The profiler is inactive. This either means that it was inactive even
+    // at the time that ProfileGatherer::Start() was called, or that it was
+    // stopped on a different thread since that call. Either way, we need to
+    // reject the promise and stop gathering.
+    return GatheringPromise::CreateAndReject(NS_ERROR_NOT_AVAILABLE, __func__);
+  }
+
+  mWriter->StartArrayProperty("processes");
+
+  // If we have any process exit profiles, add them immediately.
+  Vector<nsCString> exitProfiles = profiler_move_exit_profiles();
+  for (auto& exitProfile : exitProfiles) {
+    if (!exitProfile.IsEmpty()) {
+      mWriter->Splice(exitProfile);
+    }
+  }
+
+  mPromiseHolder.emplace();
+  RefPtr<GatheringPromise> promise = mPromiseHolder->Ensure(__func__);
+
+  // Keep the array property "processes" and the root object in mWriter open
+  // until FinishGathering() is called. As profiles from the other processes
+  // come in, they will be inserted and end up in the right spot.
+  // FinishGathering() will close the array and the root object.
+
+  mPendingProfiles = profiles.Length();
+  if (mPendingProfiles != 0) {
+    // There *are* pending profiles, let's add handlers for their promises.
+
+    // We want a reasonable timeout value while waiting for child profiles.
+    // We know how long the parent process took to serialize its profile:
+    const uint32_t parentTimeMs = static_cast<uint32_t>(
+        (TimeStamp::NowUnfuzzed() - streamingStart).ToMilliseconds());
+    // We will multiply this by the number of children, to cover the worst case
+    // where all processes take the same time, but because they are working in
+    // parallel on a potential single CPU, they all finish around the same later
+    // time.
+    // And multiply again by 2, for the extra processing and comms, and other
+    // work that may happen.
+    const uint32_t parentToChildrenFactor = mPendingProfiles * 2;
+    // And we add a number seconds by default. In some lopsided cases, the
+    // parent-to-child serializing ratio could be much greater than expected,
+    // so the user could force it to be a bigger number if needed.
+    uint32_t childTimeoutS = Preferences::GetUint(
+        "devtools.performance.recording.child.timeout_s", 0u);
+    if (childTimeoutS == 0) {
+      // If absent or 0, use hard-coded default.
+      childTimeoutS = 1;
+    }
+    // And this gives us a timeout value. The timer will be restarted after we
+    // receive each response.
+    // TODO: Instead of a timeout to cover the whole request-to-response time,
+    // there should be more of a continuous dialog between processes, to only
+    // give up if some processes are really unresponsive. See bug 1673513.
+    const uint32_t streamingTimeoutMs =
+        parentTimeMs * parentToChildrenFactor + childTimeoutS * 1000;
+    Unused << NS_NewTimerWithFuncCallback(
+        getter_AddRefs(mGatheringTimer), GatheringTimerCallback, this,
+        streamingTimeoutMs, nsITimer::TYPE_ONE_SHOT_LOW_PRIORITY, "",
+        GetMainThreadSerialEventTarget());
+
+    for (auto profile : profiles) {
+      profile->Then(
+          GetMainThreadSerialEventTarget(), __func__,
+          [self = RefPtr<nsProfiler>(this)](mozilla::ipc::Shmem&& aResult) {
+            const nsDependentCSubstring profileString(aResult.get<char>(),
+                                                      aResult.Size<char>() - 1);
+            self->GatheredOOPProfile(profileString);
+          },
+          [self =
+               RefPtr<nsProfiler>(this)](ipc::ResponseRejectReason&& aReason) {
+            self->GatheredOOPProfile(""_ns);
+          });
+    }
+  } else {
+    // There are no pending profiles, we're already done.
+    FinishGathering();
+  }
+
+  return promise;
+}
+
+RefPtr<nsProfiler::SymbolTablePromise> nsProfiler::GetSymbolTableMozPromise(
+    const nsACString& aDebugPath, const nsACString& aBreakpadID) {
+  MozPromiseHolder<SymbolTablePromise> promiseHolder;
+  RefPtr<SymbolTablePromise> promise = promiseHolder.Ensure(__func__);
+
+  if (!mSymbolTableThread) {
+    nsresult rv = NS_NewNamedThread("ProfSymbolTable",
+                                    getter_AddRefs(mSymbolTableThread));
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      promiseHolder.Reject(NS_ERROR_FAILURE, __func__);
+      return promise;
+    }
+  }
+
+  nsresult rv = mSymbolTableThread->Dispatch(NS_NewRunnableFunction(
+      "nsProfiler::GetSymbolTableMozPromise runnable on ProfSymbolTable thread",
+      [promiseHolder = std::move(promiseHolder),
+       debugPath = nsCString(aDebugPath),
+       breakpadID = nsCString(aBreakpadID)]() mutable {
+        AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING("profiler_get_symbol_table",
+                                              OTHER, debugPath);
+        SymbolTable symbolTable;
+        bool succeeded = profiler_get_symbol_table(
+            debugPath.get(), breakpadID.get(), &symbolTable);
+        if (succeeded) {
+          promiseHolder.Resolve(std::move(symbolTable), __func__);
+        } else {
+          promiseHolder.Reject(NS_ERROR_FAILURE, __func__);
+        }
+      }));
+
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    // Get-symbol task was not dispatched and therefore won't fulfill the
+    // promise, we must reject the promise now.
+    promiseHolder.Reject(NS_ERROR_FAILURE, __func__);
+  }
+
+  return promise;
+}
+
+void nsProfiler::FinishGathering() {
+  MOZ_RELEASE_ASSERT(NS_IsMainThread());
+  MOZ_RELEASE_ASSERT(mWriter.isSome());
+  MOZ_RELEASE_ASSERT(mPromiseHolder.isSome());
+
+  // Close the "processes" array property.
+  mWriter->EndArray();
+
+  // Close the root object of the generated JSON.
+  mWriter->End();
+
+  UniquePtr<char[]> buf = mWriter->ChunkedWriteFunc().CopyData();
+  size_t len = strlen(buf.get());
+  nsCString result;
+  result.Adopt(buf.release(), len);
+  mPromiseHolder->Resolve(std::move(result), __func__);
+
+  ResetGathering();
+}
+
+void nsProfiler::ResetGathering() {
+  // If we have an unfulfilled Promise in flight, we should reject it before
+  // destroying the promise holder.
+  if (mPromiseHolder.isSome()) {
+    mPromiseHolder->RejectIfExists(NS_ERROR_DOM_ABORT_ERR, __func__);
+    mPromiseHolder.reset();
+  }
+  mPendingProfiles = 0;
+  mGathering = false;
+  if (mGatheringTimer) {
+    mGatheringTimer->Cancel();
+    mGatheringTimer = nullptr;
+  }
+  mWriter.reset();
+}
diff --git a/tools/profiler/gecko/nsProfiler.h b/tools/profiler/gecko/nsProfiler.h
new file mode 100644
index 0000000000..1f05cab515
--- /dev/null
+++ b/tools/profiler/gecko/nsProfiler.h
@@ -0,0 +1,72 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsProfiler_h
+#define nsProfiler_h
+
+#include "mozilla/Attributes.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/MozPromise.h"
+#include "mozilla/ProfileJSONWriter.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/Vector.h"
+#include "nsIObserver.h"
+#include "nsIProfiler.h"
+#include "nsITimer.h"
+#include "nsServiceManagerUtils.h"
+#include "ProfilerCodeAddressService.h"
+
+class nsProfiler final : public nsIProfiler, public nsIObserver {
+ public:
+  nsProfiler();
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+  NS_DECL_NSIPROFILER
+
+  nsresult Init();
+
+  static nsProfiler* GetOrCreate() {
+    nsCOMPtr<nsIProfiler> iprofiler =
+        do_GetService("@mozilla.org/tools/profiler;1");
+    return static_cast<nsProfiler*>(iprofiler.get());
+  }
+
+  void GatheredOOPProfile(const nsACString& aProfile);
+
+ private:
+  ~nsProfiler();
+
+  typedef mozilla::MozPromise<nsCString, nsresult, false> GatheringPromise;
+  typedef mozilla::MozPromise<mozilla::SymbolTable, nsresult, true>
+      SymbolTablePromise;
+
+  RefPtr<GatheringPromise> StartGathering(double aSinceTime);
+  void FinishGathering();
+  void ResetGathering();
+  static void GatheringTimerCallback(nsITimer* aTimer, void* aClosure);
+
+  RefPtr<SymbolTablePromise> GetSymbolTableMozPromise(
+      const nsACString& aDebugPath, const nsACString& aBreakpadID);
+
+  bool mLockedForPrivateBrowsing;
+
+  struct ExitProfile {
+    nsCString mJSON;
+    uint64_t mBufferPositionAtGatherTime;
+  };
+
+  // These fields are all related to profile gathering.
+  mozilla::Vector<ExitProfile> mExitProfiles;
+  mozilla::Maybe<mozilla::MozPromiseHolder<GatheringPromise>> mPromiseHolder;
+  nsCOMPtr<nsIThread> mSymbolTableThread;
+  mozilla::Maybe<SpliceableChunkedJSONWriter> mWriter;
+  uint32_t mPendingProfiles;
+  bool mGathering;
+  nsCOMPtr<nsITimer> mGatheringTimer;
+};
+
+#endif  // nsProfiler_h
diff --git a/tools/profiler/gecko/nsProfilerCIID.h b/tools/profiler/gecko/nsProfilerCIID.h
new file mode 100644
index 0000000000..3df44596b1
--- /dev/null
+++ b/tools/profiler/gecko/nsProfilerCIID.h
@@ -0,0 +1,16 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsProfilerCIID_h__
+#define nsProfilerCIID_h__
+
+#define NS_PROFILER_CID                              \
+  {                                                  \
+    0x25db9b8e, 0x8123, 0x4de1, {                    \
+      0xb6, 0x6d, 0x8b, 0xbb, 0xed, 0xf2, 0xcd, 0xf4 \
+    }                                                \
+  }
+
+#endif
diff --git a/tools/profiler/gecko/nsProfilerStartParams.cpp b/tools/profiler/gecko/nsProfilerStartParams.cpp
new file mode 100644
index 0000000000..dfe1102668
--- /dev/null
+++ b/tools/profiler/gecko/nsProfilerStartParams.cpp
@@ -0,0 +1,66 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsProfilerStartParams.h"
+#include "ipc/IPCMessageUtils.h"
+
+NS_IMPL_ISUPPORTS(nsProfilerStartParams, nsIProfilerStartParams)
+
+nsProfilerStartParams::nsProfilerStartParams(
+    uint32_t aEntries, const mozilla::Maybe<double>& aDuration,
+    double aInterval, uint32_t aFeatures, nsTArray<nsCString>&& aFilters,
+    uint64_t aActiveBrowsingContextID)
+    : mEntries(aEntries),
+      mDuration(aDuration),
+      mInterval(aInterval),
+      mFeatures(aFeatures),
+      mFilters(std::move(aFilters)),
+      mActiveBrowsingContextID(aActiveBrowsingContextID) {}
+
+nsProfilerStartParams::~nsProfilerStartParams() {}
+
+NS_IMETHODIMP
+nsProfilerStartParams::GetEntries(uint32_t* aEntries) {
+  NS_ENSURE_ARG_POINTER(aEntries);
+  *aEntries = mEntries;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfilerStartParams::GetDuration(double* aDuration) {
+  NS_ENSURE_ARG_POINTER(aDuration);
+  if (mDuration) {
+    *aDuration = *mDuration;
+  } else {
+    *aDuration = 0;
+  }
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfilerStartParams::GetInterval(double* aInterval) {
+  NS_ENSURE_ARG_POINTER(aInterval);
+  *aInterval = mInterval;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProfilerStartParams::GetFeatures(uint32_t* aFeatures) {
+  NS_ENSURE_ARG_POINTER(aFeatures);
+  *aFeatures = mFeatures;
+  return NS_OK;
+}
+
+const nsTArray<nsCString>& nsProfilerStartParams::GetFilters() {
+  return mFilters;
+}
+
+NS_IMETHODIMP
+nsProfilerStartParams::GetActiveBrowsingContextID(
+    uint64_t* aActiveBrowsingContextID) {
+  NS_ENSURE_ARG_POINTER(aActiveBrowsingContextID);
+  *aActiveBrowsingContextID = mActiveBrowsingContextID;
+  return NS_OK;
+}
diff --git a/tools/profiler/gecko/nsProfilerStartParams.h b/tools/profiler/gecko/nsProfilerStartParams.h
new file mode 100644
index 0000000000..c06439c357
--- /dev/null
+++ b/tools/profiler/gecko/nsProfilerStartParams.h
@@ -0,0 +1,37 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _NSPROFILERSTARTPARAMS_H_
+#define _NSPROFILERSTARTPARAMS_H_
+
+#include "nsIProfiler.h"
+#include "nsString.h"
+#include "nsTArray.h"
+
+class nsProfilerStartParams : public nsIProfilerStartParams {
+ public:
+  // This class can be used on multiple threads. For example, it's used for the
+  // observer notification from profiler_start, which can run on any thread but
+  // posts the notification to the main thread.
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIPROFILERSTARTPARAMS
+
+  nsProfilerStartParams(uint32_t aEntries,
+                        const mozilla::Maybe<double>& aDuration,
+                        double aInterval, uint32_t aFeatures,
+                        nsTArray<nsCString>&& aFilters,
+                        uint64_t aActiveBrowsingContextID);
+
+ private:
+  virtual ~nsProfilerStartParams();
+  uint32_t mEntries;
+  mozilla::Maybe<double> mDuration;
+  double mInterval;
+  uint32_t mFeatures;
+  nsTArray<nsCString> mFilters;
+  uint64_t mActiveBrowsingContextID;
+};
+
+#endif
diff --git a/tools/profiler/lul/AutoObjectMapper.cpp b/tools/profiler/lul/AutoObjectMapper.cpp
new file mode 100644
index 0000000000..f7489fbfee
--- /dev/null
+++ b/tools/profiler/lul/AutoObjectMapper.cpp
@@ -0,0 +1,79 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <sys/mman.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include "mozilla/Assertions.h"
+#include "mozilla/Sprintf.h"
+
+#include "PlatformMacros.h"
+#include "AutoObjectMapper.h"
+
+// A helper function for creating failure error messages in
+// AutoObjectMapper*::Map.
+static void failedToMessage(void (*aLog)(const char*), const char* aHowFailed,
+                            std::string aFileName) {
+  char buf[300];
+  SprintfLiteral(buf, "AutoObjectMapper::Map: Failed to %s \'%s\'", aHowFailed,
+                 aFileName.c_str());
+  buf[sizeof(buf) - 1] = 0;
+  aLog(buf);
+}
+
+AutoObjectMapperPOSIX::AutoObjectMapperPOSIX(void (*aLog)(const char*))
+    : mImage(nullptr), mSize(0), mLog(aLog), mIsMapped(false) {}
+
+AutoObjectMapperPOSIX::~AutoObjectMapperPOSIX() {
+  if (!mIsMapped) {
+    // There's nothing to do.
+    MOZ_ASSERT(!mImage);
+    MOZ_ASSERT(mSize == 0);
+    return;
+  }
+  MOZ_ASSERT(mSize > 0);
+  // The following assertion doesn't necessarily have to be true,
+  // but we assume (reasonably enough) that no mmap facility would
+  // be crazy enough to map anything at page zero.
+  MOZ_ASSERT(mImage);
+  munmap(mImage, mSize);
+}
+
+bool AutoObjectMapperPOSIX::Map(/*OUT*/ void** start, /*OUT*/ size_t* length,
+                                std::string fileName) {
+  MOZ_ASSERT(!mIsMapped);
+
+  int fd = open(fileName.c_str(), O_RDONLY);
+  if (fd == -1) {
+    failedToMessage(mLog, "open", fileName);
+    return false;
+  }
+
+  struct stat st;
+  int err = fstat(fd, &st);
+  size_t sz = (err == 0) ? st.st_size : 0;
+  if (err != 0 || sz == 0) {
+    failedToMessage(mLog, "fstat", fileName);
+    close(fd);
+    return false;
+  }
+
+  void* image = mmap(nullptr, sz, PROT_READ, MAP_SHARED, fd, 0);
+  if (image == MAP_FAILED) {
+    failedToMessage(mLog, "mmap", fileName);
+    close(fd);
+    return false;
+  }
+
+  close(fd);
+  mIsMapped = true;
+  mImage = *start = image;
+  mSize = *length = sz;
+  return true;
+}
diff --git a/tools/profiler/lul/AutoObjectMapper.h b/tools/profiler/lul/AutoObjectMapper.h
new file mode 100644
index 0000000000..f63aa43e0e
--- /dev/null
+++ b/tools/profiler/lul/AutoObjectMapper.h
@@ -0,0 +1,64 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef AutoObjectMapper_h
+#define AutoObjectMapper_h
+
+#include <string>
+
+#include "mozilla/Attributes.h"
+#include "PlatformMacros.h"
+
+// A (nearly-) RAII class that maps an object in and then unmaps it on
+// destruction.  This base class version uses the "normal" POSIX
+// functions: open, fstat, close, mmap, munmap.
+
+class MOZ_STACK_CLASS AutoObjectMapperPOSIX {
+ public:
+  // The constructor does not attempt to map the file, because that
+  // might fail.  Instead, once the object has been constructed,
+  // call Map() to attempt the mapping.  There is no corresponding
+  // Unmap() since the unmapping is done in the destructor.  Failure
+  // messages are sent to |aLog|.
+  explicit AutoObjectMapperPOSIX(void (*aLog)(const char*));
+
+  // Unmap the file on destruction of this object.
+  ~AutoObjectMapperPOSIX();
+
+  // Map |fileName| into the address space and return the mapping
+  // extents.  If the file is zero sized this will fail.  The file is
+  // mapped read-only and private.  Returns true iff the mapping
+  // succeeded, in which case *start and *length hold its extent.
+  // Once a call to Map succeeds, all subsequent calls to it will
+  // fail.
+  bool Map(/*OUT*/ void** start, /*OUT*/ size_t* length, std::string fileName);
+
+ protected:
+  // If we are currently holding a mapped object, these record the
+  // mapped address range.
+  void* mImage;
+  size_t mSize;
+
+  // A logging sink, for complaining about mapping failures.
+  void (*mLog)(const char*);
+
+ private:
+  // Are we currently holding a mapped object?  This is private to
+  // the base class.  Derived classes need to have their own way to
+  // track whether they are holding a mapped object.
+  bool mIsMapped;
+
+  // Disable copying and assignment.
+  AutoObjectMapperPOSIX(const AutoObjectMapperPOSIX&);
+  AutoObjectMapperPOSIX& operator=(const AutoObjectMapperPOSIX&);
+  // Disable heap allocation of this class.
+  void* operator new(size_t);
+  void* operator new[](size_t);
+  void operator delete(void*);
+  void operator delete[](void*);
+};
+
+#endif  // AutoObjectMapper_h
diff --git a/tools/profiler/lul/LulCommon.cpp b/tools/profiler/lul/LulCommon.cpp
new file mode 100644
index 0000000000..428f102c42
--- /dev/null
+++ b/tools/profiler/lul/LulCommon.cpp
@@ -0,0 +1,100 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+
+// Copyright (c) 2011, 2013 Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Original author: Jim Blandy <jimb@mozilla.com> <jimb@red-bean.com>
+
+// This file is derived from the following files in
+// toolkit/crashreporter/google-breakpad:
+//   src/common/module.cc
+//   src/common/unique_string.cc
+
+// There's no internal-only interface for LulCommon.  Hence include
+// the external interface directly.
+#include "LulCommonExt.h"
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <string>
+#include <map>
+
+namespace lul {
+
+using std::string;
+
+////////////////////////////////////////////////////////////////
+// Module
+//
+Module::Module(const string& name, const string& os, const string& architecture,
+               const string& id)
+    : name_(name), os_(os), architecture_(architecture), id_(id) {}
+
+Module::~Module() {}
+
+////////////////////////////////////////////////////////////////
+// UniqueString
+//
+class UniqueString {
+ public:
+  explicit UniqueString(string str) { str_ = strdup(str.c_str()); }
+  ~UniqueString() { free(reinterpret_cast<void*>(const_cast<char*>(str_))); }
+  const char* str_;
+};
+
+const char* FromUniqueString(const UniqueString* ustr) { return ustr->str_; }
+
+bool IsEmptyUniqueString(const UniqueString* ustr) {
+  return (ustr->str_)[0] == '\0';
+}
+
+////////////////////////////////////////////////////////////////
+// UniqueStringUniverse
+//
+UniqueStringUniverse::~UniqueStringUniverse() {
+  for (std::map<string, UniqueString*>::iterator it = map_.begin();
+       it != map_.end(); it++) {
+    delete it->second;
+  }
+}
+
+const UniqueString* UniqueStringUniverse::ToUniqueString(string str) {
+  std::map<string, UniqueString*>::iterator it = map_.find(str);
+  if (it == map_.end()) {
+    UniqueString* ustr = new UniqueString(str);
+    map_[str] = ustr;
+    return ustr;
+  } else {
+    return it->second;
+  }
+}
+
+}  // namespace lul
diff --git a/tools/profiler/lul/LulCommonExt.h b/tools/profiler/lul/LulCommonExt.h
new file mode 100644
index 0000000000..b20a7321ff
--- /dev/null
+++ b/tools/profiler/lul/LulCommonExt.h
@@ -0,0 +1,509 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+
+// Copyright (c) 2006, 2010, 2012, 2013 Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Original author: Jim Blandy <jimb@mozilla.com> <jimb@red-bean.com>
+
+// module.h: Define google_breakpad::Module. A Module holds debugging
+// information, and can write that information out as a Breakpad
+// symbol file.
+
+//  (C) Copyright Greg Colvin and Beman Dawes 1998, 1999.
+//  Copyright (c) 2001, 2002 Peter Dimov
+//
+//  Permission to copy, use, modify, sell and distribute this software
+//  is granted provided this copyright notice appears in all copies.
+//  This software is provided "as is" without express or implied
+//  warranty, and with no claim as to its suitability for any purpose.
+//
+//  See http://www.boost.org/libs/smart_ptr/scoped_ptr.htm for documentation.
+//
+
+// This file is derived from the following files in
+// toolkit/crashreporter/google-breakpad:
+//   src/common/unique_string.h
+//   src/common/scoped_ptr.h
+//   src/common/module.h
+
+// External interface for the "Common" component of LUL.
+
+#ifndef LulCommonExt_h
+#define LulCommonExt_h
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdint.h>
+
+#include <string>
+#include <map>
+#include <vector>
+#include <cstddef>  // for std::ptrdiff_t
+
+#include "mozilla/Assertions.h"
+
+namespace lul {
+
+using std::map;
+using std::string;
+
+////////////////////////////////////////////////////////////////
+// UniqueString
+//
+
+// Abstract type
+class UniqueString;
+
+// Get the contained C string (debugging only)
+const char* FromUniqueString(const UniqueString*);
+
+// Is the given string empty (that is, "") ?
+bool IsEmptyUniqueString(const UniqueString*);
+
+////////////////////////////////////////////////////////////////
+// UniqueStringUniverse
+//
+
+// All UniqueStrings live in some specific UniqueStringUniverse.
+class UniqueStringUniverse {
+ public:
+  UniqueStringUniverse() {}
+  ~UniqueStringUniverse();
+  // Convert a |string| to a UniqueString, that lives in this universe.
+  const UniqueString* ToUniqueString(string str);
+
+ private:
+  map<string, UniqueString*> map_;
+};
+
+////////////////////////////////////////////////////////////////
+// GUID
+//
+
+typedef struct {
+  uint32_t data1;
+  uint16_t data2;
+  uint16_t data3;
+  uint8_t data4[8];
+} MDGUID;  // GUID
+
+typedef MDGUID GUID;
+
+////////////////////////////////////////////////////////////////
+// scoped_ptr
+//
+
+//  scoped_ptr mimics a built-in pointer except that it guarantees deletion
+//  of the object pointed to, either on destruction of the scoped_ptr or via
+//  an explicit reset(). scoped_ptr is a simple solution for simple needs;
+//  use shared_ptr or std::auto_ptr if your needs are more complex.
+
+//  *** NOTE ***
+//  If your scoped_ptr is a class member of class FOO pointing to a
+//  forward declared type BAR (as shown below), then you MUST use a non-inlined
+//  version of the destructor.  The destructor of a scoped_ptr (called from
+//  FOO's destructor) must have a complete definition of BAR in order to
+//  destroy it.  Example:
+//
+//  -- foo.h --
+//  class BAR;
+//
+//  class FOO {
+//   public:
+//    FOO();
+//    ~FOO();  // Required for sources that instantiate class FOO to compile!
+//
+//   private:
+//    scoped_ptr<BAR> bar_;
+//  };
+//
+//  -- foo.cc --
+//  #include "foo.h"
+//  FOO::~FOO() {} // Empty, but must be non-inlined to FOO's class definition.
+
+//  scoped_ptr_malloc added by Google
+//  When one of these goes out of scope, instead of doing a delete or
+//  delete[], it calls free().  scoped_ptr_malloc<char> is likely to see
+//  much more use than any other specializations.
+
+//  release() added by Google
+//  Use this to conditionally transfer ownership of a heap-allocated object
+//  to the caller, usually on method success.
+
+template <typename T>
+class scoped_ptr {
+ private:
+  T* ptr;
+
+  scoped_ptr(scoped_ptr const&);
+  scoped_ptr& operator=(scoped_ptr const&);
+
+ public:
+  typedef T element_type;
+
+  explicit scoped_ptr(T* p = 0) : ptr(p) {}
+
+  ~scoped_ptr() { delete ptr; }
+
+  void reset(T* p = 0) {
+    if (ptr != p) {
+      delete ptr;
+      ptr = p;
+    }
+  }
+
+  T& operator*() const {
+    MOZ_ASSERT(ptr != 0);
+    return *ptr;
+  }
+
+  T* operator->() const {
+    MOZ_ASSERT(ptr != 0);
+    return ptr;
+  }
+
+  bool operator==(T* p) const { return ptr == p; }
+
+  bool operator!=(T* p) const { return ptr != p; }
+
+  T* get() const { return ptr; }
+
+  void swap(scoped_ptr& b) {
+    T* tmp = b.ptr;
+    b.ptr = ptr;
+    ptr = tmp;
+  }
+
+  T* release() {
+    T* tmp = ptr;
+    ptr = 0;
+    return tmp;
+  }
+
+ private:
+  // no reason to use these: each scoped_ptr should have its own object
+  template <typename U>
+  bool operator==(scoped_ptr<U> const& p) const;
+  template <typename U>
+  bool operator!=(scoped_ptr<U> const& p) const;
+};
+
+template <typename T>
+inline void swap(scoped_ptr<T>& a, scoped_ptr<T>& b) {
+  a.swap(b);
+}
+
+template <typename T>
+inline bool operator==(T* p, const scoped_ptr<T>& b) {
+  return p == b.get();
+}
+
+template <typename T>
+inline bool operator!=(T* p, const scoped_ptr<T>& b) {
+  return p != b.get();
+}
+
+//  scoped_array extends scoped_ptr to arrays. Deletion of the array pointed to
+//  is guaranteed, either on destruction of the scoped_array or via an explicit
+//  reset(). Use shared_array or std::vector if your needs are more complex.
+
+template <typename T>
+class scoped_array {
+ private:
+  T* ptr;
+
+  scoped_array(scoped_array const&);
+  scoped_array& operator=(scoped_array const&);
+
+ public:
+  typedef T element_type;
+
+  explicit scoped_array(T* p = 0) : ptr(p) {}
+
+  ~scoped_array() { delete[] ptr; }
+
+  void reset(T* p = 0) {
+    if (ptr != p) {
+      delete[] ptr;
+      ptr = p;
+    }
+  }
+
+  T& operator[](std::ptrdiff_t i) const {
+    MOZ_ASSERT(ptr != 0);
+    MOZ_ASSERT(i >= 0);
+    return ptr[i];
+  }
+
+  bool operator==(T* p) const { return ptr == p; }
+
+  bool operator!=(T* p) const { return ptr != p; }
+
+  T* get() const { return ptr; }
+
+  void swap(scoped_array& b) {
+    T* tmp = b.ptr;
+    b.ptr = ptr;
+    ptr = tmp;
+  }
+
+  T* release() {
+    T* tmp = ptr;
+    ptr = 0;
+    return tmp;
+  }
+
+ private:
+  // no reason to use these: each scoped_array should have its own object
+  template <typename U>
+  bool operator==(scoped_array<U> const& p) const;
+  template <typename U>
+  bool operator!=(scoped_array<U> const& p) const;
+};
+
+template <class T>
+inline void swap(scoped_array<T>& a, scoped_array<T>& b) {
+  a.swap(b);
+}
+
+template <typename T>
+inline bool operator==(T* p, const scoped_array<T>& b) {
+  return p == b.get();
+}
+
+template <typename T>
+inline bool operator!=(T* p, const scoped_array<T>& b) {
+  return p != b.get();
+}
+
+// This class wraps the c library function free() in a class that can be
+// passed as a template argument to scoped_ptr_malloc below.
+class ScopedPtrMallocFree {
+ public:
+  inline void operator()(void* x) const { free(x); }
+};
+
+// scoped_ptr_malloc<> is similar to scoped_ptr<>, but it accepts a
+// second template argument, the functor used to free the object.
+
+template <typename T, typename FreeProc = ScopedPtrMallocFree>
+class scoped_ptr_malloc {
+ private:
+  T* ptr;
+
+  scoped_ptr_malloc(scoped_ptr_malloc const&);
+  scoped_ptr_malloc& operator=(scoped_ptr_malloc const&);
+
+ public:
+  typedef T element_type;
+
+  explicit scoped_ptr_malloc(T* p = 0) : ptr(p) {}
+
+  ~scoped_ptr_malloc() { free_((void*)ptr); }
+
+  void reset(T* p = 0) {
+    if (ptr != p) {
+      free_((void*)ptr);
+      ptr = p;
+    }
+  }
+
+  T& operator*() const {
+    MOZ_ASSERT(ptr != 0);
+    return *ptr;
+  }
+
+  T* operator->() const {
+    MOZ_ASSERT(ptr != 0);
+    return ptr;
+  }
+
+  bool operator==(T* p) const { return ptr == p; }
+
+  bool operator!=(T* p) const { return ptr != p; }
+
+  T* get() const { return ptr; }
+
+  void swap(scoped_ptr_malloc& b) {
+    T* tmp = b.ptr;
+    b.ptr = ptr;
+    ptr = tmp;
+  }
+
+  T* release() {
+    T* tmp = ptr;
+    ptr = 0;
+    return tmp;
+  }
+
+ private:
+  // no reason to use these: each scoped_ptr_malloc should have its own object
+  template <typename U, typename GP>
+  bool operator==(scoped_ptr_malloc<U, GP> const& p) const;
+  template <typename U, typename GP>
+  bool operator!=(scoped_ptr_malloc<U, GP> const& p) const;
+
+  static FreeProc const free_;
+};
+
+template <typename T, typename FP>
+FP const scoped_ptr_malloc<T, FP>::free_ = FP();
+
+template <typename T, typename FP>
+inline void swap(scoped_ptr_malloc<T, FP>& a, scoped_ptr_malloc<T, FP>& b) {
+  a.swap(b);
+}
+
+template <typename T, typename FP>
+inline bool operator==(T* p, const scoped_ptr_malloc<T, FP>& b) {
+  return p == b.get();
+}
+
+template <typename T, typename FP>
+inline bool operator!=(T* p, const scoped_ptr_malloc<T, FP>& b) {
+  return p != b.get();
+}
+
+////////////////////////////////////////////////////////////////
+// Module
+//
+
+// A Module represents the contents of a module, and supports methods
+// for adding information produced by parsing STABS or DWARF data
+// --- possibly both from the same file --- and then writing out the
+// unified contents as a Breakpad-format symbol file.
+class Module {
+ public:
+  // The type of addresses and sizes in a symbol table.
+  typedef uint64_t Address;
+
+  // Representation of an expression.  This can either be a postfix
+  // expression, in which case it is stored as a string, or a simple
+  // expression of the form (identifier + imm) or *(identifier + imm).
+  // It can also be invalid (denoting "no value").
+  enum ExprHow { kExprInvalid = 1, kExprPostfix, kExprSimple, kExprSimpleMem };
+
+  struct Expr {
+    // Construct a simple-form expression
+    Expr(const UniqueString* ident, long offset, bool deref) {
+      if (IsEmptyUniqueString(ident)) {
+        Expr();
+      } else {
+        postfix_ = "";
+        ident_ = ident;
+        offset_ = offset;
+        how_ = deref ? kExprSimpleMem : kExprSimple;
+      }
+    }
+
+    // Construct an invalid expression
+    Expr() {
+      postfix_ = "";
+      ident_ = nullptr;
+      offset_ = 0;
+      how_ = kExprInvalid;
+    }
+
+    // Return the postfix expression string, either directly,
+    // if this is a postfix expression, or by synthesising it
+    // for a simple expression.
+    std::string getExprPostfix() const {
+      switch (how_) {
+        case kExprPostfix:
+          return postfix_;
+        case kExprSimple:
+        case kExprSimpleMem: {
+          char buf[40];
+          sprintf(buf, " %ld %c%s", labs(offset_), offset_ < 0 ? '-' : '+',
+                  how_ == kExprSimple ? "" : " ^");
+          return std::string(FromUniqueString(ident_)) + std::string(buf);
+        }
+        case kExprInvalid:
+        default:
+          MOZ_ASSERT(0 && "getExprPostfix: invalid Module::Expr type");
+          return "Expr::genExprPostfix: kExprInvalid";
+      }
+    }
+
+    // The identifier that gives the starting value for simple expressions.
+    const UniqueString* ident_;
+    // The offset to add for simple expressions.
+    long offset_;
+    // The Postfix expression string to evaluate for non-simple expressions.
+    std::string postfix_;
+    // The operation expressed by this expression.
+    ExprHow how_;
+  };
+
+  // A map from register names to expressions that recover
+  // their values. This can represent a complete set of rules to
+  // follow at some address, or a set of changes to be applied to an
+  // extant set of rules.
+  // NOTE! there are two completely different types called RuleMap.  This
+  // is one of them.
+  typedef std::map<const UniqueString*, Expr> RuleMap;
+
+  // A map from addresses to RuleMaps, representing changes that take
+  // effect at given addresses.
+  typedef std::map<Address, RuleMap> RuleChangeMap;
+
+  // A range of 'STACK CFI' stack walking information. An instance of
+  // this structure corresponds to a 'STACK CFI INIT' record and the
+  // subsequent 'STACK CFI' records that fall within its range.
+  struct StackFrameEntry {
+    // The starting address and number of bytes of machine code this
+    // entry covers.
+    Address address, size;
+
+    // The initial register recovery rules, in force at the starting
+    // address.
+    RuleMap initial_rules;
+
+    // A map from addresses to rule changes. To find the rules in
+    // force at a given address, start with initial_rules, and then
+    // apply the changes given in this map for all addresses up to and
+    // including the address you're interested in.
+    RuleChangeMap rule_changes;
+  };
+
+  // Create a new module with the given name, operating system,
+  // architecture, and ID string.
+  Module(const std::string& name, const std::string& os,
+         const std::string& architecture, const std::string& id);
+  ~Module();
+
+ private:
+  // Module header entries.
+  std::string name_, os_, architecture_, id_;
+};
+
+}  // namespace lul
+
+#endif  // LulCommonExt_h
diff --git a/tools/profiler/lul/LulDwarf.cpp b/tools/profiler/lul/LulDwarf.cpp
new file mode 100644
index 0000000000..c83296fc62
--- /dev/null
+++ b/tools/profiler/lul/LulDwarf.cpp
@@ -0,0 +1,2252 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+
+// Copyright (c) 2010 Google Inc. All Rights Reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// CFI reader author: Jim Blandy <jimb@mozilla.com> <jimb@red-bean.com>
+// Original author: Jim Blandy <jimb@mozilla.com> <jimb@red-bean.com>
+
+// Implementation of dwarf2reader::LineInfo, dwarf2reader::CompilationUnit,
+// and dwarf2reader::CallFrameInfo. See dwarf2reader.h for details.
+
+// This file is derived from the following files in
+// toolkit/crashreporter/google-breakpad:
+//   src/common/dwarf/bytereader.cc
+//   src/common/dwarf/dwarf2reader.cc
+//   src/common/dwarf_cfi_to_module.cc
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <map>
+#include <stack>
+#include <string>
+
+#include "mozilla/Assertions.h"
+#include "mozilla/Sprintf.h"
+
+#include "LulCommonExt.h"
+#include "LulDwarfInt.h"
+
+// Set this to 1 for verbose logging
+#define DEBUG_DWARF 0
+
+namespace lul {
+
+using std::string;
+
+ByteReader::ByteReader(enum Endianness endian)
+    : offset_reader_(NULL),
+      address_reader_(NULL),
+      endian_(endian),
+      address_size_(0),
+      offset_size_(0),
+      have_section_base_(),
+      have_text_base_(),
+      have_data_base_(),
+      have_function_base_() {}
+
+ByteReader::~ByteReader() {}
+
+void ByteReader::SetOffsetSize(uint8 size) {
+  offset_size_ = size;
+  MOZ_ASSERT(size == 4 || size == 8);
+  if (size == 4) {
+    this->offset_reader_ = &ByteReader::ReadFourBytes;
+  } else {
+    this->offset_reader_ = &ByteReader::ReadEightBytes;
+  }
+}
+
+void ByteReader::SetAddressSize(uint8 size) {
+  address_size_ = size;
+  MOZ_ASSERT(size == 4 || size == 8);
+  if (size == 4) {
+    this->address_reader_ = &ByteReader::ReadFourBytes;
+  } else {
+    this->address_reader_ = &ByteReader::ReadEightBytes;
+  }
+}
+
+uint64 ByteReader::ReadInitialLength(const char* start, size_t* len) {
+  const uint64 initial_length = ReadFourBytes(start);
+  start += 4;
+
+  // In DWARF2/3, if the initial length is all 1 bits, then the offset
+  // size is 8 and we need to read the next 8 bytes for the real length.
+  if (initial_length == 0xffffffff) {
+    SetOffsetSize(8);
+    *len = 12;
+    return ReadOffset(start);
+  } else {
+    SetOffsetSize(4);
+    *len = 4;
+  }
+  return initial_length;
+}
+
+bool ByteReader::ValidEncoding(DwarfPointerEncoding encoding) const {
+  if (encoding == DW_EH_PE_omit) return true;
+  if (encoding == DW_EH_PE_aligned) return true;
+  if ((encoding & 0x7) > DW_EH_PE_udata8) return false;
+  if ((encoding & 0x70) > DW_EH_PE_funcrel) return false;
+  return true;
+}
+
+bool ByteReader::UsableEncoding(DwarfPointerEncoding encoding) const {
+  switch (encoding & 0x70) {
+    case DW_EH_PE_absptr:
+      return true;
+    case DW_EH_PE_pcrel:
+      return have_section_base_;
+    case DW_EH_PE_textrel:
+      return have_text_base_;
+    case DW_EH_PE_datarel:
+      return have_data_base_;
+    case DW_EH_PE_funcrel:
+      return have_function_base_;
+    default:
+      return false;
+  }
+}
+
+uint64 ByteReader::ReadEncodedPointer(const char* buffer,
+                                      DwarfPointerEncoding encoding,
+                                      size_t* len) const {
+  // UsableEncoding doesn't approve of DW_EH_PE_omit, so we shouldn't
+  // see it here.
+  MOZ_ASSERT(encoding != DW_EH_PE_omit);
+
+  // The Linux Standards Base 4.0 does not make this clear, but the
+  // GNU tools (gcc/unwind-pe.h; readelf/dwarf.c; gdb/dwarf2-frame.c)
+  // agree that aligned pointers are always absolute, machine-sized,
+  // machine-signed pointers.
+  if (encoding == DW_EH_PE_aligned) {
+    MOZ_ASSERT(have_section_base_);
+
+    // We don't need to align BUFFER in *our* address space. Rather, we
+    // need to find the next position in our buffer that would be aligned
+    // when the .eh_frame section the buffer contains is loaded into the
+    // program's memory. So align assuming that buffer_base_ gets loaded at
+    // address section_base_, where section_base_ itself may or may not be
+    // aligned.
+
+    // First, find the offset to START from the closest prior aligned
+    // address.
+    uint64 skew = section_base_ & (AddressSize() - 1);
+    // Now find the offset from that aligned address to buffer.
+    uint64 offset = skew + (buffer - buffer_base_);
+    // Round up to the next boundary.
+    uint64 aligned = (offset + AddressSize() - 1) & -AddressSize();
+    // Convert back to a pointer.
+    const char* aligned_buffer = buffer_base_ + (aligned - skew);
+    // Finally, store the length and actually fetch the pointer.
+    *len = aligned_buffer - buffer + AddressSize();
+    return ReadAddress(aligned_buffer);
+  }
+
+  // Extract the value first, ignoring whether it's a pointer or an
+  // offset relative to some base.
+  uint64 offset;
+  switch (encoding & 0x0f) {
+    case DW_EH_PE_absptr:
+      // DW_EH_PE_absptr is weird, as it is used as a meaningful value for
+      // both the high and low nybble of encoding bytes. When it appears in
+      // the high nybble, it means that the pointer is absolute, not an
+      // offset from some base address. When it appears in the low nybble,
+      // as here, it means that the pointer is stored as a normal
+      // machine-sized and machine-signed address. A low nybble of
+      // DW_EH_PE_absptr does not imply that the pointer is absolute; it is
+      // correct for us to treat the value as an offset from a base address
+      // if the upper nybble is not DW_EH_PE_absptr.
+      offset = ReadAddress(buffer);
+      *len = AddressSize();
+      break;
+
+    case DW_EH_PE_uleb128:
+      offset = ReadUnsignedLEB128(buffer, len);
+      break;
+
+    case DW_EH_PE_udata2:
+      offset = ReadTwoBytes(buffer);
+      *len = 2;
+      break;
+
+    case DW_EH_PE_udata4:
+      offset = ReadFourBytes(buffer);
+      *len = 4;
+      break;
+
+    case DW_EH_PE_udata8:
+      offset = ReadEightBytes(buffer);
+      *len = 8;
+      break;
+
+    case DW_EH_PE_sleb128:
+      offset = ReadSignedLEB128(buffer, len);
+      break;
+
+    case DW_EH_PE_sdata2:
+      offset = ReadTwoBytes(buffer);
+      // Sign-extend from 16 bits.
+      offset = (offset ^ 0x8000) - 0x8000;
+      *len = 2;
+      break;
+
+    case DW_EH_PE_sdata4:
+      offset = ReadFourBytes(buffer);
+      // Sign-extend from 32 bits.
+      offset = (offset ^ 0x80000000ULL) - 0x80000000ULL;
+      *len = 4;
+      break;
+
+    case DW_EH_PE_sdata8:
+      // No need to sign-extend; this is the full width of our type.
+      offset = ReadEightBytes(buffer);
+      *len = 8;
+      break;
+
+    default:
+      abort();
+  }
+
+  // Find the appropriate base address.
+  uint64 base;
+  switch (encoding & 0x70) {
+    case DW_EH_PE_absptr:
+      base = 0;
+      break;
+
+    case DW_EH_PE_pcrel:
+      MOZ_ASSERT(have_section_base_);
+      base = section_base_ + (buffer - buffer_base_);
+      break;
+
+    case DW_EH_PE_textrel:
+      MOZ_ASSERT(have_text_base_);
+      base = text_base_;
+      break;
+
+    case DW_EH_PE_datarel:
+      MOZ_ASSERT(have_data_base_);
+      base = data_base_;
+      break;
+
+    case DW_EH_PE_funcrel:
+      MOZ_ASSERT(have_function_base_);
+      base = function_base_;
+      break;
+
+    default:
+      abort();
+  }
+
+  uint64 pointer = base + offset;
+
+  // Remove inappropriate upper bits.
+  if (AddressSize() == 4)
+    pointer = pointer & 0xffffffff;
+  else
+    MOZ_ASSERT(AddressSize() == sizeof(uint64));
+
+  return pointer;
+}
+
+// A DWARF rule for recovering the address or value of a register, or
+// computing the canonical frame address. There is one subclass of this for
+// each '*Rule' member function in CallFrameInfo::Handler.
+//
+// It's annoying that we have to handle Rules using pointers (because
+// the concrete instances can have an arbitrary size). They're small,
+// so it would be much nicer if we could just handle them by value
+// instead of fretting about ownership and destruction.
+//
+// It seems like all these could simply be instances of std::tr1::bind,
+// except that we need instances to be EqualityComparable, too.
+//
+// This could logically be nested within State, but then the qualified names
+// get horrendous.
+class CallFrameInfo::Rule {
+ public:
+  virtual ~Rule() {}
+
+  // Tell HANDLER that, at ADDRESS in the program, REG can be
+  // recovered using this rule. If REG is kCFARegister, then this rule
+  // describes how to compute the canonical frame address. Return what the
+  // HANDLER member function returned.
+  virtual bool Handle(Handler* handler, uint64 address, int reg) const = 0;
+
+  // Equality on rules. We use these to decide which rules we need
+  // to report after a DW_CFA_restore_state instruction.
+  virtual bool operator==(const Rule& rhs) const = 0;
+
+  bool operator!=(const Rule& rhs) const { return !(*this == rhs); }
+
+  // Return a pointer to a copy of this rule.
+  virtual Rule* Copy() const = 0;
+
+  // If this is a base+offset rule, change its base register to REG.
+  // Otherwise, do nothing. (Ugly, but required for DW_CFA_def_cfa_register.)
+  virtual void SetBaseRegister(unsigned reg) {}
+
+  // If this is a base+offset rule, change its offset to OFFSET. Otherwise,
+  // do nothing. (Ugly, but required for DW_CFA_def_cfa_offset.)
+  virtual void SetOffset(long long offset) {}
+
+  // A RTTI workaround, to make it possible to implement equality
+  // comparisons on classes derived from this one.
+  enum CFIRTag {
+    CFIR_UNDEFINED_RULE,
+    CFIR_SAME_VALUE_RULE,
+    CFIR_OFFSET_RULE,
+    CFIR_VAL_OFFSET_RULE,
+    CFIR_REGISTER_RULE,
+    CFIR_EXPRESSION_RULE,
+    CFIR_VAL_EXPRESSION_RULE
+  };
+
+  // Produce the tag that identifies the child class of this object.
+  virtual CFIRTag getTag() const = 0;
+};
+
+// Rule: the value the register had in the caller cannot be recovered.
+class CallFrameInfo::UndefinedRule : public CallFrameInfo::Rule {
+ public:
+  UndefinedRule() {}
+  ~UndefinedRule() {}
+  CFIRTag getTag() const override { return CFIR_UNDEFINED_RULE; }
+  bool Handle(Handler* handler, uint64 address, int reg) const override {
+    return handler->UndefinedRule(address, reg);
+  }
+  bool operator==(const Rule& rhs) const override {
+    if (rhs.getTag() != CFIR_UNDEFINED_RULE) return false;
+    return true;
+  }
+  Rule* Copy() const override { return new UndefinedRule(*this); }
+};
+
+// Rule: the register's value is the same as that it had in the caller.
+class CallFrameInfo::SameValueRule : public CallFrameInfo::Rule {
+ public:
+  SameValueRule() {}
+  ~SameValueRule() {}
+  CFIRTag getTag() const override { return CFIR_SAME_VALUE_RULE; }
+  bool Handle(Handler* handler, uint64 address, int reg) const override {
+    return handler->SameValueRule(address, reg);
+  }
+  bool operator==(const Rule& rhs) const override {
+    if (rhs.getTag() != CFIR_SAME_VALUE_RULE) return false;
+    return true;
+  }
+  Rule* Copy() const override { return new SameValueRule(*this); }
+};
+
+// Rule: the register is saved at OFFSET from BASE_REGISTER.  BASE_REGISTER
+// may be CallFrameInfo::Handler::kCFARegister.
+class CallFrameInfo::OffsetRule : public CallFrameInfo::Rule {
+ public:
+  OffsetRule(int base_register, long offset)
+      : base_register_(base_register), offset_(offset) {}
+  ~OffsetRule() {}
+  CFIRTag getTag() const override { return CFIR_OFFSET_RULE; }
+  bool Handle(Handler* handler, uint64 address, int reg) const override {
+    return handler->OffsetRule(address, reg, base_register_, offset_);
+  }
+  bool operator==(const Rule& rhs) const override {
+    if (rhs.getTag() != CFIR_OFFSET_RULE) return false;
+    const OffsetRule* our_rhs = static_cast<const OffsetRule*>(&rhs);
+    return (base_register_ == our_rhs->base_register_ &&
+            offset_ == our_rhs->offset_);
+  }
+  Rule* Copy() const override { return new OffsetRule(*this); }
+  // We don't actually need SetBaseRegister or SetOffset here, since they
+  // are only ever applied to CFA rules, for DW_CFA_def_cfa_offset, and it
+  // doesn't make sense to use OffsetRule for computing the CFA: it
+  // computes the address at which a register is saved, not a value.
+ private:
+  int base_register_;
+  long offset_;
+};
+
+// Rule: the value the register had in the caller is the value of
+// BASE_REGISTER plus offset. BASE_REGISTER may be
+// CallFrameInfo::Handler::kCFARegister.
+class CallFrameInfo::ValOffsetRule : public CallFrameInfo::Rule {
+ public:
+  ValOffsetRule(int base_register, long offset)
+      : base_register_(base_register), offset_(offset) {}
+  ~ValOffsetRule() {}
+  CFIRTag getTag() const override { return CFIR_VAL_OFFSET_RULE; }
+  bool Handle(Handler* handler, uint64 address, int reg) const override {
+    return handler->ValOffsetRule(address, reg, base_register_, offset_);
+  }
+  bool operator==(const Rule& rhs) const override {
+    if (rhs.getTag() != CFIR_VAL_OFFSET_RULE) return false;
+    const ValOffsetRule* our_rhs = static_cast<const ValOffsetRule*>(&rhs);
+    return (base_register_ == our_rhs->base_register_ &&
+            offset_ == our_rhs->offset_);
+  }
+  Rule* Copy() const override { return new ValOffsetRule(*this); }
+  void SetBaseRegister(unsigned reg) override { base_register_ = reg; }
+  void SetOffset(long long offset) override { offset_ = offset; }
+
+ private:
+  int base_register_;
+  long offset_;
+};
+
+// Rule: the register has been saved in another register REGISTER_NUMBER_.
+class CallFrameInfo::RegisterRule : public CallFrameInfo::Rule {
+ public:
+  explicit RegisterRule(int register_number)
+      : register_number_(register_number) {}
+  ~RegisterRule() {}
+  CFIRTag getTag() const override { return CFIR_REGISTER_RULE; }
+  bool Handle(Handler* handler, uint64 address, int reg) const override {
+    return handler->RegisterRule(address, reg, register_number_);
+  }
+  bool operator==(const Rule& rhs) const override {
+    if (rhs.getTag() != CFIR_REGISTER_RULE) return false;
+    const RegisterRule* our_rhs = static_cast<const RegisterRule*>(&rhs);
+    return (register_number_ == our_rhs->register_number_);
+  }
+  Rule* Copy() const override { return new RegisterRule(*this); }
+
+ private:
+  int register_number_;
+};
+
+// Rule: EXPRESSION evaluates to the address at which the register is saved.
+class CallFrameInfo::ExpressionRule : public CallFrameInfo::Rule {
+ public:
+  explicit ExpressionRule(const string& expression) : expression_(expression) {}
+  ~ExpressionRule() {}
+  CFIRTag getTag() const override { return CFIR_EXPRESSION_RULE; }
+  bool Handle(Handler* handler, uint64 address, int reg) const override {
+    return handler->ExpressionRule(address, reg, expression_);
+  }
+  bool operator==(const Rule& rhs) const override {
+    if (rhs.getTag() != CFIR_EXPRESSION_RULE) return false;
+    const ExpressionRule* our_rhs = static_cast<const ExpressionRule*>(&rhs);
+    return (expression_ == our_rhs->expression_);
+  }
+  Rule* Copy() const override { return new ExpressionRule(*this); }
+
+ private:
+  string expression_;
+};
+
+// Rule: EXPRESSION evaluates to the previous value of the register.
+class CallFrameInfo::ValExpressionRule : public CallFrameInfo::Rule {
+ public:
+  explicit ValExpressionRule(const string& expression)
+      : expression_(expression) {}
+  ~ValExpressionRule() {}
+  CFIRTag getTag() const override { return CFIR_VAL_EXPRESSION_RULE; }
+  bool Handle(Handler* handler, uint64 address, int reg) const override {
+    return handler->ValExpressionRule(address, reg, expression_);
+  }
+  bool operator==(const Rule& rhs) const override {
+    if (rhs.getTag() != CFIR_VAL_EXPRESSION_RULE) return false;
+    const ValExpressionRule* our_rhs =
+        static_cast<const ValExpressionRule*>(&rhs);
+    return (expression_ == our_rhs->expression_);
+  }
+  Rule* Copy() const override { return new ValExpressionRule(*this); }
+
+ private:
+  string expression_;
+};
+
+// A map from register numbers to rules.
+class CallFrameInfo::RuleMap {
+ public:
+  RuleMap() : cfa_rule_(NULL) {}
+  RuleMap(const RuleMap& rhs) : cfa_rule_(NULL) { *this = rhs; }
+  ~RuleMap() { Clear(); }
+
+  RuleMap& operator=(const RuleMap& rhs);
+
+  // Set the rule for computing the CFA to RULE. Take ownership of RULE.
+  void SetCFARule(Rule* rule) {
+    delete cfa_rule_;
+    cfa_rule_ = rule;
+  }
+
+  // Return the current CFA rule. Unlike RegisterRule, this RuleMap retains
+  // ownership of the rule. We use this for DW_CFA_def_cfa_offset and
+  // DW_CFA_def_cfa_register, and for detecting references to the CFA before
+  // a rule for it has been established.
+  Rule* CFARule() const { return cfa_rule_; }
+
+  // Return the rule for REG, or NULL if there is none. The caller takes
+  // ownership of the result.
+  Rule* RegisterRule(int reg) const;
+
+  // Set the rule for computing REG to RULE. Take ownership of RULE.
+  void SetRegisterRule(int reg, Rule* rule);
+
+  // Make all the appropriate calls to HANDLER as if we were changing from
+  // this RuleMap to NEW_RULES at ADDRESS. We use this to implement
+  // DW_CFA_restore_state, where lots of rules can change simultaneously.
+  // Return true if all handlers returned true; otherwise, return false.
+  bool HandleTransitionTo(Handler* handler, uint64 address,
+                          const RuleMap& new_rules) const;
+
+ private:
+  // A map from register numbers to Rules.
+  typedef std::map<int, Rule*> RuleByNumber;
+
+  // Remove all register rules and clear cfa_rule_.
+  void Clear();
+
+  // The rule for computing the canonical frame address. This RuleMap owns
+  // this rule.
+  Rule* cfa_rule_;
+
+  // A map from register numbers to postfix expressions to recover
+  // their values. This RuleMap owns the Rules the map refers to.
+  RuleByNumber registers_;
+};
+
+CallFrameInfo::RuleMap& CallFrameInfo::RuleMap::operator=(const RuleMap& rhs) {
+  Clear();
+  // Since each map owns the rules it refers to, assignment must copy them.
+  if (rhs.cfa_rule_) cfa_rule_ = rhs.cfa_rule_->Copy();
+  for (RuleByNumber::const_iterator it = rhs.registers_.begin();
+       it != rhs.registers_.end(); it++)
+    registers_[it->first] = it->second->Copy();
+  return *this;
+}
+
+CallFrameInfo::Rule* CallFrameInfo::RuleMap::RegisterRule(int reg) const {
+  MOZ_ASSERT(reg != Handler::kCFARegister);
+  RuleByNumber::const_iterator it = registers_.find(reg);
+  if (it != registers_.end())
+    return it->second->Copy();
+  else
+    return NULL;
+}
+
+void CallFrameInfo::RuleMap::SetRegisterRule(int reg, Rule* rule) {
+  MOZ_ASSERT(reg != Handler::kCFARegister);
+  MOZ_ASSERT(rule);
+  Rule** slot = &registers_[reg];
+  delete *slot;
+  *slot = rule;
+}
+
+bool CallFrameInfo::RuleMap::HandleTransitionTo(
+    Handler* handler, uint64 address, const RuleMap& new_rules) const {
+  // Transition from cfa_rule_ to new_rules.cfa_rule_.
+  if (cfa_rule_ && new_rules.cfa_rule_) {
+    if (*cfa_rule_ != *new_rules.cfa_rule_ &&
+        !new_rules.cfa_rule_->Handle(handler, address, Handler::kCFARegister))
+      return false;
+  } else if (cfa_rule_) {
+    // this RuleMap has a CFA rule but new_rules doesn't.
+    // CallFrameInfo::Handler has no way to handle this --- and shouldn't;
+    // it's garbage input. The instruction interpreter should have
+    // detected this and warned, so take no action here.
+  } else if (new_rules.cfa_rule_) {
+    // This shouldn't be possible: NEW_RULES is some prior state, and
+    // there's no way to remove entries.
+    MOZ_ASSERT(0);
+  } else {
+    // Both CFA rules are empty.  No action needed.
+  }
+
+  // Traverse the two maps in order by register number, and report
+  // whatever differences we find.
+  RuleByNumber::const_iterator old_it = registers_.begin();
+  RuleByNumber::const_iterator new_it = new_rules.registers_.begin();
+  while (old_it != registers_.end() && new_it != new_rules.registers_.end()) {
+    if (old_it->first < new_it->first) {
+      // This RuleMap has an entry for old_it->first, but NEW_RULES
+      // doesn't.
+      //
+      // This isn't really the right thing to do, but since CFI generally
+      // only mentions callee-saves registers, and GCC's convention for
+      // callee-saves registers is that they are unchanged, it's a good
+      // approximation.
+      if (!handler->SameValueRule(address, old_it->first)) return false;
+      old_it++;
+    } else if (old_it->first > new_it->first) {
+      // NEW_RULES has entry for new_it->first, but this RuleMap
+      // doesn't. This shouldn't be possible: NEW_RULES is some prior
+      // state, and there's no way to remove entries.
+      MOZ_ASSERT(0);
+    } else {
+      // Both maps have an entry for this register. Report the new
+      // rule if it is different.
+      if (*old_it->second != *new_it->second &&
+          !new_it->second->Handle(handler, address, new_it->first))
+        return false;
+      new_it++;
+      old_it++;
+    }
+  }
+  // Finish off entries from this RuleMap with no counterparts in new_rules.
+  while (old_it != registers_.end()) {
+    if (!handler->SameValueRule(address, old_it->first)) return false;
+    old_it++;
+  }
+  // Since we only make transitions from a rule set to some previously
+  // saved rule set, and we can only add rules to the map, NEW_RULES
+  // must have fewer rules than *this.
+  MOZ_ASSERT(new_it == new_rules.registers_.end());
+
+  return true;
+}
+
+// Remove all register rules and clear cfa_rule_.
+void CallFrameInfo::RuleMap::Clear() {
+  delete cfa_rule_;
+  cfa_rule_ = NULL;
+  for (RuleByNumber::iterator it = registers_.begin(); it != registers_.end();
+       it++)
+    delete it->second;
+  registers_.clear();
+}
+
+// The state of the call frame information interpreter as it processes
+// instructions from a CIE and FDE.
+class CallFrameInfo::State {
+ public:
+  // Create a call frame information interpreter state with the given
+  // reporter, reader, handler, and initial call frame info address.
+  State(ByteReader* reader, Handler* handler, Reporter* reporter,
+        uint64 address)
+      : reader_(reader),
+        handler_(handler),
+        reporter_(reporter),
+        address_(address),
+        entry_(NULL),
+        cursor_(NULL),
+        saved_rules_(NULL) {}
+
+  ~State() {
+    if (saved_rules_) delete saved_rules_;
+  }
+
+  // Interpret instructions from CIE, save the resulting rule set for
+  // DW_CFA_restore instructions, and return true. On error, report
+  // the problem to reporter_ and return false.
+  bool InterpretCIE(const CIE& cie);
+
+  // Interpret instructions from FDE, and return true. On error,
+  // report the problem to reporter_ and return false.
+  bool InterpretFDE(const FDE& fde);
+
+ private:
+  // The operands of a CFI instruction, for ParseOperands.
+  struct Operands {
+    unsigned register_number;  // A register number.
+    uint64 offset;             // An offset or address.
+    long signed_offset;        // A signed offset.
+    string expression;         // A DWARF expression.
+  };
+
+  // Parse CFI instruction operands from STATE's instruction stream as
+  // described by FORMAT. On success, populate OPERANDS with the
+  // results, and return true. On failure, report the problem and
+  // return false.
+  //
+  // Each character of FORMAT should be one of the following:
+  //
+  //   'r'  unsigned LEB128 register number (OPERANDS->register_number)
+  //   'o'  unsigned LEB128 offset          (OPERANDS->offset)
+  //   's'  signed LEB128 offset            (OPERANDS->signed_offset)
+  //   'a'  machine-size address            (OPERANDS->offset)
+  //        (If the CIE has a 'z' augmentation string, 'a' uses the
+  //        encoding specified by the 'R' argument.)
+  //   '1'  a one-byte offset               (OPERANDS->offset)
+  //   '2'  a two-byte offset               (OPERANDS->offset)
+  //   '4'  a four-byte offset              (OPERANDS->offset)
+  //   '8'  an eight-byte offset            (OPERANDS->offset)
+  //   'e'  a DW_FORM_block holding a       (OPERANDS->expression)
+  //        DWARF expression
+  bool ParseOperands(const char* format, Operands* operands);
+
+  // Interpret one CFI instruction from STATE's instruction stream, update
+  // STATE, report any rule changes to handler_, and return true. On
+  // failure, report the problem and return false.
+  bool DoInstruction();
+
+  // The following Do* member functions are subroutines of DoInstruction,
+  // factoring out the actual work of operations that have several
+  // different encodings.
+
+  // Set the CFA rule to be the value of BASE_REGISTER plus OFFSET, and
+  // return true. On failure, report and return false. (Used for
+  // DW_CFA_def_cfa and DW_CFA_def_cfa_sf.)
+  bool DoDefCFA(unsigned base_register, long offset);
+
+  // Change the offset of the CFA rule to OFFSET, and return true. On
+  // failure, report and return false. (Subroutine for
+  // DW_CFA_def_cfa_offset and DW_CFA_def_cfa_offset_sf.)
+  bool DoDefCFAOffset(long offset);
+
+  // Specify that REG can be recovered using RULE, and return true. On
+  // failure, report and return false.
+  bool DoRule(unsigned reg, Rule* rule);
+
+  // Specify that REG can be found at OFFSET from the CFA, and return true.
+  // On failure, report and return false. (Subroutine for DW_CFA_offset,
+  // DW_CFA_offset_extended, and DW_CFA_offset_extended_sf.)
+  bool DoOffset(unsigned reg, long offset);
+
+  // Specify that the caller's value for REG is the CFA plus OFFSET,
+  // and return true. On failure, report and return false. (Subroutine
+  // for DW_CFA_val_offset and DW_CFA_val_offset_sf.)
+  bool DoValOffset(unsigned reg, long offset);
+
+  // Restore REG to the rule established in the CIE, and return true. On
+  // failure, report and return false. (Subroutine for DW_CFA_restore and
+  // DW_CFA_restore_extended.)
+  bool DoRestore(unsigned reg);
+
+  // Return the section offset of the instruction at cursor. For use
+  // in error messages.
+  uint64 CursorOffset() { return entry_->offset + (cursor_ - entry_->start); }
+
+  // Report that entry_ is incomplete, and return false. For brevity.
+  bool ReportIncomplete() {
+    reporter_->Incomplete(entry_->offset, entry_->kind);
+    return false;
+  }
+
+  // For reading multi-byte values with the appropriate endianness.
+  ByteReader* reader_;
+
+  // The handler to which we should report the data we find.
+  Handler* handler_;
+
+  // For reporting problems in the info we're parsing.
+  Reporter* reporter_;
+
+  // The code address to which the next instruction in the stream applies.
+  uint64 address_;
+
+  // The entry whose instructions we are currently processing. This is
+  // first a CIE, and then an FDE.
+  const Entry* entry_;
+
+  // The next instruction to process.
+  const char* cursor_;
+
+  // The current set of rules.
+  RuleMap rules_;
+
+  // The set of rules established by the CIE, used by DW_CFA_restore
+  // and DW_CFA_restore_extended. We set this after interpreting the
+  // CIE's instructions.
+  RuleMap cie_rules_;
+
+  // A stack of saved states, for DW_CFA_remember_state and
+  // DW_CFA_restore_state.
+  std::stack<RuleMap>* saved_rules_;
+};
+
+bool CallFrameInfo::State::InterpretCIE(const CIE& cie) {
+  entry_ = &cie;
+  cursor_ = entry_->instructions;
+  while (cursor_ < entry_->end)
+    if (!DoInstruction()) return false;
+  // Note the rules established by the CIE, for use by DW_CFA_restore
+  // and DW_CFA_restore_extended.
+  cie_rules_ = rules_;
+  return true;
+}
+
+bool CallFrameInfo::State::InterpretFDE(const FDE& fde) {
+  entry_ = &fde;
+  cursor_ = entry_->instructions;
+  while (cursor_ < entry_->end)
+    if (!DoInstruction()) return false;
+  return true;
+}
+
+bool CallFrameInfo::State::ParseOperands(const char* format,
+                                         Operands* operands) {
+  size_t len;
+  const char* operand;
+
+  for (operand = format; *operand; operand++) {
+    size_t bytes_left = entry_->end - cursor_;
+    switch (*operand) {
+      case 'r':
+        operands->register_number = reader_->ReadUnsignedLEB128(cursor_, &len);
+        if (len > bytes_left) return ReportIncomplete();
+        cursor_ += len;
+        break;
+
+      case 'o':
+        operands->offset = reader_->ReadUnsignedLEB128(cursor_, &len);
+        if (len > bytes_left) return ReportIncomplete();
+        cursor_ += len;
+        break;
+
+      case 's':
+        operands->signed_offset = reader_->ReadSignedLEB128(cursor_, &len);
+        if (len > bytes_left) return ReportIncomplete();
+        cursor_ += len;
+        break;
+
+      case 'a':
+        operands->offset = reader_->ReadEncodedPointer(
+            cursor_, entry_->cie->pointer_encoding, &len);
+        if (len > bytes_left) return ReportIncomplete();
+        cursor_ += len;
+        break;
+
+      case '1':
+        if (1 > bytes_left) return ReportIncomplete();
+        operands->offset = static_cast<unsigned char>(*cursor_++);
+        break;
+
+      case '2':
+        if (2 > bytes_left) return ReportIncomplete();
+        operands->offset = reader_->ReadTwoBytes(cursor_);
+        cursor_ += 2;
+        break;
+
+      case '4':
+        if (4 > bytes_left) return ReportIncomplete();
+        operands->offset = reader_->ReadFourBytes(cursor_);
+        cursor_ += 4;
+        break;
+
+      case '8':
+        if (8 > bytes_left) return ReportIncomplete();
+        operands->offset = reader_->ReadEightBytes(cursor_);
+        cursor_ += 8;
+        break;
+
+      case 'e': {
+        size_t expression_length = reader_->ReadUnsignedLEB128(cursor_, &len);
+        if (len > bytes_left || expression_length > bytes_left - len)
+          return ReportIncomplete();
+        cursor_ += len;
+        operands->expression = string(cursor_, expression_length);
+        cursor_ += expression_length;
+        break;
+      }
+
+      default:
+        MOZ_ASSERT(0);
+    }
+  }
+
+  return true;
+}
+
+bool CallFrameInfo::State::DoInstruction() {
+  CIE* cie = entry_->cie;
+  Operands ops;
+
+  // Our entry's kind should have been set by now.
+  MOZ_ASSERT(entry_->kind != kUnknown);
+
+  // We shouldn't have been invoked unless there were more
+  // instructions to parse.
+  MOZ_ASSERT(cursor_ < entry_->end);
+
+  unsigned opcode = *cursor_++;
+  if ((opcode & 0xc0) != 0) {
+    switch (opcode & 0xc0) {
+      // Advance the address.
+      case DW_CFA_advance_loc: {
+        size_t code_offset = opcode & 0x3f;
+        address_ += code_offset * cie->code_alignment_factor;
+        break;
+      }
+
+      // Find a register at an offset from the CFA.
+      case DW_CFA_offset:
+        if (!ParseOperands("o", &ops) ||
+            !DoOffset(opcode & 0x3f, ops.offset * cie->data_alignment_factor))
+          return false;
+        break;
+
+      // Restore the rule established for a register by the CIE.
+      case DW_CFA_restore:
+        if (!DoRestore(opcode & 0x3f)) return false;
+        break;
+
+      // The 'if' above should have excluded this possibility.
+      default:
+        MOZ_ASSERT(0);
+    }
+
+    // Return here, so the big switch below won't be indented.
+    return true;
+  }
+
+  switch (opcode) {
+    // Set the address.
+    case DW_CFA_set_loc:
+      if (!ParseOperands("a", &ops)) return false;
+      address_ = ops.offset;
+      break;
+
+    // Advance the address.
+    case DW_CFA_advance_loc1:
+      if (!ParseOperands("1", &ops)) return false;
+      address_ += ops.offset * cie->code_alignment_factor;
+      break;
+
+    // Advance the address.
+    case DW_CFA_advance_loc2:
+      if (!ParseOperands("2", &ops)) return false;
+      address_ += ops.offset * cie->code_alignment_factor;
+      break;
+
+    // Advance the address.
+    case DW_CFA_advance_loc4:
+      if (!ParseOperands("4", &ops)) return false;
+      address_ += ops.offset * cie->code_alignment_factor;
+      break;
+
+    // Advance the address.
+    case DW_CFA_MIPS_advance_loc8:
+      if (!ParseOperands("8", &ops)) return false;
+      address_ += ops.offset * cie->code_alignment_factor;
+      break;
+
+    // Compute the CFA by adding an offset to a register.
+    case DW_CFA_def_cfa:
+      if (!ParseOperands("ro", &ops) ||
+          !DoDefCFA(ops.register_number, ops.offset))
+        return false;
+      break;
+
+    // Compute the CFA by adding an offset to a register.
+    case DW_CFA_def_cfa_sf:
+      if (!ParseOperands("rs", &ops) ||
+          !DoDefCFA(ops.register_number,
+                    ops.signed_offset * cie->data_alignment_factor))
+        return false;
+      break;
+
+    // Change the base register used to compute the CFA.
+    case DW_CFA_def_cfa_register: {
+      Rule* cfa_rule = rules_.CFARule();
+      if (!cfa_rule) {
+        reporter_->NoCFARule(entry_->offset, entry_->kind, CursorOffset());
+        return false;
+      }
+      if (!ParseOperands("r", &ops)) return false;
+      cfa_rule->SetBaseRegister(ops.register_number);
+      if (!cfa_rule->Handle(handler_, address_, Handler::kCFARegister))
+        return false;
+      break;
+    }
+
+    // Change the offset used to compute the CFA.
+    case DW_CFA_def_cfa_offset:
+      if (!ParseOperands("o", &ops) || !DoDefCFAOffset(ops.offset))
+        return false;
+      break;
+
+    // Change the offset used to compute the CFA.
+    case DW_CFA_def_cfa_offset_sf:
+      if (!ParseOperands("s", &ops) ||
+          !DoDefCFAOffset(ops.signed_offset * cie->data_alignment_factor))
+        return false;
+      break;
+
+    // Specify an expression whose value is the CFA.
+    case DW_CFA_def_cfa_expression: {
+      if (!ParseOperands("e", &ops)) return false;
+      Rule* rule = new ValExpressionRule(ops.expression);
+      rules_.SetCFARule(rule);
+      if (!rule->Handle(handler_, address_, Handler::kCFARegister))
+        return false;
+      break;
+    }
+
+    // The register's value cannot be recovered.
+    case DW_CFA_undefined: {
+      if (!ParseOperands("r", &ops) ||
+          !DoRule(ops.register_number, new UndefinedRule()))
+        return false;
+      break;
+    }
+
+    // The register's value is unchanged from its value in the caller.
+    case DW_CFA_same_value: {
+      if (!ParseOperands("r", &ops) ||
+          !DoRule(ops.register_number, new SameValueRule()))
+        return false;
+      break;
+    }
+
+    // Find a register at an offset from the CFA.
+    case DW_CFA_offset_extended:
+      if (!ParseOperands("ro", &ops) ||
+          !DoOffset(ops.register_number,
+                    ops.offset * cie->data_alignment_factor))
+        return false;
+      break;
+
+    // The register is saved at an offset from the CFA.
+    case DW_CFA_offset_extended_sf:
+      if (!ParseOperands("rs", &ops) ||
+          !DoOffset(ops.register_number,
+                    ops.signed_offset * cie->data_alignment_factor))
+        return false;
+      break;
+
+    // The register is saved at an offset from the CFA.
+    case DW_CFA_GNU_negative_offset_extended:
+      if (!ParseOperands("ro", &ops) ||
+          !DoOffset(ops.register_number,
+                    -ops.offset * cie->data_alignment_factor))
+        return false;
+      break;
+
+    // The register's value is the sum of the CFA plus an offset.
+    case DW_CFA_val_offset:
+      if (!ParseOperands("ro", &ops) ||
+          !DoValOffset(ops.register_number,
+                       ops.offset * cie->data_alignment_factor))
+        return false;
+      break;
+
+    // The register's value is the sum of the CFA plus an offset.
+    case DW_CFA_val_offset_sf:
+      if (!ParseOperands("rs", &ops) ||
+          !DoValOffset(ops.register_number,
+                       ops.signed_offset * cie->data_alignment_factor))
+        return false;
+      break;
+
+    // The register has been saved in another register.
+    case DW_CFA_register: {
+      if (!ParseOperands("ro", &ops) ||
+          !DoRule(ops.register_number, new RegisterRule(ops.offset)))
+        return false;
+      break;
+    }
+
+    // An expression yields the address at which the register is saved.
+    case DW_CFA_expression: {
+      if (!ParseOperands("re", &ops) ||
+          !DoRule(ops.register_number, new ExpressionRule(ops.expression)))
+        return false;
+      break;
+    }
+
+    // An expression yields the caller's value for the register.
+    case DW_CFA_val_expression: {
+      if (!ParseOperands("re", &ops) ||
+          !DoRule(ops.register_number, new ValExpressionRule(ops.expression)))
+        return false;
+      break;
+    }
+
+    // Restore the rule established for a register by the CIE.
+    case DW_CFA_restore_extended:
+      if (!ParseOperands("r", &ops) || !DoRestore(ops.register_number))
+        return false;
+      break;
+
+    // Save the current set of rules on a stack.
+    case DW_CFA_remember_state:
+      if (!saved_rules_) {
+        saved_rules_ = new std::stack<RuleMap>();
+      }
+      saved_rules_->push(rules_);
+      break;
+
+    // Pop the current set of rules off the stack.
+    case DW_CFA_restore_state: {
+      if (!saved_rules_ || saved_rules_->empty()) {
+        reporter_->EmptyStateStack(entry_->offset, entry_->kind,
+                                   CursorOffset());
+        return false;
+      }
+      const RuleMap& new_rules = saved_rules_->top();
+      if (rules_.CFARule() && !new_rules.CFARule()) {
+        reporter_->ClearingCFARule(entry_->offset, entry_->kind,
+                                   CursorOffset());
+        return false;
+      }
+      rules_.HandleTransitionTo(handler_, address_, new_rules);
+      rules_ = new_rules;
+      saved_rules_->pop();
+      break;
+    }
+
+    // No operation.  (Padding instruction.)
+    case DW_CFA_nop:
+      break;
+
+    // A SPARC register window save: Registers 8 through 15 (%o0-%o7)
+    // are saved in registers 24 through 31 (%i0-%i7), and registers
+    // 16 through 31 (%l0-%l7 and %i0-%i7) are saved at CFA offsets
+    // (0-15 * the register size). The register numbers must be
+    // hard-coded. A GNU extension, and not a pretty one.
+    case DW_CFA_GNU_window_save: {
+      // Save %o0-%o7 in %i0-%i7.
+      for (int i = 8; i < 16; i++)
+        if (!DoRule(i, new RegisterRule(i + 16))) return false;
+      // Save %l0-%l7 and %i0-%i7 at the CFA.
+      for (int i = 16; i < 32; i++)
+        // Assume that the byte reader's address size is the same as
+        // the architecture's register size. !@#%*^ hilarious.
+        if (!DoRule(i, new OffsetRule(Handler::kCFARegister,
+                                      (i - 16) * reader_->AddressSize())))
+          return false;
+      break;
+    }
+
+    // I'm not sure what this is. GDB doesn't use it for unwinding.
+    case DW_CFA_GNU_args_size:
+      if (!ParseOperands("o", &ops)) return false;
+      break;
+
+    // An opcode we don't recognize.
+    default: {
+      reporter_->BadInstruction(entry_->offset, entry_->kind, CursorOffset());
+      return false;
+    }
+  }
+
+  return true;
+}
+
+bool CallFrameInfo::State::DoDefCFA(unsigned base_register, long offset) {
+  Rule* rule = new ValOffsetRule(base_register, offset);
+  rules_.SetCFARule(rule);
+  return rule->Handle(handler_, address_, Handler::kCFARegister);
+}
+
+bool CallFrameInfo::State::DoDefCFAOffset(long offset) {
+  Rule* cfa_rule = rules_.CFARule();
+  if (!cfa_rule) {
+    reporter_->NoCFARule(entry_->offset, entry_->kind, CursorOffset());
+    return false;
+  }
+  cfa_rule->SetOffset(offset);
+  return cfa_rule->Handle(handler_, address_, Handler::kCFARegister);
+}
+
+bool CallFrameInfo::State::DoRule(unsigned reg, Rule* rule) {
+  rules_.SetRegisterRule(reg, rule);
+  return rule->Handle(handler_, address_, reg);
+}
+
+bool CallFrameInfo::State::DoOffset(unsigned reg, long offset) {
+  if (!rules_.CFARule()) {
+    reporter_->NoCFARule(entry_->offset, entry_->kind, CursorOffset());
+    return false;
+  }
+  return DoRule(reg, new OffsetRule(Handler::kCFARegister, offset));
+}
+
+bool CallFrameInfo::State::DoValOffset(unsigned reg, long offset) {
+  if (!rules_.CFARule()) {
+    reporter_->NoCFARule(entry_->offset, entry_->kind, CursorOffset());
+    return false;
+  }
+  return DoRule(reg, new ValOffsetRule(Handler::kCFARegister, offset));
+}
+
+bool CallFrameInfo::State::DoRestore(unsigned reg) {
+  // DW_CFA_restore and DW_CFA_restore_extended don't make sense in a CIE.
+  if (entry_->kind == kCIE) {
+    reporter_->RestoreInCIE(entry_->offset, CursorOffset());
+    return false;
+  }
+  Rule* rule = cie_rules_.RegisterRule(reg);
+  if (!rule) {
+    // This isn't really the right thing to do, but since CFI generally
+    // only mentions callee-saves registers, and GCC's convention for
+    // callee-saves registers is that they are unchanged, it's a good
+    // approximation.
+    rule = new SameValueRule();
+  }
+  return DoRule(reg, rule);
+}
+
+bool CallFrameInfo::ReadEntryPrologue(const char* cursor, Entry* entry) {
+  const char* buffer_end = buffer_ + buffer_length_;
+
+  // Initialize enough of ENTRY for use in error reporting.
+  entry->offset = cursor - buffer_;
+  entry->start = cursor;
+  entry->kind = kUnknown;
+  entry->end = NULL;
+
+  // Read the initial length. This sets reader_'s offset size.
+  size_t length_size;
+  uint64 length = reader_->ReadInitialLength(cursor, &length_size);
+  if (length_size > size_t(buffer_end - cursor)) return ReportIncomplete(entry);
+  cursor += length_size;
+
+  // In a .eh_frame section, a length of zero marks the end of the series
+  // of entries.
+  if (length == 0 && eh_frame_) {
+    entry->kind = kTerminator;
+    entry->end = cursor;
+    return true;
+  }
+
+  // Validate the length.
+  if (length > size_t(buffer_end - cursor)) return ReportIncomplete(entry);
+
+  // The length is the number of bytes after the initial length field;
+  // we have that position handy at this point, so compute the end
+  // now. (If we're parsing 64-bit-offset DWARF on a 32-bit machine,
+  // and the length didn't fit in a size_t, we would have rejected it
+  // above.)
+  entry->end = cursor + length;
+
+  // Parse the next field: either the offset of a CIE or a CIE id.
+  size_t offset_size = reader_->OffsetSize();
+  if (offset_size > size_t(entry->end - cursor)) return ReportIncomplete(entry);
+  entry->id = reader_->ReadOffset(cursor);
+
+  // Don't advance cursor past id field yet; in .eh_frame data we need
+  // the id's position to compute the section offset of an FDE's CIE.
+
+  // Now we can decide what kind of entry this is.
+  if (eh_frame_) {
+    // In .eh_frame data, an ID of zero marks the entry as a CIE, and
+    // anything else is an offset from the id field of the FDE to the start
+    // of the CIE.
+    if (entry->id == 0) {
+      entry->kind = kCIE;
+    } else {
+      entry->kind = kFDE;
+      // Turn the offset from the id into an offset from the buffer's start.
+      entry->id = (cursor - buffer_) - entry->id;
+    }
+  } else {
+    // In DWARF CFI data, an ID of ~0 (of the appropriate width, given the
+    // offset size for the entry) marks the entry as a CIE, and anything
+    // else is the offset of the CIE from the beginning of the section.
+    if (offset_size == 4)
+      entry->kind = (entry->id == 0xffffffff) ? kCIE : kFDE;
+    else {
+      MOZ_ASSERT(offset_size == 8);
+      entry->kind = (entry->id == 0xffffffffffffffffULL) ? kCIE : kFDE;
+    }
+  }
+
+  // Now advance cursor past the id.
+  cursor += offset_size;
+
+  // The fields specific to this kind of entry start here.
+  entry->fields = cursor;
+
+  entry->cie = NULL;
+
+  return true;
+}
+
+bool CallFrameInfo::ReadCIEFields(CIE* cie) {
+  const char* cursor = cie->fields;
+  size_t len;
+
+  MOZ_ASSERT(cie->kind == kCIE);
+
+  // Prepare for early exit.
+  cie->version = 0;
+  cie->augmentation.clear();
+  cie->code_alignment_factor = 0;
+  cie->data_alignment_factor = 0;
+  cie->return_address_register = 0;
+  cie->has_z_augmentation = false;
+  cie->pointer_encoding = DW_EH_PE_absptr;
+  cie->instructions = 0;
+
+  // Parse the version number.
+  if (cie->end - cursor < 1) return ReportIncomplete(cie);
+  cie->version = reader_->ReadOneByte(cursor);
+  cursor++;
+
+  // If we don't recognize the version, we can't parse any more fields of the
+  // CIE. For DWARF CFI, we handle versions 1 through 4 (there was never a
+  // version 2 of CFI data). For .eh_frame, we handle versions 1 and 4 as well;
+  // the difference between those versions seems to be the same as for
+  // .debug_frame.
+  if (cie->version < 1 || cie->version > 4) {
+    reporter_->UnrecognizedVersion(cie->offset, cie->version);
+    return false;
+  }
+
+  const char* augmentation_start = cursor;
+  const void* augmentation_end =
+      memchr(augmentation_start, '\0', cie->end - augmentation_start);
+  if (!augmentation_end) return ReportIncomplete(cie);
+  cursor = static_cast<const char*>(augmentation_end);
+  cie->augmentation = string(augmentation_start, cursor - augmentation_start);
+  // Skip the terminating '\0'.
+  cursor++;
+
+  // Is this CFI augmented?
+  if (!cie->augmentation.empty()) {
+    // Is it an augmentation we recognize?
+    if (cie->augmentation[0] == DW_Z_augmentation_start) {
+      // Linux C++ ABI 'z' augmentation, used for exception handling data.
+      cie->has_z_augmentation = true;
+    } else {
+      // Not an augmentation we recognize. Augmentations can have arbitrary
+      // effects on the form of rest of the content, so we have to give up.
+      reporter_->UnrecognizedAugmentation(cie->offset, cie->augmentation);
+      return false;
+    }
+  }
+
+  if (cie->version >= 4) {
+    // Check that the address_size and segment_size fields are plausible.
+    if (cie->end - cursor < 2) {
+      return ReportIncomplete(cie);
+    }
+    uint8_t address_size = reader_->ReadOneByte(cursor);
+    cursor++;
+    if (address_size != sizeof(void*)) {
+      // This is not per-se invalid CFI.  But we can reasonably expect to
+      // be running on a target of the same word size as the CFI is for,
+      // so we reject this case.
+      reporter_->InvalidDwarf4Artefact(cie->offset, "Invalid address_size");
+      return false;
+    }
+    uint8_t segment_size = reader_->ReadOneByte(cursor);
+    cursor++;
+    if (segment_size != 0) {
+      // This is also not per-se invalid CFI, but we don't currently handle
+      // the case of non-zero |segment_size|.
+      reporter_->InvalidDwarf4Artefact(cie->offset, "Invalid segment_size");
+      return false;
+    }
+    // We only continue parsing if |segment_size| is zero.  If this routine
+    // is ever changed to allow non-zero |segment_size|, then
+    // ReadFDEFields() below will have to be changed to match, per comments
+    // there.
+  }
+
+  // Parse the code alignment factor.
+  cie->code_alignment_factor = reader_->ReadUnsignedLEB128(cursor, &len);
+  if (size_t(cie->end - cursor) < len) return ReportIncomplete(cie);
+  cursor += len;
+
+  // Parse the data alignment factor.
+  cie->data_alignment_factor = reader_->ReadSignedLEB128(cursor, &len);
+  if (size_t(cie->end - cursor) < len) return ReportIncomplete(cie);
+  cursor += len;
+
+  // Parse the return address register. This is a ubyte in version 1, and
+  // a ULEB128 in version 3.
+  if (cie->version == 1) {
+    if (cursor >= cie->end) return ReportIncomplete(cie);
+    cie->return_address_register = uint8(*cursor++);
+  } else {
+    cie->return_address_register = reader_->ReadUnsignedLEB128(cursor, &len);
+    if (size_t(cie->end - cursor) < len) return ReportIncomplete(cie);
+    cursor += len;
+  }
+
+  // If we have a 'z' augmentation string, find the augmentation data and
+  // use the augmentation string to parse it.
+  if (cie->has_z_augmentation) {
+    uint64_t data_size = reader_->ReadUnsignedLEB128(cursor, &len);
+    if (size_t(cie->end - cursor) < len + data_size)
+      return ReportIncomplete(cie);
+    cursor += len;
+    const char* data = cursor;
+    cursor += data_size;
+    const char* data_end = cursor;
+
+    cie->has_z_lsda = false;
+    cie->has_z_personality = false;
+    cie->has_z_signal_frame = false;
+
+    // Walk the augmentation string, and extract values from the
+    // augmentation data as the string directs.
+    for (size_t i = 1; i < cie->augmentation.size(); i++) {
+      switch (cie->augmentation[i]) {
+        case DW_Z_has_LSDA:
+          // The CIE's augmentation data holds the language-specific data
+          // area pointer's encoding, and the FDE's augmentation data holds
+          // the pointer itself.
+          cie->has_z_lsda = true;
+          // Fetch the LSDA encoding from the augmentation data.
+          if (data >= data_end) return ReportIncomplete(cie);
+          cie->lsda_encoding = DwarfPointerEncoding(*data++);
+          if (!reader_->ValidEncoding(cie->lsda_encoding)) {
+            reporter_->InvalidPointerEncoding(cie->offset, cie->lsda_encoding);
+            return false;
+          }
+          // Don't check if the encoding is usable here --- we haven't
+          // read the FDE's fields yet, so we're not prepared for
+          // DW_EH_PE_funcrel, although that's a fine encoding for the
+          // LSDA to use, since it appears in the FDE.
+          break;
+
+        case DW_Z_has_personality_routine:
+          // The CIE's augmentation data holds the personality routine
+          // pointer's encoding, followed by the pointer itself.
+          cie->has_z_personality = true;
+          // Fetch the personality routine pointer's encoding from the
+          // augmentation data.
+          if (data >= data_end) return ReportIncomplete(cie);
+          cie->personality_encoding = DwarfPointerEncoding(*data++);
+          if (!reader_->ValidEncoding(cie->personality_encoding)) {
+            reporter_->InvalidPointerEncoding(cie->offset,
+                                              cie->personality_encoding);
+            return false;
+          }
+          if (!reader_->UsableEncoding(cie->personality_encoding)) {
+            reporter_->UnusablePointerEncoding(cie->offset,
+                                               cie->personality_encoding);
+            return false;
+          }
+          // Fetch the personality routine's pointer itself from the data.
+          cie->personality_address = reader_->ReadEncodedPointer(
+              data, cie->personality_encoding, &len);
+          if (len > size_t(data_end - data)) return ReportIncomplete(cie);
+          data += len;
+          break;
+
+        case DW_Z_has_FDE_address_encoding:
+          // The CIE's augmentation data holds the pointer encoding to use
+          // for addresses in the FDE.
+          if (data >= data_end) return ReportIncomplete(cie);
+          cie->pointer_encoding = DwarfPointerEncoding(*data++);
+          if (!reader_->ValidEncoding(cie->pointer_encoding)) {
+            reporter_->InvalidPointerEncoding(cie->offset,
+                                              cie->pointer_encoding);
+            return false;
+          }
+          if (!reader_->UsableEncoding(cie->pointer_encoding)) {
+            reporter_->UnusablePointerEncoding(cie->offset,
+                                               cie->pointer_encoding);
+            return false;
+          }
+          break;
+
+        case DW_Z_is_signal_trampoline:
+          // Frames using this CIE are signal delivery frames.
+          cie->has_z_signal_frame = true;
+          break;
+
+        default:
+          // An augmentation we don't recognize.
+          reporter_->UnrecognizedAugmentation(cie->offset, cie->augmentation);
+          return false;
+      }
+    }
+  }
+
+  // The CIE's instructions start here.
+  cie->instructions = cursor;
+
+  return true;
+}
+
+bool CallFrameInfo::ReadFDEFields(FDE* fde) {
+  const char* cursor = fde->fields;
+  size_t size;
+
+  // At this point, for Dwarf 4 and above, we are assuming that the
+  // associated CIE has its |segment_size| field equal to zero.  This is
+  // checked for in ReadCIEFields() above.  If ReadCIEFields() is ever
+  // changed to allow non-zero |segment_size| CIEs then we will have to read
+  // the segment_selector value at this point.
+
+  fde->address =
+      reader_->ReadEncodedPointer(cursor, fde->cie->pointer_encoding, &size);
+  if (size > size_t(fde->end - cursor)) return ReportIncomplete(fde);
+  cursor += size;
+  reader_->SetFunctionBase(fde->address);
+
+  // For the length, we strip off the upper nybble of the encoding used for
+  // the starting address.
+  DwarfPointerEncoding length_encoding =
+      DwarfPointerEncoding(fde->cie->pointer_encoding & 0x0f);
+  fde->size = reader_->ReadEncodedPointer(cursor, length_encoding, &size);
+  if (size > size_t(fde->end - cursor)) return ReportIncomplete(fde);
+  cursor += size;
+
+  // If the CIE has a 'z' augmentation string, then augmentation data
+  // appears here.
+  if (fde->cie->has_z_augmentation) {
+    uint64_t data_size = reader_->ReadUnsignedLEB128(cursor, &size);
+    if (size_t(fde->end - cursor) < size + data_size)
+      return ReportIncomplete(fde);
+    cursor += size;
+
+    // In the abstract, we should walk the augmentation string, and extract
+    // items from the FDE's augmentation data as we encounter augmentation
+    // string characters that specify their presence: the ordering of items
+    // in the augmentation string determines the arrangement of values in
+    // the augmentation data.
+    //
+    // In practice, there's only ever one value in FDE augmentation data
+    // that we support --- the LSDA pointer --- and we have to bail if we
+    // see any unrecognized augmentation string characters. So if there is
+    // anything here at all, we know what it is, and where it starts.
+    if (fde->cie->has_z_lsda) {
+      // Check whether the LSDA's pointer encoding is usable now: only once
+      // we've parsed the FDE's starting address do we call reader_->
+      // SetFunctionBase, so that the DW_EH_PE_funcrel encoding becomes
+      // usable.
+      if (!reader_->UsableEncoding(fde->cie->lsda_encoding)) {
+        reporter_->UnusablePointerEncoding(fde->cie->offset,
+                                           fde->cie->lsda_encoding);
+        return false;
+      }
+
+      fde->lsda_address =
+          reader_->ReadEncodedPointer(cursor, fde->cie->lsda_encoding, &size);
+      if (size > data_size) return ReportIncomplete(fde);
+      // Ideally, we would also complain here if there were unconsumed
+      // augmentation data.
+    }
+
+    cursor += data_size;
+  }
+
+  // The FDE's instructions start after those.
+  fde->instructions = cursor;
+
+  return true;
+}
+
+bool CallFrameInfo::Start() {
+  const char* buffer_end = buffer_ + buffer_length_;
+  const char* cursor;
+  bool all_ok = true;
+  const char* entry_end;
+  bool ok;
+
+  // Traverse all the entries in buffer_, skipping CIEs and offering
+  // FDEs to the handler.
+  for (cursor = buffer_; cursor < buffer_end;
+       cursor = entry_end, all_ok = all_ok && ok) {
+    FDE fde;
+
+    // Make it easy to skip this entry with 'continue': assume that
+    // things are not okay until we've checked all the data, and
+    // prepare the address of the next entry.
+    ok = false;
+
+    // Read the entry's prologue.
+    if (!ReadEntryPrologue(cursor, &fde)) {
+      if (!fde.end) {
+        // If we couldn't even figure out this entry's extent, then we
+        // must stop processing entries altogether.
+        all_ok = false;
+        break;
+      }
+      entry_end = fde.end;
+      continue;
+    }
+
+    // The next iteration picks up after this entry.
+    entry_end = fde.end;
+
+    // Did we see an .eh_frame terminating mark?
+    if (fde.kind == kTerminator) {
+      // If there appears to be more data left in the section after the
+      // terminating mark, warn the user. But this is just a warning;
+      // we leave all_ok true.
+      if (fde.end < buffer_end) reporter_->EarlyEHTerminator(fde.offset);
+      break;
+    }
+
+    // In this loop, we skip CIEs. We only parse them fully when we
+    // parse an FDE that refers to them. This limits our memory
+    // consumption (beyond the buffer itself) to that needed to
+    // process the largest single entry.
+    if (fde.kind != kFDE) {
+      ok = true;
+      continue;
+    }
+
+    // Validate the CIE pointer.
+    if (fde.id > buffer_length_) {
+      reporter_->CIEPointerOutOfRange(fde.offset, fde.id);
+      continue;
+    }
+
+    CIE cie;
+
+    // Parse this FDE's CIE header.
+    if (!ReadEntryPrologue(buffer_ + fde.id, &cie)) continue;
+    // This had better be an actual CIE.
+    if (cie.kind != kCIE) {
+      reporter_->BadCIEId(fde.offset, fde.id);
+      continue;
+    }
+    if (!ReadCIEFields(&cie)) continue;
+
+    // We now have the values that govern both the CIE and the FDE.
+    cie.cie = &cie;
+    fde.cie = &cie;
+
+    // Parse the FDE's header.
+    if (!ReadFDEFields(&fde)) continue;
+
+    // Call Entry to ask the consumer if they're interested.
+    if (!handler_->Entry(fde.offset, fde.address, fde.size, cie.version,
+                         cie.augmentation, cie.return_address_register)) {
+      // The handler isn't interested in this entry. That's not an error.
+      ok = true;
+      continue;
+    }
+
+    if (cie.has_z_augmentation) {
+      // Report the personality routine address, if we have one.
+      if (cie.has_z_personality) {
+        if (!handler_->PersonalityRoutine(
+                cie.personality_address,
+                IsIndirectEncoding(cie.personality_encoding)))
+          continue;
+      }
+
+      // Report the language-specific data area address, if we have one.
+      if (cie.has_z_lsda) {
+        if (!handler_->LanguageSpecificDataArea(
+                fde.lsda_address, IsIndirectEncoding(cie.lsda_encoding)))
+          continue;
+      }
+
+      // If this is a signal-handling frame, report that.
+      if (cie.has_z_signal_frame) {
+        if (!handler_->SignalHandler()) continue;
+      }
+    }
+
+    // Interpret the CIE's instructions, and then the FDE's instructions.
+    State state(reader_, handler_, reporter_, fde.address);
+    ok = state.InterpretCIE(cie) && state.InterpretFDE(fde);
+
+    // Tell the ByteReader that the function start address from the
+    // FDE header is no longer valid.
+    reader_->ClearFunctionBase();
+
+    // Report the end of the entry.
+    handler_->End();
+  }
+
+  return all_ok;
+}
+
+const char* CallFrameInfo::KindName(EntryKind kind) {
+  if (kind == CallFrameInfo::kUnknown)
+    return "entry";
+  else if (kind == CallFrameInfo::kCIE)
+    return "common information entry";
+  else if (kind == CallFrameInfo::kFDE)
+    return "frame description entry";
+  else {
+    MOZ_ASSERT(kind == CallFrameInfo::kTerminator);
+    return ".eh_frame sequence terminator";
+  }
+}
+
+bool CallFrameInfo::ReportIncomplete(Entry* entry) {
+  reporter_->Incomplete(entry->offset, entry->kind);
+  return false;
+}
+
+void CallFrameInfo::Reporter::Incomplete(uint64 offset,
+                                         CallFrameInfo::EntryKind kind) {
+  char buf[300];
+  SprintfLiteral(buf, "%s: CFI %s at offset 0x%llx in '%s': entry ends early\n",
+                 filename_.c_str(), CallFrameInfo::KindName(kind), offset,
+                 section_.c_str());
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::EarlyEHTerminator(uint64 offset) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI at offset 0x%llx in '%s': saw end-of-data marker"
+                 " before end of section contents\n",
+                 filename_.c_str(), offset, section_.c_str());
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::CIEPointerOutOfRange(uint64 offset,
+                                                   uint64 cie_offset) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI frame description entry at offset 0x%llx in '%s':"
+                 " CIE pointer is out of range: 0x%llx\n",
+                 filename_.c_str(), offset, section_.c_str(), cie_offset);
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::BadCIEId(uint64 offset, uint64 cie_offset) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI frame description entry at offset 0x%llx in '%s':"
+                 " CIE pointer does not point to a CIE: 0x%llx\n",
+                 filename_.c_str(), offset, section_.c_str(), cie_offset);
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::UnrecognizedVersion(uint64 offset, int version) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI frame description entry at offset 0x%llx in '%s':"
+                 " CIE specifies unrecognized version: %d\n",
+                 filename_.c_str(), offset, section_.c_str(), version);
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::UnrecognizedAugmentation(uint64 offset,
+                                                       const string& aug) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI frame description entry at offset 0x%llx in '%s':"
+                 " CIE specifies unrecognized augmentation: '%s'\n",
+                 filename_.c_str(), offset, section_.c_str(), aug.c_str());
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::InvalidDwarf4Artefact(uint64 offset,
+                                                    const char* what) {
+  char* what_safe = strndup(what, 100);
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI frame description entry at offset 0x%llx in '%s':"
+                 " CIE specifies invalid Dwarf4 artefact: %s\n",
+                 filename_.c_str(), offset, section_.c_str(), what_safe);
+  log_(buf);
+  free(what_safe);
+}
+
+void CallFrameInfo::Reporter::InvalidPointerEncoding(uint64 offset,
+                                                     uint8 encoding) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI common information entry at offset 0x%llx in '%s':"
+                 " 'z' augmentation specifies invalid pointer encoding: "
+                 "0x%02x\n",
+                 filename_.c_str(), offset, section_.c_str(), encoding);
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::UnusablePointerEncoding(uint64 offset,
+                                                      uint8 encoding) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI common information entry at offset 0x%llx in '%s':"
+                 " 'z' augmentation specifies a pointer encoding for which"
+                 " we have no base address: 0x%02x\n",
+                 filename_.c_str(), offset, section_.c_str(), encoding);
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::RestoreInCIE(uint64 offset, uint64 insn_offset) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI common information entry at offset 0x%llx in '%s':"
+                 " the DW_CFA_restore instruction at offset 0x%llx"
+                 " cannot be used in a common information entry\n",
+                 filename_.c_str(), offset, section_.c_str(), insn_offset);
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::BadInstruction(uint64 offset,
+                                             CallFrameInfo::EntryKind kind,
+                                             uint64 insn_offset) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI %s at offset 0x%llx in section '%s':"
+                 " the instruction at offset 0x%llx is unrecognized\n",
+                 filename_.c_str(), CallFrameInfo::KindName(kind), offset,
+                 section_.c_str(), insn_offset);
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::NoCFARule(uint64 offset,
+                                        CallFrameInfo::EntryKind kind,
+                                        uint64 insn_offset) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI %s at offset 0x%llx in section '%s':"
+                 " the instruction at offset 0x%llx assumes that a CFA rule "
+                 "has been set, but none has been set\n",
+                 filename_.c_str(), CallFrameInfo::KindName(kind), offset,
+                 section_.c_str(), insn_offset);
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::EmptyStateStack(uint64 offset,
+                                              CallFrameInfo::EntryKind kind,
+                                              uint64 insn_offset) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI %s at offset 0x%llx in section '%s':"
+                 " the DW_CFA_restore_state instruction at offset 0x%llx"
+                 " should pop a saved state from the stack, but the stack "
+                 "is empty\n",
+                 filename_.c_str(), CallFrameInfo::KindName(kind), offset,
+                 section_.c_str(), insn_offset);
+  log_(buf);
+}
+
+void CallFrameInfo::Reporter::ClearingCFARule(uint64 offset,
+                                              CallFrameInfo::EntryKind kind,
+                                              uint64 insn_offset) {
+  char buf[300];
+  SprintfLiteral(buf,
+                 "%s: CFI %s at offset 0x%llx in section '%s':"
+                 " the DW_CFA_restore_state instruction at offset 0x%llx"
+                 " would clear the CFA rule in effect\n",
+                 filename_.c_str(), CallFrameInfo::KindName(kind), offset,
+                 section_.c_str(), insn_offset);
+  log_(buf);
+}
+
+unsigned int DwarfCFIToModule::RegisterNames::I386() {
+  /*
+   8 "$eax", "$ecx", "$edx", "$ebx", "$esp", "$ebp", "$esi", "$edi",
+   3 "$eip", "$eflags", "$unused1",
+   8 "$st0", "$st1", "$st2", "$st3", "$st4", "$st5", "$st6", "$st7",
+   2 "$unused2", "$unused3",
+   8 "$xmm0", "$xmm1", "$xmm2", "$xmm3", "$xmm4", "$xmm5", "$xmm6", "$xmm7",
+   8 "$mm0", "$mm1", "$mm2", "$mm3", "$mm4", "$mm5", "$mm6", "$mm7",
+   3 "$fcw", "$fsw", "$mxcsr",
+   8 "$es", "$cs", "$ss", "$ds", "$fs", "$gs", "$unused4", "$unused5",
+   2 "$tr", "$ldtr"
+  */
+  return 8 + 3 + 8 + 2 + 8 + 8 + 3 + 8 + 2;
+}
+
+unsigned int DwarfCFIToModule::RegisterNames::X86_64() {
+  /*
+   8 "$rax", "$rdx", "$rcx", "$rbx", "$rsi", "$rdi", "$rbp", "$rsp",
+   8 "$r8",  "$r9",  "$r10", "$r11", "$r12", "$r13", "$r14", "$r15",
+   1 "$rip",
+   8 "$xmm0","$xmm1","$xmm2", "$xmm3", "$xmm4", "$xmm5", "$xmm6", "$xmm7",
+   8 "$xmm8","$xmm9","$xmm10","$xmm11","$xmm12","$xmm13","$xmm14","$xmm15",
+   8 "$st0", "$st1", "$st2", "$st3", "$st4", "$st5", "$st6", "$st7",
+   8 "$mm0", "$mm1", "$mm2", "$mm3", "$mm4", "$mm5", "$mm6", "$mm7",
+   1 "$rflags",
+   8 "$es", "$cs", "$ss", "$ds", "$fs", "$gs", "$unused1", "$unused2",
+   4 "$fs.base", "$gs.base", "$unused3", "$unused4",
+   2 "$tr", "$ldtr",
+   3 "$mxcsr", "$fcw", "$fsw"
+  */
+  return 8 + 8 + 1 + 8 + 8 + 8 + 8 + 1 + 8 + 4 + 2 + 3;
+}
+
+// Per ARM IHI 0040A, section 3.1
+unsigned int DwarfCFIToModule::RegisterNames::ARM() {
+  /*
+   8 "r0",  "r1",  "r2",  "r3",  "r4",  "r5",  "r6",  "r7",
+   8 "r8",  "r9",  "r10", "r11", "r12", "sp",  "lr",  "pc",
+   8 "f0",  "f1",  "f2",  "f3",  "f4",  "f5",  "f6",  "f7",
+   8 "fps", "cpsr", "",   "",    "",    "",    "",    "",
+   8 "",    "",    "",    "",    "",    "",    "",    "",
+   8 "",    "",    "",    "",    "",    "",    "",    "",
+   8 "",    "",    "",    "",    "",    "",    "",    "",
+   8 "",    "",    "",    "",    "",    "",    "",    "",
+   8 "s0",  "s1",  "s2",  "s3",  "s4",  "s5",  "s6",  "s7",
+   8 "s8",  "s9",  "s10", "s11", "s12", "s13", "s14", "s15",
+   8 "s16", "s17", "s18", "s19", "s20", "s21", "s22", "s23",
+   8 "s24", "s25", "s26", "s27", "s28", "s29", "s30", "s31",
+   8 "f0",  "f1",  "f2",  "f3",  "f4",  "f5",  "f6",  "f7"
+  */
+  return 13 * 8;
+}
+
+// Per ARM IHI 0057A, section 3.1
+unsigned int DwarfCFIToModule::RegisterNames::ARM64() {
+  /*
+   8 "x0",  "x1",  "x2",  "x3",  "x4",  "x5",  "x6",  "x7",
+   8 "x8",  "x9",  "x10", "x11", "x12", "x13", "x14", "x15",
+   8 "x16"  "x17", "x18", "x19", "x20", "x21", "x22", "x23",
+   8 "x24", "x25", "x26", "x27", "x28", "x29",  "x30","sp",
+   8 "",    "",    "",    "",    "",    "",    "",    "",
+   8 "",    "",    "",    "",    "",    "",    "",    "",
+   8 "",    "",    "",    "",    "",    "",    "",    "",
+   8 "",    "",    "",    "",    "",    "",    "",    "",
+   8 "v0",  "v1",  "v2",  "v3",  "v4",  "v5",  "v6",  "v7",
+   8 "v8",  "v9",  "v10", "v11", "v12", "v13", "v14", "v15",
+   8 "v16", "v17", "v18", "v19", "v20", "v21", "v22,  "v23",
+   8 "v24", "x25", "x26,  "x27", "v28", "v29", "v30", "v31",
+  */
+  return 12 * 8;
+}
+
+unsigned int DwarfCFIToModule::RegisterNames::MIPS() {
+  /*
+   8 "$zero", "$at",  "$v0",  "$v1",  "$a0",   "$a1",  "$a2",  "$a3",
+   8 "$t0",   "$t1",  "$t2",  "$t3",  "$t4",   "$t5",  "$t6",  "$t7",
+   8 "$s0",   "$s1",  "$s2",  "$s3",  "$s4",   "$s5",  "$s6",  "$s7",
+   8 "$t8",   "$t9",  "$k0",  "$k1",  "$gp",   "$sp",  "$fp",  "$ra",
+   9 "$lo",   "$hi",  "$pc",  "$f0",  "$f1",   "$f2",  "$f3",  "$f4",  "$f5",
+   8 "$f6",   "$f7",  "$f8",  "$f9",  "$f10",  "$f11", "$f12", "$f13",
+   7 "$f14",  "$f15", "$f16", "$f17", "$f18",  "$f19", "$f20",
+   7 "$f21",  "$f22", "$f23", "$f24", "$f25",  "$f26", "$f27",
+   6 "$f28",  "$f29", "$f30", "$f31", "$fcsr", "$fir"
+  */
+  return 8 + 8 + 8 + 8 + 9 + 8 + 7 + 7 + 6;
+}
+
+// See prototype for comments.
+int32_t parseDwarfExpr(Summariser* summ, const ByteReader* reader, string expr,
+                       bool debug, bool pushCfaAtStart, bool derefAtEnd) {
+  const char* cursor = expr.c_str();
+  const char* end1 = cursor + expr.length();
+
+  char buf[100];
+  if (debug) {
+    SprintfLiteral(buf, "LUL.DW  << DwarfExpr, len is %d\n",
+                   (int)(end1 - cursor));
+    summ->Log(buf);
+  }
+
+  // Add a marker for the start of this expression.  In it, indicate
+  // whether or not the CFA should be pushed onto the stack prior to
+  // evaluation.
+  int32_t start_ix =
+      summ->AddPfxInstr(PfxInstr(PX_Start, pushCfaAtStart ? 1 : 0));
+  MOZ_ASSERT(start_ix >= 0);
+
+  while (cursor < end1) {
+    uint8 opc = reader->ReadOneByte(cursor);
+    cursor++;
+
+    const char* nm = nullptr;
+    PfxExprOp pxop = PX_End;
+
+    switch (opc) {
+      case DW_OP_lit0 ... DW_OP_lit31: {
+        int32_t simm32 = (int32_t)(opc - DW_OP_lit0);
+        if (debug) {
+          SprintfLiteral(buf, "LUL.DW   DW_OP_lit%d\n", (int)simm32);
+          summ->Log(buf);
+        }
+        (void)summ->AddPfxInstr(PfxInstr(PX_SImm32, simm32));
+        break;
+      }
+
+      case DW_OP_breg0 ... DW_OP_breg31: {
+        size_t len;
+        int64_t n = reader->ReadSignedLEB128(cursor, &len);
+        cursor += len;
+        DW_REG_NUMBER reg = (DW_REG_NUMBER)(opc - DW_OP_breg0);
+        if (debug) {
+          SprintfLiteral(buf, "LUL.DW   DW_OP_breg%d %lld\n", (int)reg,
+                         (long long int)n);
+          summ->Log(buf);
+        }
+        // PfxInstr only allows a 32 bit signed offset.  So we
+        // must fail if the immediate is out of range.
+        if (n < INT32_MIN || INT32_MAX < n) goto fail;
+        (void)summ->AddPfxInstr(PfxInstr(PX_DwReg, reg));
+        (void)summ->AddPfxInstr(PfxInstr(PX_SImm32, (int32_t)n));
+        (void)summ->AddPfxInstr(PfxInstr(PX_Add));
+        break;
+      }
+
+      case DW_OP_const4s: {
+        uint64_t u64 = reader->ReadFourBytes(cursor);
+        cursor += 4;
+        // u64 is guaranteed by |ReadFourBytes| to be in the
+        // range 0 .. FFFFFFFF inclusive.  But to be safe:
+        uint32_t u32 = (uint32_t)(u64 & 0xFFFFFFFF);
+        int32_t s32 = (int32_t)u32;
+        if (debug) {
+          SprintfLiteral(buf, "LUL.DW   DW_OP_const4s %d\n", (int)s32);
+          summ->Log(buf);
+        }
+        (void)summ->AddPfxInstr(PfxInstr(PX_SImm32, s32));
+        break;
+      }
+
+      case DW_OP_deref:
+        nm = "deref";
+        pxop = PX_Deref;
+        goto no_operands;
+      case DW_OP_and:
+        nm = "and";
+        pxop = PX_And;
+        goto no_operands;
+      case DW_OP_plus:
+        nm = "plus";
+        pxop = PX_Add;
+        goto no_operands;
+      case DW_OP_minus:
+        nm = "minus";
+        pxop = PX_Sub;
+        goto no_operands;
+      case DW_OP_shl:
+        nm = "shl";
+        pxop = PX_Shl;
+        goto no_operands;
+      case DW_OP_ge:
+        nm = "ge";
+        pxop = PX_CmpGES;
+        goto no_operands;
+      no_operands:
+        MOZ_ASSERT(nm && pxop != PX_End);
+        if (debug) {
+          SprintfLiteral(buf, "LUL.DW   DW_OP_%s\n", nm);
+          summ->Log(buf);
+        }
+        (void)summ->AddPfxInstr(PfxInstr(pxop));
+        break;
+
+      default:
+        if (debug) {
+          SprintfLiteral(buf, "LUL.DW   unknown opc %d\n", (int)opc);
+          summ->Log(buf);
+        }
+        goto fail;
+
+    }  // switch (opc)
+
+  }  // while (cursor < end1)
+
+  MOZ_ASSERT(cursor >= end1);
+
+  if (cursor > end1) {
+    // We overran the Dwarf expression.  Give up.
+    goto fail;
+  }
+
+  // For DW_CFA_expression, what the expression denotes is the address
+  // of where the previous value is located.  The caller of this routine
+  // may therefore request one last dereference before the end marker is
+  // inserted.
+  if (derefAtEnd) {
+    (void)summ->AddPfxInstr(PfxInstr(PX_Deref));
+  }
+
+  // Insert an end marker, and declare success.
+  (void)summ->AddPfxInstr(PfxInstr(PX_End));
+  if (debug) {
+    SprintfLiteral(buf,
+                   "LUL.DW   conversion of dwarf expression succeeded, "
+                   "ix = %d\n",
+                   (int)start_ix);
+    summ->Log(buf);
+    summ->Log("LUL.DW  >>\n");
+  }
+  return start_ix;
+
+fail:
+  if (debug) {
+    summ->Log("LUL.DW   conversion of dwarf expression failed\n");
+    summ->Log("LUL.DW  >>\n");
+  }
+  return -1;
+}
+
+bool DwarfCFIToModule::Entry(size_t offset, uint64 address, uint64 length,
+                             uint8 version, const string& augmentation,
+                             unsigned return_address) {
+  if (DEBUG_DWARF) {
+    char buf[100];
+    SprintfLiteral(buf, "LUL.DW DwarfCFIToModule::Entry 0x%llx,+%lld\n",
+                   address, length);
+    summ_->Log(buf);
+  }
+
+  summ_->Entry(address, length);
+
+  // If dwarf2reader::CallFrameInfo can handle this version and
+  // augmentation, then we should be okay with that, so there's no
+  // need to check them here.
+
+  // Get ready to collect entries.
+  return_address_ = return_address;
+
+  // Breakpad STACK CFI records must provide a .ra rule, but DWARF CFI
+  // may not establish any rule for .ra if the return address column
+  // is an ordinary register, and that register holds the return
+  // address on entry to the function. So establish an initial .ra
+  // rule citing the return address register.
+  if (return_address_ < num_dw_regs_) {
+    summ_->Rule(address, return_address_, NODEREF, return_address, 0);
+  }
+
+  return true;
+}
+
+const UniqueString* DwarfCFIToModule::RegisterName(int i) {
+  if (i < 0) {
+    MOZ_ASSERT(i == kCFARegister);
+    return usu_->ToUniqueString(".cfa");
+  }
+  unsigned reg = i;
+  if (reg == return_address_) return usu_->ToUniqueString(".ra");
+
+  char buf[30];
+  SprintfLiteral(buf, "dwarf_reg_%u", reg);
+  return usu_->ToUniqueString(buf);
+}
+
+bool DwarfCFIToModule::UndefinedRule(uint64 address, int reg) {
+  reporter_->UndefinedNotSupported(entry_offset_, RegisterName(reg));
+  // Treat this as a non-fatal error.
+  return true;
+}
+
+bool DwarfCFIToModule::SameValueRule(uint64 address, int reg) {
+  if (DEBUG_DWARF) {
+    char buf[100];
+    SprintfLiteral(buf, "LUL.DW  0x%llx: old r%d = Same\n", address, reg);
+    summ_->Log(buf);
+  }
+  // reg + 0
+  summ_->Rule(address, reg, NODEREF, reg, 0);
+  return true;
+}
+
+bool DwarfCFIToModule::OffsetRule(uint64 address, int reg, int base_register,
+                                  long offset) {
+  if (DEBUG_DWARF) {
+    char buf[100];
+    SprintfLiteral(buf, "LUL.DW  0x%llx: old r%d = *(r%d + %ld)\n", address,
+                   reg, base_register, offset);
+    summ_->Log(buf);
+  }
+  // *(base_register + offset)
+  summ_->Rule(address, reg, DEREF, base_register, offset);
+  return true;
+}
+
+bool DwarfCFIToModule::ValOffsetRule(uint64 address, int reg, int base_register,
+                                     long offset) {
+  if (DEBUG_DWARF) {
+    char buf[100];
+    SprintfLiteral(buf, "LUL.DW  0x%llx: old r%d = r%d + %ld\n", address, reg,
+                   base_register, offset);
+    summ_->Log(buf);
+  }
+  // base_register + offset
+  summ_->Rule(address, reg, NODEREF, base_register, offset);
+  return true;
+}
+
+bool DwarfCFIToModule::RegisterRule(uint64 address, int reg,
+                                    int base_register) {
+  if (DEBUG_DWARF) {
+    char buf[100];
+    SprintfLiteral(buf, "LUL.DW  0x%llx: old r%d = r%d\n", address, reg,
+                   base_register);
+    summ_->Log(buf);
+  }
+  // base_register + 0
+  summ_->Rule(address, reg, NODEREF, base_register, 0);
+  return true;
+}
+
+bool DwarfCFIToModule::ExpressionRule(uint64 address, int reg,
+                                      const string& expression) {
+  bool debug = !!DEBUG_DWARF;
+  int32_t start_ix =
+      parseDwarfExpr(summ_, reader_, expression, debug, true /*pushCfaAtStart*/,
+                     true /*derefAtEnd*/);
+  if (start_ix >= 0) {
+    summ_->Rule(address, reg, PFXEXPR, 0, start_ix);
+  } else {
+    // Parsing of the Dwarf expression failed.  Treat this as a
+    // non-fatal error, hence return |true| even on this path.
+    reporter_->ExpressionCouldNotBeSummarised(entry_offset_, RegisterName(reg));
+  }
+  return true;
+}
+
+bool DwarfCFIToModule::ValExpressionRule(uint64 address, int reg,
+                                         const string& expression) {
+  bool debug = !!DEBUG_DWARF;
+  int32_t start_ix =
+      parseDwarfExpr(summ_, reader_, expression, debug, true /*pushCfaAtStart*/,
+                     false /*!derefAtEnd*/);
+  if (start_ix >= 0) {
+    summ_->Rule(address, reg, PFXEXPR, 0, start_ix);
+  } else {
+    // Parsing of the Dwarf expression failed.  Treat this as a
+    // non-fatal error, hence return |true| even on this path.
+    reporter_->ExpressionCouldNotBeSummarised(entry_offset_, RegisterName(reg));
+  }
+  return true;
+}
+
+bool DwarfCFIToModule::End() {
+  // module_->AddStackFrameEntry(entry_);
+  if (DEBUG_DWARF) {
+    summ_->Log("LUL.DW DwarfCFIToModule::End()\n");
+  }
+  summ_->End();
+  return true;
+}
+
+void DwarfCFIToModule::Reporter::UndefinedNotSupported(
+    size_t offset, const UniqueString* reg) {
+  char buf[300];
+  SprintfLiteral(buf, "DwarfCFIToModule::Reporter::UndefinedNotSupported()\n");
+  log_(buf);
+  // BPLOG(INFO) << file_ << ", section '" << section_
+  //  << "': the call frame entry at offset 0x"
+  //  << std::setbase(16) << offset << std::setbase(10)
+  //  << " sets the rule for register '" << FromUniqueString(reg)
+  //  << "' to 'undefined', but the Breakpad symbol file format cannot "
+  //  << " express this";
+}
+
+// FIXME: move this somewhere sensible
+static bool is_power_of_2(uint64_t n) {
+  int i, nSetBits = 0;
+  for (i = 0; i < 8 * (int)sizeof(n); i++) {
+    if ((n & ((uint64_t)1) << i) != 0) nSetBits++;
+  }
+  return nSetBits <= 1;
+}
+
+void DwarfCFIToModule::Reporter::ExpressionCouldNotBeSummarised(
+    size_t offset, const UniqueString* reg) {
+  static uint64_t n_complaints = 0;  // This isn't threadsafe
+  n_complaints++;
+  if (!is_power_of_2(n_complaints)) return;
+  char buf[300];
+  SprintfLiteral(buf,
+                 "DwarfCFIToModule::Reporter::"
+                 "ExpressionCouldNotBeSummarised(shown %llu times)\n",
+                 (unsigned long long int)n_complaints);
+  log_(buf);
+}
+
+}  // namespace lul
diff --git a/tools/profiler/lul/LulDwarfExt.h b/tools/profiler/lul/LulDwarfExt.h
new file mode 100644
index 0000000000..dcd2500e5a
--- /dev/null
+++ b/tools/profiler/lul/LulDwarfExt.h
@@ -0,0 +1,1289 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+
+// Copyright 2006, 2010 Google Inc. All Rights Reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Original author: Jim Blandy <jimb@mozilla.com> <jimb@red-bean.com>
+
+// This file is derived from the following files in
+// toolkit/crashreporter/google-breakpad:
+//   src/common/dwarf/types.h
+//   src/common/dwarf/dwarf2enums.h
+//   src/common/dwarf/bytereader.h
+//   src/common/dwarf_cfi_to_module.h
+//   src/common/dwarf/dwarf2reader.h
+
+#ifndef LulDwarfExt_h
+#define LulDwarfExt_h
+
+#include "LulDwarfSummariser.h"
+
+#include "mozilla/Assertions.h"
+
+#include <stdint.h>
+#include <string>
+
+typedef signed char int8;
+typedef short int16;
+typedef int int32;
+typedef long long int64;
+
+typedef unsigned char uint8;
+typedef unsigned short uint16;
+typedef unsigned int uint32;
+typedef unsigned long long uint64;
+
+#ifdef __PTRDIFF_TYPE__
+typedef __PTRDIFF_TYPE__ intptr;
+typedef unsigned __PTRDIFF_TYPE__ uintptr;
+#else
+#  error "Can't find pointer-sized integral types."
+#endif
+
+namespace lul {
+
+class UniqueString;
+
+// Exception handling frame description pointer formats, as described
+// by the Linux Standard Base Core Specification 4.0, section 11.5,
+// DWARF Extensions.
+enum DwarfPointerEncoding {
+  DW_EH_PE_absptr = 0x00,
+  DW_EH_PE_omit = 0xff,
+  DW_EH_PE_uleb128 = 0x01,
+  DW_EH_PE_udata2 = 0x02,
+  DW_EH_PE_udata4 = 0x03,
+  DW_EH_PE_udata8 = 0x04,
+  DW_EH_PE_sleb128 = 0x09,
+  DW_EH_PE_sdata2 = 0x0A,
+  DW_EH_PE_sdata4 = 0x0B,
+  DW_EH_PE_sdata8 = 0x0C,
+  DW_EH_PE_pcrel = 0x10,
+  DW_EH_PE_textrel = 0x20,
+  DW_EH_PE_datarel = 0x30,
+  DW_EH_PE_funcrel = 0x40,
+  DW_EH_PE_aligned = 0x50,
+
+  // The GNU toolchain sources define this enum value as well,
+  // simply to help classify the lower nybble values into signed and
+  // unsigned groups.
+  DW_EH_PE_signed = 0x08,
+
+  // This is not documented in LSB 4.0, but it is used in both the
+  // Linux and OS X toolchains. It can be added to any other
+  // encoding (except DW_EH_PE_aligned), and indicates that the
+  // encoded value represents the address at which the true address
+  // is stored, not the true address itself.
+  DW_EH_PE_indirect = 0x80
+};
+
+// We can't use the obvious name of LITTLE_ENDIAN and BIG_ENDIAN
+// because it conflicts with a macro
+enum Endianness { ENDIANNESS_BIG, ENDIANNESS_LITTLE };
+
+// A ByteReader knows how to read single- and multi-byte values of
+// various endiannesses, sizes, and encodings, as used in DWARF
+// debugging information and Linux C++ exception handling data.
+class ByteReader {
+ public:
+  // Construct a ByteReader capable of reading one-, two-, four-, and
+  // eight-byte values according to ENDIANNESS, absolute machine-sized
+  // addresses, DWARF-style "initial length" values, signed and
+  // unsigned LEB128 numbers, and Linux C++ exception handling data's
+  // encoded pointers.
+  explicit ByteReader(enum Endianness endianness);
+  virtual ~ByteReader();
+
+  // Read a single byte from BUFFER and return it as an unsigned 8 bit
+  // number.
+  uint8 ReadOneByte(const char* buffer) const;
+
+  // Read two bytes from BUFFER and return them as an unsigned 16 bit
+  // number, using this ByteReader's endianness.
+  uint16 ReadTwoBytes(const char* buffer) const;
+
+  // Read four bytes from BUFFER and return them as an unsigned 32 bit
+  // number, using this ByteReader's endianness. This function returns
+  // a uint64 so that it is compatible with ReadAddress and
+  // ReadOffset. The number it returns will never be outside the range
+  // of an unsigned 32 bit integer.
+  uint64 ReadFourBytes(const char* buffer) const;
+
+  // Read eight bytes from BUFFER and return them as an unsigned 64
+  // bit number, using this ByteReader's endianness.
+  uint64 ReadEightBytes(const char* buffer) const;
+
+  // Read an unsigned LEB128 (Little Endian Base 128) number from
+  // BUFFER and return it as an unsigned 64 bit integer. Set LEN to
+  // the number of bytes read.
+  //
+  // The unsigned LEB128 representation of an integer N is a variable
+  // number of bytes:
+  //
+  // - If N is between 0 and 0x7f, then its unsigned LEB128
+  //   representation is a single byte whose value is N.
+  //
+  // - Otherwise, its unsigned LEB128 representation is (N & 0x7f) |
+  //   0x80, followed by the unsigned LEB128 representation of N /
+  //   128, rounded towards negative infinity.
+  //
+  // In other words, we break VALUE into groups of seven bits, put
+  // them in little-endian order, and then write them as eight-bit
+  // bytes with the high bit on all but the last.
+  uint64 ReadUnsignedLEB128(const char* buffer, size_t* len) const;
+
+  // Read a signed LEB128 number from BUFFER and return it as an
+  // signed 64 bit integer. Set LEN to the number of bytes read.
+  //
+  // The signed LEB128 representation of an integer N is a variable
+  // number of bytes:
+  //
+  // - If N is between -0x40 and 0x3f, then its signed LEB128
+  //   representation is a single byte whose value is N in two's
+  //   complement.
+  //
+  // - Otherwise, its signed LEB128 representation is (N & 0x7f) |
+  //   0x80, followed by the signed LEB128 representation of N / 128,
+  //   rounded towards negative infinity.
+  //
+  // In other words, we break VALUE into groups of seven bits, put
+  // them in little-endian order, and then write them as eight-bit
+  // bytes with the high bit on all but the last.
+  int64 ReadSignedLEB128(const char* buffer, size_t* len) const;
+
+  // Indicate that addresses on this architecture are SIZE bytes long. SIZE
+  // must be either 4 or 8. (DWARF allows addresses to be any number of
+  // bytes in length from 1 to 255, but we only support 32- and 64-bit
+  // addresses at the moment.) You must call this before using the
+  // ReadAddress member function.
+  //
+  // For data in a .debug_info section, or something that .debug_info
+  // refers to like line number or macro data, the compilation unit
+  // header's address_size field indicates the address size to use. Call
+  // frame information doesn't indicate its address size (a shortcoming of
+  // the spec); you must supply the appropriate size based on the
+  // architecture of the target machine.
+  void SetAddressSize(uint8 size);
+
+  // Return the current address size, in bytes. This is either 4,
+  // indicating 32-bit addresses, or 8, indicating 64-bit addresses.
+  uint8 AddressSize() const { return address_size_; }
+
+  // Read an address from BUFFER and return it as an unsigned 64 bit
+  // integer, respecting this ByteReader's endianness and address size. You
+  // must call SetAddressSize before calling this function.
+  uint64 ReadAddress(const char* buffer) const;
+
+  // DWARF actually defines two slightly different formats: 32-bit DWARF
+  // and 64-bit DWARF. This is *not* related to the size of registers or
+  // addresses on the target machine; it refers only to the size of section
+  // offsets and data lengths appearing in the DWARF data. One only needs
+  // 64-bit DWARF when the debugging data itself is larger than 4GiB.
+  // 32-bit DWARF can handle x86_64 or PPC64 code just fine, unless the
+  // debugging data itself is very large.
+  //
+  // DWARF information identifies itself as 32-bit or 64-bit DWARF: each
+  // compilation unit and call frame information entry begins with an
+  // "initial length" field, which, in addition to giving the length of the
+  // data, also indicates the size of section offsets and lengths appearing
+  // in that data. The ReadInitialLength member function, below, reads an
+  // initial length and sets the ByteReader's offset size as a side effect.
+  // Thus, in the normal process of reading DWARF data, the appropriate
+  // offset size is set automatically. So, you should only need to call
+  // SetOffsetSize if you are using the same ByteReader to jump from the
+  // midst of one block of DWARF data into another.
+
+  // Read a DWARF "initial length" field from START, and return it as
+  // an unsigned 64 bit integer, respecting this ByteReader's
+  // endianness. Set *LEN to the length of the initial length in
+  // bytes, either four or twelve. As a side effect, set this
+  // ByteReader's offset size to either 4 (if we see a 32-bit DWARF
+  // initial length) or 8 (if we see a 64-bit DWARF initial length).
+  //
+  // A DWARF initial length is either:
+  //
+  // - a byte count stored as an unsigned 32-bit value less than
+  //   0xffffff00, indicating that the data whose length is being
+  //   measured uses the 32-bit DWARF format, or
+  //
+  // - The 32-bit value 0xffffffff, followed by a 64-bit byte count,
+  //   indicating that the data whose length is being measured uses
+  //   the 64-bit DWARF format.
+  uint64 ReadInitialLength(const char* start, size_t* len);
+
+  // Read an offset from BUFFER and return it as an unsigned 64 bit
+  // integer, respecting the ByteReader's endianness. In 32-bit DWARF, the
+  // offset is 4 bytes long; in 64-bit DWARF, the offset is eight bytes
+  // long. You must call ReadInitialLength or SetOffsetSize before calling
+  // this function; see the comments above for details.
+  uint64 ReadOffset(const char* buffer) const;
+
+  // Return the current offset size, in bytes.
+  // A return value of 4 indicates that we are reading 32-bit DWARF.
+  // A return value of 8 indicates that we are reading 64-bit DWARF.
+  uint8 OffsetSize() const { return offset_size_; }
+
+  // Indicate that section offsets and lengths are SIZE bytes long. SIZE
+  // must be either 4 (meaning 32-bit DWARF) or 8 (meaning 64-bit DWARF).
+  // Usually, you should not call this function yourself; instead, let a
+  // call to ReadInitialLength establish the data's offset size
+  // automatically.
+  void SetOffsetSize(uint8 size);
+
+  // The Linux C++ ABI uses a variant of DWARF call frame information
+  // for exception handling. This data is included in the program's
+  // address space as the ".eh_frame" section, and intepreted at
+  // runtime to walk the stack, find exception handlers, and run
+  // cleanup code. The format is mostly the same as DWARF CFI, with
+  // some adjustments made to provide the additional
+  // exception-handling data, and to make the data easier to work with
+  // in memory --- for example, to allow it to be placed in read-only
+  // memory even when describing position-independent code.
+  //
+  // In particular, exception handling data can select a number of
+  // different encodings for pointers that appear in the data, as
+  // described by the DwarfPointerEncoding enum. There are actually
+  // four axes(!) to the encoding:
+  //
+  // - The pointer size: pointers can be 2, 4, or 8 bytes long, or use
+  //   the DWARF LEB128 encoding.
+  //
+  // - The pointer's signedness: pointers can be signed or unsigned.
+  //
+  // - The pointer's base address: the data stored in the exception
+  //   handling data can be the actual address (that is, an absolute
+  //   pointer), or relative to one of a number of different base
+  //   addreses --- including that of the encoded pointer itself, for
+  //   a form of "pc-relative" addressing.
+  //
+  // - The pointer may be indirect: it may be the address where the
+  //   true pointer is stored. (This is used to refer to things via
+  //   global offset table entries, program linkage table entries, or
+  //   other tricks used in position-independent code.)
+  //
+  // There are also two options that fall outside that matrix
+  // altogether: the pointer may be omitted, or it may have padding to
+  // align it on an appropriate address boundary. (That last option
+  // may seem like it should be just another axis, but it is not.)
+
+  // Indicate that the exception handling data is loaded starting at
+  // SECTION_BASE, and that the start of its buffer in our own memory
+  // is BUFFER_BASE. This allows us to find the address that a given
+  // byte in our buffer would have when loaded into the program the
+  // data describes. We need this to resolve DW_EH_PE_pcrel pointers.
+  void SetCFIDataBase(uint64 section_base, const char* buffer_base);
+
+  // Indicate that the base address of the program's ".text" section
+  // is TEXT_BASE. We need this to resolve DW_EH_PE_textrel pointers.
+  void SetTextBase(uint64 text_base);
+
+  // Indicate that the base address for DW_EH_PE_datarel pointers is
+  // DATA_BASE. The proper value depends on the ABI; it is usually the
+  // address of the global offset table, held in a designated register in
+  // position-independent code. You will need to look at the startup code
+  // for the target system to be sure. I tried; my eyes bled.
+  void SetDataBase(uint64 data_base);
+
+  // Indicate that the base address for the FDE we are processing is
+  // FUNCTION_BASE. This is the start address of DW_EH_PE_funcrel
+  // pointers. (This encoding does not seem to be used by the GNU
+  // toolchain.)
+  void SetFunctionBase(uint64 function_base);
+
+  // Indicate that we are no longer processing any FDE, so any use of
+  // a DW_EH_PE_funcrel encoding is an error.
+  void ClearFunctionBase();
+
+  // Return true if ENCODING is a valid pointer encoding.
+  bool ValidEncoding(DwarfPointerEncoding encoding) const;
+
+  // Return true if we have all the information we need to read a
+  // pointer that uses ENCODING. This checks that the appropriate
+  // SetFooBase function for ENCODING has been called.
+  bool UsableEncoding(DwarfPointerEncoding encoding) const;
+
+  // Read an encoded pointer from BUFFER using ENCODING; return the
+  // absolute address it represents, and set *LEN to the pointer's
+  // length in bytes, including any padding for aligned pointers.
+  //
+  // This function calls 'abort' if ENCODING is invalid or refers to a
+  // base address this reader hasn't been given, so you should check
+  // with ValidEncoding and UsableEncoding first if you would rather
+  // die in a more helpful way.
+  uint64 ReadEncodedPointer(const char* buffer, DwarfPointerEncoding encoding,
+                            size_t* len) const;
+
+ private:
+  // Function pointer type for our address and offset readers.
+  typedef uint64 (ByteReader::*AddressReader)(const char*) const;
+
+  // Read an offset from BUFFER and return it as an unsigned 64 bit
+  // integer.  DWARF2/3 define offsets as either 4 or 8 bytes,
+  // generally depending on the amount of DWARF2/3 info present.
+  // This function pointer gets set by SetOffsetSize.
+  AddressReader offset_reader_;
+
+  // Read an address from BUFFER and return it as an unsigned 64 bit
+  // integer.  DWARF2/3 allow addresses to be any size from 0-255
+  // bytes currently.  Internally we support 4 and 8 byte addresses,
+  // and will CHECK on anything else.
+  // This function pointer gets set by SetAddressSize.
+  AddressReader address_reader_;
+
+  Endianness endian_;
+  uint8 address_size_;
+  uint8 offset_size_;
+
+  // Base addresses for Linux C++ exception handling data's encoded pointers.
+  bool have_section_base_, have_text_base_, have_data_base_;
+  bool have_function_base_;
+  uint64 section_base_;
+  uint64 text_base_, data_base_, function_base_;
+  const char* buffer_base_;
+};
+
+inline uint8 ByteReader::ReadOneByte(const char* buffer) const {
+  return buffer[0];
+}
+
+inline uint16 ByteReader::ReadTwoBytes(const char* signed_buffer) const {
+  const unsigned char* buffer =
+      reinterpret_cast<const unsigned char*>(signed_buffer);
+  const uint16 buffer0 = buffer[0];
+  const uint16 buffer1 = buffer[1];
+  if (endian_ == ENDIANNESS_LITTLE) {
+    return buffer0 | buffer1 << 8;
+  } else {
+    return buffer1 | buffer0 << 8;
+  }
+}
+
+inline uint64 ByteReader::ReadFourBytes(const char* signed_buffer) const {
+  const unsigned char* buffer =
+      reinterpret_cast<const unsigned char*>(signed_buffer);
+  const uint32 buffer0 = buffer[0];
+  const uint32 buffer1 = buffer[1];
+  const uint32 buffer2 = buffer[2];
+  const uint32 buffer3 = buffer[3];
+  if (endian_ == ENDIANNESS_LITTLE) {
+    return buffer0 | buffer1 << 8 | buffer2 << 16 | buffer3 << 24;
+  } else {
+    return buffer3 | buffer2 << 8 | buffer1 << 16 | buffer0 << 24;
+  }
+}
+
+inline uint64 ByteReader::ReadEightBytes(const char* signed_buffer) const {
+  const unsigned char* buffer =
+      reinterpret_cast<const unsigned char*>(signed_buffer);
+  const uint64 buffer0 = buffer[0];
+  const uint64 buffer1 = buffer[1];
+  const uint64 buffer2 = buffer[2];
+  const uint64 buffer3 = buffer[3];
+  const uint64 buffer4 = buffer[4];
+  const uint64 buffer5 = buffer[5];
+  const uint64 buffer6 = buffer[6];
+  const uint64 buffer7 = buffer[7];
+  if (endian_ == ENDIANNESS_LITTLE) {
+    return buffer0 | buffer1 << 8 | buffer2 << 16 | buffer3 << 24 |
+           buffer4 << 32 | buffer5 << 40 | buffer6 << 48 | buffer7 << 56;
+  } else {
+    return buffer7 | buffer6 << 8 | buffer5 << 16 | buffer4 << 24 |
+           buffer3 << 32 | buffer2 << 40 | buffer1 << 48 | buffer0 << 56;
+  }
+}
+
+// Read an unsigned LEB128 number.  Each byte contains 7 bits of
+// information, plus one bit saying whether the number continues or
+// not.
+
+inline uint64 ByteReader::ReadUnsignedLEB128(const char* buffer,
+                                             size_t* len) const {
+  uint64 result = 0;
+  size_t num_read = 0;
+  unsigned int shift = 0;
+  unsigned char byte;
+
+  do {
+    byte = *buffer++;
+    num_read++;
+
+    result |= (static_cast<uint64>(byte & 0x7f)) << shift;
+
+    shift += 7;
+
+  } while (byte & 0x80);
+
+  *len = num_read;
+
+  return result;
+}
+
+// Read a signed LEB128 number.  These are like regular LEB128
+// numbers, except the last byte may have a sign bit set.
+
+inline int64 ByteReader::ReadSignedLEB128(const char* buffer,
+                                          size_t* len) const {
+  int64 result = 0;
+  unsigned int shift = 0;
+  size_t num_read = 0;
+  unsigned char byte;
+
+  do {
+    byte = *buffer++;
+    num_read++;
+    result |= (static_cast<uint64>(byte & 0x7f) << shift);
+    shift += 7;
+  } while (byte & 0x80);
+
+  if ((shift < 8 * sizeof(result)) && (byte & 0x40))
+    result |= -((static_cast<int64>(1)) << shift);
+  *len = num_read;
+  return result;
+}
+
+inline uint64 ByteReader::ReadOffset(const char* buffer) const {
+  MOZ_ASSERT(this->offset_reader_);
+  return (this->*offset_reader_)(buffer);
+}
+
+inline uint64 ByteReader::ReadAddress(const char* buffer) const {
+  MOZ_ASSERT(this->address_reader_);
+  return (this->*address_reader_)(buffer);
+}
+
+inline void ByteReader::SetCFIDataBase(uint64 section_base,
+                                       const char* buffer_base) {
+  section_base_ = section_base;
+  buffer_base_ = buffer_base;
+  have_section_base_ = true;
+}
+
+inline void ByteReader::SetTextBase(uint64 text_base) {
+  text_base_ = text_base;
+  have_text_base_ = true;
+}
+
+inline void ByteReader::SetDataBase(uint64 data_base) {
+  data_base_ = data_base;
+  have_data_base_ = true;
+}
+
+inline void ByteReader::SetFunctionBase(uint64 function_base) {
+  function_base_ = function_base;
+  have_function_base_ = true;
+}
+
+inline void ByteReader::ClearFunctionBase() { have_function_base_ = false; }
+
+// (derived from)
+// dwarf_cfi_to_module.h: Define the DwarfCFIToModule class, which
+// accepts parsed DWARF call frame info and adds it to a Summariser object.
+
+// This class is a reader for DWARF's Call Frame Information.  CFI
+// describes how to unwind stack frames --- even for functions that do
+// not follow fixed conventions for saving registers, whose frame size
+// varies as they execute, etc.
+//
+// CFI describes, at each machine instruction, how to compute the
+// stack frame's base address, how to find the return address, and
+// where to find the saved values of the caller's registers (if the
+// callee has stashed them somewhere to free up the registers for its
+// own use).
+//
+// For example, suppose we have a function whose machine code looks
+// like this (imagine an assembly language that looks like C, for a
+// machine with 32-bit registers, and a stack that grows towards lower
+// addresses):
+//
+// func:                                ; entry point; return address at sp
+// func+0:      sp = sp - 16            ; allocate space for stack frame
+// func+1:      sp[12] = r0             ; save r0 at sp+12
+// ...                                  ; other code, not frame-related
+// func+10:     sp -= 4; *sp = x        ; push some x on the stack
+// ...                                  ; other code, not frame-related
+// func+20:     r0 = sp[16]             ; restore saved r0
+// func+21:     sp += 20                ; pop whole stack frame
+// func+22:     pc = *sp; sp += 4       ; pop return address and jump to it
+//
+// DWARF CFI is (a very compressed representation of) a table with a
+// row for each machine instruction address and a column for each
+// register showing how to restore it, if possible.
+//
+// A special column named "CFA", for "Canonical Frame Address", tells how
+// to compute the base address of the frame; registers' entries may
+// refer to the CFA in describing where the registers are saved.
+//
+// Another special column, named "RA", represents the return address.
+//
+// For example, here is a complete (uncompressed) table describing the
+// function above:
+//
+//     insn      cfa    r0      r1 ...  ra
+//     =======================================
+//     func+0:   sp                     cfa[0]
+//     func+1:   sp+16                  cfa[0]
+//     func+2:   sp+16  cfa[-4]         cfa[0]
+//     func+11:  sp+20  cfa[-4]         cfa[0]
+//     func+21:  sp+20                  cfa[0]
+//     func+22:  sp                     cfa[0]
+//
+// Some things to note here:
+//
+// - Each row describes the state of affairs *before* executing the
+//   instruction at the given address.  Thus, the row for func+0
+//   describes the state before we allocate the stack frame.  In the
+//   next row, the formula for computing the CFA has changed,
+//   reflecting that allocation.
+//
+// - The other entries are written in terms of the CFA; this allows
+//   them to remain unchanged as the stack pointer gets bumped around.
+//   For example, the rule for recovering the return address (the "ra"
+//   column) remains unchanged throughout the function, even as the
+//   stack pointer takes on three different offsets from the return
+//   address.
+//
+// - Although we haven't shown it, most calling conventions designate
+//   "callee-saves" and "caller-saves" registers. The callee must
+//   preserve the values of callee-saves registers; if it uses them,
+//   it must save their original values somewhere, and restore them
+//   before it returns. In contrast, the callee is free to trash
+//   caller-saves registers; if the callee uses these, it will
+//   probably not bother to save them anywhere, and the CFI will
+//   probably mark their values as "unrecoverable".
+//
+//   (However, since the caller cannot assume the callee was going to
+//   save them, caller-saves registers are probably dead in the caller
+//   anyway, so compilers usually don't generate CFA for caller-saves
+//   registers.)
+//
+// - Exactly where the CFA points is a matter of convention that
+//   depends on the architecture and ABI in use. In the example, the
+//   CFA is the value the stack pointer had upon entry to the
+//   function, pointing at the saved return address. But on the x86,
+//   the call frame information generated by GCC follows the
+//   convention that the CFA is the address *after* the saved return
+//   address.
+//
+//   But by definition, the CFA remains constant throughout the
+//   lifetime of the frame. This makes it a useful value for other
+//   columns to refer to. It is also gives debuggers a useful handle
+//   for identifying a frame.
+//
+// If you look at the table above, you'll notice that a given entry is
+// often the same as the one immediately above it: most instructions
+// change only one or two aspects of the stack frame, if they affect
+// it at all. The DWARF format takes advantage of this fact, and
+// reduces the size of the data by mentioning only the addresses and
+// columns at which changes take place. So for the above, DWARF CFI
+// data would only actually mention the following:
+//
+//     insn      cfa    r0      r1 ...  ra
+//     =======================================
+//     func+0:   sp                     cfa[0]
+//     func+1:   sp+16
+//     func+2:          cfa[-4]
+//     func+11:  sp+20
+//     func+21:         r0
+//     func+22:  sp
+//
+// In fact, this is the way the parser reports CFI to the consumer: as
+// a series of statements of the form, "At address X, column Y changed
+// to Z," and related conventions for describing the initial state.
+//
+// Naturally, it would be impractical to have to scan the entire
+// program's CFI, noting changes as we go, just to recover the
+// unwinding rules in effect at one particular instruction. To avoid
+// this, CFI data is grouped into "entries", each of which covers a
+// specified range of addresses and begins with a complete statement
+// of the rules for all recoverable registers at that starting
+// address. Each entry typically covers a single function.
+//
+// Thus, to compute the contents of a given row of the table --- that
+// is, rules for recovering the CFA, RA, and registers at a given
+// instruction --- the consumer should find the entry that covers that
+// instruction's address, start with the initial state supplied at the
+// beginning of the entry, and work forward until it has processed all
+// the changes up to and including those for the present instruction.
+//
+// There are seven kinds of rules that can appear in an entry of the
+// table:
+//
+// - "undefined": The given register is not preserved by the callee;
+//   its value cannot be recovered.
+//
+// - "same value": This register has the same value it did in the callee.
+//
+// - offset(N): The register is saved at offset N from the CFA.
+//
+// - val_offset(N): The value the register had in the caller is the
+//   CFA plus offset N. (This is usually only useful for describing
+//   the stack pointer.)
+//
+// - register(R): The register's value was saved in another register R.
+//
+// - expression(E): Evaluating the DWARF expression E using the
+//   current frame's registers' values yields the address at which the
+//   register was saved.
+//
+// - val_expression(E): Evaluating the DWARF expression E using the
+//   current frame's registers' values yields the value the register
+//   had in the caller.
+
+class CallFrameInfo {
+ public:
+  // The different kinds of entries one finds in CFI. Used internally,
+  // and for error reporting.
+  enum EntryKind { kUnknown, kCIE, kFDE, kTerminator };
+
+  // The handler class to which the parser hands the parsed call frame
+  // information.  Defined below.
+  class Handler;
+
+  // A reporter class, which CallFrameInfo uses to report errors
+  // encountered while parsing call frame information.  Defined below.
+  class Reporter;
+
+  // Create a DWARF CFI parser. BUFFER points to the contents of the
+  // .debug_frame section to parse; BUFFER_LENGTH is its length in bytes.
+  // REPORTER is an error reporter the parser should use to report
+  // problems. READER is a ByteReader instance that has the endianness and
+  // address size set properly. Report the data we find to HANDLER.
+  //
+  // This class can also parse Linux C++ exception handling data, as found
+  // in '.eh_frame' sections. This data is a variant of DWARF CFI that is
+  // placed in loadable segments so that it is present in the program's
+  // address space, and is interpreted by the C++ runtime to search the
+  // call stack for a handler interested in the exception being thrown,
+  // actually pop the frames, and find cleanup code to run.
+  //
+  // There are two differences between the call frame information described
+  // in the DWARF standard and the exception handling data Linux places in
+  // the .eh_frame section:
+  //
+  // - Exception handling data uses uses a different format for call frame
+  //   information entry headers. The distinguished CIE id, the way FDEs
+  //   refer to their CIEs, and the way the end of the series of entries is
+  //   determined are all slightly different.
+  //
+  //   If the constructor's EH_FRAME argument is true, then the
+  //   CallFrameInfo parses the entry headers as Linux C++ exception
+  //   handling data. If EH_FRAME is false or omitted, the CallFrameInfo
+  //   parses standard DWARF call frame information.
+  //
+  // - Linux C++ exception handling data uses CIE augmentation strings
+  //   beginning with 'z' to specify the presence of additional data after
+  //   the CIE and FDE headers and special encodings used for addresses in
+  //   frame description entries.
+  //
+  //   CallFrameInfo can handle 'z' augmentations in either DWARF CFI or
+  //   exception handling data if you have supplied READER with the base
+  //   addresses needed to interpret the pointer encodings that 'z'
+  //   augmentations can specify. See the ByteReader interface for details
+  //   about the base addresses. See the CallFrameInfo::Handler interface
+  //   for details about the additional information one might find in
+  //   'z'-augmented data.
+  //
+  // Thus:
+  //
+  // - If you are parsing standard DWARF CFI, as found in a .debug_frame
+  //   section, you should pass false for the EH_FRAME argument, or omit
+  //   it, and you need not worry about providing READER with the
+  //   additional base addresses.
+  //
+  // - If you want to parse Linux C++ exception handling data from a
+  //   .eh_frame section, you should pass EH_FRAME as true, and call
+  //   READER's Set*Base member functions before calling our Start method.
+  //
+  // - If you want to parse DWARF CFI that uses the 'z' augmentations
+  //   (although I don't think any toolchain ever emits such data), you
+  //   could pass false for EH_FRAME, but call READER's Set*Base members.
+  //
+  // The extensions the Linux C++ ABI makes to DWARF for exception
+  // handling are described here, rather poorly:
+  // http://refspecs.linux-foundation.org/LSB_4.0.0/LSB-Core-generic/LSB-Core-generic/dwarfext.html
+  // http://refspecs.linux-foundation.org/LSB_4.0.0/LSB-Core-generic/LSB-Core-generic/ehframechpt.html
+  //
+  // The mechanics of C++ exception handling, personality routines,
+  // and language-specific data areas are described here, rather nicely:
+  // http://www.codesourcery.com/public/cxx-abi/abi-eh.html
+
+  CallFrameInfo(const char* buffer, size_t buffer_length, ByteReader* reader,
+                Handler* handler, Reporter* reporter, bool eh_frame = false)
+      : buffer_(buffer),
+        buffer_length_(buffer_length),
+        reader_(reader),
+        handler_(handler),
+        reporter_(reporter),
+        eh_frame_(eh_frame) {}
+
+  ~CallFrameInfo() {}
+
+  // Parse the entries in BUFFER, reporting what we find to HANDLER.
+  // Return true if we reach the end of the section successfully, or
+  // false if we encounter an error.
+  bool Start();
+
+  // Return the textual name of KIND. For error reporting.
+  static const char* KindName(EntryKind kind);
+
+ private:
+  struct CIE;
+
+  // A CFI entry, either an FDE or a CIE.
+  struct Entry {
+    // The starting offset of the entry in the section, for error
+    // reporting.
+    size_t offset;
+
+    // The start of this entry in the buffer.
+    const char* start;
+
+    // Which kind of entry this is.
+    //
+    // We want to be able to use this for error reporting even while we're
+    // in the midst of parsing. Error reporting code may assume that kind,
+    // offset, and start fields are valid, although kind may be kUnknown.
+    EntryKind kind;
+
+    // The end of this entry's common prologue (initial length and id), and
+    // the start of this entry's kind-specific fields.
+    const char* fields;
+
+    // The start of this entry's instructions.
+    const char* instructions;
+
+    // The address past the entry's last byte in the buffer. (Note that
+    // since offset points to the entry's initial length field, and the
+    // length field is the number of bytes after that field, this is not
+    // simply buffer_ + offset + length.)
+    const char* end;
+
+    // For both DWARF CFI and .eh_frame sections, this is the CIE id in a
+    // CIE, and the offset of the associated CIE in an FDE.
+    uint64 id;
+
+    // The CIE that applies to this entry, if we've parsed it. If this is a
+    // CIE, then this field points to this structure.
+    CIE* cie;
+  };
+
+  // A common information entry (CIE).
+  struct CIE : public Entry {
+    uint8 version;                     // CFI data version number
+    std::string augmentation;          // vendor format extension markers
+    uint64 code_alignment_factor;      // scale for code address adjustments
+    int data_alignment_factor;         // scale for stack pointer adjustments
+    unsigned return_address_register;  // which register holds the return addr
+
+    // True if this CIE includes Linux C++ ABI 'z' augmentation data.
+    bool has_z_augmentation;
+
+    // Parsed 'z' augmentation data. These are meaningful only if
+    // has_z_augmentation is true.
+    bool has_z_lsda;          // The 'z' augmentation included 'L'.
+    bool has_z_personality;   // The 'z' augmentation included 'P'.
+    bool has_z_signal_frame;  // The 'z' augmentation included 'S'.
+
+    // If has_z_lsda is true, this is the encoding to be used for language-
+    // specific data area pointers in FDEs.
+    DwarfPointerEncoding lsda_encoding;
+
+    // If has_z_personality is true, this is the encoding used for the
+    // personality routine pointer in the augmentation data.
+    DwarfPointerEncoding personality_encoding;
+
+    // If has_z_personality is true, this is the address of the personality
+    // routine --- or, if personality_encoding & DW_EH_PE_indirect, the
+    // address where the personality routine's address is stored.
+    uint64 personality_address;
+
+    // This is the encoding used for addresses in the FDE header and
+    // in DW_CFA_set_loc instructions. This is always valid, whether
+    // or not we saw a 'z' augmentation string; its default value is
+    // DW_EH_PE_absptr, which is what normal DWARF CFI uses.
+    DwarfPointerEncoding pointer_encoding;
+  };
+
+  // A frame description entry (FDE).
+  struct FDE : public Entry {
+    uint64 address;  // start address of described code
+    uint64 size;     // size of described code, in bytes
+
+    // If cie->has_z_lsda is true, then this is the language-specific data
+    // area's address --- or its address's address, if cie->lsda_encoding
+    // has the DW_EH_PE_indirect bit set.
+    uint64 lsda_address;
+  };
+
+  // Internal use.
+  class Rule;
+  class UndefinedRule;
+  class SameValueRule;
+  class OffsetRule;
+  class ValOffsetRule;
+  class RegisterRule;
+  class ExpressionRule;
+  class ValExpressionRule;
+  class RuleMap;
+  class State;
+
+  // Parse the initial length and id of a CFI entry, either a CIE, an FDE,
+  // or a .eh_frame end-of-data mark. CURSOR points to the beginning of the
+  // data to parse. On success, populate ENTRY as appropriate, and return
+  // true. On failure, report the problem, and return false. Even if we
+  // return false, set ENTRY->end to the first byte after the entry if we
+  // were able to figure that out, or NULL if we weren't.
+  bool ReadEntryPrologue(const char* cursor, Entry* entry);
+
+  // Parse the fields of a CIE after the entry prologue, including any 'z'
+  // augmentation data. Assume that the 'Entry' fields of CIE are
+  // populated; use CIE->fields and CIE->end as the start and limit for
+  // parsing. On success, populate the rest of *CIE, and return true; on
+  // failure, report the problem and return false.
+  bool ReadCIEFields(CIE* cie);
+
+  // Parse the fields of an FDE after the entry prologue, including any 'z'
+  // augmentation data. Assume that the 'Entry' fields of *FDE are
+  // initialized; use FDE->fields and FDE->end as the start and limit for
+  // parsing. Assume that FDE->cie is fully initialized. On success,
+  // populate the rest of *FDE, and return true; on failure, report the
+  // problem and return false.
+  bool ReadFDEFields(FDE* fde);
+
+  // Report that ENTRY is incomplete, and return false. This is just a
+  // trivial wrapper for invoking reporter_->Incomplete; it provides a
+  // little brevity.
+  bool ReportIncomplete(Entry* entry);
+
+  // Return true if ENCODING has the DW_EH_PE_indirect bit set.
+  static bool IsIndirectEncoding(DwarfPointerEncoding encoding) {
+    return encoding & DW_EH_PE_indirect;
+  }
+
+  // The contents of the DWARF .debug_info section we're parsing.
+  const char* buffer_;
+  size_t buffer_length_;
+
+  // For reading multi-byte values with the appropriate endianness.
+  ByteReader* reader_;
+
+  // The handler to which we should report the data we find.
+  Handler* handler_;
+
+  // For reporting problems in the info we're parsing.
+  Reporter* reporter_;
+
+  // True if we are processing .eh_frame-format data.
+  bool eh_frame_;
+};
+
+// The handler class for CallFrameInfo.  The a CFI parser calls the
+// member functions of a handler object to report the data it finds.
+class CallFrameInfo::Handler {
+ public:
+  // The pseudo-register number for the canonical frame address.
+  enum { kCFARegister = DW_REG_CFA };
+
+  Handler() {}
+  virtual ~Handler() {}
+
+  // The parser has found CFI for the machine code at ADDRESS,
+  // extending for LENGTH bytes. OFFSET is the offset of the frame
+  // description entry in the section, for use in error messages.
+  // VERSION is the version number of the CFI format. AUGMENTATION is
+  // a string describing any producer-specific extensions present in
+  // the data. RETURN_ADDRESS is the number of the register that holds
+  // the address to which the function should return.
+  //
+  // Entry should return true to process this CFI, or false to skip to
+  // the next entry.
+  //
+  // The parser invokes Entry for each Frame Description Entry (FDE)
+  // it finds.  The parser doesn't report Common Information Entries
+  // to the handler explicitly; instead, if the handler elects to
+  // process a given FDE, the parser reiterates the appropriate CIE's
+  // contents at the beginning of the FDE's rules.
+  virtual bool Entry(size_t offset, uint64 address, uint64 length,
+                     uint8 version, const std::string& augmentation,
+                     unsigned return_address) = 0;
+
+  // When the Entry function returns true, the parser calls these
+  // handler functions repeatedly to describe the rules for recovering
+  // registers at each instruction in the given range of machine code.
+  // Immediately after a call to Entry, the handler should assume that
+  // the rule for each callee-saves register is "unchanged" --- that
+  // is, that the register still has the value it had in the caller.
+  //
+  // If a *Rule function returns true, we continue processing this entry's
+  // instructions. If a *Rule function returns false, we stop evaluating
+  // instructions, and skip to the next entry. Either way, we call End
+  // before going on to the next entry.
+  //
+  // In all of these functions, if the REG parameter is kCFARegister, then
+  // the rule describes how to find the canonical frame address.
+  // kCFARegister may be passed as a BASE_REGISTER argument, meaning that
+  // the canonical frame address should be used as the base address for the
+  // computation. All other REG values will be positive.
+
+  // At ADDRESS, register REG's value is not recoverable.
+  virtual bool UndefinedRule(uint64 address, int reg) = 0;
+
+  // At ADDRESS, register REG's value is the same as that it had in
+  // the caller.
+  virtual bool SameValueRule(uint64 address, int reg) = 0;
+
+  // At ADDRESS, register REG has been saved at offset OFFSET from
+  // BASE_REGISTER.
+  virtual bool OffsetRule(uint64 address, int reg, int base_register,
+                          long offset) = 0;
+
+  // At ADDRESS, the caller's value of register REG is the current
+  // value of BASE_REGISTER plus OFFSET. (This rule doesn't provide an
+  // address at which the register's value is saved.)
+  virtual bool ValOffsetRule(uint64 address, int reg, int base_register,
+                             long offset) = 0;
+
+  // At ADDRESS, register REG has been saved in BASE_REGISTER. This differs
+  // from ValOffsetRule(ADDRESS, REG, BASE_REGISTER, 0), in that
+  // BASE_REGISTER is the "home" for REG's saved value: if you want to
+  // assign to a variable whose home is REG in the calling frame, you
+  // should put the value in BASE_REGISTER.
+  virtual bool RegisterRule(uint64 address, int reg, int base_register) = 0;
+
+  // At ADDRESS, the DWARF expression EXPRESSION yields the address at
+  // which REG was saved.
+  virtual bool ExpressionRule(uint64 address, int reg,
+                              const std::string& expression) = 0;
+
+  // At ADDRESS, the DWARF expression EXPRESSION yields the caller's
+  // value for REG. (This rule doesn't provide an address at which the
+  // register's value is saved.)
+  virtual bool ValExpressionRule(uint64 address, int reg,
+                                 const std::string& expression) = 0;
+
+  // Indicate that the rules for the address range reported by the
+  // last call to Entry are complete.  End should return true if
+  // everything is okay, or false if an error has occurred and parsing
+  // should stop.
+  virtual bool End() = 0;
+
+  // Handler functions for Linux C++ exception handling data. These are
+  // only called if the data includes 'z' augmentation strings.
+
+  // The Linux C++ ABI uses an extension of the DWARF CFI format to
+  // walk the stack to propagate exceptions from the throw to the
+  // appropriate catch, and do the appropriate cleanups along the way.
+  // CFI entries used for exception handling have two additional data
+  // associated with them:
+  //
+  // - The "language-specific data area" describes which exception
+  //   types the function has 'catch' clauses for, and indicates how
+  //   to go about re-entering the function at the appropriate catch
+  //   clause. If the exception is not caught, it describes the
+  //   destructors that must run before the frame is popped.
+  //
+  // - The "personality routine" is responsible for interpreting the
+  //   language-specific data area's contents, and deciding whether
+  //   the exception should continue to propagate down the stack,
+  //   perhaps after doing some cleanup for this frame, or whether the
+  //   exception will be caught here.
+  //
+  // In principle, the language-specific data area is opaque to
+  // everybody but the personality routine. In practice, these values
+  // may be useful or interesting to readers with extra context, and
+  // we have to at least skip them anyway, so we might as well report
+  // them to the handler.
+
+  // This entry's exception handling personality routine's address is
+  // ADDRESS. If INDIRECT is true, then ADDRESS is the address at
+  // which the routine's address is stored. The default definition for
+  // this handler function simply returns true, allowing parsing of
+  // the entry to continue.
+  virtual bool PersonalityRoutine(uint64 address, bool indirect) {
+    return true;
+  }
+
+  // This entry's language-specific data area (LSDA) is located at
+  // ADDRESS. If INDIRECT is true, then ADDRESS is the address at
+  // which the area's address is stored. The default definition for
+  // this handler function simply returns true, allowing parsing of
+  // the entry to continue.
+  virtual bool LanguageSpecificDataArea(uint64 address, bool indirect) {
+    return true;
+  }
+
+  // This entry describes a signal trampoline --- this frame is the
+  // caller of a signal handler. The default definition for this
+  // handler function simply returns true, allowing parsing of the
+  // entry to continue.
+  //
+  // The best description of the rationale for and meaning of signal
+  // trampoline CFI entries seems to be in the GCC bug database:
+  // http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26208
+  virtual bool SignalHandler() { return true; }
+};
+
+// The CallFrameInfo class makes calls on an instance of this class to
+// report errors or warn about problems in the data it is parsing.
+// These messages are sent to the message sink |aLog| provided to the
+// constructor.
+class CallFrameInfo::Reporter {
+ public:
+  // Create an error reporter which attributes troubles to the section
+  // named SECTION in FILENAME.
+  //
+  // Normally SECTION would be .debug_frame, but the Mac puts CFI data
+  // in a Mach-O section named __debug_frame. If we support
+  // Linux-style exception handling data, we could be reading an
+  // .eh_frame section.
+  Reporter(void (*aLog)(const char*), const std::string& filename,
+           const std::string& section = ".debug_frame")
+      : log_(aLog), filename_(filename), section_(section) {}
+  virtual ~Reporter() {}
+
+  // The CFI entry at OFFSET ends too early to be well-formed. KIND
+  // indicates what kind of entry it is; KIND can be kUnknown if we
+  // haven't parsed enough of the entry to tell yet.
+  virtual void Incomplete(uint64 offset, CallFrameInfo::EntryKind kind);
+
+  // The .eh_frame data has a four-byte zero at OFFSET where the next
+  // entry's length would be; this is a terminator. However, the buffer
+  // length as given to the CallFrameInfo constructor says there should be
+  // more data.
+  virtual void EarlyEHTerminator(uint64 offset);
+
+  // The FDE at OFFSET refers to the CIE at CIE_OFFSET, but the
+  // section is not that large.
+  virtual void CIEPointerOutOfRange(uint64 offset, uint64 cie_offset);
+
+  // The FDE at OFFSET refers to the CIE at CIE_OFFSET, but the entry
+  // there is not a CIE.
+  virtual void BadCIEId(uint64 offset, uint64 cie_offset);
+
+  // The FDE at OFFSET refers to a CIE with version number VERSION,
+  // which we don't recognize. We cannot parse DWARF CFI if it uses
+  // a version number we don't recognize.
+  virtual void UnrecognizedVersion(uint64 offset, int version);
+
+  // The FDE at OFFSET refers to a CIE with augmentation AUGMENTATION,
+  // which we don't recognize. We cannot parse DWARF CFI if it uses
+  // augmentations we don't recognize.
+  virtual void UnrecognizedAugmentation(uint64 offset,
+                                        const std::string& augmentation);
+
+  // The FDE at OFFSET contains an invalid or otherwise unusable Dwarf4
+  // specific field (currently, only "address_size" or "segment_size").
+  // Parsing DWARF CFI with unexpected values here seems dubious at best,
+  // so we stop.  WHAT gives a little more information about what is wrong.
+  virtual void InvalidDwarf4Artefact(uint64 offset, const char* what);
+
+  // The pointer encoding ENCODING, specified by the CIE at OFFSET, is not
+  // a valid encoding.
+  virtual void InvalidPointerEncoding(uint64 offset, uint8 encoding);
+
+  // The pointer encoding ENCODING, specified by the CIE at OFFSET, depends
+  // on a base address which has not been supplied.
+  virtual void UnusablePointerEncoding(uint64 offset, uint8 encoding);
+
+  // The CIE at OFFSET contains a DW_CFA_restore instruction at
+  // INSN_OFFSET, which may not appear in a CIE.
+  virtual void RestoreInCIE(uint64 offset, uint64 insn_offset);
+
+  // The entry at OFFSET, of kind KIND, has an unrecognized
+  // instruction at INSN_OFFSET.
+  virtual void BadInstruction(uint64 offset, CallFrameInfo::EntryKind kind,
+                              uint64 insn_offset);
+
+  // The instruction at INSN_OFFSET in the entry at OFFSET, of kind
+  // KIND, establishes a rule that cites the CFA, but we have not
+  // established a CFA rule yet.
+  virtual void NoCFARule(uint64 offset, CallFrameInfo::EntryKind kind,
+                         uint64 insn_offset);
+
+  // The instruction at INSN_OFFSET in the entry at OFFSET, of kind
+  // KIND, is a DW_CFA_restore_state instruction, but the stack of
+  // saved states is empty.
+  virtual void EmptyStateStack(uint64 offset, CallFrameInfo::EntryKind kind,
+                               uint64 insn_offset);
+
+  // The DW_CFA_remember_state instruction at INSN_OFFSET in the entry
+  // at OFFSET, of kind KIND, would restore a state that has no CFA
+  // rule, whereas the current state does have a CFA rule. This is
+  // bogus input, which the CallFrameInfo::Handler interface doesn't
+  // (and shouldn't) have any way to report.
+  virtual void ClearingCFARule(uint64 offset, CallFrameInfo::EntryKind kind,
+                               uint64 insn_offset);
+
+ private:
+  // A logging sink function, as supplied by LUL's user.
+  void (*log_)(const char*);
+
+ protected:
+  // The name of the file whose CFI we're reading.
+  std::string filename_;
+
+  // The name of the CFI section in that file.
+  std::string section_;
+};
+
+using lul::CallFrameInfo;
+using lul::Summariser;
+
+// A class that accepts parsed call frame information from the DWARF
+// CFI parser and populates a google_breakpad::Module object with the
+// contents.
+class DwarfCFIToModule : public CallFrameInfo::Handler {
+ public:
+  // DwarfCFIToModule uses an instance of this class to report errors
+  // detected while converting DWARF CFI to Breakpad STACK CFI records.
+  class Reporter {
+   public:
+    // Create a reporter that writes messages to the message sink
+    // |aLog|. FILE is the name of the file we're processing, and
+    // SECTION is the name of the section within that file that we're
+    // looking at (.debug_frame, .eh_frame, etc.).
+    Reporter(void (*aLog)(const char*), const std::string& file,
+             const std::string& section)
+        : log_(aLog), file_(file), section_(section) {}
+    virtual ~Reporter() {}
+
+    // The DWARF CFI entry at OFFSET says that REG is undefined, but the
+    // Breakpad symbol file format cannot express this.
+    virtual void UndefinedNotSupported(size_t offset, const UniqueString* reg);
+
+    // The DWARF CFI entry at OFFSET says that REG uses a DWARF
+    // expression to find its value, but parseDwarfExpr could not
+    // convert it to a sequence of PfxInstrs.
+    virtual void ExpressionCouldNotBeSummarised(size_t offset,
+                                                const UniqueString* reg);
+
+   private:
+    // A logging sink function, as supplied by LUL's user.
+    void (*log_)(const char*);
+
+   protected:
+    std::string file_, section_;
+  };
+
+  // Register name tables. If TABLE is a vector returned by one of these
+  // functions, then TABLE[R] is the name of the register numbered R in
+  // DWARF call frame information.
+  class RegisterNames {
+   public:
+    // Intel's "x86" or IA-32.
+    static unsigned int I386();
+
+    // AMD x86_64, AMD64, Intel EM64T, or Intel 64
+    static unsigned int X86_64();
+
+    // ARM.
+    static unsigned int ARM();
+
+    // AARCH64.
+    static unsigned int ARM64();
+
+    // MIPS.
+    static unsigned int MIPS();
+  };
+
+  // Create a handler for the dwarf2reader::CallFrameInfo parser that
+  // records the stack unwinding information it receives in SUMM.
+  //
+  // Use REGISTER_NAMES[I] as the name of register number I; *this
+  // keeps a reference to the vector, so the vector should remain
+  // alive for as long as the DwarfCFIToModule does.
+  //
+  // Use REPORTER for reporting problems encountered in the conversion
+  // process.
+  DwarfCFIToModule(const unsigned int num_dw_regs, Reporter* reporter,
+                   ByteReader* reader,
+                   /*MOD*/ UniqueStringUniverse* usu,
+                   /*OUT*/ Summariser* summ)
+      : summ_(summ),
+        usu_(usu),
+        num_dw_regs_(num_dw_regs),
+        reporter_(reporter),
+        reader_(reader),
+        return_address_(-1) {}
+  virtual ~DwarfCFIToModule() {}
+
+  virtual bool Entry(size_t offset, uint64 address, uint64 length,
+                     uint8 version, const std::string& augmentation,
+                     unsigned return_address) override;
+  virtual bool UndefinedRule(uint64 address, int reg) override;
+  virtual bool SameValueRule(uint64 address, int reg) override;
+  virtual bool OffsetRule(uint64 address, int reg, int base_register,
+                          long offset) override;
+  virtual bool ValOffsetRule(uint64 address, int reg, int base_register,
+                             long offset) override;
+  virtual bool RegisterRule(uint64 address, int reg,
+                            int base_register) override;
+  virtual bool ExpressionRule(uint64 address, int reg,
+                              const std::string& expression) override;
+  virtual bool ValExpressionRule(uint64 address, int reg,
+                                 const std::string& expression) override;
+  virtual bool End() override;
+
+ private:
+  // Return the name to use for register I.
+  const UniqueString* RegisterName(int i);
+
+  // The Summariser to which we should give entries
+  Summariser* summ_;
+
+  // Universe for creating UniqueStrings in, should that be necessary.
+  UniqueStringUniverse* usu_;
+
+  // The number of Dwarf-defined register names for this architecture.
+  const unsigned int num_dw_regs_;
+
+  // The reporter to use to report problems.
+  Reporter* reporter_;
+
+  // The ByteReader to use for parsing Dwarf expressions.
+  ByteReader* reader_;
+
+  // The section offset of the current frame description entry, for
+  // use in error messages.
+  size_t entry_offset_;
+
+  // The return address column for that entry.
+  unsigned return_address_;
+};
+
+// Convert the Dwarf expression in |expr| into PfxInstrs stored in the
+// SecMap referred to by |summ|, and return the index of the starting
+// PfxInstr added, which must be >= 0.  In case of failure return -1.
+int32_t parseDwarfExpr(Summariser* summ, const ByteReader* reader,
+                       std::string expr, bool debug, bool pushCfaAtStart,
+                       bool derefAtEnd);
+
+}  // namespace lul
+
+#endif  // LulDwarfExt_h
diff --git a/tools/profiler/lul/LulDwarfInt.h b/tools/profiler/lul/LulDwarfInt.h
new file mode 100644
index 0000000000..b72c6e08e3
--- /dev/null
+++ b/tools/profiler/lul/LulDwarfInt.h
@@ -0,0 +1,193 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+
+// Copyright (c) 2008, 2010 Google Inc. All Rights Reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// CFI reader author: Jim Blandy <jimb@mozilla.com> <jimb@red-bean.com>
+
+// This file is derived from the following file in
+// toolkit/crashreporter/google-breakpad:
+//   src/common/dwarf/dwarf2enums.h
+
+#ifndef LulDwarfInt_h
+#define LulDwarfInt_h
+
+#include "LulCommonExt.h"
+#include "LulDwarfExt.h"
+
+namespace lul {
+
+// These enums do not follow the google3 style only because they are
+// known universally (specs, other implementations) by the names in
+// exactly this capitalization.
+// Tag names and codes.
+
+// Call Frame Info instructions.
+enum DwarfCFI {
+  DW_CFA_advance_loc = 0x40,
+  DW_CFA_offset = 0x80,
+  DW_CFA_restore = 0xc0,
+  DW_CFA_nop = 0x00,
+  DW_CFA_set_loc = 0x01,
+  DW_CFA_advance_loc1 = 0x02,
+  DW_CFA_advance_loc2 = 0x03,
+  DW_CFA_advance_loc4 = 0x04,
+  DW_CFA_offset_extended = 0x05,
+  DW_CFA_restore_extended = 0x06,
+  DW_CFA_undefined = 0x07,
+  DW_CFA_same_value = 0x08,
+  DW_CFA_register = 0x09,
+  DW_CFA_remember_state = 0x0a,
+  DW_CFA_restore_state = 0x0b,
+  DW_CFA_def_cfa = 0x0c,
+  DW_CFA_def_cfa_register = 0x0d,
+  DW_CFA_def_cfa_offset = 0x0e,
+  DW_CFA_def_cfa_expression = 0x0f,
+  DW_CFA_expression = 0x10,
+  DW_CFA_offset_extended_sf = 0x11,
+  DW_CFA_def_cfa_sf = 0x12,
+  DW_CFA_def_cfa_offset_sf = 0x13,
+  DW_CFA_val_offset = 0x14,
+  DW_CFA_val_offset_sf = 0x15,
+  DW_CFA_val_expression = 0x16,
+
+  // Opcodes in this range are reserved for user extensions.
+  DW_CFA_lo_user = 0x1c,
+  DW_CFA_hi_user = 0x3f,
+
+  // SGI/MIPS specific.
+  DW_CFA_MIPS_advance_loc8 = 0x1d,
+
+  // GNU extensions.
+  DW_CFA_GNU_window_save = 0x2d,
+  DW_CFA_GNU_args_size = 0x2e,
+  DW_CFA_GNU_negative_offset_extended = 0x2f
+};
+
+// Exception handling 'z' augmentation letters.
+enum DwarfZAugmentationCodes {
+  // If the CFI augmentation string begins with 'z', then the CIE and FDE
+  // have an augmentation data area just before the instructions, whose
+  // contents are determined by the subsequent augmentation letters.
+  DW_Z_augmentation_start = 'z',
+
+  // If this letter is present in a 'z' augmentation string, the CIE
+  // augmentation data includes a pointer encoding, and the FDE
+  // augmentation data includes a language-specific data area pointer,
+  // represented using that encoding.
+  DW_Z_has_LSDA = 'L',
+
+  // If this letter is present in a 'z' augmentation string, the CIE
+  // augmentation data includes a pointer encoding, followed by a pointer
+  // to a personality routine, represented using that encoding.
+  DW_Z_has_personality_routine = 'P',
+
+  // If this letter is present in a 'z' augmentation string, the CIE
+  // augmentation data includes a pointer encoding describing how the FDE's
+  // initial location, address range, and DW_CFA_set_loc operands are
+  // encoded.
+  DW_Z_has_FDE_address_encoding = 'R',
+
+  // If this letter is present in a 'z' augmentation string, then code
+  // addresses covered by FDEs that cite this CIE are signal delivery
+  // trampolines. Return addresses of frames in trampolines should not be
+  // adjusted as described in section 6.4.4 of the DWARF 3 spec.
+  DW_Z_is_signal_trampoline = 'S'
+};
+
+// Expression opcodes
+enum DwarfExpressionOpcodes {
+  DW_OP_addr = 0x03,
+  DW_OP_deref = 0x06,
+  DW_OP_const1s = 0x09,
+  DW_OP_const2u = 0x0a,
+  DW_OP_const2s = 0x0b,
+  DW_OP_const4u = 0x0c,
+  DW_OP_const4s = 0x0d,
+  DW_OP_const8u = 0x0e,
+  DW_OP_const8s = 0x0f,
+  DW_OP_constu = 0x10,
+  DW_OP_consts = 0x11,
+  DW_OP_dup = 0x12,
+  DW_OP_drop = 0x13,
+  DW_OP_over = 0x14,
+  DW_OP_pick = 0x15,
+  DW_OP_swap = 0x16,
+  DW_OP_rot = 0x17,
+  DW_OP_xderef = 0x18,
+  DW_OP_abs = 0x19,
+  DW_OP_and = 0x1a,
+  DW_OP_div = 0x1b,
+  DW_OP_minus = 0x1c,
+  DW_OP_mod = 0x1d,
+  DW_OP_mul = 0x1e,
+  DW_OP_neg = 0x1f,
+  DW_OP_not = 0x20,
+  DW_OP_or = 0x21,
+  DW_OP_plus = 0x22,
+  DW_OP_plus_uconst = 0x23,
+  DW_OP_shl = 0x24,
+  DW_OP_shr = 0x25,
+  DW_OP_shra = 0x26,
+  DW_OP_xor = 0x27,
+  DW_OP_skip = 0x2f,
+  DW_OP_bra = 0x28,
+  DW_OP_eq = 0x29,
+  DW_OP_ge = 0x2a,
+  DW_OP_gt = 0x2b,
+  DW_OP_le = 0x2c,
+  DW_OP_lt = 0x2d,
+  DW_OP_ne = 0x2e,
+  DW_OP_lit0 = 0x30,
+  DW_OP_lit31 = 0x4f,
+  DW_OP_reg0 = 0x50,
+  DW_OP_reg31 = 0x6f,
+  DW_OP_breg0 = 0x70,
+  DW_OP_breg31 = 0x8f,
+  DW_OP_regx = 0x90,
+  DW_OP_fbreg = 0x91,
+  DW_OP_bregx = 0x92,
+  DW_OP_piece = 0x93,
+  DW_OP_deref_size = 0x94,
+  DW_OP_xderef_size = 0x95,
+  DW_OP_nop = 0x96,
+  DW_OP_push_object_address = 0x97,
+  DW_OP_call2 = 0x98,
+  DW_OP_call4 = 0x99,
+  DW_OP_call_ref = 0x9a,
+  DW_OP_form_tls_address = 0x9b,
+  DW_OP_call_frame_cfa = 0x9c,
+  DW_OP_bit_piece = 0x9d,
+  DW_OP_lo_user = 0xe0,
+  DW_OP_hi_user = 0xff
+};
+
+}  // namespace lul
+
+#endif  // LulDwarfInt_h
diff --git a/tools/profiler/lul/LulDwarfSummariser.cpp b/tools/profiler/lul/LulDwarfSummariser.cpp
new file mode 100644
index 0000000000..e9172c3e18
--- /dev/null
+++ b/tools/profiler/lul/LulDwarfSummariser.cpp
@@ -0,0 +1,549 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "LulDwarfSummariser.h"
+
+#include "LulDwarfExt.h"
+
+#include "mozilla/Assertions.h"
+#include "mozilla/Sprintf.h"
+
+// Set this to 1 for verbose logging
+#define DEBUG_SUMMARISER 0
+
+namespace lul {
+
+// Do |s64|'s lowest 32 bits sign extend back to |s64| itself?
+static inline bool fitsIn32Bits(int64 s64) {
+  return s64 == ((s64 & 0xffffffff) ^ 0x80000000) - 0x80000000;
+}
+
+// Check a LExpr prefix expression, starting at pfxInstrs[start] up to
+// the next PX_End instruction, to ensure that:
+// * It only mentions registers that are tracked on this target
+// * The start point is sane
+// If the expression is ok, return NULL.  Else return a pointer
+// a const char* holding a bit of text describing the problem.
+static const char* checkPfxExpr(const vector<PfxInstr>* pfxInstrs,
+                                int64_t start) {
+  size_t nInstrs = pfxInstrs->size();
+  if (start < 0 || start >= (ssize_t)nInstrs) {
+    return "bogus start point";
+  }
+  size_t i;
+  for (i = start; i < nInstrs; i++) {
+    PfxInstr pxi = (*pfxInstrs)[i];
+    if (pxi.mOpcode == PX_End) break;
+    if (pxi.mOpcode == PX_DwReg &&
+        !registerIsTracked((DW_REG_NUMBER)pxi.mOperand)) {
+      return "uses untracked reg";
+    }
+  }
+  return nullptr;  // success
+}
+
+Summariser::Summariser(SecMap* aSecMap, uintptr_t aTextBias,
+                       void (*aLog)(const char*))
+    : mSecMap(aSecMap), mTextBias(aTextBias), mLog(aLog) {
+  mCurrAddr = 0;
+  mMax1Addr = 0;  // Gives an empty range.
+
+  // Initialise the running RuleSet to "haven't got a clue" status.
+  new (&mCurrRules) RuleSet();
+}
+
+void Summariser::Entry(uintptr_t aAddress, uintptr_t aLength) {
+  aAddress += mTextBias;
+  if (DEBUG_SUMMARISER) {
+    char buf[100];
+    SprintfLiteral(buf, "LUL Entry(%llx, %llu)\n",
+                   (unsigned long long int)aAddress,
+                   (unsigned long long int)aLength);
+    mLog(buf);
+  }
+  // This throws away any previous summary, that is, assumes
+  // that the previous summary, if any, has been properly finished
+  // by a call to End().
+  mCurrAddr = aAddress;
+  mMax1Addr = aAddress + aLength;
+  new (&mCurrRules) RuleSet();
+}
+
+void Summariser::Rule(uintptr_t aAddress, int aNewReg, LExprHow how,
+                      int16_t oldReg, int64_t offset) {
+  aAddress += mTextBias;
+  if (DEBUG_SUMMARISER) {
+    char buf[100];
+    if (how == NODEREF || how == DEREF) {
+      bool deref = how == DEREF;
+      SprintfLiteral(buf, "LUL  0x%llx  old-r%d = %sr%d + %lld%s\n",
+                     (unsigned long long int)aAddress, aNewReg,
+                     deref ? "*(" : "", (int)oldReg, (long long int)offset,
+                     deref ? ")" : "");
+    } else if (how == PFXEXPR) {
+      SprintfLiteral(buf, "LUL  0x%llx  old-r%d = pfx-expr-at %lld\n",
+                     (unsigned long long int)aAddress, aNewReg,
+                     (long long int)offset);
+    } else {
+      SprintfLiteral(buf, "LUL  0x%llx  old-r%d = (invalid LExpr!)\n",
+                     (unsigned long long int)aAddress, aNewReg);
+    }
+    mLog(buf);
+  }
+
+  if (mCurrAddr < aAddress) {
+    // Flush the existing summary first.
+    mSecMap->AddRuleSet(&mCurrRules, mCurrAddr, aAddress - mCurrAddr);
+    if (DEBUG_SUMMARISER) {
+      mLog("LUL  ");
+      mCurrRules.Print(mCurrAddr, aAddress - mCurrAddr, mLog);
+      mLog("\n");
+    }
+    mCurrAddr = aAddress;
+  }
+
+  // If for some reason summarisation fails, either or both of these
+  // become non-null and point at constant text describing the
+  // problem.  Using two rather than just one avoids complications of
+  // having to concatenate two strings to produce a complete error message.
+  const char* reason1 = nullptr;
+  const char* reason2 = nullptr;
+
+  // |offset| needs to be a 32 bit value that sign extends to 64 bits
+  // on a 64 bit target.  We will need to incorporate |offset| into
+  // any LExpr made here.  So we may as well check it right now.
+  if (!fitsIn32Bits(offset)) {
+    reason1 = "offset not in signed 32-bit range";
+    goto cant_summarise;
+  }
+
+  // FIXME: factor out common parts of the arch-dependent summarisers.
+
+#if defined(GP_ARCH_arm)
+
+  // ----------------- arm ----------------- //
+
+  // Now, can we add the rule to our summary?  This depends on whether
+  // the registers and the overall expression are representable.  This
+  // is the heart of the summarisation process.
+  switch (aNewReg) {
+    case DW_REG_CFA:
+      // This is a rule that defines the CFA.  The only forms we
+      // choose to represent are: r7/11/12/13 + offset.  The offset
+      // must fit into 32 bits since 'uintptr_t' is 32 bit on ARM,
+      // hence there is no need to check it for overflow.
+      if (how != NODEREF) {
+        reason1 = "rule for DW_REG_CFA: invalid |how|";
+        goto cant_summarise;
+      }
+      switch (oldReg) {
+        case DW_REG_ARM_R7:
+        case DW_REG_ARM_R11:
+        case DW_REG_ARM_R12:
+        case DW_REG_ARM_R13:
+          break;
+        default:
+          reason1 = "rule for DW_REG_CFA: invalid |oldReg|";
+          goto cant_summarise;
+      }
+      mCurrRules.mCfaExpr = LExpr(how, oldReg, offset);
+      break;
+
+    case DW_REG_ARM_R7:
+    case DW_REG_ARM_R11:
+    case DW_REG_ARM_R12:
+    case DW_REG_ARM_R13:
+    case DW_REG_ARM_R14:
+    case DW_REG_ARM_R15: {
+      // This is a new rule for R7, R11, R12, R13 (SP), R14 (LR) or
+      // R15 (the return address).
+      switch (how) {
+        case NODEREF:
+        case DEREF:
+          // Check the old register is one we're tracking.
+          if (!registerIsTracked((DW_REG_NUMBER)oldReg) &&
+              oldReg != DW_REG_CFA) {
+            reason1 = "rule for R7/11/12/13/14/15: uses untracked reg";
+            goto cant_summarise;
+          }
+          break;
+        case PFXEXPR: {
+          // Check that the prefix expression only mentions tracked registers.
+          const vector<PfxInstr>* pfxInstrs = mSecMap->GetPfxInstrs();
+          reason2 = checkPfxExpr(pfxInstrs, offset);
+          if (reason2) {
+            reason1 = "rule for R7/11/12/13/14/15: ";
+            goto cant_summarise;
+          }
+          break;
+        }
+        default:
+          goto cant_summarise;
+      }
+      LExpr expr = LExpr(how, oldReg, offset);
+      switch (aNewReg) {
+        case DW_REG_ARM_R7:
+          mCurrRules.mR7expr = expr;
+          break;
+        case DW_REG_ARM_R11:
+          mCurrRules.mR11expr = expr;
+          break;
+        case DW_REG_ARM_R12:
+          mCurrRules.mR12expr = expr;
+          break;
+        case DW_REG_ARM_R13:
+          mCurrRules.mR13expr = expr;
+          break;
+        case DW_REG_ARM_R14:
+          mCurrRules.mR14expr = expr;
+          break;
+        case DW_REG_ARM_R15:
+          mCurrRules.mR15expr = expr;
+          break;
+        default:
+          MOZ_ASSERT(0);
+      }
+      break;
+    }
+
+    default:
+      // Leave |reason1| and |reason2| unset here.  This program point
+      // is reached so often that it causes a flood of "Can't
+      // summarise" messages.  In any case, we don't really care about
+      // the fact that this summary would produce a new value for a
+      // register that we're not tracking.  We do on the other hand
+      // care if the summary's expression *uses* a register that we're
+      // not tracking.  But in that case one of the above failures
+      // should tell us which.
+      goto cant_summarise;
+  }
+
+  // Mark callee-saved registers (r4 .. r11) as unchanged, if there is
+  // no other information about them.  FIXME: do this just once, at
+  // the point where the ruleset is committed.
+  if (mCurrRules.mR7expr.mHow == UNKNOWN) {
+    mCurrRules.mR7expr = LExpr(NODEREF, DW_REG_ARM_R7, 0);
+  }
+  if (mCurrRules.mR11expr.mHow == UNKNOWN) {
+    mCurrRules.mR11expr = LExpr(NODEREF, DW_REG_ARM_R11, 0);
+  }
+  if (mCurrRules.mR12expr.mHow == UNKNOWN) {
+    mCurrRules.mR12expr = LExpr(NODEREF, DW_REG_ARM_R12, 0);
+  }
+
+  // The old r13 (SP) value before the call is always the same as the
+  // CFA.
+  mCurrRules.mR13expr = LExpr(NODEREF, DW_REG_CFA, 0);
+
+  // If there's no information about R15 (the return address), say
+  // it's a copy of R14 (the link register).
+  if (mCurrRules.mR15expr.mHow == UNKNOWN) {
+    mCurrRules.mR15expr = LExpr(NODEREF, DW_REG_ARM_R14, 0);
+  }
+
+#elif defined(GP_ARCH_arm64)
+
+  // ----------------- arm64 ----------------- //
+
+  switch (aNewReg) {
+    case DW_REG_CFA:
+      if (how != NODEREF) {
+        reason1 = "rule for DW_REG_CFA: invalid |how|";
+        goto cant_summarise;
+      }
+      switch (oldReg) {
+        case DW_REG_AARCH64_X29:
+        case DW_REG_AARCH64_SP:
+          break;
+        default:
+          reason1 = "rule for DW_REG_CFA: invalid |oldReg|";
+          goto cant_summarise;
+      }
+      mCurrRules.mCfaExpr = LExpr(how, oldReg, offset);
+      break;
+
+    case DW_REG_AARCH64_X29:
+    case DW_REG_AARCH64_X30:
+    case DW_REG_AARCH64_SP: {
+      switch (how) {
+        case NODEREF:
+        case DEREF:
+          // Check the old register is one we're tracking.
+          if (!registerIsTracked((DW_REG_NUMBER)oldReg) &&
+              oldReg != DW_REG_CFA) {
+            reason1 = "rule for X29/X30/SP: uses untracked reg";
+            goto cant_summarise;
+          }
+          break;
+        case PFXEXPR: {
+          // Check that the prefix expression only mentions tracked registers.
+          const vector<PfxInstr>* pfxInstrs = mSecMap->GetPfxInstrs();
+          reason2 = checkPfxExpr(pfxInstrs, offset);
+          if (reason2) {
+            reason1 = "rule for X29/X30/SP: ";
+            goto cant_summarise;
+          }
+          break;
+        }
+        default:
+          goto cant_summarise;
+      }
+      LExpr expr = LExpr(how, oldReg, offset);
+      switch (aNewReg) {
+        case DW_REG_AARCH64_X29:
+          mCurrRules.mX29expr = expr;
+          break;
+        case DW_REG_AARCH64_X30:
+          mCurrRules.mX30expr = expr;
+          break;
+        case DW_REG_AARCH64_SP:
+          mCurrRules.mSPexpr = expr;
+          break;
+        default:
+          MOZ_ASSERT(0);
+      }
+      break;
+    }
+    default:
+      // Leave |reason1| and |reason2| unset here, for the reasons explained
+      // in the analogous point
+      goto cant_summarise;
+  }
+
+  if (mCurrRules.mX29expr.mHow == UNKNOWN) {
+    mCurrRules.mX29expr = LExpr(NODEREF, DW_REG_AARCH64_X29, 0);
+  }
+  if (mCurrRules.mX30expr.mHow == UNKNOWN) {
+    mCurrRules.mX30expr = LExpr(NODEREF, DW_REG_AARCH64_X30, 0);
+  }
+  // On aarch64, it seems the old SP value before the call is always the
+  // same as the CFA.  Therefore, in the absence of any other way to
+  // recover the SP, specify that the CFA should be copied.
+  if (mCurrRules.mSPexpr.mHow == UNKNOWN) {
+    mCurrRules.mSPexpr = LExpr(NODEREF, DW_REG_CFA, 0);
+  }
+#elif defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+
+  // ---------------- x64/x86 ---------------- //
+
+  // Now, can we add the rule to our summary?  This depends on whether
+  // the registers and the overall expression are representable.  This
+  // is the heart of the summarisation process.
+  switch (aNewReg) {
+    case DW_REG_CFA: {
+      // This is a rule that defines the CFA.  The only forms we choose to
+      // represent are: = SP+offset, = FP+offset, or =prefix-expr.
+      switch (how) {
+        case NODEREF:
+          if (oldReg != DW_REG_INTEL_XSP && oldReg != DW_REG_INTEL_XBP) {
+            reason1 = "rule for DW_REG_CFA: invalid |oldReg|";
+            goto cant_summarise;
+          }
+          break;
+        case DEREF:
+          reason1 = "rule for DW_REG_CFA: invalid |how|";
+          goto cant_summarise;
+        case PFXEXPR: {
+          // Check that the prefix expression only mentions tracked registers.
+          const vector<PfxInstr>* pfxInstrs = mSecMap->GetPfxInstrs();
+          reason2 = checkPfxExpr(pfxInstrs, offset);
+          if (reason2) {
+            reason1 = "rule for CFA: ";
+            goto cant_summarise;
+          }
+          break;
+        }
+        default:
+          goto cant_summarise;
+      }
+      mCurrRules.mCfaExpr = LExpr(how, oldReg, offset);
+      break;
+    }
+
+    case DW_REG_INTEL_XSP:
+    case DW_REG_INTEL_XBP:
+    case DW_REG_INTEL_XIP: {
+      // This is a new rule for XSP, XBP or XIP (the return address).
+      switch (how) {
+        case NODEREF:
+        case DEREF:
+          // Check the old register is one we're tracking.
+          if (!registerIsTracked((DW_REG_NUMBER)oldReg) &&
+              oldReg != DW_REG_CFA) {
+            reason1 = "rule for XSP/XBP/XIP: uses untracked reg";
+            goto cant_summarise;
+          }
+          break;
+        case PFXEXPR: {
+          // Check that the prefix expression only mentions tracked registers.
+          const vector<PfxInstr>* pfxInstrs = mSecMap->GetPfxInstrs();
+          reason2 = checkPfxExpr(pfxInstrs, offset);
+          if (reason2) {
+            reason1 = "rule for XSP/XBP/XIP: ";
+            goto cant_summarise;
+          }
+          break;
+        }
+        default:
+          goto cant_summarise;
+      }
+      LExpr expr = LExpr(how, oldReg, offset);
+      switch (aNewReg) {
+        case DW_REG_INTEL_XBP:
+          mCurrRules.mXbpExpr = expr;
+          break;
+        case DW_REG_INTEL_XSP:
+          mCurrRules.mXspExpr = expr;
+          break;
+        case DW_REG_INTEL_XIP:
+          mCurrRules.mXipExpr = expr;
+          break;
+        default:
+          MOZ_CRASH("impossible value for aNewReg");
+      }
+      break;
+    }
+
+    default:
+      // Leave |reason1| and |reason2| unset here, for the reasons
+      // explained in the analogous point in the ARM case just above.
+      goto cant_summarise;
+  }
+
+  // On Intel, it seems the old SP value before the call is always the
+  // same as the CFA.  Therefore, in the absence of any other way to
+  // recover the SP, specify that the CFA should be copied.
+  if (mCurrRules.mXspExpr.mHow == UNKNOWN) {
+    mCurrRules.mXspExpr = LExpr(NODEREF, DW_REG_CFA, 0);
+  }
+
+  // Also, gcc says "Undef" for BP when it is unchanged.
+  if (mCurrRules.mXbpExpr.mHow == UNKNOWN) {
+    mCurrRules.mXbpExpr = LExpr(NODEREF, DW_REG_INTEL_XBP, 0);
+  }
+
+#elif defined(GP_ARCH_mips64)
+  // ---------------- mips ---------------- //
+  //
+  // Now, can we add the rule to our summary?  This depends on whether
+  // the registers and the overall expression are representable.  This
+  // is the heart of the summarisation process.
+  switch (aNewReg) {
+    case DW_REG_CFA:
+      // This is a rule that defines the CFA.  The only forms we can
+      // represent are: = SP+offset or = FP+offset.
+      if (how != NODEREF) {
+        reason1 = "rule for DW_REG_CFA: invalid |how|";
+        goto cant_summarise;
+      }
+      if (oldReg != DW_REG_MIPS_SP && oldReg != DW_REG_MIPS_FP) {
+        reason1 = "rule for DW_REG_CFA: invalid |oldReg|";
+        goto cant_summarise;
+      }
+      mCurrRules.mCfaExpr = LExpr(how, oldReg, offset);
+      break;
+
+    case DW_REG_MIPS_SP:
+    case DW_REG_MIPS_FP:
+    case DW_REG_MIPS_PC: {
+      // This is a new rule for SP, FP or PC (the return address).
+      switch (how) {
+        case NODEREF:
+        case DEREF:
+          // Check the old register is one we're tracking.
+          if (!registerIsTracked((DW_REG_NUMBER)oldReg) &&
+              oldReg != DW_REG_CFA) {
+            reason1 = "rule for SP/FP/PC: uses untracked reg";
+            goto cant_summarise;
+          }
+          break;
+        case PFXEXPR: {
+          // Check that the prefix expression only mentions tracked registers.
+          const vector<PfxInstr>* pfxInstrs = mSecMap->GetPfxInstrs();
+          reason2 = checkPfxExpr(pfxInstrs, offset);
+          if (reason2) {
+            reason1 = "rule for SP/FP/PC: ";
+            goto cant_summarise;
+          }
+          break;
+        }
+        default:
+          goto cant_summarise;
+      }
+      LExpr expr = LExpr(how, oldReg, offset);
+      switch (aNewReg) {
+        case DW_REG_MIPS_FP:
+          mCurrRules.mFPexpr = expr;
+          break;
+        case DW_REG_MIPS_SP:
+          mCurrRules.mSPexpr = expr;
+          break;
+        case DW_REG_MIPS_PC:
+          mCurrRules.mPCexpr = expr;
+          break;
+        default:
+          MOZ_CRASH("impossible value for aNewReg");
+      }
+      break;
+    }
+    default:
+      // Leave |reason1| and |reason2| unset here, for the reasons
+      // explained in the analogous point in the ARM case just above.
+      goto cant_summarise;
+  }
+
+  // On MIPS, it seems the old SP value before the call is always the
+  // same as the CFA.  Therefore, in the absence of any other way to
+  // recover the SP, specify that the CFA should be copied.
+  if (mCurrRules.mSPexpr.mHow == UNKNOWN) {
+    mCurrRules.mSPexpr = LExpr(NODEREF, DW_REG_CFA, 0);
+  }
+
+  // Also, gcc says "Undef" for FP when it is unchanged.
+  if (mCurrRules.mFPexpr.mHow == UNKNOWN) {
+    mCurrRules.mFPexpr = LExpr(NODEREF, DW_REG_MIPS_FP, 0);
+  }
+
+#else
+
+#  error "Unsupported arch"
+#endif
+
+  return;
+
+cant_summarise:
+  if (reason1 || reason2) {
+    char buf[200];
+    SprintfLiteral(buf,
+                   "LUL  can't summarise: "
+                   "SVMA=0x%llx: %s%s, expr=LExpr(%s,%u,%lld)\n",
+                   (unsigned long long int)(aAddress - mTextBias),
+                   reason1 ? reason1 : "", reason2 ? reason2 : "",
+                   NameOf_LExprHow(how), (unsigned int)oldReg,
+                   (long long int)offset);
+    mLog(buf);
+  }
+}
+
+uint32_t Summariser::AddPfxInstr(PfxInstr pfxi) {
+  return mSecMap->AddPfxInstr(pfxi);
+}
+
+void Summariser::End() {
+  if (DEBUG_SUMMARISER) {
+    mLog("LUL End\n");
+  }
+  if (mCurrAddr < mMax1Addr) {
+    mSecMap->AddRuleSet(&mCurrRules, mCurrAddr, mMax1Addr - mCurrAddr);
+    if (DEBUG_SUMMARISER) {
+      mLog("LUL  ");
+      mCurrRules.Print(mCurrAddr, mMax1Addr - mCurrAddr, mLog);
+      mLog("\n");
+    }
+  }
+}
+
+}  // namespace lul
diff --git a/tools/profiler/lul/LulDwarfSummariser.h b/tools/profiler/lul/LulDwarfSummariser.h
new file mode 100644
index 0000000000..30f1ba23c1
--- /dev/null
+++ b/tools/profiler/lul/LulDwarfSummariser.h
@@ -0,0 +1,64 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef LulDwarfSummariser_h
+#define LulDwarfSummariser_h
+
+#include "LulMainInt.h"
+
+namespace lul {
+
+class Summariser {
+ public:
+  Summariser(SecMap* aSecMap, uintptr_t aTextBias, void (*aLog)(const char*));
+
+  virtual void Entry(uintptr_t aAddress, uintptr_t aLength);
+  virtual void End();
+
+  // Tell the summariser that the value for |aNewReg| at |aAddress| is
+  // recovered using the LExpr that can be constructed using the
+  // components |how|, |oldReg| and |offset|.  The summariser will
+  // inspect the components and may reject them for various reasons,
+  // but the hope is that it will find them acceptable and record this
+  // rule permanently.
+  virtual void Rule(uintptr_t aAddress, int aNewReg, LExprHow how,
+                    int16_t oldReg, int64_t offset);
+
+  virtual uint32_t AddPfxInstr(PfxInstr pfxi);
+
+  // Send output to the logging sink, for debugging.
+  virtual void Log(const char* str) { mLog(str); }
+
+ private:
+  // The SecMap in which we park the finished summaries (RuleSets) and
+  // also any PfxInstrs derived from Dwarf expressions.
+  SecMap* mSecMap;
+
+  // Running state for the current summary (RuleSet) under construction.
+  RuleSet mCurrRules;
+
+  // The start of the address range to which the RuleSet under
+  // construction applies.
+  uintptr_t mCurrAddr;
+
+  // The highest address, plus one, for which the RuleSet under
+  // construction could possibly apply.  If there are no further
+  // incoming events then mCurrRules will eventually be emitted
+  // as-is, for the range mCurrAddr.. mMax1Addr - 1, if that is
+  // nonempty.
+  uintptr_t mMax1Addr;
+
+  // The bias value (to add to the SVMAs, to get AVMAs) to be used
+  // when adding entries into mSecMap.
+  uintptr_t mTextBias;
+
+  // A logging sink, for debugging.
+  void (*mLog)(const char* aFmt);
+};
+
+}  // namespace lul
+
+#endif  // LulDwarfSummariser_h
diff --git a/tools/profiler/lul/LulElf.cpp b/tools/profiler/lul/LulElf.cpp
new file mode 100644
index 0000000000..28980a1349
--- /dev/null
+++ b/tools/profiler/lul/LulElf.cpp
@@ -0,0 +1,887 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+
+// Copyright (c) 2006, 2011, 2012 Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Restructured in 2009 by: Jim Blandy <jimb@mozilla.com> <jimb@red-bean.com>
+
+// (derived from)
+// dump_symbols.cc: implement google_breakpad::WriteSymbolFile:
+// Find all the debugging info in a file and dump it as a Breakpad symbol file.
+//
+// dump_symbols.h: Read debugging information from an ELF file, and write
+// it out as a Breakpad symbol file.
+
+// This file is derived from the following files in
+// toolkit/crashreporter/google-breakpad:
+//   src/common/linux/dump_symbols.cc
+//   src/common/linux/elfutils.cc
+//   src/common/linux/file_id.cc
+
+#include <errno.h>
+#include <fcntl.h>
+#include <libgen.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <arpa/inet.h>
+
+#include <set>
+#include <string>
+#include <vector>
+
+#include "mozilla/Assertions.h"
+#include "mozilla/Sprintf.h"
+
+#include "PlatformMacros.h"
+#include "LulCommonExt.h"
+#include "LulDwarfExt.h"
+#include "LulElfInt.h"
+#include "LulMainInt.h"
+
+#if defined(GP_PLAT_arm_android) && !defined(SHT_ARM_EXIDX)
+// bionic and older glibsc don't define it
+#  define SHT_ARM_EXIDX (SHT_LOPROC + 1)
+#endif
+
+#if (defined(GP_PLAT_amd64_linux) || defined(GP_PLAT_amd64_android)) && \
+    !defined(SHT_X86_64_UNWIND)
+// This is sometimes necessary on x86_64-android and x86_64-linux.
+#  define SHT_X86_64_UNWIND 0x70000001
+#endif
+
+// Old Linux header doesn't define EM_AARCH64
+#ifndef EM_AARCH64
+#  define EM_AARCH64 183
+#endif
+
+// This namespace contains helper functions.
+namespace {
+
+using lul::DwarfCFIToModule;
+using lul::FindElfSectionByName;
+using lul::GetOffset;
+using lul::IsValidElf;
+using lul::Module;
+using lul::scoped_ptr;
+using lul::Summariser;
+using lul::UniqueStringUniverse;
+using std::set;
+using std::string;
+using std::vector;
+
+//
+// FDWrapper
+//
+// Wrapper class to make sure opened file is closed.
+//
+class FDWrapper {
+ public:
+  explicit FDWrapper(int fd) : fd_(fd) {}
+  ~FDWrapper() {
+    if (fd_ != -1) close(fd_);
+  }
+  int get() { return fd_; }
+  int release() {
+    int fd = fd_;
+    fd_ = -1;
+    return fd;
+  }
+
+ private:
+  int fd_;
+};
+
+//
+// MmapWrapper
+//
+// Wrapper class to make sure mapped regions are unmapped.
+//
+class MmapWrapper {
+ public:
+  MmapWrapper() : is_set_(false), base_(NULL), size_(0) {}
+  ~MmapWrapper() {
+    if (is_set_ && base_ != NULL) {
+      MOZ_ASSERT(size_ > 0);
+      munmap(base_, size_);
+    }
+  }
+  void set(void* mapped_address, size_t mapped_size) {
+    is_set_ = true;
+    base_ = mapped_address;
+    size_ = mapped_size;
+  }
+  void release() {
+    MOZ_ASSERT(is_set_);
+    is_set_ = false;
+    base_ = NULL;
+    size_ = 0;
+  }
+
+ private:
+  bool is_set_;
+  void* base_;
+  size_t size_;
+};
+
+// Set NUM_DW_REGNAMES to be the number of Dwarf register names
+// appropriate to the machine architecture given in HEADER.  Return
+// true on success, or false if HEADER's machine architecture is not
+// supported.
+template <typename ElfClass>
+bool DwarfCFIRegisterNames(const typename ElfClass::Ehdr* elf_header,
+                           unsigned int* num_dw_regnames) {
+  switch (elf_header->e_machine) {
+    case EM_386:
+      *num_dw_regnames = DwarfCFIToModule::RegisterNames::I386();
+      return true;
+    case EM_ARM:
+      *num_dw_regnames = DwarfCFIToModule::RegisterNames::ARM();
+      return true;
+    case EM_X86_64:
+      *num_dw_regnames = DwarfCFIToModule::RegisterNames::X86_64();
+      return true;
+    case EM_MIPS:
+      *num_dw_regnames = DwarfCFIToModule::RegisterNames::MIPS();
+      return true;
+    case EM_AARCH64:
+      *num_dw_regnames = DwarfCFIToModule::RegisterNames::ARM64();
+      return true;
+    default:
+      MOZ_ASSERT(0);
+      return false;
+  }
+}
+
+template <typename ElfClass>
+bool LoadDwarfCFI(const string& dwarf_filename,
+                  const typename ElfClass::Ehdr* elf_header,
+                  const char* section_name,
+                  const typename ElfClass::Shdr* section, const bool eh_frame,
+                  const typename ElfClass::Shdr* got_section,
+                  const typename ElfClass::Shdr* text_section,
+                  const bool big_endian, SecMap* smap, uintptr_t text_bias,
+                  UniqueStringUniverse* usu, void (*log)(const char*)) {
+  // Find the appropriate set of register names for this file's
+  // architecture.
+  unsigned int num_dw_regs = 0;
+  if (!DwarfCFIRegisterNames<ElfClass>(elf_header, &num_dw_regs)) {
+    fprintf(stderr,
+            "%s: unrecognized ELF machine architecture '%d';"
+            " cannot convert DWARF call frame information\n",
+            dwarf_filename.c_str(), elf_header->e_machine);
+    return false;
+  }
+
+  const lul::Endianness endianness =
+      big_endian ? lul::ENDIANNESS_BIG : lul::ENDIANNESS_LITTLE;
+
+  // Find the call frame information and its size.
+  const char* cfi = GetOffset<ElfClass, char>(elf_header, section->sh_offset);
+  size_t cfi_size = section->sh_size;
+
+  // Plug together the parser, handler, and their entourages.
+
+  // Here's a summariser, which will receive the output of the
+  // parser, create summaries, and add them to |smap|.
+  Summariser summ(smap, text_bias, log);
+
+  lul::ByteReader reader(endianness);
+  reader.SetAddressSize(ElfClass::kAddrSize);
+
+  DwarfCFIToModule::Reporter module_reporter(log, dwarf_filename, section_name);
+  DwarfCFIToModule handler(num_dw_regs, &module_reporter, &reader, usu, &summ);
+
+  // Provide the base addresses for .eh_frame encoded pointers, if
+  // possible.
+  reader.SetCFIDataBase(section->sh_addr, cfi);
+  if (got_section) reader.SetDataBase(got_section->sh_addr);
+  if (text_section) reader.SetTextBase(text_section->sh_addr);
+
+  lul::CallFrameInfo::Reporter dwarf_reporter(log, dwarf_filename,
+                                              section_name);
+  lul::CallFrameInfo parser(cfi, cfi_size, &reader, &handler, &dwarf_reporter,
+                            eh_frame);
+  parser.Start();
+
+  return true;
+}
+
+bool LoadELF(const string& obj_file, MmapWrapper* map_wrapper,
+             void** elf_header) {
+  int obj_fd = open(obj_file.c_str(), O_RDONLY);
+  if (obj_fd < 0) {
+    fprintf(stderr, "Failed to open ELF file '%s': %s\n", obj_file.c_str(),
+            strerror(errno));
+    return false;
+  }
+  FDWrapper obj_fd_wrapper(obj_fd);
+  struct stat st;
+  if (fstat(obj_fd, &st) != 0 && st.st_size <= 0) {
+    fprintf(stderr, "Unable to fstat ELF file '%s': %s\n", obj_file.c_str(),
+            strerror(errno));
+    return false;
+  }
+  // Mapping it read-only is good enough.  In any case, mapping it
+  // read-write confuses Valgrind's debuginfo acquire/discard
+  // heuristics, making it hard to profile the profiler.
+  void* obj_base = mmap(nullptr, st.st_size, PROT_READ, MAP_PRIVATE, obj_fd, 0);
+  if (obj_base == MAP_FAILED) {
+    fprintf(stderr, "Failed to mmap ELF file '%s': %s\n", obj_file.c_str(),
+            strerror(errno));
+    return false;
+  }
+  map_wrapper->set(obj_base, st.st_size);
+  *elf_header = obj_base;
+  if (!IsValidElf(*elf_header)) {
+    fprintf(stderr, "Not a valid ELF file: %s\n", obj_file.c_str());
+    return false;
+  }
+  return true;
+}
+
+// Get the endianness of ELF_HEADER. If it's invalid, return false.
+template <typename ElfClass>
+bool ElfEndianness(const typename ElfClass::Ehdr* elf_header,
+                   bool* big_endian) {
+  if (elf_header->e_ident[EI_DATA] == ELFDATA2LSB) {
+    *big_endian = false;
+    return true;
+  }
+  if (elf_header->e_ident[EI_DATA] == ELFDATA2MSB) {
+    *big_endian = true;
+    return true;
+  }
+
+  fprintf(stderr, "bad data encoding in ELF header: %d\n",
+          elf_header->e_ident[EI_DATA]);
+  return false;
+}
+
+//
+// LoadSymbolsInfo
+//
+// Holds the state between the two calls to LoadSymbols() in case it's necessary
+// to follow the .gnu_debuglink section and load debug information from a
+// different file.
+//
+template <typename ElfClass>
+class LoadSymbolsInfo {
+ public:
+  typedef typename ElfClass::Addr Addr;
+
+  explicit LoadSymbolsInfo(const vector<string>& dbg_dirs)
+      : debug_dirs_(dbg_dirs), has_loading_addr_(false) {}
+
+  // Keeps track of which sections have been loaded so sections don't
+  // accidentally get loaded twice from two different files.
+  void LoadedSection(const string& section) {
+    if (loaded_sections_.count(section) == 0) {
+      loaded_sections_.insert(section);
+    } else {
+      fprintf(stderr, "Section %s has already been loaded.\n", section.c_str());
+    }
+  }
+
+  string debuglink_file() const { return debuglink_file_; }
+
+ private:
+  const vector<string>& debug_dirs_;  // Directories in which to
+                                      // search for the debug ELF file.
+
+  string debuglink_file_;  // Full path to the debug ELF file.
+
+  bool has_loading_addr_;  // Indicate if LOADING_ADDR_ is valid.
+
+  set<string> loaded_sections_;  // Tracks the Loaded ELF sections
+                                 // between calls to LoadSymbols().
+};
+
+// Find the preferred loading address of the binary.
+template <typename ElfClass>
+typename ElfClass::Addr GetLoadingAddress(
+    const typename ElfClass::Phdr* program_headers, int nheader) {
+  typedef typename ElfClass::Phdr Phdr;
+
+  // For non-PIC executables (e_type == ET_EXEC), the load address is
+  // the start address of the first PT_LOAD segment.  (ELF requires
+  // the segments to be sorted by load address.)  For PIC executables
+  // and dynamic libraries (e_type == ET_DYN), this address will
+  // normally be zero.
+  for (int i = 0; i < nheader; ++i) {
+    const Phdr& header = program_headers[i];
+    if (header.p_type == PT_LOAD) return header.p_vaddr;
+  }
+  return 0;
+}
+
+template <typename ElfClass>
+bool LoadSymbols(const string& obj_file, const bool big_endian,
+                 const typename ElfClass::Ehdr* elf_header,
+                 const bool read_gnu_debug_link,
+                 LoadSymbolsInfo<ElfClass>* info, SecMap* smap, void* rx_avma,
+                 size_t rx_size, UniqueStringUniverse* usu,
+                 void (*log)(const char*)) {
+  typedef typename ElfClass::Phdr Phdr;
+  typedef typename ElfClass::Shdr Shdr;
+
+  char buf[500];
+  SprintfLiteral(buf, "LoadSymbols: BEGIN   %s\n", obj_file.c_str());
+  buf[sizeof(buf) - 1] = 0;
+  log(buf);
+
+  // This is how the text bias is calculated.
+  // BEGIN CALCULATE BIAS
+  uintptr_t loading_addr = GetLoadingAddress<ElfClass>(
+      GetOffset<ElfClass, Phdr>(elf_header, elf_header->e_phoff),
+      elf_header->e_phnum);
+  uintptr_t text_bias = ((uintptr_t)rx_avma) - loading_addr;
+  SprintfLiteral(buf, "LoadSymbols:   rx_avma=%llx, text_bias=%llx",
+                 (unsigned long long int)(uintptr_t)rx_avma,
+                 (unsigned long long int)text_bias);
+  buf[sizeof(buf) - 1] = 0;
+  log(buf);
+  // END CALCULATE BIAS
+
+  const Shdr* sections =
+      GetOffset<ElfClass, Shdr>(elf_header, elf_header->e_shoff);
+  const Shdr* section_names = sections + elf_header->e_shstrndx;
+  const char* names =
+      GetOffset<ElfClass, char>(elf_header, section_names->sh_offset);
+  const char* names_end = names + section_names->sh_size;
+  bool found_usable_info = false;
+
+  // Dwarf Call Frame Information (CFI) is actually independent from
+  // the other DWARF debugging information, and can be used alone.
+  const Shdr* dwarf_cfi_section =
+      FindElfSectionByName<ElfClass>(".debug_frame", SHT_PROGBITS, sections,
+                                     names, names_end, elf_header->e_shnum);
+  if (dwarf_cfi_section) {
+    // Ignore the return value of this function; even without call frame
+    // information, the other debugging information could be perfectly
+    // useful.
+    info->LoadedSection(".debug_frame");
+    bool result = LoadDwarfCFI<ElfClass>(obj_file, elf_header, ".debug_frame",
+                                         dwarf_cfi_section, false, 0, 0,
+                                         big_endian, smap, text_bias, usu, log);
+    found_usable_info = found_usable_info || result;
+    if (result) log("LoadSymbols:   read CFI from .debug_frame");
+  }
+
+  // Linux C++ exception handling information can also provide
+  // unwinding data.
+  const Shdr* eh_frame_section =
+      FindElfSectionByName<ElfClass>(".eh_frame", SHT_PROGBITS, sections, names,
+                                     names_end, elf_header->e_shnum);
+#if defined(GP_PLAT_amd64_linux) || defined(GP_PLAT_amd64_android)
+  if (!eh_frame_section) {
+    // Possibly depending on which linker created libxul.so, on x86_64-linux
+    // and -android, .eh_frame may instead have the SHT_X86_64_UNWIND type.
+    eh_frame_section =
+        FindElfSectionByName<ElfClass>(".eh_frame", SHT_X86_64_UNWIND, sections,
+                                       names, names_end, elf_header->e_shnum);
+  }
+#endif
+  if (eh_frame_section) {
+    // Pointers in .eh_frame data may be relative to the base addresses of
+    // certain sections. Provide those sections if present.
+    const Shdr* got_section = FindElfSectionByName<ElfClass>(
+        ".got", SHT_PROGBITS, sections, names, names_end, elf_header->e_shnum);
+    const Shdr* text_section = FindElfSectionByName<ElfClass>(
+        ".text", SHT_PROGBITS, sections, names, names_end, elf_header->e_shnum);
+    info->LoadedSection(".eh_frame");
+    // As above, ignore the return value of this function.
+    bool result = LoadDwarfCFI<ElfClass>(
+        obj_file, elf_header, ".eh_frame", eh_frame_section, true, got_section,
+        text_section, big_endian, smap, text_bias, usu, log);
+    found_usable_info = found_usable_info || result;
+    if (result) log("LoadSymbols:   read CFI from .eh_frame");
+  }
+
+  SprintfLiteral(buf, "LoadSymbols: END     %s\n", obj_file.c_str());
+  buf[sizeof(buf) - 1] = 0;
+  log(buf);
+
+  return found_usable_info;
+}
+
+// Return the breakpad symbol file identifier for the architecture of
+// ELF_HEADER.
+template <typename ElfClass>
+const char* ElfArchitecture(const typename ElfClass::Ehdr* elf_header) {
+  typedef typename ElfClass::Half Half;
+  Half arch = elf_header->e_machine;
+  switch (arch) {
+    case EM_386:
+      return "x86";
+    case EM_ARM:
+      return "arm";
+    case EM_AARCH64:
+      return "arm64";
+    case EM_MIPS:
+      return "mips";
+    case EM_PPC64:
+      return "ppc64";
+    case EM_PPC:
+      return "ppc";
+    case EM_S390:
+      return "s390";
+    case EM_SPARC:
+      return "sparc";
+    case EM_SPARCV9:
+      return "sparcv9";
+    case EM_X86_64:
+      return "x86_64";
+    default:
+      return NULL;
+  }
+}
+
+// Format the Elf file identifier in IDENTIFIER as a UUID with the
+// dashes removed.
+string FormatIdentifier(unsigned char identifier[16]) {
+  char identifier_str[40];
+  lul::FileID::ConvertIdentifierToString(identifier, identifier_str,
+                                         sizeof(identifier_str));
+  string id_no_dash;
+  for (int i = 0; identifier_str[i] != '\0'; ++i)
+    if (identifier_str[i] != '-') id_no_dash += identifier_str[i];
+  // Add an extra "0" by the end.  PDB files on Windows have an 'age'
+  // number appended to the end of the file identifier; this isn't
+  // really used or necessary on other platforms, but be consistent.
+  id_no_dash += '0';
+  return id_no_dash;
+}
+
+// Return the non-directory portion of FILENAME: the portion after the
+// last slash, or the whole filename if there are no slashes.
+string BaseFileName(const string& filename) {
+  // Lots of copies!  basename's behavior is less than ideal.
+  char* c_filename = strdup(filename.c_str());
+  string base = basename(c_filename);
+  free(c_filename);
+  return base;
+}
+
+template <typename ElfClass>
+bool ReadSymbolDataElfClass(const typename ElfClass::Ehdr* elf_header,
+                            const string& obj_filename,
+                            const vector<string>& debug_dirs, SecMap* smap,
+                            void* rx_avma, size_t rx_size,
+                            UniqueStringUniverse* usu,
+                            void (*log)(const char*)) {
+  typedef typename ElfClass::Ehdr Ehdr;
+
+  unsigned char identifier[16];
+  if (!lul ::FileID::ElfFileIdentifierFromMappedFile(elf_header, identifier)) {
+    fprintf(stderr, "%s: unable to generate file identifier\n",
+            obj_filename.c_str());
+    return false;
+  }
+
+  const char* architecture = ElfArchitecture<ElfClass>(elf_header);
+  if (!architecture) {
+    fprintf(stderr, "%s: unrecognized ELF machine architecture: %d\n",
+            obj_filename.c_str(), elf_header->e_machine);
+    return false;
+  }
+
+  // Figure out what endianness this file is.
+  bool big_endian;
+  if (!ElfEndianness<ElfClass>(elf_header, &big_endian)) return false;
+
+  string name = BaseFileName(obj_filename);
+  string os = "Linux";
+  string id = FormatIdentifier(identifier);
+
+  LoadSymbolsInfo<ElfClass> info(debug_dirs);
+  if (!LoadSymbols<ElfClass>(obj_filename, big_endian, elf_header,
+                             !debug_dirs.empty(), &info, smap, rx_avma, rx_size,
+                             usu, log)) {
+    const string debuglink_file = info.debuglink_file();
+    if (debuglink_file.empty()) return false;
+
+    // Load debuglink ELF file.
+    fprintf(stderr, "Found debugging info in %s\n", debuglink_file.c_str());
+    MmapWrapper debug_map_wrapper;
+    Ehdr* debug_elf_header = NULL;
+    if (!LoadELF(debuglink_file, &debug_map_wrapper,
+                 reinterpret_cast<void**>(&debug_elf_header)))
+      return false;
+    // Sanity checks to make sure everything matches up.
+    const char* debug_architecture =
+        ElfArchitecture<ElfClass>(debug_elf_header);
+    if (!debug_architecture) {
+      fprintf(stderr, "%s: unrecognized ELF machine architecture: %d\n",
+              debuglink_file.c_str(), debug_elf_header->e_machine);
+      return false;
+    }
+    if (strcmp(architecture, debug_architecture)) {
+      fprintf(stderr,
+              "%s with ELF machine architecture %s does not match "
+              "%s with ELF architecture %s\n",
+              debuglink_file.c_str(), debug_architecture, obj_filename.c_str(),
+              architecture);
+      return false;
+    }
+
+    bool debug_big_endian;
+    if (!ElfEndianness<ElfClass>(debug_elf_header, &debug_big_endian))
+      return false;
+    if (debug_big_endian != big_endian) {
+      fprintf(stderr, "%s and %s does not match in endianness\n",
+              obj_filename.c_str(), debuglink_file.c_str());
+      return false;
+    }
+
+    if (!LoadSymbols<ElfClass>(debuglink_file, debug_big_endian,
+                               debug_elf_header, false, &info, smap, rx_avma,
+                               rx_size, usu, log)) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+}  // namespace
+
+namespace lul {
+
+bool ReadSymbolDataInternal(const uint8_t* obj_file, const string& obj_filename,
+                            const vector<string>& debug_dirs, SecMap* smap,
+                            void* rx_avma, size_t rx_size,
+                            UniqueStringUniverse* usu,
+                            void (*log)(const char*)) {
+  if (!IsValidElf(obj_file)) {
+    fprintf(stderr, "Not a valid ELF file: %s\n", obj_filename.c_str());
+    return false;
+  }
+
+  int elfclass = ElfClass(obj_file);
+  if (elfclass == ELFCLASS32) {
+    return ReadSymbolDataElfClass<ElfClass32>(
+        reinterpret_cast<const Elf32_Ehdr*>(obj_file), obj_filename, debug_dirs,
+        smap, rx_avma, rx_size, usu, log);
+  }
+  if (elfclass == ELFCLASS64) {
+    return ReadSymbolDataElfClass<ElfClass64>(
+        reinterpret_cast<const Elf64_Ehdr*>(obj_file), obj_filename, debug_dirs,
+        smap, rx_avma, rx_size, usu, log);
+  }
+
+  return false;
+}
+
+bool ReadSymbolData(const string& obj_file, const vector<string>& debug_dirs,
+                    SecMap* smap, void* rx_avma, size_t rx_size,
+                    UniqueStringUniverse* usu, void (*log)(const char*)) {
+  MmapWrapper map_wrapper;
+  void* elf_header = NULL;
+  if (!LoadELF(obj_file, &map_wrapper, &elf_header)) return false;
+
+  return ReadSymbolDataInternal(reinterpret_cast<uint8_t*>(elf_header),
+                                obj_file, debug_dirs, smap, rx_avma, rx_size,
+                                usu, log);
+}
+
+namespace {
+
+template <typename ElfClass>
+void FindElfClassSection(const char* elf_base, const char* section_name,
+                         typename ElfClass::Word section_type,
+                         const void** section_start, int* section_size) {
+  typedef typename ElfClass::Ehdr Ehdr;
+  typedef typename ElfClass::Shdr Shdr;
+
+  MOZ_ASSERT(elf_base);
+  MOZ_ASSERT(section_start);
+  MOZ_ASSERT(section_size);
+
+  MOZ_ASSERT(strncmp(elf_base, ELFMAG, SELFMAG) == 0);
+
+  const Ehdr* elf_header = reinterpret_cast<const Ehdr*>(elf_base);
+  MOZ_ASSERT(elf_header->e_ident[EI_CLASS] == ElfClass::kClass);
+
+  const Shdr* sections =
+      GetOffset<ElfClass, Shdr>(elf_header, elf_header->e_shoff);
+  const Shdr* section_names = sections + elf_header->e_shstrndx;
+  const char* names =
+      GetOffset<ElfClass, char>(elf_header, section_names->sh_offset);
+  const char* names_end = names + section_names->sh_size;
+
+  const Shdr* section =
+      FindElfSectionByName<ElfClass>(section_name, section_type, sections,
+                                     names, names_end, elf_header->e_shnum);
+
+  if (section != NULL && section->sh_size > 0) {
+    *section_start = elf_base + section->sh_offset;
+    *section_size = section->sh_size;
+  }
+}
+
+template <typename ElfClass>
+void FindElfClassSegment(const char* elf_base,
+                         typename ElfClass::Word segment_type,
+                         const void** segment_start, int* segment_size) {
+  typedef typename ElfClass::Ehdr Ehdr;
+  typedef typename ElfClass::Phdr Phdr;
+
+  MOZ_ASSERT(elf_base);
+  MOZ_ASSERT(segment_start);
+  MOZ_ASSERT(segment_size);
+
+  MOZ_ASSERT(strncmp(elf_base, ELFMAG, SELFMAG) == 0);
+
+  const Ehdr* elf_header = reinterpret_cast<const Ehdr*>(elf_base);
+  MOZ_ASSERT(elf_header->e_ident[EI_CLASS] == ElfClass::kClass);
+
+  const Phdr* phdrs =
+      GetOffset<ElfClass, Phdr>(elf_header, elf_header->e_phoff);
+
+  for (int i = 0; i < elf_header->e_phnum; ++i) {
+    if (phdrs[i].p_type == segment_type) {
+      *segment_start = elf_base + phdrs[i].p_offset;
+      *segment_size = phdrs[i].p_filesz;
+      return;
+    }
+  }
+}
+
+}  // namespace
+
+bool IsValidElf(const void* elf_base) {
+  return strncmp(reinterpret_cast<const char*>(elf_base), ELFMAG, SELFMAG) == 0;
+}
+
+int ElfClass(const void* elf_base) {
+  const ElfW(Ehdr)* elf_header = reinterpret_cast<const ElfW(Ehdr)*>(elf_base);
+
+  return elf_header->e_ident[EI_CLASS];
+}
+
+bool FindElfSection(const void* elf_mapped_base, const char* section_name,
+                    uint32_t section_type, const void** section_start,
+                    int* section_size, int* elfclass) {
+  MOZ_ASSERT(elf_mapped_base);
+  MOZ_ASSERT(section_start);
+  MOZ_ASSERT(section_size);
+
+  *section_start = NULL;
+  *section_size = 0;
+
+  if (!IsValidElf(elf_mapped_base)) return false;
+
+  int cls = ElfClass(elf_mapped_base);
+  if (elfclass) {
+    *elfclass = cls;
+  }
+
+  const char* elf_base = static_cast<const char*>(elf_mapped_base);
+
+  if (cls == ELFCLASS32) {
+    FindElfClassSection<ElfClass32>(elf_base, section_name, section_type,
+                                    section_start, section_size);
+    return *section_start != NULL;
+  } else if (cls == ELFCLASS64) {
+    FindElfClassSection<ElfClass64>(elf_base, section_name, section_type,
+                                    section_start, section_size);
+    return *section_start != NULL;
+  }
+
+  return false;
+}
+
+bool FindElfSegment(const void* elf_mapped_base, uint32_t segment_type,
+                    const void** segment_start, int* segment_size,
+                    int* elfclass) {
+  MOZ_ASSERT(elf_mapped_base);
+  MOZ_ASSERT(segment_start);
+  MOZ_ASSERT(segment_size);
+
+  *segment_start = NULL;
+  *segment_size = 0;
+
+  if (!IsValidElf(elf_mapped_base)) return false;
+
+  int cls = ElfClass(elf_mapped_base);
+  if (elfclass) {
+    *elfclass = cls;
+  }
+
+  const char* elf_base = static_cast<const char*>(elf_mapped_base);
+
+  if (cls == ELFCLASS32) {
+    FindElfClassSegment<ElfClass32>(elf_base, segment_type, segment_start,
+                                    segment_size);
+    return *segment_start != NULL;
+  } else if (cls == ELFCLASS64) {
+    FindElfClassSegment<ElfClass64>(elf_base, segment_type, segment_start,
+                                    segment_size);
+    return *segment_start != NULL;
+  }
+
+  return false;
+}
+
+// (derived from)
+// file_id.cc: Return a unique identifier for a file
+//
+// See file_id.h for documentation
+//
+
+// ELF note name and desc are 32-bits word padded.
+#define NOTE_PADDING(a) ((a + 3) & ~3)
+
+// These functions are also used inside the crashed process, so be safe
+// and use the syscall/libc wrappers instead of direct syscalls or libc.
+
+template <typename ElfClass>
+static bool ElfClassBuildIDNoteIdentifier(const void* section, int length,
+                                          uint8_t identifier[kMDGUIDSize]) {
+  typedef typename ElfClass::Nhdr Nhdr;
+
+  const void* section_end = reinterpret_cast<const char*>(section) + length;
+  const Nhdr* note_header = reinterpret_cast<const Nhdr*>(section);
+  while (reinterpret_cast<const void*>(note_header) < section_end) {
+    if (note_header->n_type == NT_GNU_BUILD_ID) break;
+    note_header = reinterpret_cast<const Nhdr*>(
+        reinterpret_cast<const char*>(note_header) + sizeof(Nhdr) +
+        NOTE_PADDING(note_header->n_namesz) +
+        NOTE_PADDING(note_header->n_descsz));
+  }
+  if (reinterpret_cast<const void*>(note_header) >= section_end ||
+      note_header->n_descsz == 0) {
+    return false;
+  }
+
+  const char* build_id = reinterpret_cast<const char*>(note_header) +
+                         sizeof(Nhdr) + NOTE_PADDING(note_header->n_namesz);
+  // Copy as many bits of the build ID as will fit
+  // into the GUID space.
+  memset(identifier, 0, kMDGUIDSize);
+  memcpy(identifier, build_id,
+         std::min(kMDGUIDSize, (size_t)note_header->n_descsz));
+
+  return true;
+}
+
+// Attempt to locate a .note.gnu.build-id section in an ELF binary
+// and copy as many bytes of it as will fit into |identifier|.
+static bool FindElfBuildIDNote(const void* elf_mapped_base,
+                               uint8_t identifier[kMDGUIDSize]) {
+  void* note_section;
+  int note_size, elfclass;
+  if ((!FindElfSegment(elf_mapped_base, PT_NOTE, (const void**)&note_section,
+                       &note_size, &elfclass) ||
+       note_size == 0) &&
+      (!FindElfSection(elf_mapped_base, ".note.gnu.build-id", SHT_NOTE,
+                       (const void**)&note_section, &note_size, &elfclass) ||
+       note_size == 0)) {
+    return false;
+  }
+
+  if (elfclass == ELFCLASS32) {
+    return ElfClassBuildIDNoteIdentifier<ElfClass32>(note_section, note_size,
+                                                     identifier);
+  } else if (elfclass == ELFCLASS64) {
+    return ElfClassBuildIDNoteIdentifier<ElfClass64>(note_section, note_size,
+                                                     identifier);
+  }
+
+  return false;
+}
+
+// Attempt to locate the .text section of an ELF binary and generate
+// a simple hash by XORing the first page worth of bytes into |identifier|.
+static bool HashElfTextSection(const void* elf_mapped_base,
+                               uint8_t identifier[kMDGUIDSize]) {
+  void* text_section;
+  int text_size;
+  if (!FindElfSection(elf_mapped_base, ".text", SHT_PROGBITS,
+                      (const void**)&text_section, &text_size, NULL) ||
+      text_size == 0) {
+    return false;
+  }
+
+  memset(identifier, 0, kMDGUIDSize);
+  const uint8_t* ptr = reinterpret_cast<const uint8_t*>(text_section);
+  const uint8_t* ptr_end = ptr + std::min(text_size, 4096);
+  while (ptr < ptr_end) {
+    for (unsigned i = 0; i < kMDGUIDSize; i++) identifier[i] ^= ptr[i];
+    ptr += kMDGUIDSize;
+  }
+  return true;
+}
+
+// static
+bool FileID::ElfFileIdentifierFromMappedFile(const void* base,
+                                             uint8_t identifier[kMDGUIDSize]) {
+  // Look for a build id note first.
+  if (FindElfBuildIDNote(base, identifier)) return true;
+
+  // Fall back on hashing the first page of the text section.
+  return HashElfTextSection(base, identifier);
+}
+
+// static
+void FileID::ConvertIdentifierToString(const uint8_t identifier[kMDGUIDSize],
+                                       char* buffer, int buffer_length) {
+  uint8_t identifier_swapped[kMDGUIDSize];
+
+  // Endian-ness swap to match dump processor expectation.
+  memcpy(identifier_swapped, identifier, kMDGUIDSize);
+  uint32_t* data1 = reinterpret_cast<uint32_t*>(identifier_swapped);
+  *data1 = htonl(*data1);
+  uint16_t* data2 = reinterpret_cast<uint16_t*>(identifier_swapped + 4);
+  *data2 = htons(*data2);
+  uint16_t* data3 = reinterpret_cast<uint16_t*>(identifier_swapped + 6);
+  *data3 = htons(*data3);
+
+  int buffer_idx = 0;
+  for (unsigned int idx = 0;
+       (buffer_idx < buffer_length) && (idx < kMDGUIDSize); ++idx) {
+    int hi = (identifier_swapped[idx] >> 4) & 0x0F;
+    int lo = (identifier_swapped[idx]) & 0x0F;
+
+    if (idx == 4 || idx == 6 || idx == 8 || idx == 10)
+      buffer[buffer_idx++] = '-';
+
+    buffer[buffer_idx++] = (hi >= 10) ? 'A' + hi - 10 : '0' + hi;
+    buffer[buffer_idx++] = (lo >= 10) ? 'A' + lo - 10 : '0' + lo;
+  }
+
+  // NULL terminate
+  buffer[(buffer_idx < buffer_length) ? buffer_idx : buffer_idx - 1] = 0;
+}
+
+}  // namespace lul
diff --git a/tools/profiler/lul/LulElfExt.h b/tools/profiler/lul/LulElfExt.h
new file mode 100644
index 0000000000..73d9ff7f15
--- /dev/null
+++ b/tools/profiler/lul/LulElfExt.h
@@ -0,0 +1,69 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+
+// Copyright (c) 2006, 2011, 2012 Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This file is derived from the following files in
+// toolkit/crashreporter/google-breakpad:
+//   src/common/linux/dump_symbols.h
+
+#ifndef LulElfExt_h
+#define LulElfExt_h
+
+// These two functions are the external interface to the
+// ELF/Dwarf/EXIDX reader.
+
+#include "LulMainInt.h"
+
+using lul::SecMap;
+
+namespace lul {
+
+class UniqueStringUniverse;
+
+// Find all the unwind information in OBJ_FILE, an ELF executable
+// or shared library, and add it to SMAP.
+bool ReadSymbolData(const std::string& obj_file,
+                    const std::vector<std::string>& debug_dirs, SecMap* smap,
+                    void* rx_avma, size_t rx_size, UniqueStringUniverse* usu,
+                    void (*log)(const char*));
+
+// The same as ReadSymbolData, except that OBJ_FILE is assumed to
+// point to a mapped-in image of OBJ_FILENAME.
+bool ReadSymbolDataInternal(const uint8_t* obj_file,
+                            const std::string& obj_filename,
+                            const std::vector<std::string>& debug_dirs,
+                            SecMap* smap, void* rx_avma, size_t rx_size,
+                            UniqueStringUniverse* usu,
+                            void (*log)(const char*));
+
+}  // namespace lul
+
+#endif  // LulElfExt_h
diff --git a/tools/profiler/lul/LulElfInt.h b/tools/profiler/lul/LulElfInt.h
new file mode 100644
index 0000000000..31ffba8ff0
--- /dev/null
+++ b/tools/profiler/lul/LulElfInt.h
@@ -0,0 +1,218 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+
+// Copyright (c) 2006, 2012, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This file is derived from the following files in
+// toolkit/crashreporter/google-breakpad:
+//   src/common/android/include/elf.h
+//   src/common/linux/elfutils.h
+//   src/common/linux/file_id.h
+//   src/common/linux/elfutils-inl.h
+
+#ifndef LulElfInt_h
+#define LulElfInt_h
+
+// This header defines functions etc internal to the ELF reader.  It
+// should not be included outside of LulElf.cpp.
+
+#include <elf.h>
+#include <stdlib.h>
+
+#include "mozilla/Assertions.h"
+
+#include "PlatformMacros.h"
+
+// (derived from)
+// elfutils.h: Utilities for dealing with ELF files.
+//
+#include <link.h>
+
+#if defined(GP_OS_android)
+
+// From toolkit/crashreporter/google-breakpad/src/common/android/include/elf.h
+// The Android headers don't always define this constant.
+#  ifndef EM_X86_64
+#    define EM_X86_64 62
+#  endif
+
+#  ifndef EM_PPC64
+#    define EM_PPC64 21
+#  endif
+
+#  ifndef EM_S390
+#    define EM_S390 22
+#  endif
+
+#  ifndef NT_GNU_BUILD_ID
+#    define NT_GNU_BUILD_ID 3
+#  endif
+
+#  ifndef ElfW
+#    define ElfW(type) _ElfW(Elf, ELFSIZE, type)
+#    define _ElfW(e, w, t) _ElfW_1(e, w, _##t)
+#    define _ElfW_1(e, w, t) e##w##t
+#  endif
+
+#endif
+
+#if defined(GP_OS_freebsd)
+
+#  ifndef ElfW
+#    define ElfW(type) Elf_##type
+#  endif
+
+#endif
+
+namespace lul {
+
+// Traits classes so consumers can write templatized code to deal
+// with specific ELF bits.
+struct ElfClass32 {
+  typedef Elf32_Addr Addr;
+  typedef Elf32_Ehdr Ehdr;
+  typedef Elf32_Nhdr Nhdr;
+  typedef Elf32_Phdr Phdr;
+  typedef Elf32_Shdr Shdr;
+  typedef Elf32_Half Half;
+  typedef Elf32_Off Off;
+  typedef Elf32_Word Word;
+  static const int kClass = ELFCLASS32;
+  static const size_t kAddrSize = sizeof(Elf32_Addr);
+};
+
+struct ElfClass64 {
+  typedef Elf64_Addr Addr;
+  typedef Elf64_Ehdr Ehdr;
+  typedef Elf64_Nhdr Nhdr;
+  typedef Elf64_Phdr Phdr;
+  typedef Elf64_Shdr Shdr;
+  typedef Elf64_Half Half;
+  typedef Elf64_Off Off;
+  typedef Elf64_Word Word;
+  static const int kClass = ELFCLASS64;
+  static const size_t kAddrSize = sizeof(Elf64_Addr);
+};
+
+bool IsValidElf(const void* elf_header);
+int ElfClass(const void* elf_base);
+
+// Attempt to find a section named |section_name| of type |section_type|
+// in the ELF binary data at |elf_mapped_base|. On success, returns true
+// and sets |*section_start| to point to the start of the section data,
+// and |*section_size| to the size of the section's data. If |elfclass|
+// is not NULL, set |*elfclass| to the ELF file class.
+bool FindElfSection(const void* elf_mapped_base, const char* section_name,
+                    uint32_t section_type, const void** section_start,
+                    int* section_size, int* elfclass);
+
+// Internal helper method, exposed for convenience for callers
+// that already have more info.
+template <typename ElfClass>
+const typename ElfClass::Shdr* FindElfSectionByName(
+    const char* name, typename ElfClass::Word section_type,
+    const typename ElfClass::Shdr* sections, const char* section_names,
+    const char* names_end, int nsection);
+
+// Attempt to find the first segment of type |segment_type| in the ELF
+// binary data at |elf_mapped_base|. On success, returns true and sets
+// |*segment_start| to point to the start of the segment data, and
+// and |*segment_size| to the size of the segment's data. If |elfclass|
+// is not NULL, set |*elfclass| to the ELF file class.
+bool FindElfSegment(const void* elf_mapped_base, uint32_t segment_type,
+                    const void** segment_start, int* segment_size,
+                    int* elfclass);
+
+// Convert an offset from an Elf header into a pointer to the mapped
+// address in the current process. Takes an extra template parameter
+// to specify the return type to avoid having to dynamic_cast the
+// result.
+template <typename ElfClass, typename T>
+const T* GetOffset(const typename ElfClass::Ehdr* elf_header,
+                   typename ElfClass::Off offset);
+
+// (derived from)
+// file_id.h: Return a unique identifier for a file
+//
+
+static const size_t kMDGUIDSize = sizeof(MDGUID);
+
+class FileID {
+ public:
+  // Load the identifier for the elf file mapped into memory at |base| into
+  // |identifier|.  Return false if the identifier could not be created for the
+  // file.
+  static bool ElfFileIdentifierFromMappedFile(const void* base,
+                                              uint8_t identifier[kMDGUIDSize]);
+
+  // Convert the |identifier| data to a NULL terminated string.  The string will
+  // be formatted as a UUID (e.g., 22F065BB-FC9C-49F7-80FE-26A7CEBD7BCE).
+  // The |buffer| should be at least 37 bytes long to receive all of the data
+  // and termination.  Shorter buffers will contain truncated data.
+  static void ConvertIdentifierToString(const uint8_t identifier[kMDGUIDSize],
+                                        char* buffer, int buffer_length);
+};
+
+template <typename ElfClass, typename T>
+const T* GetOffset(const typename ElfClass::Ehdr* elf_header,
+                   typename ElfClass::Off offset) {
+  return reinterpret_cast<const T*>(reinterpret_cast<uintptr_t>(elf_header) +
+                                    offset);
+}
+
+template <typename ElfClass>
+const typename ElfClass::Shdr* FindElfSectionByName(
+    const char* name, typename ElfClass::Word section_type,
+    const typename ElfClass::Shdr* sections, const char* section_names,
+    const char* names_end, int nsection) {
+  MOZ_ASSERT(name != NULL);
+  MOZ_ASSERT(sections != NULL);
+  MOZ_ASSERT(nsection > 0);
+
+  int name_len = strlen(name);
+  if (name_len == 0) return NULL;
+
+  for (int i = 0; i < nsection; ++i) {
+    const char* section_name = section_names + sections[i].sh_name;
+    if (sections[i].sh_type == section_type &&
+        names_end - section_name >= name_len + 1 &&
+        strcmp(name, section_name) == 0) {
+      return sections + i;
+    }
+  }
+  return NULL;
+}
+
+}  // namespace lul
+
+// And finally, the external interface, offered to LulMain.cpp
+#include "LulElfExt.h"
+
+#endif  // LulElfInt_h
diff --git a/tools/profiler/lul/LulMain.cpp b/tools/profiler/lul/LulMain.cpp
new file mode 100644
index 0000000000..a557830929
--- /dev/null
+++ b/tools/profiler/lul/LulMain.cpp
@@ -0,0 +1,2081 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "LulMain.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>  // write(), only for testing LUL
+
+#include <algorithm>  // std::sort
+#include <string>
+#include <utility>
+
+#include "GeckoProfiler.h"  // for profiler_current_thread_id()
+#include "LulCommonExt.h"
+#include "LulElfExt.h"
+#include "LulMainInt.h"
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/Assertions.h"
+#include "mozilla/CheckedInt.h"
+#include "mozilla/DebugOnly.h"
+#include "mozilla/MemoryChecking.h"
+#include "mozilla/Sprintf.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Unused.h"
+
+// Set this to 1 for verbose logging
+#define DEBUG_MAIN 0
+
+namespace lul {
+
+using mozilla::CheckedInt;
+using mozilla::DebugOnly;
+using mozilla::MallocSizeOf;
+using mozilla::Unused;
+using std::pair;
+using std::string;
+using std::vector;
+
+// WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
+//
+// Some functions in this file are marked RUNS IN NO-MALLOC CONTEXT.
+// Any such function -- and, hence, the transitive closure of those
+// reachable from it -- must not do any dynamic memory allocation.
+// Doing so risks deadlock.  There is exactly one root function for
+// the transitive closure: Lul::Unwind.
+//
+// WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
+
+////////////////////////////////////////////////////////////////
+// RuleSet                                                    //
+////////////////////////////////////////////////////////////////
+
+static const char* NameOf_DW_REG(int16_t aReg) {
+  switch (aReg) {
+    case DW_REG_CFA:
+      return "cfa";
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+    case DW_REG_INTEL_XBP:
+      return "xbp";
+    case DW_REG_INTEL_XSP:
+      return "xsp";
+    case DW_REG_INTEL_XIP:
+      return "xip";
+#elif defined(GP_ARCH_arm)
+    case DW_REG_ARM_R7:
+      return "r7";
+    case DW_REG_ARM_R11:
+      return "r11";
+    case DW_REG_ARM_R12:
+      return "r12";
+    case DW_REG_ARM_R13:
+      return "r13";
+    case DW_REG_ARM_R14:
+      return "r14";
+    case DW_REG_ARM_R15:
+      return "r15";
+#elif defined(GP_ARCH_arm64)
+    case DW_REG_AARCH64_X29:
+      return "x29";
+    case DW_REG_AARCH64_X30:
+      return "x30";
+    case DW_REG_AARCH64_SP:
+      return "sp";
+#elif defined(GP_ARCH_mips64)
+    case DW_REG_MIPS_SP:
+      return "sp";
+    case DW_REG_MIPS_FP:
+      return "fp";
+    case DW_REG_MIPS_PC:
+      return "pc";
+#else
+#  error "Unsupported arch"
+#endif
+    default:
+      return "???";
+  }
+}
+
+string LExpr::ShowRule(const char* aNewReg) const {
+  char buf[64];
+  string res = string(aNewReg) + "=";
+  switch (mHow) {
+    case UNKNOWN:
+      res += "Unknown";
+      break;
+    case NODEREF:
+      SprintfLiteral(buf, "%s+%d", NameOf_DW_REG(mReg), (int)mOffset);
+      res += buf;
+      break;
+    case DEREF:
+      SprintfLiteral(buf, "*(%s+%d)", NameOf_DW_REG(mReg), (int)mOffset);
+      res += buf;
+      break;
+    case PFXEXPR:
+      SprintfLiteral(buf, "PfxExpr-at-%d", (int)mOffset);
+      res += buf;
+      break;
+    default:
+      res += "???";
+      break;
+  }
+  return res;
+}
+
+void RuleSet::Print(uintptr_t avma, uintptr_t len,
+                    void (*aLog)(const char*)) const {
+  char buf[96];
+  SprintfLiteral(buf, "[%llx .. %llx]: let ", (unsigned long long int)avma,
+                 (unsigned long long int)(avma + len - 1));
+  string res = string(buf);
+  res += mCfaExpr.ShowRule("cfa");
+  res += " in";
+  // For each reg we care about, print the recovery expression.
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+  res += mXipExpr.ShowRule(" RA");
+  res += mXspExpr.ShowRule(" SP");
+  res += mXbpExpr.ShowRule(" BP");
+#elif defined(GP_ARCH_arm)
+  res += mR15expr.ShowRule(" R15");
+  res += mR7expr.ShowRule(" R7");
+  res += mR11expr.ShowRule(" R11");
+  res += mR12expr.ShowRule(" R12");
+  res += mR13expr.ShowRule(" R13");
+  res += mR14expr.ShowRule(" R14");
+#elif defined(GP_ARCH_arm64)
+  res += mX29expr.ShowRule(" X29");
+  res += mX30expr.ShowRule(" X30");
+  res += mSPexpr.ShowRule(" SP");
+#elif defined(GP_ARCH_mips64)
+  res += mPCexpr.ShowRule(" PC");
+  res += mSPexpr.ShowRule(" SP");
+  res += mFPexpr.ShowRule(" FP");
+#else
+#  error "Unsupported arch"
+#endif
+  aLog(res.c_str());
+}
+
+LExpr* RuleSet::ExprForRegno(DW_REG_NUMBER aRegno) {
+  switch (aRegno) {
+    case DW_REG_CFA:
+      return &mCfaExpr;
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+    case DW_REG_INTEL_XIP:
+      return &mXipExpr;
+    case DW_REG_INTEL_XSP:
+      return &mXspExpr;
+    case DW_REG_INTEL_XBP:
+      return &mXbpExpr;
+#elif defined(GP_ARCH_arm)
+    case DW_REG_ARM_R15:
+      return &mR15expr;
+    case DW_REG_ARM_R14:
+      return &mR14expr;
+    case DW_REG_ARM_R13:
+      return &mR13expr;
+    case DW_REG_ARM_R12:
+      return &mR12expr;
+    case DW_REG_ARM_R11:
+      return &mR11expr;
+    case DW_REG_ARM_R7:
+      return &mR7expr;
+#elif defined(GP_ARCH_arm64)
+    case DW_REG_AARCH64_X29:
+      return &mX29expr;
+    case DW_REG_AARCH64_X30:
+      return &mX30expr;
+    case DW_REG_AARCH64_SP:
+      return &mSPexpr;
+#elif defined(GP_ARCH_mips64)
+    case DW_REG_MIPS_SP:
+      return &mSPexpr;
+    case DW_REG_MIPS_FP:
+      return &mFPexpr;
+    case DW_REG_MIPS_PC:
+      return &mPCexpr;
+#else
+#  error "Unknown arch"
+#endif
+    default:
+      return nullptr;
+  }
+}
+
+RuleSet::RuleSet() {
+  // All fields are of type LExpr and so are initialised by LExpr::LExpr().
+}
+
+////////////////////////////////////////////////////////////////
+// SecMap                                                     //
+////////////////////////////////////////////////////////////////
+
+// See header file LulMainInt.h for comments about invariants.
+
+SecMap::SecMap(uintptr_t mapStartAVMA, uint32_t mapLen,
+               void (*aLog)(const char*))
+    : mUsable(false),
+      mUniqifier(new mozilla::HashMap<RuleSet, uint32_t, RuleSet,
+                                      InfallibleAllocPolicy>),
+      mLog(aLog) {
+  if (mapLen == 0) {
+    // Degenerate case.
+    mMapMinAVMA = 1;
+    mMapMaxAVMA = 0;
+  } else {
+    mMapMinAVMA = mapStartAVMA;
+    mMapMaxAVMA = mapStartAVMA + (uintptr_t)mapLen - 1;
+  }
+}
+
+SecMap::~SecMap() {
+  mExtents.clear();
+  mDictionary.clear();
+  if (mUniqifier) {
+    mUniqifier->clear();
+    mUniqifier = nullptr;
+  }
+}
+
+// RUNS IN NO-MALLOC CONTEXT
+RuleSet* SecMap::FindRuleSet(uintptr_t ia) {
+  // Binary search mExtents to find one that brackets |ia|.
+  // lo and hi need to be signed, else the loop termination tests
+  // don't work properly.  Note that this works correctly even when
+  // mExtents.size() == 0.
+
+  // Can't do this until the array has been sorted and preened.
+  MOZ_ASSERT(mUsable);
+
+  long int lo = 0;
+  long int hi = (long int)mExtents.size() - 1;
+  while (true) {
+    // current unsearched space is from lo to hi, inclusive.
+    if (lo > hi) {
+      // not found
+      return nullptr;
+    }
+    long int mid = lo + ((hi - lo) / 2);
+    Extent* mid_extent = &mExtents[mid];
+    uintptr_t mid_offset = mid_extent->offset();
+    uintptr_t mid_len = mid_extent->len();
+    uintptr_t mid_minAddr = mMapMinAVMA + mid_offset;
+    uintptr_t mid_maxAddr = mid_minAddr + mid_len - 1;
+    if (ia < mid_minAddr) {
+      hi = mid - 1;
+      continue;
+    }
+    if (ia > mid_maxAddr) {
+      lo = mid + 1;
+      continue;
+    }
+    MOZ_ASSERT(mid_minAddr <= ia && ia <= mid_maxAddr);
+    uint32_t mid_extent_dictIx = mid_extent->dictIx();
+    MOZ_RELEASE_ASSERT(mid_extent_dictIx < mExtents.size());
+    return &mDictionary[mid_extent_dictIx];
+  }
+  // NOTREACHED
+}
+
+// Add a RuleSet to the collection.  The rule is copied in.  Calling
+// this makes the map non-searchable.
+void SecMap::AddRuleSet(const RuleSet* rs, uintptr_t avma, uintptr_t len) {
+  mUsable = false;
+
+  // Zero length RuleSet?  Meaningless, but ignore it anyway.
+  if (len == 0) {
+    return;
+  }
+
+  // Ignore attempts to add RuleSets whose address range doesn't fall within
+  // the declared address range for the SecMap.  Maybe we should print some
+  // kind of error message rather than silently ignoring them.
+  if (!(avma >= mMapMinAVMA && avma + len - 1 <= mMapMaxAVMA)) {
+    return;
+  }
+
+  // Because `mMapStartAVMA` .. `mMapEndAVMA` can specify at most a 2^32-1 byte
+  // chunk of address space, the following must now hold.
+  MOZ_RELEASE_ASSERT(len <= (uintptr_t)0xFFFFFFFF);
+
+  // See if `mUniqifier` already has `rs`.  If so set `dictIx` to the assigned
+  // dictionary index; if not, add `rs` to `mUniqifier` and assign a new
+  // dictionary index.  This is the core of the RuleSet-de-duplication process.
+  uint32_t dictIx = 0;
+  mozilla::HashMap<RuleSet, uint32_t, RuleSet, InfallibleAllocPolicy>::AddPtr
+      p = mUniqifier->lookupForAdd(*rs);
+  if (!p) {
+    dictIx = mUniqifier->count();
+    // If this ever fails, Extents::dictIx will need to be changed to be a
+    // type wider than the current uint16_t.
+    MOZ_RELEASE_ASSERT(dictIx < (1 << 16));
+    // This returns `false` on OOM.  We ignore the return value since we asked
+    // for it to use the InfallibleAllocPolicy.
+    DebugOnly<bool> addedOK = mUniqifier->add(p, *rs, dictIx);
+    MOZ_ASSERT(addedOK);
+  } else {
+    dictIx = p->value();
+  }
+
+  uint32_t offset = (uint32_t)(avma - mMapMinAVMA);
+  while (len > 0) {
+    // Because Extents::len is a uint16_t, we have to add multiple `mExtents`
+    // entries to cover the case where `len` is equal to or greater than 2^16.
+    // This happens only exceedingly rarely.  In order to get more test
+    // coverage on what would otherwise be a very low probability (less than
+    // 0.0002%) corner case, we do this in steps of 4095.  On libxul.so as of
+    // Sept 2020, this increases the number of `mExtents` entries by about
+    // 0.05%, hence has no meaningful effect on space use, but increases the
+    // use of this corner case, and hence its test coverage, by a factor of 250.
+    uint32_t this_step_len = (len > 4095) ? 4095 : len;
+    mExtents.emplace_back(offset, this_step_len, dictIx);
+    offset += this_step_len;
+    len -= this_step_len;
+  }
+}
+
+// Add a PfxInstr to the vector of such instrs, and return the index
+// in the vector.  Calling this makes the map non-searchable.
+uint32_t SecMap::AddPfxInstr(PfxInstr pfxi) {
+  mUsable = false;
+  mPfxInstrs.push_back(pfxi);
+  return mPfxInstrs.size() - 1;
+}
+
+static bool CmpExtentsByOffsetLE(const Extent& ext1, const Extent& ext2) {
+  return ext1.offset() < ext2.offset();
+}
+
+// Prepare the map for searching, by sorting it, de-overlapping entries and
+// removing any resulting zero-length entries.  At the start of this routine,
+// all Extents should fall within [mMapMinAVMA, mMapMaxAVMA] and not have zero
+// length, as a result of the checks in AddRuleSet().
+void SecMap::PrepareRuleSets() {
+  // At this point, the de-duped RuleSets are in `mUniqifier`, and
+  // `mDictionary` is empty.  This method will, amongst other things, copy
+  // them into `mDictionary` in order of their assigned dictionary-index
+  // values, as established by `SecMap::AddRuleSet`, and free `mUniqifier`;
+  // after this method, it has no further use.
+  MOZ_RELEASE_ASSERT(mUniqifier);
+  MOZ_RELEASE_ASSERT(mDictionary.empty());
+
+  if (mExtents.empty()) {
+    mUniqifier->clear();
+    mUniqifier = nullptr;
+    return;
+  }
+
+  if (mMapMinAVMA == 1 && mMapMaxAVMA == 0) {
+    // The map is empty.  This should never happen.
+    mExtents.clear();
+    mUniqifier->clear();
+    mUniqifier = nullptr;
+    return;
+  }
+  MOZ_RELEASE_ASSERT(mMapMinAVMA <= mMapMaxAVMA);
+
+  // We must have at least one Extent, and as a consequence there must be at
+  // least one entry in the uniqifier.
+  MOZ_RELEASE_ASSERT(!mExtents.empty() && !mUniqifier->empty());
+
+#ifdef DEBUG
+  // Check invariants on incoming Extents.
+  for (size_t i = 0; i < mExtents.size(); ++i) {
+    Extent* ext = &mExtents[i];
+    uint32_t len = ext->len();
+    MOZ_ASSERT(len > 0);
+    MOZ_ASSERT(len <= 4095 /* per '4095' in AddRuleSet() */);
+    uint32_t offset = ext->offset();
+    uintptr_t avma = mMapMinAVMA + (uintptr_t)offset;
+    // Upper bounds test.  There's no lower bounds test because `offset` is a
+    // positive displacement from `mMapMinAVMA`, so a small underrun will
+    // manifest as `len` being close to 2^32.
+    MOZ_ASSERT(avma + (uintptr_t)len - 1 <= mMapMaxAVMA);
+  }
+#endif
+
+  // Sort by start addresses.
+  std::sort(mExtents.begin(), mExtents.end(), CmpExtentsByOffsetLE);
+
+  // Iteratively truncate any overlaps and remove any zero length
+  // entries that might result, or that may have been present
+  // initially.  Unless the input is seriously screwy, this is
+  // expected to iterate only once.
+  while (true) {
+    size_t i;
+    size_t n = mExtents.size();
+    size_t nZeroLen = 0;
+
+    if (n == 0) {
+      break;
+    }
+
+    for (i = 1; i < n; ++i) {
+      Extent* prev = &mExtents[i - 1];
+      Extent* here = &mExtents[i];
+      MOZ_ASSERT(prev->offset() <= here->offset());
+      if (prev->offset() + prev->len() > here->offset()) {
+        prev->setLen(here->offset() - prev->offset());
+      }
+      if (prev->len() == 0) {
+        nZeroLen++;
+      }
+    }
+
+    if (mExtents[n - 1].len() == 0) {
+      nZeroLen++;
+    }
+
+    // At this point, the entries are in-order and non-overlapping.
+    // If none of them are zero-length, we are done.
+    if (nZeroLen == 0) {
+      break;
+    }
+
+    // Slide back the entries to remove the zero length ones.
+    size_t j = 0;  // The write-point.
+    for (i = 0; i < n; ++i) {
+      if (mExtents[i].len() == 0) {
+        continue;
+      }
+      if (j != i) {
+        mExtents[j] = mExtents[i];
+      }
+      ++j;
+    }
+    MOZ_ASSERT(i == n);
+    MOZ_ASSERT(nZeroLen <= n);
+    MOZ_ASSERT(j == n - nZeroLen);
+    while (nZeroLen > 0) {
+      mExtents.pop_back();
+      nZeroLen--;
+    }
+
+    MOZ_ASSERT(mExtents.size() == j);
+  }
+
+  size_t nExtents = mExtents.size();
+
+#ifdef DEBUG
+  // Do a final check on the extents: their address ranges must be
+  // ascending, non overlapping, non zero sized.
+  if (nExtents > 0) {
+    MOZ_ASSERT(mExtents[0].len() > 0);
+    for (size_t i = 1; i < nExtents; ++i) {
+      const Extent* prev = &mExtents[i - 1];
+      const Extent* here = &mExtents[i];
+      MOZ_ASSERT(prev->offset() < here->offset());
+      MOZ_ASSERT(here->len() > 0);
+      MOZ_ASSERT(prev->offset() + prev->len() <= here->offset());
+    }
+  }
+#endif
+
+  // Create the final dictionary by enumerating the uniqifier.
+  size_t nUniques = mUniqifier->count();
+
+  RuleSet dummy;
+  mozilla::PodZero(&dummy);
+
+  mDictionary.reserve(nUniques);
+  for (size_t i = 0; i < nUniques; i++) {
+    mDictionary.push_back(dummy);
+  }
+
+  for (auto iter = mUniqifier->iter(); !iter.done(); iter.next()) {
+    MOZ_RELEASE_ASSERT(iter.get().value() < nUniques);
+    mDictionary[iter.get().value()] = iter.get().key();
+  }
+
+  mUniqifier = nullptr;
+
+  char buf[150];
+  SprintfLiteral(
+      buf,
+      "PrepareRuleSets: %lu extents, %lu rulesets, "
+      "avma min/max 0x%llx, 0x%llx\n",
+      (unsigned long int)nExtents, (unsigned long int)mDictionary.size(),
+      (unsigned long long int)mMapMinAVMA, (unsigned long long int)mMapMaxAVMA);
+  buf[sizeof(buf) - 1] = 0;
+  mLog(buf);
+
+  // Is now usable for binary search.
+  mUsable = true;
+
+#if 0
+  mLog("\nRulesets after preening\n");
+  for (size_t i = 0; i < nExtents; ++i) {
+    const Extent* extent = &mExtents[i];
+    uintptr_t avma = mMapMinAVMA + (uintptr_t)extent->offset();
+    mDictionary[extent->dictIx()].Print(avma, extent->len(), mLog);
+    mLog("\n");
+  }
+  mLog("\n");
+#endif
+}
+
+bool SecMap::IsEmpty() { return mExtents.empty(); }
+
+size_t SecMap::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const {
+  size_t n = aMallocSizeOf(this);
+
+  // It's conceivable that these calls would be unsafe with some
+  // implementations of std::vector, but it seems to be working for now...
+  n += aMallocSizeOf(mPfxInstrs.data());
+
+  if (mUniqifier) {
+    n += mUniqifier->shallowSizeOfIncludingThis(aMallocSizeOf);
+  }
+  n += aMallocSizeOf(mDictionary.data());
+  n += aMallocSizeOf(mExtents.data());
+
+  return n;
+}
+
+////////////////////////////////////////////////////////////////
+// SegArray                                                   //
+////////////////////////////////////////////////////////////////
+
+// A SegArray holds a set of address ranges that together exactly
+// cover an address range, with no overlaps or holes.  Each range has
+// an associated value, which in this case has been specialised to be
+// a simple boolean.  The representation is kept to minimal canonical
+// form in which adjacent ranges with the same associated value are
+// merged together.  Each range is represented by a |struct Seg|.
+//
+// SegArrays are used to keep track of which parts of the address
+// space are known to contain instructions.
+class SegArray {
+ public:
+  void add(uintptr_t lo, uintptr_t hi, bool val) {
+    if (lo > hi) {
+      return;
+    }
+    split_at(lo);
+    if (hi < UINTPTR_MAX) {
+      split_at(hi + 1);
+    }
+    std::vector<Seg>::size_type iLo, iHi, i;
+    iLo = find(lo);
+    iHi = find(hi);
+    for (i = iLo; i <= iHi; ++i) {
+      mSegs[i].val = val;
+    }
+    preen();
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  bool getBoundingCodeSegment(/*OUT*/ uintptr_t* rx_min,
+                              /*OUT*/ uintptr_t* rx_max, uintptr_t addr) {
+    std::vector<Seg>::size_type i = find(addr);
+    if (!mSegs[i].val) {
+      return false;
+    }
+    *rx_min = mSegs[i].lo;
+    *rx_max = mSegs[i].hi;
+    return true;
+  }
+
+  SegArray() {
+    Seg s(0, UINTPTR_MAX, false);
+    mSegs.push_back(s);
+  }
+
+ private:
+  struct Seg {
+    Seg(uintptr_t lo, uintptr_t hi, bool val) : lo(lo), hi(hi), val(val) {}
+    uintptr_t lo;
+    uintptr_t hi;
+    bool val;
+  };
+
+  void preen() {
+    for (std::vector<Seg>::iterator iter = mSegs.begin();
+         iter < mSegs.end() - 1; ++iter) {
+      if (iter[0].val != iter[1].val) {
+        continue;
+      }
+      iter[0].hi = iter[1].hi;
+      mSegs.erase(iter + 1);
+      // Back up one, so as not to miss an opportunity to merge
+      // with the entry after this one.
+      --iter;
+    }
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  std::vector<Seg>::size_type find(uintptr_t a) {
+    long int lo = 0;
+    long int hi = (long int)mSegs.size();
+    while (true) {
+      // The unsearched space is lo .. hi inclusive.
+      if (lo > hi) {
+        // Not found.  This can't happen.
+        return (std::vector<Seg>::size_type)(-1);
+      }
+      long int mid = lo + ((hi - lo) / 2);
+      uintptr_t mid_lo = mSegs[mid].lo;
+      uintptr_t mid_hi = mSegs[mid].hi;
+      if (a < mid_lo) {
+        hi = mid - 1;
+        continue;
+      }
+      if (a > mid_hi) {
+        lo = mid + 1;
+        continue;
+      }
+      return (std::vector<Seg>::size_type)mid;
+    }
+  }
+
+  void split_at(uintptr_t a) {
+    std::vector<Seg>::size_type i = find(a);
+    if (mSegs[i].lo == a) {
+      return;
+    }
+    mSegs.insert(mSegs.begin() + i + 1, mSegs[i]);
+    mSegs[i].hi = a - 1;
+    mSegs[i + 1].lo = a;
+  }
+
+  void show() {
+    printf("<< %d entries:\n", (int)mSegs.size());
+    for (std::vector<Seg>::iterator iter = mSegs.begin(); iter < mSegs.end();
+         ++iter) {
+      printf("  %016llx  %016llx  %s\n", (unsigned long long int)(*iter).lo,
+             (unsigned long long int)(*iter).hi,
+             (*iter).val ? "true" : "false");
+    }
+    printf(">>\n");
+  }
+
+  std::vector<Seg> mSegs;
+};
+
+////////////////////////////////////////////////////////////////
+// PriMap                                                     //
+////////////////////////////////////////////////////////////////
+
+class PriMap {
+ public:
+  explicit PriMap(void (*aLog)(const char*)) : mLog(aLog) {}
+
+  // RUNS IN NO-MALLOC CONTEXT
+  pair<const RuleSet*, const vector<PfxInstr>*> Lookup(uintptr_t ia) {
+    SecMap* sm = FindSecMap(ia);
+    return pair<const RuleSet*, const vector<PfxInstr>*>(
+        sm ? sm->FindRuleSet(ia) : nullptr, sm ? sm->GetPfxInstrs() : nullptr);
+  }
+
+  // Add a secondary map.  No overlaps allowed w.r.t. existing
+  // secondary maps.
+  void AddSecMap(mozilla::UniquePtr<SecMap>&& aSecMap) {
+    // We can't add an empty SecMap to the PriMap.  But that's OK
+    // since we'd never be able to find anything in it anyway.
+    if (aSecMap->IsEmpty()) {
+      return;
+    }
+
+    // Iterate through the SecMaps and find the right place for this
+    // one.  At the same time, ensure that the in-order
+    // non-overlapping invariant is preserved (and, generally, holds).
+    // FIXME: this gives a cost that is O(N^2) in the total number of
+    // shared objects in the system.  ToDo: better.
+    MOZ_ASSERT(aSecMap->mMapMinAVMA <= aSecMap->mMapMaxAVMA);
+
+    size_t num_secMaps = mSecMaps.size();
+    uintptr_t i;
+    for (i = 0; i < num_secMaps; ++i) {
+      mozilla::UniquePtr<SecMap>& sm_i = mSecMaps[i];
+      MOZ_ASSERT(sm_i->mMapMinAVMA <= sm_i->mMapMaxAVMA);
+      if (aSecMap->mMapMinAVMA < sm_i->mMapMaxAVMA) {
+        // |aSecMap| needs to be inserted immediately before mSecMaps[i].
+        break;
+      }
+    }
+    MOZ_ASSERT(i <= num_secMaps);
+    if (i == num_secMaps) {
+      // It goes at the end.
+      mSecMaps.push_back(std::move(aSecMap));
+    } else {
+      std::vector<mozilla::UniquePtr<SecMap>>::iterator iter =
+          mSecMaps.begin() + i;
+      mSecMaps.insert(iter, std::move(aSecMap));
+    }
+    char buf[100];
+    SprintfLiteral(buf, "AddSecMap: now have %d SecMaps\n",
+                   (int)mSecMaps.size());
+    buf[sizeof(buf) - 1] = 0;
+    mLog(buf);
+  }
+
+  // Remove and delete any SecMaps in the mapping, that intersect
+  // with the specified address range.
+  void RemoveSecMapsInRange(uintptr_t avma_min, uintptr_t avma_max) {
+    MOZ_ASSERT(avma_min <= avma_max);
+    size_t num_secMaps = mSecMaps.size();
+    if (num_secMaps > 0) {
+      intptr_t i;
+      // Iterate from end to start over the vector, so as to ensure
+      // that the special case where |avma_min| and |avma_max| denote
+      // the entire address space, can be completed in time proportional
+      // to the number of elements in the map.
+      for (i = (intptr_t)num_secMaps - 1; i >= 0; i--) {
+        mozilla::UniquePtr<SecMap>& sm_i = mSecMaps[i];
+        if (sm_i->mMapMaxAVMA < avma_min || avma_max < sm_i->mMapMinAVMA) {
+          // There's no overlap.  Move on.
+          continue;
+        }
+        // We need to remove mSecMaps[i] and slide all those above it
+        // downwards to cover the hole.
+        mSecMaps.erase(mSecMaps.begin() + i);
+      }
+    }
+  }
+
+  // Return the number of currently contained SecMaps.
+  size_t CountSecMaps() { return mSecMaps.size(); }
+
+  size_t SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const {
+    size_t n = aMallocSizeOf(this);
+
+    // It's conceivable that this call would be unsafe with some
+    // implementations of std::vector, but it seems to be working for now...
+    n += aMallocSizeOf(mSecMaps.data());
+
+    for (size_t i = 0; i < mSecMaps.size(); i++) {
+      n += mSecMaps[i]->SizeOfIncludingThis(aMallocSizeOf);
+    }
+
+    return n;
+  }
+
+ private:
+  // RUNS IN NO-MALLOC CONTEXT
+  SecMap* FindSecMap(uintptr_t ia) {
+    // Binary search mSecMaps to find one that brackets |ia|.
+    // lo and hi need to be signed, else the loop termination tests
+    // don't work properly.
+    long int lo = 0;
+    long int hi = (long int)mSecMaps.size() - 1;
+    while (true) {
+      // current unsearched space is from lo to hi, inclusive.
+      if (lo > hi) {
+        // not found
+        return nullptr;
+      }
+      long int mid = lo + ((hi - lo) / 2);
+      mozilla::UniquePtr<SecMap>& mid_secMap = mSecMaps[mid];
+      uintptr_t mid_minAddr = mid_secMap->mMapMinAVMA;
+      uintptr_t mid_maxAddr = mid_secMap->mMapMaxAVMA;
+      if (ia < mid_minAddr) {
+        hi = mid - 1;
+        continue;
+      }
+      if (ia > mid_maxAddr) {
+        lo = mid + 1;
+        continue;
+      }
+      MOZ_ASSERT(mid_minAddr <= ia && ia <= mid_maxAddr);
+      return mid_secMap.get();
+    }
+    // NOTREACHED
+  }
+
+ private:
+  // sorted array of per-object ranges, non overlapping, non empty
+  std::vector<mozilla::UniquePtr<SecMap>> mSecMaps;
+
+  // a logging sink, for debugging.
+  void (*mLog)(const char*);
+};
+
+////////////////////////////////////////////////////////////////
+// LUL                                                        //
+////////////////////////////////////////////////////////////////
+
+#define LUL_LOG(_str)                                           \
+  do {                                                          \
+    char buf[200];                                              \
+    SprintfLiteral(buf, "LUL: pid %d tid %d lul-obj %p: %s",    \
+                   profiler_current_process_id(),               \
+                   profiler_current_thread_id(), this, (_str)); \
+    buf[sizeof(buf) - 1] = 0;                                   \
+    mLog(buf);                                                  \
+  } while (0)
+
+LUL::LUL(void (*aLog)(const char*))
+    : mLog(aLog),
+      mAdminMode(true),
+      mAdminThreadId(profiler_current_thread_id()),
+      mPriMap(new PriMap(aLog)),
+      mSegArray(new SegArray()),
+      mUSU(new UniqueStringUniverse()) {
+  LUL_LOG("LUL::LUL: Created object");
+}
+
+LUL::~LUL() {
+  LUL_LOG("LUL::~LUL: Destroyed object");
+  delete mPriMap;
+  delete mSegArray;
+  mLog = nullptr;
+  delete mUSU;
+}
+
+void LUL::MaybeShowStats() {
+  // This is racey in the sense that it can't guarantee that
+  //   n_new == n_new_Context + n_new_CFI + n_new_Scanned
+  // if it should happen that mStats is updated by some other thread
+  // in between computation of n_new and n_new_{Context,CFI,FP}.
+  // But it's just stats printing, so we don't really care.
+  uint32_t n_new = mStats - mStatsPrevious;
+  if (n_new >= 5000) {
+    uint32_t n_new_Context = mStats.mContext - mStatsPrevious.mContext;
+    uint32_t n_new_CFI = mStats.mCFI - mStatsPrevious.mCFI;
+    uint32_t n_new_FP = mStats.mFP - mStatsPrevious.mFP;
+    mStatsPrevious = mStats;
+    char buf[200];
+    SprintfLiteral(buf,
+                   "LUL frame stats: TOTAL %5u"
+                   "    CTX %4u    CFI %4u    FP %4u",
+                   n_new, n_new_Context, n_new_CFI, n_new_FP);
+    buf[sizeof(buf) - 1] = 0;
+    mLog(buf);
+  }
+}
+
+size_t LUL::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const {
+  size_t n = aMallocSizeOf(this);
+  n += mPriMap->SizeOfIncludingThis(aMallocSizeOf);
+
+  // Measurement of the following members may be added later if DMD finds it
+  // is worthwhile:
+  // - mSegArray
+  // - mUSU
+
+  return n;
+}
+
+void LUL::EnableUnwinding() {
+  LUL_LOG("LUL::EnableUnwinding");
+  // Don't assert for Admin mode here.  That is, tolerate a call here
+  // if we are already in Unwinding mode.
+  MOZ_RELEASE_ASSERT(profiler_current_thread_id() == mAdminThreadId);
+
+  mAdminMode = false;
+}
+
+void LUL::NotifyAfterMap(uintptr_t aRXavma, size_t aSize, const char* aFileName,
+                         const void* aMappedImage) {
+  MOZ_RELEASE_ASSERT(mAdminMode);
+  MOZ_RELEASE_ASSERT(profiler_current_thread_id() == mAdminThreadId);
+
+  mLog(":\n");
+  char buf[200];
+  SprintfLiteral(buf, "NotifyMap %llx %llu %s\n",
+                 (unsigned long long int)aRXavma, (unsigned long long int)aSize,
+                 aFileName);
+  buf[sizeof(buf) - 1] = 0;
+  mLog(buf);
+
+  // We can't have a SecMap covering more than 2^32-1 bytes of address space.
+  // See the definition of SecMap for why.  Rather than crash the system, just
+  // limit the SecMap's size accordingly.  This case is never actually
+  // expected to happen.
+  if (((unsigned long long int)aSize) > 0xFFFFFFFFULL) {
+    aSize = (uintptr_t)0xFFFFFFFF;
+  }
+  MOZ_RELEASE_ASSERT(aSize <= 0xFFFFFFFF);
+
+  // Ignore obviously-stupid notifications.
+  if (aSize > 0) {
+    // Here's a new mapping, for this object.
+    mozilla::UniquePtr<SecMap> smap =
+        mozilla::MakeUnique<SecMap>(aRXavma, (uint32_t)aSize, mLog);
+
+    // Read CFI or EXIDX unwind data into |smap|.
+    if (!aMappedImage) {
+      (void)lul::ReadSymbolData(string(aFileName), std::vector<string>(),
+                                smap.get(), (void*)aRXavma, aSize, mUSU, mLog);
+    } else {
+      (void)lul::ReadSymbolDataInternal(
+          (const uint8_t*)aMappedImage, string(aFileName),
+          std::vector<string>(), smap.get(), (void*)aRXavma, aSize, mUSU, mLog);
+    }
+
+    mLog("NotifyMap .. preparing entries\n");
+
+    smap->PrepareRuleSets();
+
+    SprintfLiteral(buf, "NotifyMap got %lld entries\n",
+                   (long long int)smap->Size());
+    buf[sizeof(buf) - 1] = 0;
+    mLog(buf);
+
+    // Add it to the primary map (the top level set of mapped objects).
+    mPriMap->AddSecMap(std::move(smap));
+
+    // Tell the segment array about the mapping, so that the stack
+    // scan and __kernel_syscall mechanisms know where valid code is.
+    mSegArray->add(aRXavma, aRXavma + aSize - 1, true);
+  }
+}
+
+void LUL::NotifyExecutableArea(uintptr_t aRXavma, size_t aSize) {
+  MOZ_RELEASE_ASSERT(mAdminMode);
+  MOZ_RELEASE_ASSERT(profiler_current_thread_id() == mAdminThreadId);
+
+  mLog(":\n");
+  char buf[200];
+  SprintfLiteral(buf, "NotifyExecutableArea %llx %llu\n",
+                 (unsigned long long int)aRXavma,
+                 (unsigned long long int)aSize);
+  buf[sizeof(buf) - 1] = 0;
+  mLog(buf);
+
+  // Ignore obviously-stupid notifications.
+  if (aSize > 0) {
+    // Tell the segment array about the mapping, so that the stack
+    // scan and __kernel_syscall mechanisms know where valid code is.
+    mSegArray->add(aRXavma, aRXavma + aSize - 1, true);
+  }
+}
+
+void LUL::NotifyBeforeUnmap(uintptr_t aRXavmaMin, uintptr_t aRXavmaMax) {
+  MOZ_RELEASE_ASSERT(mAdminMode);
+  MOZ_RELEASE_ASSERT(profiler_current_thread_id() == mAdminThreadId);
+
+  mLog(":\n");
+  char buf[100];
+  SprintfLiteral(buf, "NotifyUnmap %016llx-%016llx\n",
+                 (unsigned long long int)aRXavmaMin,
+                 (unsigned long long int)aRXavmaMax);
+  buf[sizeof(buf) - 1] = 0;
+  mLog(buf);
+
+  MOZ_ASSERT(aRXavmaMin <= aRXavmaMax);
+
+  // Remove from the primary map, any secondary maps that intersect
+  // with the address range.  Also delete the secondary maps.
+  mPriMap->RemoveSecMapsInRange(aRXavmaMin, aRXavmaMax);
+
+  // Tell the segment array that the address range no longer
+  // contains valid code.
+  mSegArray->add(aRXavmaMin, aRXavmaMax, false);
+
+  SprintfLiteral(buf, "NotifyUnmap: now have %d SecMaps\n",
+                 (int)mPriMap->CountSecMaps());
+  buf[sizeof(buf) - 1] = 0;
+  mLog(buf);
+}
+
+size_t LUL::CountMappings() {
+  MOZ_RELEASE_ASSERT(mAdminMode);
+  MOZ_RELEASE_ASSERT(profiler_current_thread_id() == mAdminThreadId);
+
+  return mPriMap->CountSecMaps();
+}
+
+// RUNS IN NO-MALLOC CONTEXT
+static TaggedUWord DerefTUW(TaggedUWord aAddr, const StackImage* aStackImg) {
+  if (!aAddr.Valid()) {
+    return TaggedUWord();
+  }
+
+  // Lower limit check.  |aAddr.Value()| is the lowest requested address
+  // and |aStackImg->mStartAvma| is the lowest address we actually have,
+  // so the comparison is straightforward.
+  if (aAddr.Value() < aStackImg->mStartAvma) {
+    return TaggedUWord();
+  }
+
+  // Upper limit check.  We must compute the highest requested address
+  // and the highest address we actually have, but being careful to
+  // avoid overflow.  In particular if |aAddr| is 0xFFF...FFF or the
+  // 3/7 values below that, then we will get overflow.  See bug #1245477.
+  typedef CheckedInt<uintptr_t> CheckedUWord;
+  CheckedUWord highest_requested_plus_one =
+      CheckedUWord(aAddr.Value()) + CheckedUWord(sizeof(uintptr_t));
+  CheckedUWord highest_available_plus_one =
+      CheckedUWord(aStackImg->mStartAvma) + CheckedUWord(aStackImg->mLen);
+  if (!highest_requested_plus_one.isValid()     // overflow?
+      || !highest_available_plus_one.isValid()  // overflow?
+      || (highest_requested_plus_one.value() >
+          highest_available_plus_one.value())) {  // in range?
+    return TaggedUWord();
+  }
+
+  return TaggedUWord(
+      *(uintptr_t*)(&aStackImg
+                         ->mContents[aAddr.Value() - aStackImg->mStartAvma]));
+}
+
+// RUNS IN NO-MALLOC CONTEXT
+static TaggedUWord EvaluateReg(int16_t aReg, const UnwindRegs* aOldRegs,
+                               TaggedUWord aCFA) {
+  switch (aReg) {
+    case DW_REG_CFA:
+      return aCFA;
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+    case DW_REG_INTEL_XBP:
+      return aOldRegs->xbp;
+    case DW_REG_INTEL_XSP:
+      return aOldRegs->xsp;
+    case DW_REG_INTEL_XIP:
+      return aOldRegs->xip;
+#elif defined(GP_ARCH_arm)
+    case DW_REG_ARM_R7:
+      return aOldRegs->r7;
+    case DW_REG_ARM_R11:
+      return aOldRegs->r11;
+    case DW_REG_ARM_R12:
+      return aOldRegs->r12;
+    case DW_REG_ARM_R13:
+      return aOldRegs->r13;
+    case DW_REG_ARM_R14:
+      return aOldRegs->r14;
+    case DW_REG_ARM_R15:
+      return aOldRegs->r15;
+#elif defined(GP_ARCH_arm64)
+    case DW_REG_AARCH64_X29:
+      return aOldRegs->x29;
+    case DW_REG_AARCH64_X30:
+      return aOldRegs->x30;
+    case DW_REG_AARCH64_SP:
+      return aOldRegs->sp;
+#elif defined(GP_ARCH_mips64)
+    case DW_REG_MIPS_SP:
+      return aOldRegs->sp;
+    case DW_REG_MIPS_FP:
+      return aOldRegs->fp;
+    case DW_REG_MIPS_PC:
+      return aOldRegs->pc;
+#else
+#  error "Unsupported arch"
+#endif
+    default:
+      MOZ_ASSERT(0);
+      return TaggedUWord();
+  }
+}
+
+// RUNS IN NO-MALLOC CONTEXT
+// See prototype for comment.
+TaggedUWord EvaluatePfxExpr(int32_t start, const UnwindRegs* aOldRegs,
+                            TaggedUWord aCFA, const StackImage* aStackImg,
+                            const vector<PfxInstr>& aPfxInstrs) {
+  // A small evaluation stack, and a stack pointer, which points to
+  // the highest numbered in-use element.
+  const int N_STACK = 10;
+  TaggedUWord stack[N_STACK];
+  int stackPointer = -1;
+  for (int i = 0; i < N_STACK; i++) stack[i] = TaggedUWord();
+
+#define PUSH(_tuw)                                             \
+  do {                                                         \
+    if (stackPointer >= N_STACK - 1) goto fail; /* overflow */ \
+    stack[++stackPointer] = (_tuw);                            \
+  } while (0)
+
+#define POP(_lval)                                   \
+  do {                                               \
+    if (stackPointer < 0) goto fail; /* underflow */ \
+    _lval = stack[stackPointer--];                   \
+  } while (0)
+
+  // Cursor in the instruction sequence.
+  size_t curr = start + 1;
+
+  // Check the start point is sane.
+  size_t nInstrs = aPfxInstrs.size();
+  if (start < 0 || (size_t)start >= nInstrs) goto fail;
+
+  {
+    // The instruction sequence must start with PX_Start.  If not,
+    // something is seriously wrong.
+    PfxInstr first = aPfxInstrs[start];
+    if (first.mOpcode != PX_Start) goto fail;
+
+    // Push the CFA on the stack to start with (or not), as required by
+    // the original DW_OP_*expression* CFI.
+    if (first.mOperand != 0) PUSH(aCFA);
+  }
+
+  while (true) {
+    if (curr >= nInstrs) goto fail;  // ran off the end of the sequence
+
+    PfxInstr pfxi = aPfxInstrs[curr++];
+    if (pfxi.mOpcode == PX_End) break;  // we're done
+
+    switch (pfxi.mOpcode) {
+      case PX_Start:
+        // This should appear only at the start of the sequence.
+        goto fail;
+      case PX_End:
+        // We just took care of that, so we shouldn't see it again.
+        MOZ_ASSERT(0);
+        goto fail;
+      case PX_SImm32:
+        PUSH(TaggedUWord((intptr_t)pfxi.mOperand));
+        break;
+      case PX_DwReg: {
+        DW_REG_NUMBER reg = (DW_REG_NUMBER)pfxi.mOperand;
+        MOZ_ASSERT(reg != DW_REG_CFA);
+        PUSH(EvaluateReg(reg, aOldRegs, aCFA));
+        break;
+      }
+      case PX_Deref: {
+        TaggedUWord addr;
+        POP(addr);
+        PUSH(DerefTUW(addr, aStackImg));
+        break;
+      }
+      case PX_Add: {
+        TaggedUWord x, y;
+        POP(x);
+        POP(y);
+        PUSH(y + x);
+        break;
+      }
+      case PX_Sub: {
+        TaggedUWord x, y;
+        POP(x);
+        POP(y);
+        PUSH(y - x);
+        break;
+      }
+      case PX_And: {
+        TaggedUWord x, y;
+        POP(x);
+        POP(y);
+        PUSH(y & x);
+        break;
+      }
+      case PX_Or: {
+        TaggedUWord x, y;
+        POP(x);
+        POP(y);
+        PUSH(y | x);
+        break;
+      }
+      case PX_CmpGES: {
+        TaggedUWord x, y;
+        POP(x);
+        POP(y);
+        PUSH(y.CmpGEs(x));
+        break;
+      }
+      case PX_Shl: {
+        TaggedUWord x, y;
+        POP(x);
+        POP(y);
+        PUSH(y << x);
+        break;
+      }
+      default:
+        MOZ_ASSERT(0);
+        goto fail;
+    }
+  }  // while (true)
+
+  // Evaluation finished.  The top value on the stack is the result.
+  if (stackPointer >= 0) {
+    return stack[stackPointer];
+  }
+  // Else fall through
+
+fail:
+  return TaggedUWord();
+
+#undef PUSH
+#undef POP
+}
+
+// RUNS IN NO-MALLOC CONTEXT
+TaggedUWord LExpr::EvaluateExpr(const UnwindRegs* aOldRegs, TaggedUWord aCFA,
+                                const StackImage* aStackImg,
+                                const vector<PfxInstr>* aPfxInstrs) const {
+  switch (mHow) {
+    case UNKNOWN:
+      return TaggedUWord();
+    case NODEREF: {
+      TaggedUWord tuw = EvaluateReg(mReg, aOldRegs, aCFA);
+      tuw = tuw + TaggedUWord((intptr_t)mOffset);
+      return tuw;
+    }
+    case DEREF: {
+      TaggedUWord tuw = EvaluateReg(mReg, aOldRegs, aCFA);
+      tuw = tuw + TaggedUWord((intptr_t)mOffset);
+      return DerefTUW(tuw, aStackImg);
+    }
+    case PFXEXPR: {
+      MOZ_ASSERT(aPfxInstrs);
+      if (!aPfxInstrs) {
+        return TaggedUWord();
+      }
+      return EvaluatePfxExpr(mOffset, aOldRegs, aCFA, aStackImg, *aPfxInstrs);
+    }
+    default:
+      MOZ_ASSERT(0);
+      return TaggedUWord();
+  }
+}
+
+// RUNS IN NO-MALLOC CONTEXT
+static void UseRuleSet(/*MOD*/ UnwindRegs* aRegs, const StackImage* aStackImg,
+                       const RuleSet* aRS, const vector<PfxInstr>* aPfxInstrs) {
+  // Take a copy of regs, since we'll need to refer to the old values
+  // whilst computing the new ones.
+  UnwindRegs old_regs = *aRegs;
+
+  // Mark all the current register values as invalid, so that the
+  // caller can see, on our return, which ones have been computed
+  // anew.  If we don't even manage to compute a new PC value, then
+  // the caller will have to abandon the unwind.
+  // FIXME: Create and use instead: aRegs->SetAllInvalid();
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+  aRegs->xbp = TaggedUWord();
+  aRegs->xsp = TaggedUWord();
+  aRegs->xip = TaggedUWord();
+#elif defined(GP_ARCH_arm)
+  aRegs->r7 = TaggedUWord();
+  aRegs->r11 = TaggedUWord();
+  aRegs->r12 = TaggedUWord();
+  aRegs->r13 = TaggedUWord();
+  aRegs->r14 = TaggedUWord();
+  aRegs->r15 = TaggedUWord();
+#elif defined(GP_ARCH_arm64)
+  aRegs->x29 = TaggedUWord();
+  aRegs->x30 = TaggedUWord();
+  aRegs->sp = TaggedUWord();
+  aRegs->pc = TaggedUWord();
+#elif defined(GP_ARCH_mips64)
+  aRegs->sp = TaggedUWord();
+  aRegs->fp = TaggedUWord();
+  aRegs->pc = TaggedUWord();
+#else
+#  error "Unsupported arch"
+#endif
+
+  // This is generally useful.
+  const TaggedUWord inval = TaggedUWord();
+
+  // First, compute the CFA.
+  TaggedUWord cfa = aRS->mCfaExpr.EvaluateExpr(&old_regs, inval /*old cfa*/,
+                                               aStackImg, aPfxInstrs);
+
+  // If we didn't manage to compute the CFA, well .. that's ungood,
+  // but keep going anyway.  It'll be OK provided none of the register
+  // value rules mention the CFA.  In any case, compute the new values
+  // for each register that we're tracking.
+
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+  aRegs->xbp =
+      aRS->mXbpExpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->xsp =
+      aRS->mXspExpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->xip =
+      aRS->mXipExpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+#elif defined(GP_ARCH_arm)
+  aRegs->r7 = aRS->mR7expr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->r11 =
+      aRS->mR11expr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->r12 =
+      aRS->mR12expr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->r13 =
+      aRS->mR13expr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->r14 =
+      aRS->mR14expr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->r15 =
+      aRS->mR15expr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+#elif defined(GP_ARCH_arm64)
+  aRegs->x29 =
+      aRS->mX29expr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->x30 =
+      aRS->mX30expr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->sp = aRS->mSPexpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+#elif defined(GP_ARCH_mips64)
+  aRegs->sp = aRS->mSPexpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->fp = aRS->mFPexpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+  aRegs->pc = aRS->mPCexpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
+#else
+#  error "Unsupported arch"
+#endif
+
+  // We're done.  Any regs for which we didn't manage to compute a
+  // new value will now be marked as invalid.
+}
+
+// RUNS IN NO-MALLOC CONTEXT
+void LUL::Unwind(/*OUT*/ uintptr_t* aFramePCs,
+                 /*OUT*/ uintptr_t* aFrameSPs,
+                 /*OUT*/ size_t* aFramesUsed,
+                 /*OUT*/ size_t* aFramePointerFramesAcquired,
+                 size_t aFramesAvail, UnwindRegs* aStartRegs,
+                 StackImage* aStackImg) {
+  MOZ_RELEASE_ASSERT(!mAdminMode);
+
+  /////////////////////////////////////////////////////////
+  // BEGIN UNWIND
+
+  *aFramesUsed = 0;
+
+  UnwindRegs regs = *aStartRegs;
+  TaggedUWord last_valid_sp = TaggedUWord();
+
+  while (true) {
+    if (DEBUG_MAIN) {
+      char buf[300];
+      mLog("\n");
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+      SprintfLiteral(
+          buf, "LoopTop: rip %d/%llx  rsp %d/%llx  rbp %d/%llx\n",
+          (int)regs.xip.Valid(), (unsigned long long int)regs.xip.Value(),
+          (int)regs.xsp.Valid(), (unsigned long long int)regs.xsp.Value(),
+          (int)regs.xbp.Valid(), (unsigned long long int)regs.xbp.Value());
+      buf[sizeof(buf) - 1] = 0;
+      mLog(buf);
+#elif defined(GP_ARCH_arm)
+      SprintfLiteral(
+          buf,
+          "LoopTop: r15 %d/%llx  r7 %d/%llx  r11 %d/%llx"
+          "  r12 %d/%llx  r13 %d/%llx  r14 %d/%llx\n",
+          (int)regs.r15.Valid(), (unsigned long long int)regs.r15.Value(),
+          (int)regs.r7.Valid(), (unsigned long long int)regs.r7.Value(),
+          (int)regs.r11.Valid(), (unsigned long long int)regs.r11.Value(),
+          (int)regs.r12.Valid(), (unsigned long long int)regs.r12.Value(),
+          (int)regs.r13.Valid(), (unsigned long long int)regs.r13.Value(),
+          (int)regs.r14.Valid(), (unsigned long long int)regs.r14.Value());
+      buf[sizeof(buf) - 1] = 0;
+      mLog(buf);
+#elif defined(GP_ARCH_arm64)
+      SprintfLiteral(
+          buf,
+          "LoopTop: pc %d/%llx  x29 %d/%llx  x30 %d/%llx"
+          "  sp %d/%llx\n",
+          (int)regs.pc.Valid(), (unsigned long long int)regs.pc.Value(),
+          (int)regs.x29.Valid(), (unsigned long long int)regs.x29.Value(),
+          (int)regs.x30.Valid(), (unsigned long long int)regs.x30.Value(),
+          (int)regs.sp.Valid(), (unsigned long long int)regs.sp.Value());
+      buf[sizeof(buf) - 1] = 0;
+      mLog(buf);
+#elif defined(GP_ARCH_mips64)
+      SprintfLiteral(
+          buf, "LoopTop: pc %d/%llx  sp %d/%llx  fp %d/%llx\n",
+          (int)regs.pc.Valid(), (unsigned long long int)regs.pc.Value(),
+          (int)regs.sp.Valid(), (unsigned long long int)regs.sp.Value(),
+          (int)regs.fp.Valid(), (unsigned long long int)regs.fp.Value());
+      buf[sizeof(buf) - 1] = 0;
+      mLog(buf);
+#else
+#  error "Unsupported arch"
+#endif
+    }
+
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+    TaggedUWord ia = regs.xip;
+    TaggedUWord sp = regs.xsp;
+#elif defined(GP_ARCH_arm)
+    TaggedUWord ia = (*aFramesUsed == 0 ? regs.r15 : regs.r14);
+    TaggedUWord sp = regs.r13;
+#elif defined(GP_ARCH_arm64)
+    TaggedUWord ia = (*aFramesUsed == 0 ? regs.pc : regs.x30);
+    TaggedUWord sp = regs.sp;
+#elif defined(GP_ARCH_mips64)
+    TaggedUWord ia = regs.pc;
+    TaggedUWord sp = regs.sp;
+#else
+#  error "Unsupported arch"
+#endif
+
+    if (*aFramesUsed >= aFramesAvail) {
+      break;
+    }
+
+    // If we don't have a valid value for the PC, give up.
+    if (!ia.Valid()) {
+      break;
+    }
+
+    // If this is the innermost frame, record the SP value, which
+    // presumably is valid.  If this isn't the innermost frame, and we
+    // have a valid SP value, check that its SP value isn't less that
+    // the one we've seen so far, so as to catch potential SP value
+    // cycles.
+    if (*aFramesUsed == 0) {
+      last_valid_sp = sp;
+    } else {
+      MOZ_ASSERT(last_valid_sp.Valid());
+      if (sp.Valid()) {
+        if (sp.Value() < last_valid_sp.Value()) {
+          // Hmm, SP going in the wrong direction.  Let's stop.
+          break;
+        }
+        // Remember where we got to.
+        last_valid_sp = sp;
+      }
+    }
+
+    // For the innermost frame, the IA value is what we need.  For all
+    // other frames, it's actually the return address, so back up one
+    // byte so as to get it into the calling instruction.
+    aFramePCs[*aFramesUsed] = ia.Value() - (*aFramesUsed == 0 ? 0 : 1);
+    aFrameSPs[*aFramesUsed] = sp.Valid() ? sp.Value() : 0;
+    (*aFramesUsed)++;
+
+    // Find the RuleSet for the current IA, if any.  This will also
+    // query the backing (secondary) maps if it isn't found in the
+    // thread-local cache.
+
+    // If this isn't the innermost frame, back up into the calling insn.
+    if (*aFramesUsed > 1) {
+      ia = ia + TaggedUWord((uintptr_t)(-1));
+    }
+
+    pair<const RuleSet*, const vector<PfxInstr>*> ruleset_and_pfxinstrs =
+        mPriMap->Lookup(ia.Value());
+    const RuleSet* ruleset = ruleset_and_pfxinstrs.first;
+    const vector<PfxInstr>* pfxinstrs = ruleset_and_pfxinstrs.second;
+
+    if (DEBUG_MAIN) {
+      char buf[100];
+      SprintfLiteral(buf, "ruleset for 0x%llx = %p\n",
+                     (unsigned long long int)ia.Value(), ruleset);
+      buf[sizeof(buf) - 1] = 0;
+      mLog(buf);
+    }
+
+#if defined(GP_PLAT_x86_android) || defined(GP_PLAT_x86_linux)
+    /////////////////////////////////////////////
+    ////
+    // On 32 bit x86-linux, syscalls are often done via the VDSO
+    // function __kernel_vsyscall, which doesn't have a corresponding
+    // object that we can read debuginfo from.  That effectively kills
+    // off all stack traces for threads blocked in syscalls.  Hence
+    // special-case by looking at the code surrounding the program
+    // counter.
+    //
+    // 0xf7757420 <__kernel_vsyscall+0>:	push   %ecx
+    // 0xf7757421 <__kernel_vsyscall+1>:	push   %edx
+    // 0xf7757422 <__kernel_vsyscall+2>:	push   %ebp
+    // 0xf7757423 <__kernel_vsyscall+3>:	mov    %esp,%ebp
+    // 0xf7757425 <__kernel_vsyscall+5>:	sysenter
+    // 0xf7757427 <__kernel_vsyscall+7>:	nop
+    // 0xf7757428 <__kernel_vsyscall+8>:	nop
+    // 0xf7757429 <__kernel_vsyscall+9>:	nop
+    // 0xf775742a <__kernel_vsyscall+10>:	nop
+    // 0xf775742b <__kernel_vsyscall+11>:	nop
+    // 0xf775742c <__kernel_vsyscall+12>:	nop
+    // 0xf775742d <__kernel_vsyscall+13>:	nop
+    // 0xf775742e <__kernel_vsyscall+14>:	int    $0x80
+    // 0xf7757430 <__kernel_vsyscall+16>:	pop    %ebp
+    // 0xf7757431 <__kernel_vsyscall+17>:	pop    %edx
+    // 0xf7757432 <__kernel_vsyscall+18>:	pop    %ecx
+    // 0xf7757433 <__kernel_vsyscall+19>:	ret
+    //
+    // In cases where the sampled thread is blocked in a syscall, its
+    // program counter will point at "pop %ebp".  Hence we look for
+    // the sequence "int $0x80; pop %ebp; pop %edx; pop %ecx; ret", and
+    // the corresponding register-recovery actions are:
+    //    new_ebp = *(old_esp + 0)
+    //    new eip = *(old_esp + 12)
+    //    new_esp = old_esp + 16
+    //
+    // It may also be the case that the program counter points two
+    // nops before the "int $0x80", viz, is __kernel_vsyscall+12, in
+    // the case where the syscall has been restarted but the thread
+    // hasn't been rescheduled.  The code below doesn't handle that;
+    // it could easily be made to.
+    //
+    if (!ruleset && *aFramesUsed == 1 && ia.Valid() && sp.Valid()) {
+      uintptr_t insns_min, insns_max;
+      uintptr_t eip = ia.Value();
+      bool b = mSegArray->getBoundingCodeSegment(&insns_min, &insns_max, eip);
+      if (b && eip - 2 >= insns_min && eip + 3 <= insns_max) {
+        uint8_t* eipC = (uint8_t*)eip;
+        if (eipC[-2] == 0xCD && eipC[-1] == 0x80 && eipC[0] == 0x5D &&
+            eipC[1] == 0x5A && eipC[2] == 0x59 && eipC[3] == 0xC3) {
+          TaggedUWord sp_plus_0 = sp;
+          TaggedUWord sp_plus_12 = sp;
+          TaggedUWord sp_plus_16 = sp;
+          sp_plus_12 = sp_plus_12 + TaggedUWord(12);
+          sp_plus_16 = sp_plus_16 + TaggedUWord(16);
+          TaggedUWord new_ebp = DerefTUW(sp_plus_0, aStackImg);
+          TaggedUWord new_eip = DerefTUW(sp_plus_12, aStackImg);
+          TaggedUWord new_esp = sp_plus_16;
+          if (new_ebp.Valid() && new_eip.Valid() && new_esp.Valid()) {
+            regs.xbp = new_ebp;
+            regs.xip = new_eip;
+            regs.xsp = new_esp;
+            continue;
+          }
+        }
+      }
+    }
+    ////
+    /////////////////////////////////////////////
+#endif  // defined(GP_PLAT_x86_android) || defined(GP_PLAT_x86_linux)
+
+    // So, do we have a ruleset for this address?  If so, use it now.
+    if (ruleset) {
+      if (DEBUG_MAIN) {
+        ruleset->Print(ia.Value(), 1 /*bogus, but doesn't matter*/, mLog);
+        mLog("\n");
+      }
+      // Use the RuleSet to compute the registers for the previous
+      // frame.  |regs| is modified in-place.
+      UseRuleSet(&regs, aStackImg, ruleset, pfxinstrs);
+      continue;
+    }
+
+#if defined(GP_PLAT_amd64_linux) || defined(GP_PLAT_x86_linux) ||     \
+    defined(GP_PLAT_amd64_android) || defined(GP_PLAT_x86_android) || \
+    defined(GP_PLAT_amd64_freebsd)
+    // There's no RuleSet for the specified address.  On amd64/x86_linux, see if
+    // it's possible to recover the caller's frame by using the frame pointer.
+
+    // We seek to compute (new_IP, new_SP, new_BP) from (old_BP, stack image),
+    // and assume the following layout:
+    //
+    //                 <--- new_SP
+    //   +----------+
+    //   |  new_IP  |  (return address)
+    //   +----------+
+    //   |  new_BP  |  <--- old_BP
+    //   +----------+
+    //   |   ....   |
+    //   |   ....   |
+    //   |   ....   |
+    //   +----------+  <---- old_SP (arbitrary, but must be <= old_BP)
+
+    const size_t wordSzB = sizeof(uintptr_t);
+    TaggedUWord old_xsp = regs.xsp;
+
+    // points at new_BP ?
+    TaggedUWord old_xbp = regs.xbp;
+    // points at new_IP ?
+    TaggedUWord old_xbp_plus1 = regs.xbp + TaggedUWord(1 * wordSzB);
+    // is the new_SP ?
+    TaggedUWord old_xbp_plus2 = regs.xbp + TaggedUWord(2 * wordSzB);
+
+    if (old_xbp.Valid() && old_xbp.IsAligned() && old_xsp.Valid() &&
+        old_xsp.IsAligned() && old_xsp.Value() <= old_xbp.Value()) {
+      // We don't need to do any range, alignment or validity checks for
+      // addresses passed to DerefTUW, since that performs them itself, and
+      // returns an invalid value on failure.  Any such value will poison
+      // subsequent uses, and we do a final check for validity before putting
+      // the computed values into |regs|.
+      TaggedUWord new_xbp = DerefTUW(old_xbp, aStackImg);
+      if (new_xbp.Valid() && new_xbp.IsAligned() &&
+          old_xbp.Value() < new_xbp.Value()) {
+        TaggedUWord new_xip = DerefTUW(old_xbp_plus1, aStackImg);
+        TaggedUWord new_xsp = old_xbp_plus2;
+        if (new_xbp.Valid() && new_xip.Valid() && new_xsp.Valid()) {
+          regs.xbp = new_xbp;
+          regs.xip = new_xip;
+          regs.xsp = new_xsp;
+          (*aFramePointerFramesAcquired)++;
+          continue;
+        }
+      }
+    }
+#elif defined(GP_ARCH_arm64)
+    // Here is an example of generated code for prologue and epilogue..
+    //
+    // stp     x29, x30, [sp, #-16]!
+    // mov     x29, sp
+    // ...
+    // ldp     x29, x30, [sp], #16
+    // ret
+    //
+    // Next is another example of generated code.
+    //
+    // stp     x20, x19, [sp, #-32]!
+    // stp     x29, x30, [sp, #16]
+    // add     x29, sp, #0x10
+    // ...
+    // ldp     x29, x30, [sp, #16]
+    // ldp     x20, x19, [sp], #32
+    // ret
+    //
+    // Previous x29 and x30 register are stored in the address of x29 register.
+    // But since sp register value depends on local variables, we cannot compute
+    // previous sp register from current sp/fp/lr register and there is no
+    // regular rule for sp register in prologue. But since return address is lr
+    // register, if x29 is valid, we will get return address without sp
+    // register.
+    //
+    // So we assume the following layout that if no rule set. x29 is frame
+    // pointer, so we will be able to compute x29 and x30 .
+    //
+    //   +----------+  <--- new_sp (cannot compute)
+    //   |   ....   |
+    //   +----------+
+    //   |  new_lr  |  (return address)
+    //   +----------+
+    //   |  new_fp  |  <--- old_fp
+    //   +----------+
+    //   |   ....   |
+    //   |   ....   |
+    //   +----------+  <---- old_sp (arbitrary, but unused)
+
+    TaggedUWord old_fp = regs.x29;
+    if (old_fp.Valid() && old_fp.IsAligned() && last_valid_sp.Valid() &&
+        last_valid_sp.Value() <= old_fp.Value()) {
+      TaggedUWord new_fp = DerefTUW(old_fp, aStackImg);
+      if (new_fp.Valid() && new_fp.IsAligned() &&
+          old_fp.Value() < new_fp.Value()) {
+        TaggedUWord old_fp_plus1 = old_fp + TaggedUWord(8);
+        TaggedUWord new_lr = DerefTUW(old_fp_plus1, aStackImg);
+        if (new_lr.Valid()) {
+          regs.x29 = new_fp;
+          regs.x30 = new_lr;
+          // When using frame pointer to walk stack, we cannot compute sp
+          // register since we cannot compute sp register from fp/lr/sp
+          // register, and there is no regular rule to compute previous sp
+          // register. So mark as invalid.
+          regs.sp = TaggedUWord();
+          (*aFramePointerFramesAcquired)++;
+          continue;
+        }
+      }
+    }
+#endif  // defined(GP_PLAT_amd64_linux) || defined(GP_PLAT_x86_linux) ||
+        // defined(GP_PLAT_amd64_android) || defined(GP_PLAT_x86_android) ||
+        // defined(GP_PLAT_amd64_freebsd)
+
+    // We failed to recover a frame either using CFI or FP chasing, and we
+    // have no other ways to recover the frame.  So we have to give up.
+    break;
+
+  }  // top level unwind loop
+
+  // END UNWIND
+  /////////////////////////////////////////////////////////
+}
+
+////////////////////////////////////////////////////////////////
+// LUL Unit Testing                                           //
+////////////////////////////////////////////////////////////////
+
+static const int LUL_UNIT_TEST_STACK_SIZE = 32768;
+
+#if defined(GP_ARCH_mips64)
+static __attribute__((noinline)) unsigned long __getpc(void) {
+  unsigned long rtaddr;
+  __asm__ volatile("move %0, $31" : "=r"(rtaddr));
+  return rtaddr;
+}
+#endif
+
+// This function is innermost in the test call sequence.  It uses LUL
+// to unwind, and compares the result with the sequence specified in
+// the director string.  These need to agree in order for the test to
+// pass.  In order not to screw up the results, this function needs
+// to have a not-very big stack frame, since we're only presenting
+// the innermost LUL_UNIT_TEST_STACK_SIZE bytes of stack to LUL, and
+// that chunk unavoidably includes the frame for this function.
+//
+// This function must not be inlined into its callers.  Doing so will
+// cause the expected-vs-actual backtrace consistency checking to
+// fail.  Prints summary results to |aLUL|'s logging sink and also
+// returns a boolean indicating whether or not the test passed.
+static __attribute__((noinline)) bool GetAndCheckStackTrace(
+    LUL* aLUL, const char* dstring) {
+  // Get hold of the current unwind-start registers.
+  UnwindRegs startRegs;
+  memset(&startRegs, 0, sizeof(startRegs));
+#if defined(GP_ARCH_amd64)
+  volatile uintptr_t block[3];
+  MOZ_ASSERT(sizeof(block) == 24);
+  __asm__ __volatile__(
+      "leaq 0(%%rip), %%r15"
+      "\n\t"
+      "movq %%r15, 0(%0)"
+      "\n\t"
+      "movq %%rsp, 8(%0)"
+      "\n\t"
+      "movq %%rbp, 16(%0)"
+      "\n"
+      :
+      : "r"(&block[0])
+      : "memory", "r15");
+  startRegs.xip = TaggedUWord(block[0]);
+  startRegs.xsp = TaggedUWord(block[1]);
+  startRegs.xbp = TaggedUWord(block[2]);
+  const uintptr_t REDZONE_SIZE = 128;
+  uintptr_t start = block[1] - REDZONE_SIZE;
+#elif defined(GP_PLAT_x86_linux) || defined(GP_PLAT_x86_android)
+  volatile uintptr_t block[3];
+  MOZ_ASSERT(sizeof(block) == 12);
+  __asm__ __volatile__(
+      ".byte 0xE8,0x00,0x00,0x00,0x00" /*call next insn*/
+      "\n\t"
+      "popl %%edi"
+      "\n\t"
+      "movl %%edi, 0(%0)"
+      "\n\t"
+      "movl %%esp, 4(%0)"
+      "\n\t"
+      "movl %%ebp, 8(%0)"
+      "\n"
+      :
+      : "r"(&block[0])
+      : "memory", "edi");
+  startRegs.xip = TaggedUWord(block[0]);
+  startRegs.xsp = TaggedUWord(block[1]);
+  startRegs.xbp = TaggedUWord(block[2]);
+  const uintptr_t REDZONE_SIZE = 0;
+  uintptr_t start = block[1] - REDZONE_SIZE;
+#elif defined(GP_PLAT_arm_linux) || defined(GP_PLAT_arm_android)
+  volatile uintptr_t block[6];
+  MOZ_ASSERT(sizeof(block) == 24);
+  __asm__ __volatile__(
+      "mov r0, r15"
+      "\n\t"
+      "str r0,  [%0, #0]"
+      "\n\t"
+      "str r14, [%0, #4]"
+      "\n\t"
+      "str r13, [%0, #8]"
+      "\n\t"
+      "str r12, [%0, #12]"
+      "\n\t"
+      "str r11, [%0, #16]"
+      "\n\t"
+      "str r7,  [%0, #20]"
+      "\n"
+      :
+      : "r"(&block[0])
+      : "memory", "r0");
+  startRegs.r15 = TaggedUWord(block[0]);
+  startRegs.r14 = TaggedUWord(block[1]);
+  startRegs.r13 = TaggedUWord(block[2]);
+  startRegs.r12 = TaggedUWord(block[3]);
+  startRegs.r11 = TaggedUWord(block[4]);
+  startRegs.r7 = TaggedUWord(block[5]);
+  const uintptr_t REDZONE_SIZE = 0;
+  uintptr_t start = block[1] - REDZONE_SIZE;
+#elif defined(GP_ARCH_arm64)
+  volatile uintptr_t block[4];
+  MOZ_ASSERT(sizeof(block) == 32);
+  __asm__ __volatile__(
+      "adr x0, . \n\t"
+      "str x0, [%0, #0] \n\t"
+      "str x29, [%0, #8] \n\t"
+      "str x30, [%0, #16] \n\t"
+      "mov x0, sp \n\t"
+      "str x0, [%0, #24] \n\t"
+      :
+      : "r"(&block[0])
+      : "memory", "x0");
+  startRegs.pc = TaggedUWord(block[0]);
+  startRegs.x29 = TaggedUWord(block[1]);
+  startRegs.x30 = TaggedUWord(block[2]);
+  startRegs.sp = TaggedUWord(block[3]);
+  const uintptr_t REDZONE_SIZE = 0;
+  uintptr_t start = block[1] - REDZONE_SIZE;
+#elif defined(GP_ARCH_mips64)
+  volatile uintptr_t block[3];
+  MOZ_ASSERT(sizeof(block) == 24);
+  __asm__ __volatile__(
+      "sd $29, 8(%0)     \n"
+      "sd $30, 16(%0)    \n"
+      :
+      : "r"(block)
+      : "memory");
+  block[0] = __getpc();
+  startRegs.pc = TaggedUWord(block[0]);
+  startRegs.sp = TaggedUWord(block[1]);
+  startRegs.fp = TaggedUWord(block[2]);
+  const uintptr_t REDZONE_SIZE = 0;
+  uintptr_t start = block[1] - REDZONE_SIZE;
+#else
+#  error "Unsupported platform"
+#endif
+
+  // Get hold of the innermost LUL_UNIT_TEST_STACK_SIZE bytes of the
+  // stack.
+  uintptr_t end = start + LUL_UNIT_TEST_STACK_SIZE;
+  uintptr_t ws = sizeof(void*);
+  start &= ~(ws - 1);
+  end &= ~(ws - 1);
+  uintptr_t nToCopy = end - start;
+  if (nToCopy > lul::N_STACK_BYTES) {
+    nToCopy = lul::N_STACK_BYTES;
+  }
+  MOZ_ASSERT(nToCopy <= lul::N_STACK_BYTES);
+  StackImage* stackImg = new StackImage();
+  stackImg->mLen = nToCopy;
+  stackImg->mStartAvma = start;
+  if (nToCopy > 0) {
+    MOZ_MAKE_MEM_DEFINED((void*)start, nToCopy);
+    memcpy(&stackImg->mContents[0], (void*)start, nToCopy);
+  }
+
+  // Unwind it.
+  const int MAX_TEST_FRAMES = 64;
+  uintptr_t framePCs[MAX_TEST_FRAMES];
+  uintptr_t frameSPs[MAX_TEST_FRAMES];
+  size_t framesAvail = mozilla::ArrayLength(framePCs);
+  size_t framesUsed = 0;
+  size_t framePointerFramesAcquired = 0;
+  aLUL->Unwind(&framePCs[0], &frameSPs[0], &framesUsed,
+               &framePointerFramesAcquired, framesAvail, &startRegs, stackImg);
+
+  delete stackImg;
+
+  // if (0) {
+  //  // Show what we have.
+  //  fprintf(stderr, "Got %d frames:\n", (int)framesUsed);
+  //  for (size_t i = 0; i < framesUsed; i++) {
+  //    fprintf(stderr, "  [%2d]   SP %p   PC %p\n",
+  //            (int)i, (void*)frameSPs[i], (void*)framePCs[i]);
+  //  }
+  //  fprintf(stderr, "\n");
+  //}
+
+  // Check to see if there's a consistent binding between digits in
+  // the director string ('1' .. '8') and the PC values acquired by
+  // the unwind.  If there isn't, the unwinding has failed somehow.
+  uintptr_t binding[8];  // binding for '1' .. binding for '8'
+  memset((void*)binding, 0, sizeof(binding));
+
+  // The general plan is to work backwards along the director string
+  // and forwards along the framePCs array.  Doing so corresponds to
+  // working outwards from the innermost frame of the recursive test set.
+  const char* cursor = dstring;
+
+  // Find the end.  This leaves |cursor| two bytes past the first
+  // character we want to look at -- see comment below.
+  while (*cursor) cursor++;
+
+  // Counts the number of consistent frames.
+  size_t nConsistent = 0;
+
+  // Iterate back to the start of the director string.  The starting
+  // points are a bit complex.  We can't use framePCs[0] because that
+  // contains the PC in this frame (above).  We can't use framePCs[1]
+  // because that will contain the PC at return point in the recursive
+  // test group (TestFn[1-8]) for their call "out" to this function,
+  // GetAndCheckStackTrace.  Although LUL will compute a correct
+  // return address, that will not be the same return address as for a
+  // recursive call out of the the function to another function in the
+  // group.  Hence we can only start consistency checking at
+  // framePCs[2].
+  //
+  // To be consistent, then, we must ignore the last element in the
+  // director string as that corresponds to framePCs[1].  Hence the
+  // start points are: framePCs[2] and the director string 2 bytes
+  // before the terminating zero.
+  //
+  // Also as a result of this, the number of consistent frames counted
+  // will always be one less than the length of the director string
+  // (not including its terminating zero).
+  size_t frameIx;
+  for (cursor = cursor - 2, frameIx = 2;
+       cursor >= dstring && frameIx < framesUsed; cursor--, frameIx++) {
+    char c = *cursor;
+    uintptr_t pc = framePCs[frameIx];
+    // If this doesn't hold, the director string is ill-formed.
+    MOZ_ASSERT(c >= '1' && c <= '8');
+    int n = ((int)c) - ((int)'1');
+    if (binding[n] == 0) {
+      // There's no binding for |c| yet, so install |pc| and carry on.
+      binding[n] = pc;
+      nConsistent++;
+      continue;
+    }
+    // There's a pre-existing binding for |c|.  Check it's consistent.
+    if (binding[n] != pc) {
+      // Not consistent.  Give up now.
+      break;
+    }
+    // Consistent.  Keep going.
+    nConsistent++;
+  }
+
+  // So, did we succeed?
+  bool passed = nConsistent + 1 == strlen(dstring);
+
+  // Show the results.
+  char buf[200];
+  SprintfLiteral(buf, "LULUnitTest:   dstring = %s\n", dstring);
+  buf[sizeof(buf) - 1] = 0;
+  aLUL->mLog(buf);
+  SprintfLiteral(buf, "LULUnitTest:     %d consistent, %d in dstring: %s\n",
+                 (int)nConsistent, (int)strlen(dstring),
+                 passed ? "PASS" : "FAIL");
+  buf[sizeof(buf) - 1] = 0;
+  aLUL->mLog(buf);
+
+  return passed;
+}
+
+// Macro magic to create a set of 8 mutually recursive functions with
+// varying frame sizes.  These will recurse amongst themselves as
+// specified by |strP|, the directory string, and call
+// GetAndCheckStackTrace when the string becomes empty, passing it the
+// original value of the string.  This checks the result, printing
+// results on |aLUL|'s logging sink, and also returns a boolean
+// indicating whether or not the results are acceptable (correct).
+
+#define DECL_TEST_FN(NAME) \
+  bool NAME(LUL* aLUL, const char* strPorig, const char* strP);
+
+#define GEN_TEST_FN(NAME, FRAMESIZE)                                          \
+  bool NAME(LUL* aLUL, const char* strPorig, const char* strP) {              \
+    /* Create a frame of size (at least) FRAMESIZE, so that the */            \
+    /* 8 functions created by this macro offer some variation in frame */     \
+    /* sizes.  This isn't as simple as it might seem, since a clever */       \
+    /* optimizing compiler (eg, clang-5) detects that the array is unused */  \
+    /* and removes it.  We try to defeat this by passing it to a function */  \
+    /* in a different compilation unit, and hoping that clang does not */     \
+    /* notice that the call is a no-op. */                                    \
+    char space[FRAMESIZE];                                                    \
+    Unused << write(1, space, 0); /* write zero bytes of |space| to stdout */ \
+                                                                              \
+    if (*strP == '\0') {                                                      \
+      /* We've come to the end of the director string. */                     \
+      /* Take a stack snapshot. */                                            \
+      return GetAndCheckStackTrace(aLUL, strPorig);                           \
+    } else {                                                                  \
+      /* Recurse onwards.  This is a bit subtle.  The obvious */              \
+      /* thing to do here is call onwards directly, from within the */        \
+      /* arms of the case statement.  That gives a problem in that */         \
+      /* there will be multiple return points inside each function when */    \
+      /* unwinding, so it will be difficult to check for consistency */       \
+      /* against the director string.  Instead, we make an indirect */        \
+      /* call, so as to guarantee that there is only one call site */         \
+      /* within each function.  This does assume that the compiler */         \
+      /* won't transform it back to the simple direct-call form. */           \
+      /* To discourage it from doing so, the call is bracketed with */        \
+      /* __asm__ __volatile__ sections so as to make it not-movable. */       \
+      bool (*nextFn)(LUL*, const char*, const char*) = NULL;                  \
+      switch (*strP) {                                                        \
+        case '1':                                                             \
+          nextFn = TestFn1;                                                   \
+          break;                                                              \
+        case '2':                                                             \
+          nextFn = TestFn2;                                                   \
+          break;                                                              \
+        case '3':                                                             \
+          nextFn = TestFn3;                                                   \
+          break;                                                              \
+        case '4':                                                             \
+          nextFn = TestFn4;                                                   \
+          break;                                                              \
+        case '5':                                                             \
+          nextFn = TestFn5;                                                   \
+          break;                                                              \
+        case '6':                                                             \
+          nextFn = TestFn6;                                                   \
+          break;                                                              \
+        case '7':                                                             \
+          nextFn = TestFn7;                                                   \
+          break;                                                              \
+        case '8':                                                             \
+          nextFn = TestFn8;                                                   \
+          break;                                                              \
+        default:                                                              \
+          nextFn = TestFn8;                                                   \
+          break;                                                              \
+      }                                                                       \
+      /* "use" |space| immediately after the recursive call, */               \
+      /* so as to dissuade clang from deallocating the space while */         \
+      /* the call is active, or otherwise messing with the stack frame. */    \
+      __asm__ __volatile__("" ::: "cc", "memory");                            \
+      bool passed = nextFn(aLUL, strPorig, strP + 1);                         \
+      Unused << write(1, space, 0);                                           \
+      __asm__ __volatile__("" ::: "cc", "memory");                            \
+      return passed;                                                          \
+    }                                                                         \
+  }
+
+// The test functions are mutually recursive, so it is necessary to
+// declare them before defining them.
+DECL_TEST_FN(TestFn1)
+DECL_TEST_FN(TestFn2)
+DECL_TEST_FN(TestFn3)
+DECL_TEST_FN(TestFn4)
+DECL_TEST_FN(TestFn5)
+DECL_TEST_FN(TestFn6)
+DECL_TEST_FN(TestFn7)
+DECL_TEST_FN(TestFn8)
+
+GEN_TEST_FN(TestFn1, 123)
+GEN_TEST_FN(TestFn2, 456)
+GEN_TEST_FN(TestFn3, 789)
+GEN_TEST_FN(TestFn4, 23)
+GEN_TEST_FN(TestFn5, 47)
+GEN_TEST_FN(TestFn6, 117)
+GEN_TEST_FN(TestFn7, 1)
+GEN_TEST_FN(TestFn8, 99)
+
+// This starts the test sequence going.  Call here to generate a
+// sequence of calls as directed by the string |dstring|.  The call
+// sequence will, from its innermost frame, finish by calling
+// GetAndCheckStackTrace() and passing it |dstring|.
+// GetAndCheckStackTrace() will unwind the stack, check consistency
+// of those results against |dstring|, and print a pass/fail message
+// to aLUL's logging sink.  It also updates the counters in *aNTests
+// and aNTestsPassed.
+__attribute__((noinline)) void TestUnw(/*OUT*/ int* aNTests,
+                                       /*OUT*/ int* aNTestsPassed, LUL* aLUL,
+                                       const char* dstring) {
+  // Ensure that the stack has at least this much space on it.  This
+  // makes it safe to saw off the top LUL_UNIT_TEST_STACK_SIZE bytes
+  // and hand it to LUL.  Safe in the sense that no segfault can
+  // happen because the stack is at least this big.  This is all
+  // somewhat dubious in the sense that a sufficiently clever compiler
+  // (clang, for one) can figure out that space[] is unused and delete
+  // it from the frame.  Hence the somewhat elaborate hoop jumping to
+  // fill it up before the call and to at least appear to use the
+  // value afterwards.
+  int i;
+  volatile char space[LUL_UNIT_TEST_STACK_SIZE];
+  for (i = 0; i < LUL_UNIT_TEST_STACK_SIZE; i++) {
+    space[i] = (char)(i & 0x7F);
+  }
+
+  // Really run the test.
+  bool passed = TestFn1(aLUL, dstring, dstring);
+
+  // Appear to use space[], by visiting the value to compute some kind
+  // of checksum, and then (apparently) using the checksum.
+  int sum = 0;
+  for (i = 0; i < LUL_UNIT_TEST_STACK_SIZE; i++) {
+    // If this doesn't fool LLVM, I don't know what will.
+    sum += space[i] - 3 * i;
+  }
+  __asm__ __volatile__("" : : "r"(sum));
+
+  // Update the counters.
+  (*aNTests)++;
+  if (passed) {
+    (*aNTestsPassed)++;
+  }
+}
+
+void RunLulUnitTests(/*OUT*/ int* aNTests, /*OUT*/ int* aNTestsPassed,
+                     LUL* aLUL) {
+  aLUL->mLog(":\n");
+  aLUL->mLog("LULUnitTest: BEGIN\n");
+  *aNTests = *aNTestsPassed = 0;
+  TestUnw(aNTests, aNTestsPassed, aLUL, "11111111");
+  TestUnw(aNTests, aNTestsPassed, aLUL, "11222211");
+  TestUnw(aNTests, aNTestsPassed, aLUL, "111222333");
+  TestUnw(aNTests, aNTestsPassed, aLUL, "1212121231212331212121212121212");
+  TestUnw(aNTests, aNTestsPassed, aLUL, "31415827271828325332173258");
+  TestUnw(aNTests, aNTestsPassed, aLUL,
+          "123456781122334455667788777777777777777777777");
+  aLUL->mLog("LULUnitTest: END\n");
+  aLUL->mLog(":\n");
+}
+
+}  // namespace lul
diff --git a/tools/profiler/lul/LulMain.h b/tools/profiler/lul/LulMain.h
new file mode 100644
index 0000000000..b0cb7f4f1e
--- /dev/null
+++ b/tools/profiler/lul/LulMain.h
@@ -0,0 +1,377 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef LulMain_h
+#define LulMain_h
+
+#include "PlatformMacros.h"
+#include "mozilla/Atomics.h"
+#include "mozilla/MemoryReporting.h"
+
+// LUL: A Lightweight Unwind Library.
+// This file provides the end-user (external) interface for LUL.
+
+// Some comments about naming in the implementation.  These are safe
+// to ignore if you are merely using LUL, but are important if you
+// hack on its internals.
+//
+// Debuginfo readers in general have tended to use the word "address"
+// to mean several different things.  This sometimes makes them
+// difficult to understand and maintain.  LUL tries hard to avoid
+// using the word "address" and instead uses the following more
+// precise terms:
+//
+// * SVMA ("Stated Virtual Memory Address"): this is an address of a
+//   symbol (etc) as it is stated in the symbol table, or other
+//   metadata, of an object.  Such values are typically small and
+//   start from zero or thereabouts, unless the object has been
+//   prelinked.
+//
+// * AVMA ("Actual Virtual Memory Address"): this is the address of a
+//   symbol (etc) in a running process, that is, once the associated
+//   object has been mapped into a process.  Such values are typically
+//   much larger than SVMAs, since objects can get mapped arbitrarily
+//   far along the address space.
+//
+// * "Bias": the difference between AVMA and SVMA for a given symbol
+//   (specifically, AVMA - SVMA).  The bias is always an integral
+//   number of pages.  Once we know the bias for a given object's
+//   text section (for example), we can compute the AVMAs of all of
+//   its text symbols by adding the bias to their SVMAs.
+//
+// * "Image address": typically, to read debuginfo from an object we
+//   will temporarily mmap in the file so as to read symbol tables
+//   etc.  Addresses in this temporary mapping are called "Image
+//   addresses".  Note that the temporary mapping is entirely
+//   unrelated to the mappings of the file that the dynamic linker
+//   must perform merely in order to get the program to run.  Hence
+//   image addresses are unrelated to either SVMAs or AVMAs.
+
+namespace lul {
+
+// A machine word plus validity tag.
+class TaggedUWord {
+ public:
+  // RUNS IN NO-MALLOC CONTEXT
+  // Construct a valid one.
+  explicit TaggedUWord(uintptr_t w) : mValue(w), mValid(true) {}
+
+  // RUNS IN NO-MALLOC CONTEXT
+  // Construct an invalid one.
+  TaggedUWord() : mValue(0), mValid(false) {}
+
+  // RUNS IN NO-MALLOC CONTEXT
+  TaggedUWord operator+(TaggedUWord rhs) const {
+    return (Valid() && rhs.Valid()) ? TaggedUWord(Value() + rhs.Value())
+                                    : TaggedUWord();
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  TaggedUWord operator-(TaggedUWord rhs) const {
+    return (Valid() && rhs.Valid()) ? TaggedUWord(Value() - rhs.Value())
+                                    : TaggedUWord();
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  TaggedUWord operator&(TaggedUWord rhs) const {
+    return (Valid() && rhs.Valid()) ? TaggedUWord(Value() & rhs.Value())
+                                    : TaggedUWord();
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  TaggedUWord operator|(TaggedUWord rhs) const {
+    return (Valid() && rhs.Valid()) ? TaggedUWord(Value() | rhs.Value())
+                                    : TaggedUWord();
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  TaggedUWord CmpGEs(TaggedUWord rhs) const {
+    if (Valid() && rhs.Valid()) {
+      intptr_t s1 = (intptr_t)Value();
+      intptr_t s2 = (intptr_t)rhs.Value();
+      return TaggedUWord(s1 >= s2 ? 1 : 0);
+    }
+    return TaggedUWord();
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  TaggedUWord operator<<(TaggedUWord rhs) const {
+    if (Valid() && rhs.Valid()) {
+      uintptr_t shift = rhs.Value();
+      if (shift < 8 * sizeof(uintptr_t)) return TaggedUWord(Value() << shift);
+    }
+    return TaggedUWord();
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  // Is equal?  Note: non-validity on either side gives non-equality.
+  bool operator==(TaggedUWord other) const {
+    return (mValid && other.Valid()) ? (mValue == other.Value()) : false;
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  // Is it word-aligned?
+  bool IsAligned() const {
+    return mValid && (mValue & (sizeof(uintptr_t) - 1)) == 0;
+  }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  uintptr_t Value() const { return mValue; }
+
+  // RUNS IN NO-MALLOC CONTEXT
+  bool Valid() const { return mValid; }
+
+ private:
+  uintptr_t mValue;
+  bool mValid;
+};
+
+// The registers, with validity tags, that will be unwound.
+
+struct UnwindRegs {
+#if defined(GP_ARCH_arm)
+  TaggedUWord r7;
+  TaggedUWord r11;
+  TaggedUWord r12;
+  TaggedUWord r13;
+  TaggedUWord r14;
+  TaggedUWord r15;
+#elif defined(GP_ARCH_arm64)
+  TaggedUWord x29;
+  TaggedUWord x30;
+  TaggedUWord sp;
+  TaggedUWord pc;
+#elif defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+  TaggedUWord xbp;
+  TaggedUWord xsp;
+  TaggedUWord xip;
+#elif defined(GP_ARCH_mips64)
+  TaggedUWord sp;
+  TaggedUWord fp;
+  TaggedUWord pc;
+#else
+#  error "Unknown plat"
+#endif
+};
+
+// The maximum number of bytes in a stack snapshot.  This value can be increased
+// if necessary, but testing showed that 160k is enough to obtain good
+// backtraces on x86_64 Linux.  Most backtraces fit comfortably into 4-8k of
+// stack space, but we do have some very deep stacks occasionally.  Please see
+// the comments in DoNativeBacktrace as to why it's OK to have this value be so
+// large.
+static const size_t N_STACK_BYTES = 160 * 1024;
+
+// The stack chunk image that will be unwound.
+struct StackImage {
+  // [start_avma, +len) specify the address range in the buffer.
+  // Obviously we require 0 <= len <= N_STACK_BYTES.
+  uintptr_t mStartAvma;
+  size_t mLen;
+  uint8_t mContents[N_STACK_BYTES];
+};
+
+// Statistics collection for the unwinder.
+template <typename T>
+class LULStats {
+ public:
+  LULStats() : mContext(0), mCFI(0), mFP(0) {}
+
+  template <typename S>
+  explicit LULStats(const LULStats<S>& aOther)
+      : mContext(aOther.mContext), mCFI(aOther.mCFI), mFP(aOther.mFP) {}
+
+  template <typename S>
+  LULStats<T>& operator=(const LULStats<S>& aOther) {
+    mContext = aOther.mContext;
+    mCFI = aOther.mCFI;
+    mFP = aOther.mFP;
+    return *this;
+  }
+
+  template <typename S>
+  uint32_t operator-(const LULStats<S>& aOther) {
+    return (mContext - aOther.mContext) + (mCFI - aOther.mCFI) +
+           (mFP - aOther.mFP);
+  }
+
+  T mContext;  // Number of context frames
+  T mCFI;      // Number of CFI/EXIDX frames
+  T mFP;       // Number of frame-pointer recovered frames
+};
+
+// The core unwinder library class.  Just one of these is needed, and
+// it can be shared by multiple unwinder threads.
+//
+// The library operates in one of two modes.
+//
+// * Admin mode.  The library is this state after creation.  In Admin
+//   mode, no unwinding may be performed.  It is however allowable to
+//   perform administrative tasks -- primarily, loading of unwind info
+//   -- in this mode.  In particular, it is safe for the library to
+//   perform dynamic memory allocation in this mode.  Safe in the
+//   sense that there is no risk of deadlock against unwinding threads
+//   that might -- because of where they have been sampled -- hold the
+//   system's malloc lock.
+//
+// * Unwind mode.  In this mode, calls to ::Unwind may be made, but
+//   nothing else.  ::Unwind guarantees not to make any dynamic memory
+//   requests, so as to guarantee that the calling thread won't
+//   deadlock in the case where it already holds the system's malloc lock.
+//
+// The library is created in Admin mode.  After debuginfo is loaded,
+// the caller must switch it into Unwind mode by calling
+// ::EnableUnwinding.  There is no way to switch it back to Admin mode
+// after that.  To safely switch back to Admin mode would require the
+// caller (or other external agent) to guarantee that there are no
+// pending ::Unwind calls.
+
+class PriMap;
+class SegArray;
+class UniqueStringUniverse;
+
+class LUL {
+ public:
+  // Create; supply a logging sink.  Sets the object in Admin mode.
+  explicit LUL(void (*aLog)(const char*));
+
+  // Destroy.  Caller is responsible for ensuring that no other
+  // threads are in Unwind calls.  All resources are freed and all
+  // registered unwinder threads are deregistered.  Can be called
+  // either in Admin or Unwind mode.
+  ~LUL();
+
+  // Notify the library that unwinding is now allowed and so
+  // admin-mode calls are no longer allowed.  The object is initially
+  // created in admin mode.  The only possible transition is
+  // admin->unwinding, therefore.
+  void EnableUnwinding();
+
+  // Notify of a new r-x mapping, and load the associated unwind info.
+  // The filename is strdup'd and used for debug printing.  If
+  // aMappedImage is NULL, this function will mmap/munmap the file
+  // itself, so as to be able to read the unwind info.  If
+  // aMappedImage is non-NULL then it is assumed to point to a
+  // called-supplied and caller-managed mapped image of the file.
+  // May only be called in Admin mode.
+  void NotifyAfterMap(uintptr_t aRXavma, size_t aSize, const char* aFileName,
+                      const void* aMappedImage);
+
+  // In rare cases we know an executable area exists but don't know
+  // what the associated file is.  This call notifies LUL of such
+  // areas.  This is important for correct functioning of stack
+  // scanning and of the x86-{linux,android} special-case
+  // __kernel_syscall function handling.
+  // This must be called only after the code area in
+  // question really has been mapped.
+  // May only be called in Admin mode.
+  void NotifyExecutableArea(uintptr_t aRXavma, size_t aSize);
+
+  // Notify that a mapped area has been unmapped; discard any
+  // associated unwind info.  Acquires mRWlock for writing.  Note that
+  // to avoid segfaulting the stack-scan unwinder, which inspects code
+  // areas, this must be called before the code area in question is
+  // really unmapped.  Note that, unlike NotifyAfterMap(), this
+  // function takes the start and end addresses of the range to be
+  // unmapped, rather than a start and a length parameter.  This is so
+  // as to make it possible to notify an unmap for the entire address
+  // space using a single call.
+  // May only be called in Admin mode.
+  void NotifyBeforeUnmap(uintptr_t aAvmaMin, uintptr_t aAvmaMax);
+
+  // Apply NotifyBeforeUnmap to the entire address space.  This causes
+  // LUL to discard all unwind and executable-area information for the
+  // entire address space.
+  // May only be called in Admin mode.
+  void NotifyBeforeUnmapAll() { NotifyBeforeUnmap(0, UINTPTR_MAX); }
+
+  // Returns the number of mappings currently registered.
+  // May only be called in Admin mode.
+  size_t CountMappings();
+
+  // Unwind |aStackImg| starting with the context in |aStartRegs|.
+  // Write the number of frames recovered in *aFramesUsed.  Put
+  // the PC values in aFramePCs[0 .. *aFramesUsed-1] and
+  // the SP values in aFrameSPs[0 .. *aFramesUsed-1].
+  // |aFramesAvail| is the size of the two output arrays and hence the
+  // largest possible value of *aFramesUsed.  PC values are always
+  // valid, and the unwind will stop when the PC becomes invalid, but
+  // the SP values might be invalid, in which case the value zero will
+  // be written in the relevant frameSPs[] slot.
+  //
+  // This function assumes that the SP values increase as it unwinds
+  // away from the innermost frame -- that is, that the stack grows
+  // down.  It monitors SP values as it unwinds to check they
+  // decrease, so as to avoid looping on corrupted stacks.
+  //
+  // May only be called in Unwind mode.  Multiple threads may unwind
+  // at once.  LUL user is responsible for ensuring that no thread makes
+  // any Admin calls whilst in Unwind mode.
+  // MOZ_CRASHes if the calling thread is not registered for unwinding.
+  //
+  // The calling thread must previously have been registered via a call to
+  // RegisterSampledThread.
+  void Unwind(/*OUT*/ uintptr_t* aFramePCs,
+              /*OUT*/ uintptr_t* aFrameSPs,
+              /*OUT*/ size_t* aFramesUsed,
+              /*OUT*/ size_t* aFramePointerFramesAcquired, size_t aFramesAvail,
+              UnwindRegs* aStartRegs, StackImage* aStackImg);
+
+  // The logging sink.  Call to send debug strings to the caller-
+  // specified destination.  Can only be called by the Admin thread.
+  void (*mLog)(const char*);
+
+  // Statistics relating to unwinding.  These have to be atomic since
+  // unwinding can occur on different threads simultaneously.
+  LULStats<mozilla::Atomic<uint32_t>> mStats;
+
+  // Possibly show the statistics.  This may not be called from any
+  // registered sampling thread, since it involves I/O.
+  void MaybeShowStats();
+
+  size_t SizeOfIncludingThis(mozilla::MallocSizeOf) const;
+
+ private:
+  // The statistics counters at the point where they were last printed.
+  LULStats<uint32_t> mStatsPrevious;
+
+  // Are we in admin mode?  Initially |true| but changes to |false|
+  // once unwinding begins.
+  bool mAdminMode;
+
+  // The thread ID associated with admin mode.  This is the only thread
+  // that is allowed do perform non-Unwind calls on this object.  Conversely,
+  // no registered Unwinding thread may be the admin thread.  This is so
+  // as to clearly partition the one thread that may do dynamic memory
+  // allocation from the threads that are being sampled, since the latter
+  // absolutely may not do dynamic memory allocation.
+  int mAdminThreadId;
+
+  // The top level mapping from code address ranges to postprocessed
+  // unwind info.  Basically a sorted array of (addr, len, info)
+  // records.  This field is updated by NotifyAfterMap and NotifyBeforeUnmap.
+  PriMap* mPriMap;
+
+  // An auxiliary structure that records which address ranges are
+  // mapped r-x, for the benefit of the stack scanner.
+  SegArray* mSegArray;
+
+  // A UniqueStringUniverse that holds all the strdup'd strings created
+  // whilst reading unwind information.  This is included so as to make
+  // it possible to free them in ~LUL.
+  UniqueStringUniverse* mUSU;
+};
+
+// Run unit tests on an initialised, loaded-up LUL instance, and print
+// summary results on |aLUL|'s logging sink.  Also return the number
+// of tests run in *aNTests and the number that passed in
+// *aNTestsPassed.
+void RunLulUnitTests(/*OUT*/ int* aNTests, /*OUT*/ int* aNTestsPassed,
+                     LUL* aLUL);
+
+}  // namespace lul
+
+#endif  // LulMain_h
diff --git a/tools/profiler/lul/LulMainInt.h b/tools/profiler/lul/LulMainInt.h
new file mode 100644
index 0000000000..f32c56e84f
--- /dev/null
+++ b/tools/profiler/lul/LulMainInt.h
@@ -0,0 +1,630 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef LulMainInt_h
+#define LulMainInt_h
+
+#include "PlatformMacros.h"
+#include "LulMain.h"  // for TaggedUWord
+
+#include <string>
+#include <vector>
+
+#include "mozilla/Assertions.h"
+#include "mozilla/HashFunctions.h"
+#include "mozilla/HashTable.h"
+
+// This file provides an internal interface inside LUL.  If you are an
+// end-user of LUL, do not include it in your code.  The end-user
+// interface is in LulMain.h.
+
+namespace lul {
+
+using std::vector;
+
+////////////////////////////////////////////////////////////////
+// DW_REG_ constants                                          //
+////////////////////////////////////////////////////////////////
+
+// These are the Dwarf CFI register numbers, as (presumably) defined
+// in the ELF ABI supplements for each architecture.
+
+enum DW_REG_NUMBER {
+  // No real register has this number.  It's convenient to be able to
+  // treat the CFA (Canonical Frame Address) as "just another
+  // register", though.
+  DW_REG_CFA = -1,
+#if defined(GP_ARCH_arm)
+  // ARM registers
+  DW_REG_ARM_R7 = 7,
+  DW_REG_ARM_R11 = 11,
+  DW_REG_ARM_R12 = 12,
+  DW_REG_ARM_R13 = 13,
+  DW_REG_ARM_R14 = 14,
+  DW_REG_ARM_R15 = 15,
+#elif defined(GP_ARCH_arm64)
+  // aarch64 registers
+  DW_REG_AARCH64_X29 = 29,
+  DW_REG_AARCH64_X30 = 30,
+  DW_REG_AARCH64_SP = 31,
+#elif defined(GP_ARCH_amd64)
+  // Because the X86 (32 bit) and AMD64 (64 bit) summarisers are
+  // combined, a merged set of register constants is needed.
+  DW_REG_INTEL_XBP = 6,
+  DW_REG_INTEL_XSP = 7,
+  DW_REG_INTEL_XIP = 16,
+#elif defined(GP_ARCH_x86)
+  DW_REG_INTEL_XBP = 5,
+  DW_REG_INTEL_XSP = 4,
+  DW_REG_INTEL_XIP = 8,
+#elif defined(GP_ARCH_mips64)
+  DW_REG_MIPS_SP = 29,
+  DW_REG_MIPS_FP = 30,
+  DW_REG_MIPS_PC = 34,
+#else
+#  error "Unknown arch"
+#endif
+};
+
+////////////////////////////////////////////////////////////////
+// PfxExpr                                                    //
+////////////////////////////////////////////////////////////////
+
+enum PfxExprOp {
+  //             meaning of mOperand     effect on stack
+  PX_Start,   // bool start-with-CFA?    start, with CFA on stack, or not
+  PX_End,     // none                    stop; result is at top of stack
+  PX_SImm32,  // int32                   push signed int32
+  PX_DwReg,   // DW_REG_NUMBER           push value of the specified reg
+  PX_Deref,   // none                    pop X ; push *X
+  PX_Add,     // none                    pop X ; pop Y ; push Y + X
+  PX_Sub,     // none                    pop X ; pop Y ; push Y - X
+  PX_And,     // none                    pop X ; pop Y ; push Y & X
+  PX_Or,      // none                    pop X ; pop Y ; push Y | X
+  PX_CmpGES,  // none                    pop X ; pop Y ; push (Y >=s X) ? 1 : 0
+  PX_Shl      // none                    pop X ; pop Y ; push Y << X
+};
+
+struct PfxInstr {
+  PfxInstr(PfxExprOp opcode, int32_t operand)
+      : mOpcode(opcode), mOperand(operand) {}
+  explicit PfxInstr(PfxExprOp opcode) : mOpcode(opcode), mOperand(0) {}
+  bool operator==(const PfxInstr& other) const {
+    return mOpcode == other.mOpcode && mOperand == other.mOperand;
+  }
+  PfxExprOp mOpcode;
+  int32_t mOperand;
+};
+
+static_assert(sizeof(PfxInstr) <= 8, "PfxInstr size changed unexpectedly");
+
+// Evaluate the prefix expression whose PfxInstrs start at aPfxInstrs[start].
+// In the case of any mishap (stack over/underflow, running off the end of
+// the instruction vector, obviously malformed sequences),
+// return an invalid TaggedUWord.
+// RUNS IN NO-MALLOC CONTEXT
+TaggedUWord EvaluatePfxExpr(int32_t start, const UnwindRegs* aOldRegs,
+                            TaggedUWord aCFA, const StackImage* aStackImg,
+                            const vector<PfxInstr>& aPfxInstrs);
+
+////////////////////////////////////////////////////////////////
+// LExpr                                                      //
+////////////////////////////////////////////////////////////////
+
+// An expression -- very primitive.  Denotes either "register +
+// offset", a dereferenced version of the same, or a reference to a
+// prefix expression stored elsewhere.  So as to allow convenient
+// handling of Dwarf-derived unwind info, the register may also denote
+// the CFA.  A large number of these need to be stored, so we ensure
+// it fits into 8 bytes.  See comment below on RuleSet to see how
+// expressions fit into the bigger picture.
+
+enum LExprHow {
+  UNKNOWN = 0,  // This LExpr denotes no value.
+  NODEREF,      // Value is  (mReg + mOffset).
+  DEREF,        // Value is *(mReg + mOffset).
+  PFXEXPR       // Value is EvaluatePfxExpr(secMap->mPfxInstrs[mOffset])
+};
+
+inline static const char* NameOf_LExprHow(LExprHow how) {
+  switch (how) {
+    case UNKNOWN:
+      return "UNKNOWN";
+    case NODEREF:
+      return "NODEREF";
+    case DEREF:
+      return "DEREF";
+    case PFXEXPR:
+      return "PFXEXPR";
+    default:
+      return "LExpr-??";
+  }
+}
+
+struct LExpr {
+  // Denotes an expression with no value.
+  LExpr() : mHow(UNKNOWN), mReg(0), mOffset(0) {}
+
+  // Denotes any expressible expression.
+  LExpr(LExprHow how, int16_t reg, int32_t offset)
+      : mHow(how), mReg(reg), mOffset(offset) {
+    switch (how) {
+      case UNKNOWN:
+        MOZ_ASSERT(reg == 0 && offset == 0);
+        break;
+      case NODEREF:
+        break;
+      case DEREF:
+        break;
+      case PFXEXPR:
+        MOZ_ASSERT(reg == 0 && offset >= 0);
+        break;
+      default:
+        MOZ_RELEASE_ASSERT(0, "LExpr::LExpr: invalid how");
+    }
+  }
+
+  // Hash it, carefully looking only at defined parts.
+  mozilla::HashNumber hash() const {
+    mozilla::HashNumber h = mHow;
+    switch (mHow) {
+      case UNKNOWN:
+        break;
+      case NODEREF:
+      case DEREF:
+        h = mozilla::AddToHash(h, mReg);
+        h = mozilla::AddToHash(h, mOffset);
+        break;
+      case PFXEXPR:
+        h = mozilla::AddToHash(h, mOffset);
+        break;
+      default:
+        MOZ_RELEASE_ASSERT(0, "LExpr::hash: invalid how");
+    }
+    return h;
+  }
+
+  // And structural equality.
+  bool equals(const LExpr& other) const {
+    if (mHow != other.mHow) {
+      return false;
+    }
+    switch (mHow) {
+      case UNKNOWN:
+        return true;
+      case NODEREF:
+      case DEREF:
+        return mReg == other.mReg && mOffset == other.mOffset;
+      case PFXEXPR:
+        return mOffset == other.mOffset;
+      default:
+        MOZ_RELEASE_ASSERT(0, "LExpr::equals: invalid how");
+    }
+  }
+
+  // Change the offset for an expression that references memory.
+  LExpr add_delta(long delta) {
+    MOZ_ASSERT(mHow == NODEREF);
+    // If this is a non-debug build and the above assertion would have
+    // failed, at least return LExpr() so that the machinery that uses
+    // the resulting expression fails in a repeatable way.
+    return (mHow == NODEREF) ? LExpr(mHow, mReg, mOffset + delta)
+                             : LExpr();  // Gone bad
+  }
+
+  // Dereference an expression that denotes a memory address.
+  LExpr deref() {
+    MOZ_ASSERT(mHow == NODEREF);
+    // Same rationale as for add_delta().
+    return (mHow == NODEREF) ? LExpr(DEREF, mReg, mOffset)
+                             : LExpr();  // Gone bad
+  }
+
+  // Print a rule for recovery of |aNewReg| whose recovered value
+  // is this LExpr.
+  std::string ShowRule(const char* aNewReg) const;
+
+  // Evaluate this expression, producing a TaggedUWord.  |aOldRegs|
+  // holds register values that may be referred to by the expression.
+  // |aCFA| holds the CFA value, if any, that applies.  |aStackImg|
+  // contains a chuck of stack that will be consulted if the expression
+  // references memory.  |aPfxInstrs| holds the vector of PfxInstrs
+  // that will be consulted if this is a PFXEXPR.
+  // RUNS IN NO-MALLOC CONTEXT
+  TaggedUWord EvaluateExpr(const UnwindRegs* aOldRegs, TaggedUWord aCFA,
+                           const StackImage* aStackImg,
+                           const vector<PfxInstr>* aPfxInstrs) const;
+
+  // Representation of expressions.  If |mReg| is DW_REG_CFA (-1) then
+  // it denotes the CFA.  All other allowed values for |mReg| are
+  // nonnegative and are DW_REG_ values.
+  LExprHow mHow : 8;
+  int16_t mReg;     // A DW_REG_ value
+  int32_t mOffset;  // 32-bit signed offset should be more than enough.
+};
+
+static_assert(sizeof(LExpr) <= 8, "LExpr size changed unexpectedly");
+
+////////////////////////////////////////////////////////////////
+// RuleSet                                                    //
+////////////////////////////////////////////////////////////////
+
+// This is platform-dependent.  It describes how to recover the CFA and then
+// how to recover the registers for the previous frame.  Such "recipes" are
+// specific to particular ranges of machine code, but the associated range
+// is not stored in RuleSet, because in general each RuleSet may be used
+// for many such range fragments ("extents").  See the comments below for
+// Extent and SecMap.
+//
+// The set of LExprs contained in a given RuleSet describe a DAG which
+// says how to compute the caller's registers ("new registers") from
+// the callee's registers ("old registers").  The DAG can contain a
+// single internal node, which is the value of the CFA for the callee.
+// It would be possible to construct a DAG that omits the CFA, but
+// including it makes the summarisers simpler, and the Dwarf CFI spec
+// has the CFA as a central concept.
+//
+// For this to make sense, |mCfaExpr| can't have
+// |mReg| == DW_REG_CFA since we have no previous value for the CFA.
+// All of the other |Expr| fields can -- and usually do -- specify
+// |mReg| == DW_REG_CFA.
+//
+// With that in place, the unwind algorithm proceeds as follows.
+//
+// (0) Initially: we have values for the old registers, and a memory
+//     image.
+//
+// (1) Compute the CFA by evaluating |mCfaExpr|.  Add the computed
+//     value to the set of "old registers".
+//
+// (2) Compute values for the registers by evaluating all of the other
+//     |Expr| fields in the RuleSet.  These can depend on both the old
+//     register values and the just-computed CFA.
+//
+// If we are unwinding without computing a CFA, perhaps because the
+// RuleSets are derived from EXIDX instead of Dwarf, then
+// |mCfaExpr.mHow| will be LExpr::UNKNOWN, so the computed value will
+// be invalid -- that is, TaggedUWord() -- and so any attempt to use
+// that will result in the same value.  But that's OK because the
+// RuleSet would make no sense if depended on the CFA but specified no
+// way to compute it.
+//
+// A RuleSet is not allowed to cover zero address range.  Having zero
+// length would break binary searching in SecMaps and PriMaps.
+
+class RuleSet {
+ public:
+  RuleSet();
+  void Print(uintptr_t avma, uintptr_t len, void (*aLog)(const char*)) const;
+
+  // Find the LExpr* for a given DW_REG_ value in this class.
+  LExpr* ExprForRegno(DW_REG_NUMBER aRegno);
+
+  // How to compute the CFA.
+  LExpr mCfaExpr;
+  // How to compute caller register values.  These may reference the
+  // value defined by |mCfaExpr|.
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+  LExpr mXipExpr;  // return address
+  LExpr mXspExpr;
+  LExpr mXbpExpr;
+#elif defined(GP_ARCH_arm)
+  LExpr mR15expr;  // return address
+  LExpr mR14expr;
+  LExpr mR13expr;
+  LExpr mR12expr;
+  LExpr mR11expr;
+  LExpr mR7expr;
+#elif defined(GP_ARCH_arm64)
+  LExpr mX29expr;  // frame pointer register
+  LExpr mX30expr;  // link register
+  LExpr mSPexpr;
+#elif defined(GP_ARCH_mips64)
+  LExpr mPCexpr;
+  LExpr mFPexpr;
+  LExpr mSPexpr;
+#else
+#  error "Unknown arch"
+#endif
+
+  // Machinery in support of hashing.
+  typedef RuleSet Lookup;
+
+  static mozilla::HashNumber hash(RuleSet rs) {
+    mozilla::HashNumber h = rs.mCfaExpr.hash();
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+    h = mozilla::AddToHash(h, rs.mXipExpr.hash());
+    h = mozilla::AddToHash(h, rs.mXspExpr.hash());
+    h = mozilla::AddToHash(h, rs.mXbpExpr.hash());
+#elif defined(GP_ARCH_arm)
+    h = mozilla::AddToHash(h, rs.mR15expr.hash());
+    h = mozilla::AddToHash(h, rs.mR14expr.hash());
+    h = mozilla::AddToHash(h, rs.mR13expr.hash());
+    h = mozilla::AddToHash(h, rs.mR12expr.hash());
+    h = mozilla::AddToHash(h, rs.mR11expr.hash());
+    h = mozilla::AddToHash(h, rs.mR7expr.hash());
+#elif defined(GP_ARCH_arm64)
+    h = mozilla::AddToHash(h, rs.mX29expr.hash());
+    h = mozilla::AddToHash(h, rs.mX30expr.hash());
+    h = mozilla::AddToHash(h, rs.mSPexpr.hash());
+#elif defined(GP_ARCH_mips64)
+    h = mozilla::AddToHash(h, rs.mPCexpr.hash());
+    h = mozilla::AddToHash(h, rs.mFPexpr.hash());
+    h = mozilla::AddToHash(h, rs.mSPexpr.hash());
+#else
+#  error "Unknown arch"
+#endif
+    return h;
+  }
+
+  static bool match(const RuleSet& rs1, const RuleSet& rs2) {
+    return rs1.mCfaExpr.equals(rs2.mCfaExpr) &&
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+           rs1.mXipExpr.equals(rs2.mXipExpr) &&
+           rs1.mXspExpr.equals(rs2.mXspExpr) &&
+           rs1.mXbpExpr.equals(rs2.mXbpExpr);
+#elif defined(GP_ARCH_arm)
+           rs1.mR15expr.equals(rs2.mR15expr) &&
+           rs1.mR14expr.equals(rs2.mR14expr) &&
+           rs1.mR13expr.equals(rs2.mR13expr) &&
+           rs1.mR12expr.equals(rs2.mR12expr) &&
+           rs1.mR11expr.equals(rs2.mR11expr) && rs1.mR7expr.equals(rs2.mR7expr);
+#elif defined(GP_ARCH_arm64)
+           rs1.mX29expr.equals(rs2.mX29expr) &&
+           rs1.mX30expr.equals(rs2.mX30expr) && rs1.mSPexpr.equals(rs2.mSPexpr);
+#elif defined(GP_ARCH_mips64)
+           rs1.mPCexpr.equals(rs2.mPCexpr) && rs1.mFPexpr.equals(rs2.mFPexpr) &&
+           rs1.mSPexpr.equals(rs2.mSPexpr);
+#else
+#  error "Unknown arch"
+#endif
+  }
+};
+
+// Returns |true| for Dwarf register numbers which are members
+// of the set of registers that LUL unwinds on this target.
+static inline bool registerIsTracked(DW_REG_NUMBER reg) {
+  switch (reg) {
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+    case DW_REG_INTEL_XBP:
+    case DW_REG_INTEL_XSP:
+    case DW_REG_INTEL_XIP:
+      return true;
+#elif defined(GP_ARCH_arm)
+    case DW_REG_ARM_R7:
+    case DW_REG_ARM_R11:
+    case DW_REG_ARM_R12:
+    case DW_REG_ARM_R13:
+    case DW_REG_ARM_R14:
+    case DW_REG_ARM_R15:
+      return true;
+#elif defined(GP_ARCH_arm64)
+    case DW_REG_AARCH64_X29:
+    case DW_REG_AARCH64_X30:
+    case DW_REG_AARCH64_SP:
+      return true;
+#elif defined(GP_ARCH_mips64)
+    case DW_REG_MIPS_FP:
+    case DW_REG_MIPS_SP:
+    case DW_REG_MIPS_PC:
+      return true;
+#else
+#  error "Unknown arch"
+#endif
+    default:
+      return false;
+  }
+}
+
+////////////////////////////////////////////////////////////////
+// Extent                                                     //
+////////////////////////////////////////////////////////////////
+
+struct Extent {
+  // Three fields, which together take 8 bytes.
+  uint32_t mOffset;
+  uint16_t mLen;
+  uint16_t mDictIx;
+
+  // What this means is: suppose we are looking for the unwind rules for some
+  // code address (AVMA) `avma`.  If we can find some SecMap `secmap` such
+  // that `avma` falls in the range
+  //
+  //   `[secmap.mMapMinAVMA, secmap.mMapMaxAVMA]`
+  //
+  // then the RuleSet to use is `secmap.mDictionary[dictIx]` iff we can find
+  // an `extent` in `secmap.mExtents` such that `avma` falls into the range
+  //
+  //   `[secmap.mMapMinAVMA + extent.offset(),
+  //     secmap.mMapMinAVMA + extent.offset() + extent.len())`.
+  //
+  // Packing Extent into the minimum space is important, since there will be
+  // huge numbers of Extents -- around 3 million for libxul.so as of Sept
+  // 2020.  Here, we aim for an 8-byte size, with the field sizes chosen
+  // carefully, as follows:
+  //
+  // `offset` denotes a byte offset inside the text section for some shared
+  // object.  libxul.so is by far the largest.  As of Sept 2020 it has a text
+  // size of up to around 120MB, that is, close to 2^27 bytes.  Hence a 32-bit
+  // `offset` field gives a safety margin of around a factor of 32
+  // (== 2 ^(32 - 27)).
+  //
+  // `dictIx` indicates a unique `RuleSet` for some code address range.
+  // Experimentation on x86_64-linux indicates that only around 300 different
+  // `RuleSet`s exist, for libxul.so.  A 16-bit bit field allows up to 65536
+  // to be recorded, hence leaving us a generous safety margin.
+  //
+  // `len` indicates the length of the associated address range.
+  //
+  // Note the representation becomes unusable if either `offset` overflows 32
+  // bits or `dictIx` overflows 16 bits.  On the other hand, it does not
+  // matter (although is undesirable) if `len` overflows 16 bits, because in
+  // that case we can add multiple size-65535 entries to `secmap.mExtents` to
+  // cover the entire range.  Hence the field sizes are biased so as to give a
+  // good safety margin for `offset` and `dictIx` at the cost of stealing bits
+  // from `len`.  Almost all `len` values we will ever see in practice are
+  // 65535 or less, so stealing those bits does not matter much.
+  //
+  // If further compression is required, it would be feasible to implement
+  // Extent using 29 bits for the offset, 8 bits for the length and 11 bits
+  // for the dictionary index, giving a total of 6 bytes, provided that the
+  // data is packed into 3 uint16_t's.  That would be a bit slower, though,
+  // due to the bit packing, and it would be more fragile, in the sense that
+  // it would fail for any object with more than 512MB of text segment, or
+  // with more than 2048 different `RuleSet`s.  For the current (Sept 2020)
+  // libxul.so situation, though, it would work fine.
+
+  Extent(uint32_t offset, uint32_t len, uint32_t dictIx) {
+    MOZ_RELEASE_ASSERT(len < (1 << 16));
+    MOZ_RELEASE_ASSERT(dictIx < (1 << 16));
+    mOffset = offset;
+    mLen = len;
+    mDictIx = dictIx;
+  }
+  uint32_t offset() const { return mOffset; }
+  uint32_t len() const { return mLen; }
+  uint32_t dictIx() const { return mDictIx; }
+  void setLen(uint32_t len) {
+    MOZ_RELEASE_ASSERT(len < (1 << 16));
+    mLen = len;
+  }
+  void Print(void (*aLog)(const char*)) const {
+    char buf[64];
+    SprintfLiteral(buf, "Extent(offs=0x%x, len=%u, dictIx=%u)", this->offset(),
+                   this->len(), this->dictIx());
+    aLog(buf);
+  }
+};
+
+static_assert(sizeof(Extent) == 8);
+
+////////////////////////////////////////////////////////////////
+// SecMap                                                     //
+////////////////////////////////////////////////////////////////
+
+// A SecMap may have zero address range, temporarily, whilst RuleSets
+// are being added to it.  But adding a zero-range SecMap to a PriMap
+// will make it impossible to maintain the total order of the PriMap
+// entries, and so that can't be allowed to happen.
+
+class SecMap {
+ public:
+  // In the constructor, `mapStartAVMA` and `mapLen` define the actual
+  // (in-process) virtual addresses covered by the SecMap.  All RuleSets
+  // subsequently added to it by calling `AddRuleSet` must fall into this
+  // address range, and attempts to add ones outside the range will be
+  // ignored.  This restriction exists because the type Extent (see below)
+  // indicates an address range for a RuleSet, but for reasons of compactness,
+  // it does not contain the start address of the range.  Instead, it contains
+  // a 32-bit offset from the base address of the SecMap.  This is also the
+  // reason why the map's size is a `uint32_t` and not a `uintptr_t`.
+  //
+  // The effect is to limit this mechanism to shared objects / executables
+  // whose text section size does not exceed 4GB (2^32 bytes).  Given that, as
+  // of Sept 2020, libxul.so's text section size is around 120MB, this does
+  // not seem like much of a limitation.
+  //
+  // From the supplied `mapStartAVMA` and `mapLen`, fields `mMapMinAVMA` and
+  // `mMapMaxAVMA` are calculated.  It is intended that no two SecMaps owned
+  // by the same PriMap contain overlapping address ranges, and the PriMap
+  // logic enforces that.
+  //
+  // Some invariants:
+  //
+  // mExtents is nonempty
+  //    <=> mMapMinAVMA <= mMapMaxAVMA
+  //        && mMapMinAVMA <= apply_delta(mExtents[0].offset())
+  //        && apply_delta(mExtents[#rulesets-1].offset()
+  //             + mExtents[#rulesets-1].len() - 1) <= mMapMaxAVMA
+  //        where
+  //           apply_delta(off) = off + mMapMinAVMA
+  //
+  //        This requires that no RuleSet has zero length.
+  //
+  // mExtents is empty
+  //    <=> mMapMinAVMA > mMapMaxAVMA
+  //
+  // This doesn't constrain mMapMinAVMA and mMapMaxAVMA uniquely, so let's use
+  // mMapMinAVMA == 1 and mMapMaxAVMA == 0 to denote this case.
+
+  SecMap(uintptr_t mapStartAVMA, uint32_t mapLen, void (*aLog)(const char*));
+  ~SecMap();
+
+  // Binary search mRuleSets to find one that brackets |ia|, or nullptr
+  // if none is found.  It's not allowable to do this until PrepareRuleSets
+  // has been called first.
+  RuleSet* FindRuleSet(uintptr_t ia);
+
+  // Add a RuleSet to the collection.  The rule is copied in.  Calling
+  // this makes the map non-searchable.
+  void AddRuleSet(const RuleSet* rs, uintptr_t avma, uintptr_t len);
+
+  // Add a PfxInstr to the vector of such instrs, and return the index
+  // in the vector.  Calling this makes the map non-searchable.
+  uint32_t AddPfxInstr(PfxInstr pfxi);
+
+  // Returns the entire vector of PfxInstrs.
+  const vector<PfxInstr>* GetPfxInstrs() { return &mPfxInstrs; }
+
+  // Prepare the map for searching, by sorting it, de-overlapping entries and
+  // removing any resulting zero-length entries.  At the start of this
+  // routine, all Extents should fall within [mMapMinAVMA, mMapMaxAVMA] and
+  // not have zero length, as a result of the checks in AddRuleSet().
+  void PrepareRuleSets();
+
+  bool IsEmpty();
+
+  size_t Size() { return mExtents.size() + mDictionary.size(); }
+
+  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+
+  // The extent of this SecMap as a whole.  The extents of all contained
+  // RuleSets must fall inside this.  See comment above for details.
+  uintptr_t mMapMinAVMA;
+  uintptr_t mMapMaxAVMA;
+
+ private:
+  // False whilst adding entries; true once it is safe to call FindRuleSet.
+  // Transition (false->true) is caused by calling PrepareRuleSets().
+  bool mUsable;
+
+  // This is used to find and remove duplicate RuleSets while we are adding
+  // them to the SecMap.  Almost all RuleSets are duplicates, so de-duping
+  // them is a huge space win.  This is non-null while `mUsable` is false, and
+  // becomes null (is discarded) after the call to PrepareRuleSets, which
+  // copies all the entries into `mDictionary`.
+  mozilla::UniquePtr<
+      mozilla::HashMap<RuleSet, uint32_t, RuleSet, InfallibleAllocPolicy>>
+      mUniqifier;
+
+  // This will contain final contents of `mUniqifier`, but ordered
+  // (implicitly) by the `uint32_t` value fields, for fast access.
+  vector<RuleSet> mDictionary;
+
+  // A vector of Extents, sorted by offset value, nonoverlapping (post
+  // PrepareRuleSets()).
+  vector<Extent> mExtents;
+
+  // A vector of PfxInstrs, which are referred to by the RuleSets.
+  // These are provided as a representation of Dwarf expressions
+  // (DW_CFA_val_expression, DW_CFA_expression, DW_CFA_def_cfa_expression),
+  // are relatively expensive to evaluate, and and are therefore
+  // expected to be used only occasionally.
+  //
+  // The vector holds a bunch of separate PfxInstr programs, each one
+  // starting with a PX_Start and terminated by a PX_End, all
+  // concatenated together.  When a RuleSet can't recover a value
+  // using a self-contained LExpr, it uses a PFXEXPR whose mOffset is
+  // the index in this vector of start of the necessary PfxInstr program.
+  vector<PfxInstr> mPfxInstrs;
+
+  // A logging sink, for debugging.
+  void (*mLog)(const char*);
+};
+
+}  // namespace lul
+
+#endif  // ndef LulMainInt_h
diff --git a/tools/profiler/lul/platform-linux-lul.cpp b/tools/profiler/lul/platform-linux-lul.cpp
new file mode 100644
index 0000000000..42977133e6
--- /dev/null
+++ b/tools/profiler/lul/platform-linux-lul.cpp
@@ -0,0 +1,73 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <stdio.h>
+#include <signal.h>
+#include <string.h>
+#include <stdlib.h>
+#include <time.h>
+
+#include "platform.h"
+#include "PlatformMacros.h"
+#include "LulMain.h"
+#include "shared-libraries.h"
+#include "AutoObjectMapper.h"
+
+// Contains miscellaneous helpers that are used to connect the Gecko Profiler
+// and LUL.
+
+// Find out, in a platform-dependent way, where the code modules got
+// mapped in the process' virtual address space, and get |aLUL| to
+// load unwind info for them.
+void read_procmaps(lul::LUL* aLUL) {
+  MOZ_ASSERT(aLUL->CountMappings() == 0);
+
+#if defined(GP_OS_linux) || defined(GP_OS_android) || defined(GP_OS_freebsd)
+  SharedLibraryInfo info = SharedLibraryInfo::GetInfoForSelf();
+
+  for (size_t i = 0; i < info.GetSize(); i++) {
+    const SharedLibrary& lib = info.GetEntry(i);
+
+    std::string nativePath = lib.GetNativeDebugPath();
+
+    // We can use the standard POSIX-based mapper.
+    AutoObjectMapperPOSIX mapper(aLUL->mLog);
+
+    // Ask |mapper| to map the object.  Then hand its mapped address
+    // to NotifyAfterMap().
+    void* image = nullptr;
+    size_t size = 0;
+    bool ok = mapper.Map(&image, &size, nativePath);
+    if (ok && image && size > 0) {
+      aLUL->NotifyAfterMap(lib.GetStart(), lib.GetEnd() - lib.GetStart(),
+                           nativePath.c_str(), image);
+    } else if (!ok && lib.GetDebugName().IsEmpty()) {
+      // The object has no name and (as a consequence) the mapper failed to map
+      // it.  This happens on Linux, where GetInfoForSelf() produces such a
+      // mapping for the VDSO.  This is a problem on x86-{linux,android} because
+      // lack of knowledge about the mapped area inhibits LUL's special
+      // __kernel_syscall handling.  Hence notify |aLUL| at least of the
+      // mapping, even though it can't read any unwind information for the area.
+      aLUL->NotifyExecutableArea(lib.GetStart(), lib.GetEnd() - lib.GetStart());
+    }
+
+    // |mapper| goes out of scope at this point and so its destructor
+    // unmaps the object.
+  }
+
+#else
+#  error "Unknown platform"
+#endif
+}
+
+// LUL needs a callback for its logging sink.
+void logging_sink_for_LUL(const char* str) {
+  // These are only printed when Verbose logging is enabled (e.g. with
+  // MOZ_LOG="prof:5"). This is because LUL's logging is much more verbose than
+  // the rest of the profiler's logging, which occurs at the Info (3) and Debug
+  // (4) levels.
+  MOZ_LOG(gProfilerLog, mozilla::LogLevel::Verbose,
+          ("[%d] %s", profiler_current_process_id(), str));
+}
diff --git a/tools/profiler/lul/platform-linux-lul.h b/tools/profiler/lul/platform-linux-lul.h
new file mode 100644
index 0000000000..7c94299961
--- /dev/null
+++ b/tools/profiler/lul/platform-linux-lul.h
@@ -0,0 +1,19 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZ_PLATFORM_LINUX_LUL_H
+#define MOZ_PLATFORM_LINUX_LUL_H
+
+#include "platform.h"
+
+// Find out, in a platform-dependent way, where the code modules got
+// mapped in the process' virtual address space, and get |aLUL| to
+// load unwind info for them.
+void read_procmaps(lul::LUL* aLUL);
+
+// LUL needs a callback for its logging sink.
+void logging_sink_for_LUL(const char* str);
+
+#endif /* ndef MOZ_PLATFORM_LINUX_LUL_H */
diff --git a/tools/profiler/moz.build b/tools/profiler/moz.build
new file mode 100644
index 0000000000..2d8d7d1b2a
--- /dev/null
+++ b/tools/profiler/moz.build
@@ -0,0 +1,180 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+if CONFIG["MOZ_GECKO_PROFILER"]:
+    DEFINES["MOZ_REPLACE_MALLOC_PREFIX"] = "profiler"
+    XPIDL_MODULE = "profiler"
+    XPIDL_SOURCES += [
+        "gecko/nsIProfiler.idl",
+    ]
+    EXPORTS += [
+        "public/ChildProfilerController.h",
+        "public/GeckoProfilerReporter.h",
+        "public/ProfilerChild.h",
+        "public/ProfilerCodeAddressService.h",
+        "public/ProfilerParent.h",
+        "public/shared-libraries.h",
+    ]
+    UNIFIED_SOURCES += [
+        "core/PageInformation.cpp",
+        "core/platform.cpp",
+        "core/ProfileBuffer.cpp",
+        "core/ProfileBufferEntry.cpp",
+        "core/ProfiledThreadData.cpp",
+        "core/ProfilerBacktrace.cpp",
+        "core/ProfilerCodeAddressService.cpp",
+        "core/ProfilerMarkers.cpp",
+        "core/RegisteredThread.cpp",
+        "gecko/ChildProfilerController.cpp",
+        "gecko/nsProfilerStartParams.cpp",
+        "gecko/ProfilerChild.cpp",
+        "gecko/ProfilerIOInterposeObserver.cpp",
+        "gecko/ProfilerParent.cpp",
+    ]
+    if CONFIG["MOZ_REPLACE_MALLOC"] and CONFIG["MOZ_PROFILER_MEMORY"]:
+        SOURCES += [
+            "core/memory_hooks.cpp",  # Non-unified because of order of #includes
+        ]
+
+    XPCOM_MANIFESTS += [
+        "gecko/components.conf",
+    ]
+
+    if CONFIG["OS_TARGET"] == "Darwin":
+        # This file cannot be built in unified mode because it includes
+        # "nsLocalFile.h", which pulls in a system header which uses a type
+        # called TextRange, which conflicts with mozilla::TextRange due to
+        # a "using namespace mozilla;" declaration from a different file.
+        SOURCES += [
+            "gecko/nsProfiler.cpp",
+        ]
+    else:
+        UNIFIED_SOURCES += [
+            "gecko/nsProfiler.cpp",
+        ]
+
+    if CONFIG["OS_TARGET"] in ("Android", "Linux", "FreeBSD"):
+        if CONFIG["CPU_ARCH"] in ("arm", "aarch64", "x86", "x86_64", "mips64"):
+            UNIFIED_SOURCES += [
+                "lul/AutoObjectMapper.cpp",
+                "lul/LulCommon.cpp",
+                "lul/LulDwarf.cpp",
+                "lul/LulDwarfSummariser.cpp",
+                "lul/LulElf.cpp",
+                "lul/LulMain.cpp",
+                "lul/platform-linux-lul.cpp",
+            ]
+        # These files cannot be built in unified mode because of name clashes with mozglue headers on Android.
+        SOURCES += [
+            "core/shared-libraries-linux.cc",
+        ]
+        if not CONFIG["MOZ_CRASHREPORTER"]:
+            SOURCES += [
+                "/toolkit/crashreporter/google-breakpad/src/common/linux/elfutils.cc",
+                "/toolkit/crashreporter/google-breakpad/src/common/linux/file_id.cc",
+                "/toolkit/crashreporter/google-breakpad/src/common/linux/linux_libc_support.cc",
+                "/toolkit/crashreporter/google-breakpad/src/common/linux/memory_mapped_file.cc",
+            ]
+            if not CONFIG["HAVE_GETCONTEXT"]:
+                SOURCES += [
+                    "/toolkit/crashreporter/google-breakpad/src/common/linux/breakpad_getcontext.S"
+                ]
+        if CONFIG["CPU_ARCH"] == "arm" and CONFIG["OS_TARGET"] != "FreeBSD":
+            SOURCES += [
+                "core/EHABIStackWalk.cpp",
+            ]
+    elif CONFIG["OS_TARGET"] == "Darwin":
+        UNIFIED_SOURCES += [
+            "core/shared-libraries-macos.cc",
+        ]
+    elif CONFIG["OS_TARGET"] == "WINNT":
+        SOURCES += [
+            "core/shared-libraries-win32.cc",
+        ]
+
+    LOCAL_INCLUDES += [
+        "/caps",
+        "/docshell/base",
+        "/ipc/chromium/src",
+        "/mozglue/linker",
+        "/netwerk/base",
+        "/netwerk/protocol/http",
+        "/toolkit/crashreporter/google-breakpad/src",
+        "/tools/profiler/core/",
+        "/tools/profiler/gecko/",
+        "/xpcom/base",
+    ]
+
+    if CONFIG["OS_TARGET"] == "Android":
+        DEFINES["ANDROID_NDK_MAJOR_VERSION"] = CONFIG["ANDROID_NDK_MAJOR_VERSION"]
+        DEFINES["ANDROID_NDK_MINOR_VERSION"] = CONFIG["ANDROID_NDK_MINOR_VERSION"]
+        LOCAL_INCLUDES += [
+            # We need access to Breakpad's getcontext(3) which is suitable for Android
+            "/toolkit/crashreporter/google-breakpad/src/common/android/include",
+        ]
+
+    if CONFIG["ENABLE_TESTS"]:
+        DIRS += ["tests/gtest"]
+
+    FINAL_LIBRARY = "xul"
+
+IPDL_SOURCES += [
+    "gecko/PProfiler.ipdl",
+    "gecko/ProfilerTypes.ipdlh",
+]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+# GeckoProfiler.h and ProfilerCounts.h are the only code that's visible in
+# non-MOZ_GECKO_PROFILER builds, and they only contains no-op macros in that
+# case.
+EXPORTS += [
+    "public/GeckoProfiler.h",
+]
+
+EXPORTS.mozilla += [
+    "public/ProfileBufferEntrySerializationGeckoExtensions.h",
+    "public/ProfileJSONWriter.h",
+    # vm/GeckoProfiler.h needs to include this and doesn't like #include "ProfilerCounts.h"
+    "public/ProfilerCounts.h",
+    "public/ProfilerMarkers.h",
+    "public/ProfilerMarkersDetail.h",
+    "public/ProfilerMarkersPrerequisites.h",
+    "public/ProfilerMarkerTypes.h",
+]
+
+if CONFIG["MOZ_VTUNE"]:
+    DEFINES["MOZ_VTUNE_INSTRUMENTATION"] = True
+    UNIFIED_SOURCES += [
+        "core/VTuneProfiler.cpp",
+    ]
+
+
+if CONFIG["MOZ_TASK_TRACER"]:
+    EXPORTS += [
+        "tasktracer/GeckoTaskTracer.h",
+        "tasktracer/GeckoTaskTracerImpl.h",
+        "tasktracer/SourceEventTypeMap.h",
+        "tasktracer/TracedTaskCommon.h",
+    ]
+    UNIFIED_SOURCES += [
+        "tasktracer/GeckoTaskTracer.cpp",
+        "tasktracer/TracedTaskCommon.cpp",
+    ]
+
+XPCSHELL_TESTS_MANIFESTS += ["tests/xpcshell/xpcshell.ini"]
+MOCHITEST_CHROME_MANIFESTS += ["tests/chrome/chrome.ini"]
+BROWSER_CHROME_MANIFESTS += ["tests/browser/browser.ini"]
+
+if CONFIG["CC_TYPE"] in ("clang", "gcc"):
+    CXXFLAGS += [
+        "-Wno-error=shadow",
+        "-Wno-error=stack-protector",
+        "-Wno-ignored-qualifiers",  # due to use of breakpad headers
+    ]
+
+with Files("**"):
+    BUG_COMPONENT = ("Core", "Gecko Profiler")
diff --git a/tools/profiler/public/ChildProfilerController.h b/tools/profiler/public/ChildProfilerController.h
new file mode 100644
index 0000000000..8be428b18f
--- /dev/null
+++ b/tools/profiler/public/ChildProfilerController.h
@@ -0,0 +1,51 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ChildProfilerController_h
+#define ChildProfilerController_h
+
+#include "base/process.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/ipc/ProtocolUtils.h"
+#include "mozilla/RefPtr.h"
+#include "nsISupportsImpl.h"
+#include "nsStringFwd.h"
+
+namespace mozilla {
+
+class ProfilerChild;
+class PProfilerChild;
+class PProfilerParent;
+
+// ChildProfilerController manages the setup and teardown of ProfilerChild.
+// It's used on the main thread.
+// It manages a background thread that ProfilerChild runs on.
+class ChildProfilerController final {
+ public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(ChildProfilerController)
+
+  static already_AddRefed<ChildProfilerController> Create(
+      mozilla::ipc::Endpoint<PProfilerChild>&& aEndpoint);
+
+  [[nodiscard]] nsCString GrabShutdownProfileAndShutdown();
+  void Shutdown();
+
+ private:
+  ChildProfilerController();
+  ~ChildProfilerController();
+  void Init(mozilla::ipc::Endpoint<PProfilerChild>&& aEndpoint);
+  void ShutdownAndMaybeGrabShutdownProfileFirst(nsCString* aOutShutdownProfile);
+
+  // Called on mThread:
+  void SetupProfilerChild(mozilla::ipc::Endpoint<PProfilerChild>&& aEndpoint);
+  void ShutdownProfilerChild(nsCString* aOutShutdownProfile);
+
+  RefPtr<ProfilerChild> mProfilerChild;  // only accessed on mThread
+  RefPtr<nsIThread> mThread;
+};
+
+}  // namespace mozilla
+
+#endif  // ChildProfilerController_h
diff --git a/tools/profiler/public/GeckoProfiler.h b/tools/profiler/public/GeckoProfiler.h
new file mode 100644
index 0000000000..7433a3d2ea
--- /dev/null
+++ b/tools/profiler/public/GeckoProfiler.h
@@ -0,0 +1,1172 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// The Gecko Profiler is an always-on profiler that takes fast and low overhead
+// samples of the program execution using only userspace functionality for
+// portability. The goal of this module is to provide performance data in a
+// generic cross-platform way without requiring custom tools or kernel support.
+//
+// Samples are collected to form a timeline with optional timeline event
+// (markers) used for filtering. The samples include both native stacks and
+// platform-independent "label stack" frames.
+
+#ifndef GeckoProfiler_h
+#define GeckoProfiler_h
+
+// everything in here is also safe to include unconditionally, and only defines
+// empty macros if MOZ_GECKO_PROFILER is unset
+#include "BaseProfiler.h"
+#include "mozilla/ProfilerCounts.h"
+
+// ProfilerMarkers.h is #included in the middle of this header!
+// #include "mozilla/ProfilerMarkers.h"
+
+#ifndef MOZ_GECKO_PROFILER
+
+#  include "mozilla/ProfilerMarkers.h"
+#  include "mozilla/UniquePtr.h"
+
+// This file can be #included unconditionally. However, everything within this
+// file must be guarded by a #ifdef MOZ_GECKO_PROFILER, *except* for the
+// following macros and functions, which encapsulate the most common operations
+// and thus avoid the need for many #ifdefs.
+
+#  define AUTO_PROFILER_INIT
+#  define AUTO_PROFILER_INIT2
+
+#  define PROFILER_REGISTER_THREAD(name)
+#  define PROFILER_UNREGISTER_THREAD()
+#  define AUTO_PROFILER_REGISTER_THREAD(name)
+
+#  define AUTO_PROFILER_THREAD_SLEEP
+#  define AUTO_PROFILER_THREAD_WAKE
+
+#  define PROFILER_JS_INTERRUPT_CALLBACK()
+
+#  define PROFILER_SET_JS_CONTEXT(cx)
+#  define PROFILER_CLEAR_JS_CONTEXT()
+
+#  define AUTO_PROFILER_LABEL(label, categoryPair)
+#  define AUTO_PROFILER_LABEL_CATEGORY_PAIR(categoryPair)
+#  define AUTO_PROFILER_LABEL_DYNAMIC_CSTR(label, categoryPair, cStr)
+#  define AUTO_PROFILER_LABEL_DYNAMIC_CSTR_NONSENSITIVE(label, categoryPair, \
+                                                        cStr)
+#  define AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING(label, categoryPair, nsCStr)
+#  define AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING_NONSENSITIVE( \
+      label, categoryPair, nsCStr)
+#  define AUTO_PROFILER_LABEL_DYNAMIC_LOSSY_NSSTRING(label, categoryPair, nsStr)
+#  define AUTO_PROFILER_LABEL_FAST(label, categoryPair, ctx)
+#  define AUTO_PROFILER_LABEL_DYNAMIC_FAST(label, dynamicString, categoryPair, \
+                                           ctx, flags)
+
+// Function stubs for when MOZ_GECKO_PROFILER is not defined.
+
+// This won't be used, it's just there to allow the empty definition of
+// `profiler_get_backtrace`.
+struct ProfilerBacktrace {};
+using UniqueProfilerBacktrace = mozilla::UniquePtr<int>;
+
+// Get/Capture-backtrace functions can return nullptr or false, the result
+// should be fed to another empty macro or stub anyway.
+
+static inline UniqueProfilerBacktrace profiler_get_backtrace() {
+  return nullptr;
+}
+
+static inline bool profiler_capture_backtrace_into(
+    mozilla::ProfileChunkedBuffer& aChunkedBuffer) {
+  return false;
+}
+static inline mozilla::UniquePtr<mozilla::ProfileChunkedBuffer>
+profiler_capture_backtrace() {
+  return nullptr;
+}
+
+#else  // !MOZ_GECKO_PROFILER
+
+#  include "js/ProfilingCategory.h"
+#  include "js/ProfilingStack.h"
+#  include "js/RootingAPI.h"
+#  include "mozilla/Assertions.h"
+#  include "mozilla/Atomics.h"
+#  include "mozilla/Attributes.h"
+#  include "mozilla/Maybe.h"
+#  include "mozilla/PowerOfTwo.h"
+#  include "mozilla/Sprintf.h"
+#  include "mozilla/ThreadLocal.h"
+#  include "mozilla/TimeStamp.h"
+#  include "mozilla/UniquePtr.h"
+#  include "nscore.h"
+#  include "nsString.h"
+
+#  include <functional>
+#  include <stdint.h>
+
+class ProfilerBacktrace;
+class ProfilerCodeAddressService;
+struct JSContext;
+
+namespace JS {
+struct RecordAllocationInfo;
+}
+
+namespace mozilla {
+class ProfileBufferControlledChunkManager;
+class ProfileChunkedBuffer;
+namespace baseprofiler {
+class SpliceableJSONWriter;
+}  // namespace baseprofiler
+namespace net {
+struct TimingStruct;
+enum CacheDisposition : uint8_t;
+}  // namespace net
+}  // namespace mozilla
+class nsIURI;
+class nsIDocShell;
+
+namespace mozilla {
+class MallocAllocPolicy;
+template <class T, size_t MinInlineCapacity, class AllocPolicy>
+class Vector;
+}  // namespace mozilla
+
+// Macros used by the AUTO_PROFILER_* macros below.
+#  define PROFILER_RAII_PASTE(id, line) id##line
+#  define PROFILER_RAII_EXPAND(id, line) PROFILER_RAII_PASTE(id, line)
+#  define PROFILER_RAII PROFILER_RAII_EXPAND(raiiObject, __LINE__)
+
+//---------------------------------------------------------------------------
+// Profiler features
+//---------------------------------------------------------------------------
+
+// Higher-order macro containing all the feature info in one place. Define
+// |MACRO| appropriately to extract the relevant parts. Note that the number
+// values are used internally only and so can be changed without consequence.
+// Any changes to this list should also be applied to the feature list in
+// toolkit/components/extensions/schemas/geckoProfiler.json.
+#  define PROFILER_FOR_EACH_FEATURE(MACRO)                                     \
+    MACRO(0, "java", Java, "Profile Java code, Android only")                  \
+                                                                               \
+    MACRO(1, "js", JS,                                                         \
+          "Get the JS engine to expose the JS stack to the profiler")          \
+                                                                               \
+    /* The DevTools profiler doesn't want the native addresses. */             \
+    MACRO(2, "leaf", Leaf, "Include the C++ leaf node if not stackwalking")    \
+                                                                               \
+    MACRO(3, "mainthreadio", MainThreadIO, "Add main thread file I/O")         \
+                                                                               \
+    MACRO(4, "fileio", FileIO,                                                 \
+          "Add file I/O from all profiled threads, implies mainthreadio")      \
+                                                                               \
+    MACRO(5, "fileioall", FileIOAll,                                           \
+          "Add file I/O from all threads, implies fileio")                     \
+                                                                               \
+    MACRO(6, "noiostacks", NoIOStacks,                                         \
+          "File I/O markers do not capture stacks, to reduce overhead")        \
+                                                                               \
+    MACRO(7, "screenshots", Screenshots,                                       \
+          "Take a snapshot of the window on every composition")                \
+                                                                               \
+    MACRO(8, "seqstyle", SequentialStyle,                                      \
+          "Disable parallel traversal in styling")                             \
+                                                                               \
+    MACRO(9, "stackwalk", StackWalk,                                           \
+          "Walk the C++ stack, not available on all platforms")                \
+                                                                               \
+    MACRO(10, "tasktracer", TaskTracer,                                        \
+          "Start profiling with feature TaskTracer")                           \
+                                                                               \
+    MACRO(11, "threads", Threads, "Profile the registered secondary threads")  \
+                                                                               \
+    MACRO(12, "jstracer", JSTracer, "Enable tracing of the JavaScript engine") \
+                                                                               \
+    MACRO(13, "jsallocations", JSAllocations,                                  \
+          "Have the JavaScript engine track allocations")                      \
+                                                                               \
+    MACRO(14, "nostacksampling", NoStackSampling,                              \
+          "Disable all stack sampling: Cancels \"js\", \"leaf\", "             \
+          "\"stackwalk\" and labels")                                          \
+                                                                               \
+    MACRO(15, "preferencereads", PreferenceReads,                              \
+          "Track when preferences are read")                                   \
+                                                                               \
+    MACRO(16, "nativeallocations", NativeAllocations,                          \
+          "Collect the stacks from a smaller subset of all native "            \
+          "allocations, biasing towards collecting larger allocations")        \
+                                                                               \
+    MACRO(17, "ipcmessages", IPCMessages,                                      \
+          "Have the IPC layer track cross-process messages")                   \
+                                                                               \
+    MACRO(18, "audiocallbacktracing", AudioCallbackTracing,                    \
+          "Audio callback tracing")                                            \
+                                                                               \
+    MACRO(19, "cpu", CPUUtilization, "CPU utilization")
+
+struct ProfilerFeature {
+#  define DECLARE(n_, str_, Name_, desc_)                     \
+    static constexpr uint32_t Name_ = (1u << n_);             \
+    static constexpr bool Has##Name_(uint32_t aFeatures) {    \
+      return aFeatures & Name_;                               \
+    }                                                         \
+    static constexpr void Set##Name_(uint32_t& aFeatures) {   \
+      aFeatures |= Name_;                                     \
+    }                                                         \
+    static constexpr void Clear##Name_(uint32_t& aFeatures) { \
+      aFeatures &= ~Name_;                                    \
+    }
+
+  // Define a bitfield constant, a getter, and two setters for each feature.
+  PROFILER_FOR_EACH_FEATURE(DECLARE)
+
+#  undef DECLARE
+};
+
+namespace mozilla {
+namespace profiler {
+namespace detail {
+
+// RacyFeatures is only defined in this header file so that its methods can
+// be inlined into profiler_is_active(). Please do not use anything from the
+// detail namespace outside the profiler.
+
+// Within the profiler's code, the preferred way to check profiler activeness
+// and features is via ActivePS(). However, that requires locking gPSMutex.
+// There are some hot operations where absolute precision isn't required, so we
+// duplicate the activeness/feature state in a lock-free manner in this class.
+class RacyFeatures {
+ public:
+  static void SetActive(uint32_t aFeatures) {
+    sActiveAndFeatures = Active | aFeatures;
+  }
+
+  static void SetInactive() { sActiveAndFeatures = 0; }
+
+  static void SetPaused() { sActiveAndFeatures |= Paused; }
+
+  static void SetUnpaused() { sActiveAndFeatures &= ~Paused; }
+
+  static void SetSamplingPaused() { sActiveAndFeatures |= SamplingPaused; }
+
+  static void SetSamplingUnpaused() { sActiveAndFeatures &= ~SamplingPaused; }
+
+  static mozilla::Maybe<uint32_t> FeaturesIfActive() {
+    if (uint32_t af = sActiveAndFeatures; af & Active) {
+      // Active, remove the Active&Paused bits to get all features.
+      return Some(af & ~(Active | Paused | SamplingPaused));
+    }
+    return Nothing();
+  }
+
+  static mozilla::Maybe<uint32_t> FeaturesIfActiveAndUnpaused() {
+    if (uint32_t af = sActiveAndFeatures; (af & (Active | Paused)) == Active) {
+      // Active but not fully paused, remove the Active and sampling-paused bits
+      // to get all features.
+      return Some(af & ~(Active | SamplingPaused));
+    }
+    return Nothing();
+  }
+
+  static bool IsActive() { return uint32_t(sActiveAndFeatures) & Active; }
+
+  static bool IsActiveWithFeature(uint32_t aFeature) {
+    uint32_t af = sActiveAndFeatures;  // copy it first
+    return (af & Active) && (af & aFeature);
+  }
+
+  // True if profiler is active, and not fully paused.
+  // Note that periodic sampling *could* be paused!
+  static bool IsActiveAndUnpaused() {
+    uint32_t af = sActiveAndFeatures;  // copy it first
+    return (af & Active) && !(af & Paused);
+  }
+
+  // True if profiler is active, and sampling is not paused (though generic
+  // `SetPaused()` or specific `SetSamplingPaused()`).
+  static bool IsActiveAndSamplingUnpaused() {
+    uint32_t af = sActiveAndFeatures;  // copy it first
+    return (af & Active) && !(af & (Paused | SamplingPaused));
+  }
+
+ private:
+  static constexpr uint32_t Active = 1u << 31;
+  static constexpr uint32_t Paused = 1u << 30;
+  static constexpr uint32_t SamplingPaused = 1u << 29;
+
+// Ensure Active/Paused don't overlap with any of the feature bits.
+#  define NO_OVERLAP(n_, str_, Name_, desc_)                \
+    static_assert(ProfilerFeature::Name_ != SamplingPaused, \
+                  "bad feature value");
+
+  PROFILER_FOR_EACH_FEATURE(NO_OVERLAP);
+
+#  undef NO_OVERLAP
+
+  // We combine the active bit with the feature bits so they can be read or
+  // written in a single atomic operation. Accesses to this atomic are not
+  // recorded by web replay as they may occur at non-deterministic points.
+  static mozilla::Atomic<uint32_t, mozilla::MemoryOrdering::Relaxed>
+      sActiveAndFeatures;
+};
+
+bool IsThreadBeingProfiled();
+bool IsThreadRegistered();
+
+}  // namespace detail
+}  // namespace profiler
+}  // namespace mozilla
+
+//---------------------------------------------------------------------------
+// Start and stop the profiler
+//---------------------------------------------------------------------------
+
+static constexpr mozilla::PowerOfTwo32 PROFILER_DEFAULT_ENTRIES =
+#  if !defined(GP_PLAT_arm_android)
+    mozilla::MakePowerOfTwo32<8 * 1024 * 1024>();  // 8M entries = 64MB
+#  else
+    mozilla::MakePowerOfTwo32<2 * 1024 * 1024>();  // 2M entries = 16MB
+#  endif
+
+// Startup profiling usually need to capture more data, especially on slow
+// systems.
+// Note: Keep in sync with GeckoThread.maybeStartGeckoProfiler:
+// https://searchfox.org/mozilla-central/source/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java
+static constexpr mozilla::PowerOfTwo32 PROFILER_DEFAULT_STARTUP_ENTRIES =
+#  if !defined(GP_PLAT_arm_android)
+    mozilla::MakePowerOfTwo32<64 * 1024 * 1024>();  // 64M entries = 512MB
+#  else
+    mozilla::MakePowerOfTwo32<8 * 1024 * 1024>();  // 8M entries = 64MB
+#  endif
+
+#  define PROFILER_DEFAULT_DURATION 20 /* seconds, for tests only */
+// Note: Keep in sync with GeckoThread.maybeStartGeckoProfiler:
+// https://searchfox.org/mozilla-central/source/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java
+#  define PROFILER_DEFAULT_INTERVAL 1  /* millisecond */
+#  define PROFILER_MAX_INTERVAL 5000   /* milliseconds */
+
+// Initialize the profiler. If MOZ_PROFILER_STARTUP is set the profiler will
+// also be started. This call must happen before any other profiler calls
+// (except profiler_start(), which will call profiler_init() if it hasn't
+// already run).
+void profiler_init(void* stackTop);
+void profiler_init_threadmanager();
+
+// Call this as early as possible
+#  define AUTO_PROFILER_INIT mozilla::AutoProfilerInit PROFILER_RAII
+// Call this after the nsThreadManager is Init()ed
+#  define AUTO_PROFILER_INIT2 mozilla::AutoProfilerInit2 PROFILER_RAII
+
+enum class IsFastShutdown {
+  No,
+  Yes,
+};
+
+// Clean up the profiler module, stopping it if required. This function may
+// also save a shutdown profile if requested. No profiler calls should happen
+// after this point and all profiling stack labels should have been popped.
+void profiler_shutdown(IsFastShutdown aIsFastShutdown = IsFastShutdown::No);
+
+// Start the profiler -- initializing it first if necessary -- with the
+// selected options. Stops and restarts the profiler if it is already active.
+// After starting the profiler is "active". The samples will be recorded in a
+// circular buffer.
+//   "aCapacity" is the maximum number of 8-bytes entries in the profiler's
+//               circular buffer.
+//   "aInterval" the sampling interval, measured in millseconds.
+//   "aFeatures" is the feature set. Features unsupported by this
+//               platform/configuration are ignored.
+//   "aFilters" is the list of thread filters. Threads that do not match any
+//              of the filters are not profiled. A filter matches a thread if
+//              (a) the thread name contains the filter as a case-insensitive
+//                  substring, or
+//              (b) the filter is of the form "pid:<n>" where n is the process
+//                  id of the process that the thread is running in.
+//   "aActiveBrowsingContextID" Browsing Context of the active browser screen's
+//               active tab. It's being used to determine the profiled tab.
+//               It's "0" if we failed to get the ID.
+//   "aDuration" is the duration of entries in the profiler's circular buffer.
+void profiler_start(
+    mozilla::PowerOfTwo32 aCapacity, double aInterval, uint32_t aFeatures,
+    const char** aFilters, uint32_t aFilterCount,
+    uint64_t aActiveBrowsingContextID,
+    const mozilla::Maybe<double>& aDuration = mozilla::Nothing());
+
+// Stop the profiler and discard the profile without saving it. A no-op if the
+// profiler is inactive. After stopping the profiler is "inactive".
+void profiler_stop();
+
+// If the profiler is inactive, start it. If it's already active, restart it if
+// the requested settings differ from the current settings. Both the check and
+// the state change are performed while the profiler state is locked.
+// The only difference to profiler_start is that the current buffer contents are
+// not discarded if the profiler is already running with the requested settings.
+void profiler_ensure_started(
+    mozilla::PowerOfTwo32 aCapacity, double aInterval, uint32_t aFeatures,
+    const char** aFilters, uint32_t aFilterCount,
+    uint64_t aActiveBrowsingContextID,
+    const mozilla::Maybe<double>& aDuration = mozilla::Nothing());
+
+//---------------------------------------------------------------------------
+// Control the profiler
+//---------------------------------------------------------------------------
+
+// Register/unregister threads with the profiler. Both functions operate the
+// same whether the profiler is active or inactive.
+#  define PROFILER_REGISTER_THREAD(name)         \
+    do {                                         \
+      char stackTop;                             \
+      profiler_register_thread(name, &stackTop); \
+    } while (0)
+#  define PROFILER_UNREGISTER_THREAD() profiler_unregister_thread()
+ProfilingStack* profiler_register_thread(const char* name, void* guessStackTop);
+void profiler_unregister_thread();
+
+// Registers a DOM Window (the JS global `window`) with the profiler. Each
+// Window _roughly_ corresponds to a single document loaded within a
+// BrowsingContext. The unique IDs for both the Window and BrowsingContext are
+// recorded to allow correlating different Windows loaded within the same tab or
+// frame element.
+//
+// We register pages for each navigations but we do not register
+// history.pushState or history.replaceState since they correspond to the same
+// Inner Window ID. When a Browsing context is first loaded, the first url
+// loaded in it will be about:blank. Because of that, this call keeps the first
+// non-about:blank registration of window and discards the previous one.
+//
+//   "aBrowsingContextID"     is the ID of the browsing context that document
+//                            belongs to. That's used to determine the tab of
+//                            that page.
+//   "aInnerWindowID"         is the ID of the `window` global object of that
+//                            document.
+//   "aUrl"                   is the URL of the page.
+//   "aEmbedderInnerWindowID" is the inner window id of embedder. It's used to
+//                            determine sub documents of a page.
+void profiler_register_page(uint64_t aBrowsingContextID,
+                            uint64_t aInnerWindowID, const nsCString& aUrl,
+                            uint64_t aEmbedderInnerWindowID);
+// Unregister page with the profiler.
+//
+// Take a Inner Window ID and unregister the page entry that has the same ID.
+void profiler_unregister_page(uint64_t aRegisteredInnerWindowID);
+
+// Remove all registered and unregistered pages in the profiler.
+void profiler_clear_all_pages();
+
+class BaseProfilerCount;
+void profiler_add_sampled_counter(BaseProfilerCount* aCounter);
+void profiler_remove_sampled_counter(BaseProfilerCount* aCounter);
+
+// Register and unregister a thread within a scope.
+#  define AUTO_PROFILER_REGISTER_THREAD(name) \
+    mozilla::AutoProfilerRegisterThread PROFILER_RAII(name)
+
+enum class SamplingState {
+  JustStopped,  // Sampling loop has just stopped without sampling, between the
+                // callback registration and now.
+  SamplingPaused,  // Profiler is active but sampling loop has gone through a
+                   // pause.
+  NoStackSamplingCompleted,  // A full sampling loop has completed in
+                             // no-stack-sampling mode.
+  SamplingCompleted          // A full sampling loop has completed.
+};
+
+using PostSamplingCallback = std::function<void(SamplingState)>;
+
+// Install a callback to be invoked at the end of the next sampling loop.
+// - `false` if profiler is not active, `aCallback` will stay untouched.
+// - `true` if `aCallback` was successfully moved-from into internal storage,
+//   and *will* be invoked at the end of the next sampling cycle. Note that this
+//   will happen on the Sampler thread, and will block further sampling, so
+//   please be mindful not to block for a long time (e.g., just dispatch a
+//   runnable to another thread.) Calling profiler functions from the callback
+//   is allowed.
+[[nodiscard]] bool profiler_callback_after_sampling(
+    PostSamplingCallback&& aCallback);
+
+// Pause and resume the profiler. No-ops if the profiler is inactive. While
+// paused the profile will not take any samples and will not record any data
+// into its buffers. The profiler remains fully initialized in this state.
+// Timeline markers will still be stored. This feature will keep JavaScript
+// profiling enabled, thus allowing toggling the profiler without invalidating
+// the JIT.
+void profiler_pause();
+void profiler_resume();
+
+// Only pause and resume the periodic sampling loop, including stack sampling,
+// counters, and profiling overheads.
+void profiler_pause_sampling();
+void profiler_resume_sampling();
+
+// These functions tell the profiler that a thread went to sleep so that we can
+// avoid sampling it while it's sleeping. Calling profiler_thread_sleep()
+// twice without an intervening profiler_thread_wake() is an error. All three
+// functions operate the same whether the profiler is active or inactive.
+void profiler_thread_sleep();
+void profiler_thread_wake();
+
+// Mark a thread as asleep/awake within a scope.
+#  define AUTO_PROFILER_THREAD_SLEEP \
+    mozilla::AutoProfilerThreadSleep PROFILER_RAII
+#  define AUTO_PROFILER_THREAD_WAKE \
+    mozilla::AutoProfilerThreadWake PROFILER_RAII
+
+// Called by the JSRuntime's operation callback. This is used to start profiling
+// on auxiliary threads. Operates the same whether the profiler is active or
+// not.
+#  define PROFILER_JS_INTERRUPT_CALLBACK() profiler_js_interrupt_callback()
+void profiler_js_interrupt_callback();
+
+// Set and clear the current thread's JSContext.
+#  define PROFILER_SET_JS_CONTEXT(cx) profiler_set_js_context(cx)
+#  define PROFILER_CLEAR_JS_CONTEXT() profiler_clear_js_context()
+void profiler_set_js_context(JSContext* aCx);
+void profiler_clear_js_context();
+
+//---------------------------------------------------------------------------
+// Get information from the profiler
+//---------------------------------------------------------------------------
+
+// Is the profiler active? Note: the return value of this function can become
+// immediately out-of-date. E.g. the profile might be active but then
+// profiler_stop() is called immediately afterward. One common and reasonable
+// pattern of usage is the following:
+//
+//   if (profiler_is_active()) {
+//     ExpensiveData expensiveData = CreateExpensiveData();
+//     PROFILER_OPERATION(expensiveData);
+//   }
+//
+// where PROFILER_OPERATION is a no-op if the profiler is inactive. In this
+// case the profiler_is_active() check is just an optimization -- it prevents
+// us calling CreateExpensiveData() unnecessarily in most cases, but the
+// expensive data will end up being created but not used if another thread
+// stops the profiler between the CreateExpensiveData() and PROFILER_OPERATION
+// calls.
+inline bool profiler_is_active() {
+  return mozilla::profiler::detail::RacyFeatures::IsActive();
+}
+
+// Same as profiler_is_active(), but with the same extra checks that determine
+// if the profiler would currently store markers. So this should be used before
+// doing some potentially-expensive work that's used in a marker. E.g.:
+//
+//   if (profiler_can_accept_markers()) {
+//     ExpensiveMarkerPayload expensivePayload = CreateExpensivePayload();
+//     BASE_PROFILER_ADD_MARKER_WITH_PAYLOAD(name, OTHER, expensivePayload);
+//   }
+inline bool profiler_can_accept_markers() {
+  return mozilla::profiler::detail::RacyFeatures::IsActiveAndUnpaused();
+}
+
+// Is the profiler active, and is the current thread being profiled?
+// (Same caveats and recommented usage as profiler_is_active().)
+inline bool profiler_thread_is_being_profiled() {
+  return profiler_is_active() &&
+         mozilla::profiler::detail::IsThreadBeingProfiled();
+}
+
+// During profiling, if the current thread is registered, return true
+// (regardless of whether it is actively being profiled).
+// (Same caveats and recommented usage as profiler_is_active().)
+inline bool profiler_is_active_and_thread_is_registered() {
+  return profiler_is_active() &&
+         mozilla::profiler::detail::IsThreadRegistered();
+}
+
+// Is the profiler active and paused? Returns false if the profiler is inactive.
+bool profiler_is_paused();
+
+// Is the profiler active and sampling is paused? Returns false if the profiler
+// is inactive.
+bool profiler_is_sampling_paused();
+
+// Is the current thread sleeping?
+bool profiler_thread_is_sleeping();
+
+// Get all the features supported by the profiler that are accepted by
+// profiler_start(). The result is the same whether the profiler is active or
+// not.
+uint32_t profiler_get_available_features();
+
+// Returns the full feature set if the profiler is active.
+// Note: the return value can become immediately out-of-date, much like the
+// return value of profiler_is_active().
+inline mozilla::Maybe<uint32_t> profiler_features_if_active() {
+  return mozilla::profiler::detail::RacyFeatures::FeaturesIfActive();
+}
+
+// Returns the full feature set if the profiler is active and unpaused.
+// Note: the return value can become immediately out-of-date, much like the
+// return value of profiler_is_active().
+inline mozilla::Maybe<uint32_t> profiler_features_if_active_and_unpaused() {
+  return mozilla::profiler::detail::RacyFeatures::FeaturesIfActiveAndUnpaused();
+}
+
+// Check if a profiler feature (specified via the ProfilerFeature type) is
+// active. Returns false if the profiler is inactive. Note: the return value
+// can become immediately out-of-date, much like the return value of
+// profiler_is_active().
+bool profiler_feature_active(uint32_t aFeature);
+
+// Get the params used to start the profiler. Returns 0 and an empty vector
+// (via outparams) if the profile is inactive. It's possible that the features
+// returned may be slightly different to those requested due to required
+// adjustments.
+void profiler_get_start_params(
+    int* aEntrySize, mozilla::Maybe<double>* aDuration, double* aInterval,
+    uint32_t* aFeatures,
+    mozilla::Vector<const char*, 0, mozilla::MallocAllocPolicy>* aFilters,
+    uint64_t* aActiveBrowsingContextID);
+
+// Get the chunk manager used in the current profiling session, or null.
+mozilla::ProfileBufferControlledChunkManager*
+profiler_get_controlled_chunk_manager();
+
+// The number of milliseconds since the process started. Operates the same
+// whether the profiler is active or inactive.
+double profiler_time();
+
+// Get the current process's ID.
+int profiler_current_process_id();
+
+// Get the current thread's ID.
+int profiler_current_thread_id();
+
+// Statically initialized to 0, then set once from profiler_init(), which should
+// be called from the main thread before any other use of the profiler.
+extern int scProfilerMainThreadId;
+
+inline int profiler_main_thread_id() { return scProfilerMainThreadId; }
+
+inline bool profiler_is_main_thread() {
+  return profiler_current_thread_id() == profiler_main_thread_id();
+}
+
+// An object of this class is passed to profiler_suspend_and_sample_thread().
+// For each stack frame, one of the Collect methods will be called.
+class ProfilerStackCollector {
+ public:
+  // Some collectors need to worry about possibly overwriting previous
+  // generations of data. If that's not an issue, this can return Nothing,
+  // which is the default behaviour.
+  virtual mozilla::Maybe<uint64_t> SamplePositionInBuffer() {
+    return mozilla::Nothing();
+  }
+  virtual mozilla::Maybe<uint64_t> BufferRangeStart() {
+    return mozilla::Nothing();
+  }
+
+  // This method will be called once if the thread being suspended is the main
+  // thread. Default behaviour is to do nothing.
+  virtual void SetIsMainThread() {}
+
+  // WARNING: The target thread is suspended when the Collect methods are
+  // called. Do not try to allocate or acquire any locks, or you could
+  // deadlock. The target thread will have resumed by the time this function
+  // returns.
+
+  virtual void CollectNativeLeafAddr(void* aAddr) = 0;
+
+  virtual void CollectJitReturnAddr(void* aAddr) = 0;
+
+  virtual void CollectWasmFrame(const char* aLabel) = 0;
+
+  virtual void CollectProfilingStackFrame(
+      const js::ProfilingStackFrame& aFrame) = 0;
+};
+
+// This method suspends the thread identified by aThreadId, samples its
+// profiling stack, JS stack, and (optionally) native stack, passing the
+// collected frames into aCollector. aFeatures dictates which compiler features
+// are used. |Leaf| is the only relevant one.
+void profiler_suspend_and_sample_thread(int aThreadId, uint32_t aFeatures,
+                                        ProfilerStackCollector& aCollector,
+                                        bool aSampleNative = true);
+
+struct ProfilerBacktraceDestructor {
+  void operator()(ProfilerBacktrace*);
+};
+
+using UniqueProfilerBacktrace =
+    mozilla::UniquePtr<ProfilerBacktrace, ProfilerBacktraceDestructor>;
+
+// Immediately capture the current thread's call stack, store it in the provided
+// buffer (usually to avoid allocations if you can construct the buffer on the
+// stack). Returns false if unsuccessful, or if the profiler is inactive.
+bool profiler_capture_backtrace_into(
+    mozilla::ProfileChunkedBuffer& aChunkedBuffer);
+
+// Immediately capture the current thread's call stack, and return it in a
+// ProfileChunkedBuffer (usually for later use in MarkerStack::TakeBacktrace()).
+// May be null if unsuccessful, or if the profiler is inactive.
+mozilla::UniquePtr<mozilla::ProfileChunkedBuffer> profiler_capture_backtrace();
+
+// Immediately capture the current thread's call stack, and return it in a
+// ProfilerBacktrace (usually for later use in marker function that take a
+// ProfilerBacktrace). May be null if unsuccessful, or if the profiler is
+// inactive.
+UniqueProfilerBacktrace profiler_get_backtrace();
+
+struct ProfilerStats {
+  unsigned n = 0;
+  double sum = 0;
+  double min = std::numeric_limits<double>::max();
+  double max = 0;
+  void Count(double v) {
+    ++n;
+    sum += v;
+    if (v < min) {
+      min = v;
+    }
+    if (v > max) {
+      max = v;
+    }
+  }
+};
+
+struct ProfilerBufferInfo {
+  // Index of the oldest entry.
+  uint64_t mRangeStart;
+  // Index of the newest entry.
+  uint64_t mRangeEnd;
+  // Buffer capacity in number of 8-byte entries.
+  uint32_t mEntryCount;
+  // Sampling stats: Interval between successive samplings.
+  ProfilerStats mIntervalsUs;
+  // Sampling stats: Total sampling duration. (Split detail below.)
+  ProfilerStats mOverheadsUs;
+  // Sampling stats: Time to acquire the lock before sampling.
+  ProfilerStats mLockingsUs;
+  // Sampling stats: Time to discard expired data.
+  ProfilerStats mCleaningsUs;
+  // Sampling stats: Time to collect counter data.
+  ProfilerStats mCountersUs;
+  // Sampling stats: Time to sample thread stacks.
+  ProfilerStats mThreadsUs;
+};
+
+// Get information about the current buffer status.
+// Returns Nothing() if the profiler is inactive.
+//
+// This information may be useful to a user-interface displaying the current
+// status of the profiler, allowing the user to get a sense for how fast the
+// buffer is being written to, and how much data is visible.
+mozilla::Maybe<ProfilerBufferInfo> profiler_get_buffer_info();
+
+// ProfilerMarkers.h requires some stuff from this header.
+// TODO: Move common stuff to shared header, and move this #include to the top.
+#  include "mozilla/ProfilerMarkers.h"
+
+//---------------------------------------------------------------------------
+// Put profiling data into the profiler (labels and markers)
+//---------------------------------------------------------------------------
+
+// Insert an RAII object in this scope to enter a label stack frame. Any
+// samples collected in this scope will contain this label in their stack.
+// The label argument must be a static C string. It is usually of the
+// form "ClassName::FunctionName". (Ideally we'd use the compiler to provide
+// that for us, but __func__ gives us the function name without the class
+// name.) If the label applies to only part of a function, you can qualify it
+// like this: "ClassName::FunctionName:PartName".
+//
+// Use AUTO_PROFILER_LABEL_DYNAMIC_* if you want to add additional / dynamic
+// information to the label stack frame.
+#  define AUTO_PROFILER_LABEL(label, categoryPair) \
+    mozilla::AutoProfilerLabel PROFILER_RAII(      \
+        label, nullptr, JS::ProfilingCategoryPair::categoryPair)
+
+// Similar to AUTO_PROFILER_LABEL, but with only one argument: the category
+// pair. The label string is taken from the category pair. This is convenient
+// for labels like AUTO_PROFILER_LABEL_CATEGORY_PAIR(GRAPHICS_LayerBuilding)
+// which would otherwise just repeat the string.
+#  define AUTO_PROFILER_LABEL_CATEGORY_PAIR(categoryPair)     \
+    mozilla::AutoProfilerLabel PROFILER_RAII(                 \
+        "", nullptr, JS::ProfilingCategoryPair::categoryPair, \
+        uint32_t(js::ProfilingStackFrame::Flags::             \
+                     LABEL_DETERMINED_BY_CATEGORY_PAIR))
+
+// Similar to AUTO_PROFILER_LABEL, but with an additional string. The inserted
+// RAII object stores the cStr pointer in a field; it does not copy the string.
+//
+// WARNING: This means that the string you pass to this macro needs to live at
+// least until the end of the current scope. Be careful using this macro with
+// ns[C]String; the other AUTO_PROFILER_LABEL_DYNAMIC_* macros below are
+// preferred because they avoid this problem.
+//
+// If the profiler samples the current thread and walks the label stack while
+// this RAII object is on the stack, it will copy the supplied string into the
+// profile buffer. So there's one string copy operation, and it happens at
+// sample time.
+//
+// Compare this to the plain AUTO_PROFILER_LABEL macro, which only accepts
+// literal strings: When the label stack frames generated by
+// AUTO_PROFILER_LABEL are sampled, no string copy needs to be made because the
+// profile buffer can just store the raw pointers to the literal strings.
+// Consequently, AUTO_PROFILER_LABEL frames take up considerably less space in
+// the profile buffer than AUTO_PROFILER_LABEL_DYNAMIC_* frames.
+#  define AUTO_PROFILER_LABEL_DYNAMIC_CSTR(label, categoryPair, cStr) \
+    mozilla::AutoProfilerLabel PROFILER_RAII(                         \
+        label, cStr, JS::ProfilingCategoryPair::categoryPair)
+
+// Like AUTO_PROFILER_LABEL_DYNAMIC_CSTR, but with the NONSENSITIVE flag to
+// note that it does not contain sensitive information (so we can include it
+// in, for example, the BackgroundHangMonitor)
+#  define AUTO_PROFILER_LABEL_DYNAMIC_CSTR_NONSENSITIVE(label, categoryPair, \
+                                                        cStr)                \
+    mozilla::AutoProfilerLabel PROFILER_RAII(                                \
+        label, cStr, JS::ProfilingCategoryPair::categoryPair,                \
+        uint32_t(js::ProfilingStackFrame::Flags::NONSENSITIVE))
+
+// Similar to AUTO_PROFILER_LABEL_DYNAMIC_CSTR, but takes an nsACString.
+//
+// Note: The use of the Maybe<>s ensures the scopes for the dynamic string and
+// the AutoProfilerLabel are appropriate, while also not incurring the runtime
+// cost of the string assignment unless the profiler is active. Therefore,
+// unlike AUTO_PROFILER_LABEL and AUTO_PROFILER_LABEL_DYNAMIC_CSTR, this macro
+// doesn't push/pop a label when the profiler is inactive.
+#  define AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING(label, categoryPair, nsCStr) \
+    mozilla::Maybe<nsAutoCString> autoCStr;                                  \
+    mozilla::Maybe<mozilla::AutoProfilerLabel> raiiObjectNsCString;          \
+    if (profiler_is_active()) {                                              \
+      autoCStr.emplace(nsCStr);                                              \
+      raiiObjectNsCString.emplace(label, autoCStr->get(),                    \
+                                  JS::ProfilingCategoryPair::categoryPair);  \
+    }
+
+// See note above AUTO_PROFILER_LABEL_DYNAMIC_CSTR_NONSENSITIVE
+#  define AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING_NONSENSITIVE(              \
+      label, categoryPair, nsCStr)                                         \
+    mozilla::Maybe<nsAutoCString> autoCStr;                                \
+    mozilla::Maybe<mozilla::AutoProfilerLabel> raiiObjectNsCString;        \
+    if (profiler_is_active()) {                                            \
+      autoCStr.emplace(nsCStr);                                            \
+      raiiObjectNsCString.emplace(                                         \
+          label, autoCStr->get(), JS::ProfilingCategoryPair::categoryPair, \
+          uint32_t(js::ProfilingStackFrame::Flags::NONSENSITIVE));         \
+    }
+
+// Similar to AUTO_PROFILER_LABEL_DYNAMIC_CSTR, but takes an nsString that is
+// is lossily converted to an ASCII string.
+//
+// Note: The use of the Maybe<>s ensures the scopes for the converted dynamic
+// string and the AutoProfilerLabel are appropriate, while also not incurring
+// the runtime cost of the string conversion unless the profiler is active.
+// Therefore, unlike AUTO_PROFILER_LABEL and AUTO_PROFILER_LABEL_DYNAMIC_CSTR,
+// this macro doesn't push/pop a label when the profiler is inactive.
+#  define AUTO_PROFILER_LABEL_DYNAMIC_LOSSY_NSSTRING(label, categoryPair,   \
+                                                     nsStr)                 \
+    mozilla::Maybe<NS_LossyConvertUTF16toASCII> asciiStr;                   \
+    mozilla::Maybe<mozilla::AutoProfilerLabel> raiiObjectLossyNsString;     \
+    if (profiler_is_active()) {                                             \
+      asciiStr.emplace(nsStr);                                              \
+      raiiObjectLossyNsString.emplace(                                      \
+          label, asciiStr->get(), JS::ProfilingCategoryPair::categoryPair); \
+    }
+
+// Similar to AUTO_PROFILER_LABEL, but accepting a JSContext* parameter, and a
+// no-op if the profiler is disabled.
+// Used to annotate functions for which overhead in the range of nanoseconds is
+// noticeable. It avoids overhead from the TLS lookup because it can get the
+// ProfilingStack from the JS context, and avoids almost all overhead in the
+// case where the profiler is disabled.
+#  define AUTO_PROFILER_LABEL_FAST(label, categoryPair, ctx) \
+    mozilla::AutoProfilerLabel PROFILER_RAII(                \
+        ctx, label, nullptr, JS::ProfilingCategoryPair::categoryPair)
+
+// Similar to AUTO_PROFILER_LABEL_FAST, but also takes an extra string and an
+// additional set of flags. The flags parameter should carry values from the
+// js::ProfilingStackFrame::Flags enum.
+#  define AUTO_PROFILER_LABEL_DYNAMIC_FAST(label, dynamicString, categoryPair, \
+                                           ctx, flags)                         \
+    mozilla::AutoProfilerLabel PROFILER_RAII(                                  \
+        ctx, label, dynamicString, JS::ProfilingCategoryPair::categoryPair,    \
+        flags)
+
+void profiler_add_js_marker(const char* aMarkerName, const char* aMarkerText);
+void profiler_add_js_allocation_marker(JS::RecordAllocationInfo&& info);
+
+// Returns true or or false depending on whether the marker was actually added
+// or not.
+bool profiler_add_native_allocation_marker(int64_t aSize,
+                                           uintptr_t aMemoryAddress);
+
+// Returns true if any of the profiler mutexes are currently locked *on the
+// current thread*. This may be used by re-entrant code that may call profiler
+// functions while the same of a different profiler mutex is locked, which could
+// deadlock.
+bool profiler_is_locked_on_current_thread();
+
+enum class NetworkLoadType { LOAD_START, LOAD_STOP, LOAD_REDIRECT };
+
+void profiler_add_network_marker(
+    nsIURI* aURI, const nsACString& aRequestMethod, int32_t aPriority,
+    uint64_t aChannelId, NetworkLoadType aType, mozilla::TimeStamp aStart,
+    mozilla::TimeStamp aEnd, int64_t aCount,
+    mozilla::net::CacheDisposition aCacheDisposition, uint64_t aInnerWindowID,
+    const mozilla::net::TimingStruct* aTimings = nullptr,
+    nsIURI* aRedirectURI = nullptr,
+    mozilla::UniquePtr<mozilla::ProfileChunkedBuffer> aSource = nullptr,
+    const mozilla::Maybe<nsDependentCString>& aContentType =
+        mozilla::Nothing());
+
+enum TracingKind {
+  TRACING_EVENT,
+  TRACING_INTERVAL_START,
+  TRACING_INTERVAL_END,
+};
+
+// This is a helper function to get the Inner Window ID from DocShell but it's
+// not a recommended method to get it and it's not encouraged to use this
+// function. If there is a computed inner window ID, `window`, or `Document`
+// available in the call site, please use them. Use this function as a last
+// resort.
+mozilla::Maybe<uint64_t> profiler_get_inner_window_id_from_docshell(
+    nsIDocShell* aDocshell);
+
+inline mozilla::MarkerInnerWindowId MarkerInnerWindowIdFromDocShell(
+    nsIDocShell* aDocshell) {
+  mozilla::Maybe<uint64_t> id =
+      profiler_get_inner_window_id_from_docshell(aDocshell);
+  if (!id) {
+    return mozilla::MarkerInnerWindowId::NoId();
+  }
+  return mozilla::MarkerInnerWindowId(*id);
+}
+
+//---------------------------------------------------------------------------
+// Output profiles
+//---------------------------------------------------------------------------
+
+// Set a user-friendly process name, used in JSON stream.  Allows an optional
+// detailed name which may include private info (eTLD+1 in fission)
+void profiler_set_process_name(const nsACString& aProcessName,
+                               const nsACString* aETLDplus1 = nullptr);
+
+// Get the profile encoded as a JSON string. A no-op (returning nullptr) if the
+// profiler is inactive.
+// If aIsShuttingDown is true, the current time is included as the process
+// shutdown time in the JSON's "meta" object.
+mozilla::UniquePtr<char[]> profiler_get_profile(double aSinceTime = 0,
+                                                bool aIsShuttingDown = false);
+
+// Write the profile for this process (excluding subprocesses) into aWriter.
+// Returns false if the profiler is inactive.
+bool profiler_stream_json_for_this_process(
+    mozilla::baseprofiler::SpliceableJSONWriter& aWriter, double aSinceTime = 0,
+    bool aIsShuttingDown = false,
+    ProfilerCodeAddressService* aService = nullptr);
+
+// Get the profile and write it into a file. A no-op if the profile is
+// inactive.
+//
+// This function is 'extern "C"' so that it is easily callable from a debugger
+// in a build without debugging information (a workaround for
+// http://llvm.org/bugs/show_bug.cgi?id=22211).
+extern "C" {
+void profiler_save_profile_to_file(const char* aFilename);
+}
+
+//---------------------------------------------------------------------------
+// RAII classes
+//---------------------------------------------------------------------------
+
+class TLSRegisteredThread;  // Needed for friendship in ProfilingStackOwnerTLS.
+
+namespace mozilla {
+
+class MOZ_RAII AutoProfilerInit {
+ public:
+  explicit AutoProfilerInit() { profiler_init(this); }
+
+  ~AutoProfilerInit() { profiler_shutdown(); }
+
+ private:
+};
+
+class MOZ_RAII AutoProfilerInit2 {
+ public:
+  explicit AutoProfilerInit2() { profiler_init_threadmanager(); }
+
+ private:
+};
+
+// Convenience class to register and unregister a thread with the profiler.
+// Needs to be the first object on the stack of the thread.
+class MOZ_RAII AutoProfilerRegisterThread final {
+ public:
+  explicit AutoProfilerRegisterThread(const char* aName) {
+    profiler_register_thread(aName, this);
+  }
+
+  ~AutoProfilerRegisterThread() { profiler_unregister_thread(); }
+
+ private:
+  AutoProfilerRegisterThread(const AutoProfilerRegisterThread&) = delete;
+  AutoProfilerRegisterThread& operator=(const AutoProfilerRegisterThread&) =
+      delete;
+};
+
+class MOZ_RAII AutoProfilerThreadSleep {
+ public:
+  explicit AutoProfilerThreadSleep() { profiler_thread_sleep(); }
+
+  ~AutoProfilerThreadSleep() { profiler_thread_wake(); }
+
+ private:
+};
+
+// Temporarily wake up the profiling of a thread while servicing events such as
+// Asynchronous Procedure Calls (APCs).
+class MOZ_RAII AutoProfilerThreadWake {
+ public:
+  explicit AutoProfilerThreadWake()
+      : mIssuedWake(profiler_thread_is_sleeping()) {
+    if (mIssuedWake) {
+      profiler_thread_wake();
+    }
+  }
+
+  ~AutoProfilerThreadWake() {
+    if (mIssuedWake) {
+      MOZ_ASSERT(!profiler_thread_is_sleeping());
+      profiler_thread_sleep();
+    }
+  }
+
+ private:
+  bool mIssuedWake;
+};
+
+// Ref-counted shell around a `ProfilingStack`, to be used by the owning
+// (Racy)RegisteredThread and AutoProfilerLabel.
+class ProfilingStackOwner {
+ public:
+  class ProfilingStack& ProfilingStack() {
+    return mProfilingStack;
+  }
+
+  // Using hand-rolled ref-counting, to evade leak checking (emergency patch
+  // for bug 1445822).
+  // TODO: Eliminate all/most leaks if possible.
+  void AddRef() const { ++mRefCnt; }
+  void Release() const {
+    MOZ_ASSERT(int32_t(mRefCnt) > 0);
+    if (--mRefCnt == 0) {
+      if (mProfilingStack.stackSize() > 0) {
+        DumpStackAndCrash();
+      }
+      delete this;
+    }
+  }
+
+ private:
+  ~ProfilingStackOwner() = default;
+
+  MOZ_NORETURN void DumpStackAndCrash() const;
+
+  class ProfilingStack mProfilingStack;
+
+  mutable Atomic<int32_t, MemoryOrdering::ReleaseAcquire> mRefCnt;
+};
+
+// This class creates a non-owning ProfilingStack reference. Objects of this
+// class are stack-allocated, and so exist within a thread, and are thus bounded
+// by the lifetime of the thread, which ensures that the references held can't
+// be used after the ProfilingStack is destroyed.
+class MOZ_RAII AutoProfilerLabel {
+ public:
+  // This is the AUTO_PROFILER_LABEL and AUTO_PROFILER_LABEL_DYNAMIC variant.
+  AutoProfilerLabel(const char* aLabel, const char* aDynamicString,
+                    JS::ProfilingCategoryPair aCategoryPair,
+                    uint32_t aFlags = 0) {
+    // Get the ProfilingStack from TLS.
+    ProfilingStackOwner* profilingStackOwner = ProfilingStackOwnerTLS::Get();
+    Push(profilingStackOwner ? &profilingStackOwner->ProfilingStack() : nullptr,
+         aLabel, aDynamicString, aCategoryPair, aFlags);
+  }
+
+  // This is the AUTO_PROFILER_LABEL_FAST variant. It retrieves the
+  // ProfilingStack from the JSContext and does nothing if the profiler is
+  // inactive.
+  AutoProfilerLabel(JSContext* aJSContext, const char* aLabel,
+                    const char* aDynamicString,
+                    JS::ProfilingCategoryPair aCategoryPair, uint32_t aFlags) {
+    Push(js::GetContextProfilingStackIfEnabled(aJSContext), aLabel,
+         aDynamicString, aCategoryPair, aFlags);
+  }
+
+  void Push(ProfilingStack* aProfilingStack, const char* aLabel,
+            const char* aDynamicString, JS::ProfilingCategoryPair aCategoryPair,
+            uint32_t aFlags = 0) {
+    // This function runs both on and off the main thread.
+
+    mProfilingStack = aProfilingStack;
+    if (mProfilingStack) {
+      mProfilingStack->pushLabelFrame(aLabel, aDynamicString, this,
+                                      aCategoryPair, aFlags);
+    }
+  }
+
+  ~AutoProfilerLabel() {
+    // This function runs both on and off the main thread.
+
+    if (mProfilingStack) {
+      mProfilingStack->pop();
+    }
+  }
+
+ private:
+  // We save a ProfilingStack pointer in the ctor so we don't have to redo the
+  // TLS lookup in the dtor.
+  ProfilingStack* mProfilingStack;
+
+ public:
+  // See the comment on the definition in platform.cpp for details about this.
+  class ProfilingStackOwnerTLS {
+   public:
+    static ProfilingStackOwner* Get() {
+      MOZ_ASSERT(
+          sState != State::Uninitialized,
+          "ProfilingStackOwnerTLS::Get() should only be called after Init()");
+      if (sState != State::Initialized) {
+        return nullptr;
+      }
+      return sProfilingStackOwnerTLS.get();
+    }
+
+    static void Set(ProfilingStackOwner* aProfilingStackOwner) {
+      MOZ_ASSERT(
+          sState != State::Uninitialized,
+          "ProfilingStackOwnerTLS::Set() should only be called after Init()");
+      MOZ_DIAGNOSTIC_ASSERT(sState == State::Initialized,
+                            "ProfilingStackOwnerTLS::Set() should only be "
+                            "called after a successful Init()");
+      sProfilingStackOwnerTLS.set(aProfilingStackOwner);
+    }
+
+   private:
+    friend TLSRegisteredThread;
+    static void Init();
+
+    enum class State { Uninitialized = 0, Initialized, Unavailable };
+    static State sState;
+
+    static MOZ_THREAD_LOCAL(ProfilingStackOwner*) sProfilingStackOwnerTLS;
+  };
+};
+
+// Get the MOZ_PROFILER_STARTUP* environment variables that should be
+// supplied to a child process that is about to be launched, in order
+// to make that child process start with the same profiler settings as
+// in the current process.  The given function is invoked once for
+// each variable to be set.
+void GetProfilerEnvVarsForChildProcess(
+    std::function<void(const char* key, const char* value)>&& aSetEnv);
+
+}  // namespace mozilla
+
+#endif  // !MOZ_GECKO_PROFILER
+
+#endif  // GeckoProfiler_h
diff --git a/tools/profiler/public/GeckoProfilerReporter.h b/tools/profiler/public/GeckoProfilerReporter.h
new file mode 100644
index 0000000000..f5bf41f223
--- /dev/null
+++ b/tools/profiler/public/GeckoProfilerReporter.h
@@ -0,0 +1,26 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef GeckoProfilerReporter_h
+#define GeckoProfilerReporter_h
+
+#include "nsIMemoryReporter.h"
+
+class GeckoProfilerReporter final : public nsIMemoryReporter {
+ public:
+  NS_DECL_ISUPPORTS
+
+  GeckoProfilerReporter() {}
+
+  NS_IMETHOD
+  CollectReports(nsIHandleReportCallback* aHandleReport, nsISupports* aData,
+                 bool aAnonymize) override;
+
+ private:
+  ~GeckoProfilerReporter() {}
+};
+
+#endif
diff --git a/tools/profiler/public/ProfileBufferEntrySerializationGeckoExtensions.h b/tools/profiler/public/ProfileBufferEntrySerializationGeckoExtensions.h
new file mode 100644
index 0000000000..1578bd2ddc
--- /dev/null
+++ b/tools/profiler/public/ProfileBufferEntrySerializationGeckoExtensions.h
@@ -0,0 +1,160 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProfileBufferEntrySerializationGeckoExtensions_h
+#define ProfileBufferEntrySerializationGeckoExtensions_h
+
+#include "mozilla/ProfileBufferEntrySerialization.h"
+
+#include "js/AllocPolicy.h"
+#include "js/Utility.h"
+#include "nsString.h"
+
+namespace mozilla {
+
+// ----------------------------------------------------------------------------
+// ns[C]String
+
+// nsString or nsCString contents are serialized as the number of bytes (encoded
+// as ULEB128) and all the characters in the string. The terminal '\0' is
+// omitted.
+// Make sure you write and read with the same character type!
+//
+// Usage: `nsCString s = ...; aEW.WriteObject(s);`
+template <typename CHAR>
+struct ProfileBufferEntryWriter::Serializer<nsTString<CHAR>> {
+  static Length Bytes(const nsTString<CHAR>& aS) {
+    const auto length = aS.Length();
+    return ProfileBufferEntryWriter::ULEB128Size(length) +
+           static_cast<Length>(length * sizeof(CHAR));
+  }
+
+  static void Write(ProfileBufferEntryWriter& aEW, const nsTString<CHAR>& aS) {
+    const auto length = aS.Length();
+    aEW.WriteULEB128(length);
+    // Copy the bytes from the string's buffer.
+    aEW.WriteBytes(aS.Data(), length * sizeof(CHAR));
+  }
+};
+
+template <typename CHAR>
+struct ProfileBufferEntryReader::Deserializer<nsTString<CHAR>> {
+  static void ReadInto(ProfileBufferEntryReader& aER, nsTString<CHAR>& aS) {
+    aS = Read(aER);
+  }
+
+  static nsTString<CHAR> Read(ProfileBufferEntryReader& aER) {
+    const Length length = aER.ReadULEB128<Length>();
+    nsTString<CHAR> s;
+    // BulkWrite is the most efficient way to copy bytes into the target string.
+    auto writerOrErr = s.BulkWrite(length, 0, true);
+    MOZ_RELEASE_ASSERT(!writerOrErr.isErr());
+
+    auto writer = writerOrErr.unwrap();
+
+    aER.ReadBytes(writer.Elements(), length * sizeof(CHAR));
+    writer.Finish(length, true);
+    return s;
+  }
+};
+
+// ----------------------------------------------------------------------------
+// nsAuto[C]String
+
+// nsAuto[C]String contents are serialized as the number of bytes (encoded as
+// ULEB128) and all the characters in the string. The terminal '\0' is omitted.
+// Make sure you write and read with the same character type!
+//
+// Usage: `nsAutoCString s = ...; aEW.WriteObject(s);`
+template <typename CHAR, size_t N>
+struct ProfileBufferEntryWriter::Serializer<nsTAutoStringN<CHAR, N>> {
+  static Length Bytes(const nsTAutoStringN<CHAR, N>& aS) {
+    const auto length = aS.Length();
+    return ProfileBufferEntryWriter::ULEB128Size(length) +
+           static_cast<Length>(length * sizeof(CHAR));
+  }
+
+  static void Write(ProfileBufferEntryWriter& aEW,
+                    const nsTAutoStringN<CHAR, N>& aS) {
+    const auto length = aS.Length();
+    aEW.WriteULEB128(length);
+    // Copy the bytes from the string's buffer.
+    aEW.WriteBytes(aS.BeginReading(), length * sizeof(CHAR));
+  }
+};
+
+template <typename CHAR, size_t N>
+struct ProfileBufferEntryReader::Deserializer<nsTAutoStringN<CHAR, N>> {
+  static void ReadInto(ProfileBufferEntryReader& aER,
+                       nsTAutoStringN<CHAR, N>& aS) {
+    aS = Read(aER);
+  }
+
+  static nsTAutoStringN<CHAR, N> Read(ProfileBufferEntryReader& aER) {
+    const auto length = aER.ReadULEB128<Length>();
+    nsTAutoStringN<CHAR, N> s;
+    // BulkWrite is the most efficient way to copy bytes into the target string.
+    auto writerOrErr = s.BulkWrite(length, 0, true);
+    MOZ_RELEASE_ASSERT(!writerOrErr.isErr());
+
+    auto writer = writerOrErr.unwrap();
+    aER.ReadBytes(writer.Elements(), length * sizeof(CHAR));
+    writer.Finish(length, true);
+    return s;
+  }
+};
+
+// ----------------------------------------------------------------------------
+// JS::UniqueChars
+
+// JS::UniqueChars contents are serialized as the number of bytes (encoded as
+// ULEB128) and all the characters in the string. The terminal '\0' is omitted.
+// Note: A nullptr pointer will be serialized like an empty string, so when
+// deserializing it will result in an allocated buffer only containing a
+// single null terminator.
+//
+// Usage: `JS::UniqueChars s = ...; aEW.WriteObject(s);`
+template <>
+struct ProfileBufferEntryWriter::Serializer<JS::UniqueChars> {
+  static Length Bytes(const JS::UniqueChars& aS) {
+    if (!aS) {
+      return ProfileBufferEntryWriter::ULEB128Size<Length>(0);
+    }
+    const auto len = static_cast<Length>(strlen(aS.get()));
+    return ProfileBufferEntryWriter::ULEB128Size(len) + len;
+  }
+
+  static void Write(ProfileBufferEntryWriter& aEW, const JS::UniqueChars& aS) {
+    if (!aS) {
+      aEW.WriteULEB128<Length>(0);
+      return;
+    }
+    const auto len = static_cast<Length>(strlen(aS.get()));
+    aEW.WriteULEB128(len);
+    aEW.WriteBytes(aS.get(), len);
+  }
+};
+
+template <>
+struct ProfileBufferEntryReader::Deserializer<JS::UniqueChars> {
+  static void ReadInto(ProfileBufferEntryReader& aER, JS::UniqueChars& aS) {
+    aS = Read(aER);
+  }
+
+  static JS::UniqueChars Read(ProfileBufferEntryReader& aER) {
+    const auto len = aER.ReadULEB128<Length>();
+    // Use the same allocation policy as JS_smprintf.
+    char* buffer =
+        static_cast<char*>(js::SystemAllocPolicy{}.pod_malloc<char>(len + 1));
+    aER.ReadBytes(buffer, len);
+    buffer[len] = '\0';
+    return JS::UniqueChars(buffer);
+  }
+};
+
+}  // namespace mozilla
+
+#endif  // ProfileBufferEntrySerializationGeckoExtensions_h
diff --git a/tools/profiler/public/ProfileJSONWriter.h b/tools/profiler/public/ProfileJSONWriter.h
new file mode 100644
index 0000000000..8d23d7a890
--- /dev/null
+++ b/tools/profiler/public/ProfileJSONWriter.h
@@ -0,0 +1,19 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef PROFILEJSONWRITER_H
+#define PROFILEJSONWRITER_H
+
+#include "mozilla/BaseProfileJSONWriter.h"
+
+using ChunkedJSONWriteFunc = mozilla::baseprofiler::ChunkedJSONWriteFunc;
+using JSONSchemaWriter = mozilla::baseprofiler::JSONSchemaWriter;
+using OStreamJSONWriteFunc = mozilla::baseprofiler::OStreamJSONWriteFunc;
+using SpliceableChunkedJSONWriter =
+    mozilla::baseprofiler::SpliceableChunkedJSONWriter;
+using SpliceableJSONWriter = mozilla::baseprofiler::SpliceableJSONWriter;
+using UniqueJSONStrings = mozilla::baseprofiler::UniqueJSONStrings;
+
+#endif  // PROFILEJSONWRITER_H
diff --git a/tools/profiler/public/ProfilerChild.h b/tools/profiler/public/ProfilerChild.h
new file mode 100644
index 0000000000..4e4875f909
--- /dev/null
+++ b/tools/profiler/public/ProfilerChild.h
@@ -0,0 +1,91 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProfilerChild_h
+#define ProfilerChild_h
+
+#include "mozilla/BaseProfilerDetail.h"
+#include "mozilla/DataMutex.h"
+#include "mozilla/PProfilerChild.h"
+#include "mozilla/ProfileBufferControlledChunkManager.h"
+#include "mozilla/RefPtr.h"
+
+class nsIThread;
+
+namespace mozilla {
+
+// The ProfilerChild actor is created in all processes except for the main
+// process. The corresponding ProfilerParent actor is created in the main
+// process, and it will notify us about profiler state changes and request
+// profiles from us.
+class ProfilerChild final : public PProfilerChild,
+                            public mozilla::ipc::IShmemAllocator {
+  NS_INLINE_DECL_REFCOUNTING(ProfilerChild)
+
+  ProfilerChild();
+
+  // Collects and returns a profile.
+  // This method can be used to grab a profile just before PProfiler is torn
+  // down. The collected profile should then be sent through a different
+  // message channel that is guaranteed to stay open long enough.
+  nsCString GrabShutdownProfile();
+
+  void Destroy();
+
+  // This should be called regularly from outside of the profiler lock.
+  static void ProcessPendingUpdate();
+
+  static bool IsLockedOnCurrentThread();
+
+ private:
+  virtual ~ProfilerChild();
+
+  mozilla::ipc::IPCResult RecvStart(const ProfilerInitParams& params) override;
+  mozilla::ipc::IPCResult RecvEnsureStarted(
+      const ProfilerInitParams& params) override;
+  mozilla::ipc::IPCResult RecvStop() override;
+  mozilla::ipc::IPCResult RecvPause() override;
+  mozilla::ipc::IPCResult RecvResume() override;
+  mozilla::ipc::IPCResult RecvPauseSampling() override;
+  mozilla::ipc::IPCResult RecvResumeSampling() override;
+  mozilla::ipc::IPCResult RecvAwaitNextChunkManagerUpdate(
+      AwaitNextChunkManagerUpdateResolver&& aResolve) override;
+  mozilla::ipc::IPCResult RecvDestroyReleasedChunksAtOrBefore(
+      const TimeStamp& aTimeStamp) override;
+  mozilla::ipc::IPCResult RecvGatherProfile(
+      GatherProfileResolver&& aResolve) override;
+  mozilla::ipc::IPCResult RecvClearAllPages() override;
+
+  void ActorDestroy(ActorDestroyReason aActorDestroyReason) override;
+
+  FORWARD_SHMEM_ALLOCATOR_TO(PProfilerChild)
+
+  void SetupChunkManager();
+  void ResetChunkManager();
+  void ResolveChunkUpdate(
+      PProfilerChild::AwaitNextChunkManagerUpdateResolver& aResolve);
+  void ProcessChunkManagerUpdate(
+      ProfileBufferControlledChunkManager::Update&& aUpdate);
+
+  nsCOMPtr<nsIThread> mThread;
+  bool mDestroyed;
+
+  ProfileBufferControlledChunkManager* mChunkManager = nullptr;
+  AwaitNextChunkManagerUpdateResolver mAwaitNextChunkManagerUpdateResolver;
+  ProfileBufferControlledChunkManager::Update mChunkManagerUpdate;
+
+  struct ProfilerChildAndUpdate {
+    RefPtr<ProfilerChild> mProfilerChild;
+    ProfileBufferControlledChunkManager::Update mUpdate;
+  };
+  static DataMutexBase<ProfilerChildAndUpdate,
+                       baseprofiler::detail::BaseProfilerMutex>
+      sPendingChunkManagerUpdate;
+};
+
+}  // namespace mozilla
+
+#endif  // ProfilerChild_h
diff --git a/tools/profiler/public/ProfilerCodeAddressService.h b/tools/profiler/public/ProfilerCodeAddressService.h
new file mode 100644
index 0000000000..9d75c363b3
--- /dev/null
+++ b/tools/profiler/public/ProfilerCodeAddressService.h
@@ -0,0 +1,52 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProfilerCodeAddressService_h
+#define ProfilerCodeAddressService_h
+
+#include "CodeAddressService.h"
+#include "nsTArray.h"
+
+namespace mozilla {
+
+// This SymbolTable struct, and the CompactSymbolTable struct in the
+// profiler rust module, have the exact same memory layout.
+// nsTArray and ThinVec are FFI-compatible, because the thin-vec crate is
+// being compiled with the "gecko-ffi" feature enabled.
+struct SymbolTable {
+  SymbolTable() = default;
+  SymbolTable(SymbolTable&& aOther) = default;
+
+  nsTArray<uint32_t> mAddrs;
+  nsTArray<uint32_t> mIndex;
+  nsTArray<uint8_t> mBuffer;
+};
+
+}  // namespace mozilla
+
+/**
+ * Cache and look up function symbol names.
+ *
+ * We don't template this on AllocPolicy since we need to use nsTArray in
+ * SymbolTable above, which doesn't work with AllocPolicy.  (We can't switch
+ * to Vector, as we would lose FFI compatibility with ThinVec.)
+ */
+class ProfilerCodeAddressService : public mozilla::CodeAddressService<> {
+ public:
+  // Like GetLocation, but only returns the symbol name.
+  bool GetFunction(const void* aPc, nsACString& aResult);
+
+ private:
+#if defined(XP_LINUX) || defined(XP_FREEBSD)
+  // Map of library names (owned by mLibraryStrings) to SymbolTables filled
+  // in by profiler_get_symbol_table.
+  mozilla::HashMap<const char*, mozilla::SymbolTable,
+                   mozilla::DefaultHasher<const char*>, AllocPolicy>
+      mSymbolTables;
+#endif
+};
+
+#endif  // ProfilerCodeAddressService_h
diff --git a/tools/profiler/public/ProfilerCounts.h b/tools/profiler/public/ProfilerCounts.h
new file mode 100644
index 0000000000..a86cf19709
--- /dev/null
+++ b/tools/profiler/public/ProfilerCounts.h
@@ -0,0 +1,274 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProfilerCounts_h
+#define ProfilerCounts_h
+
+#ifndef MOZ_GECKO_PROFILER
+
+#  define PROFILER_DEFINE_COUNT_TOTAL(label, category, description)
+#  define PROFILER_DEFINE_COUNT(label, category, description)
+#  define PROFILER_DEFINE_STATIC_COUNT_TOTAL(label, category, description)
+#  define AUTO_PROFILER_TOTAL(label, count)
+#  define AUTO_PROFILER_COUNT(label)
+#  define AUTO_PROFILER_STATIC_COUNT(label, count)
+
+#else
+
+#  include "mozilla/Atomics.h"
+
+class BaseProfilerCount;
+void profiler_add_sampled_counter(BaseProfilerCount* aCounter);
+void profiler_remove_sampled_counter(BaseProfilerCount* aCounter);
+
+typedef mozilla::Atomic<int64_t, mozilla::MemoryOrdering::Relaxed>
+    ProfilerAtomicSigned;
+typedef mozilla::Atomic<uint64_t, mozilla::MemoryOrdering::Relaxed>
+    ProfilerAtomicUnsigned;
+
+// Counter support
+// There are two types of counters:
+// 1) a simple counter which can be added to or subtracted from.  This could
+// track the number of objects of a type, the number of calls to something
+// (reflow, JIT, etc).
+// 2) a combined counter which has the above, plus a number-of-calls counter
+// that is incremented by 1 for each call to modify the count.  This provides
+// an optional source for a 'heatmap' of access.  This can be used (for
+// example) to track the amount of memory allocated, and provide a heatmap of
+// memory operations (allocs/frees).
+//
+// Counters are sampled by the profiler once per sample-period.  At this time,
+// all counters are global to the process.  In the future, there might be more
+// versions with per-thread or other discriminators.
+//
+// Typical usage:
+// There are two ways to use counters: With heap-created counter objects,
+// or using macros.  Note: the macros use statics, and will be slightly
+// faster/smaller, and you need to care about creating them before using
+// them.  They're similar to the use-pattern for the other AUTO_PROFILER*
+// macros, but they do need the PROFILER_DEFINE* to be use to instantiate
+// the statics.
+//
+// PROFILER_DEFINE_COUNT(mything, "JIT", "Some JIT byte count")
+// ...
+// void foo() { ... AUTO_PROFILER_COUNT(mything, number_of_bytes_used); ... }
+//
+// or (to also get a heatmap)
+//
+// PROFILER_DEFINE_COUNT_TOTAL(mything, "JIT", "Some JIT byte count")
+// ...
+// void foo() {
+//   ...
+//   AUTO_PROFILER_COUNT_TOTAL(mything, number_of_bytes_generated);
+//   ...
+// }
+//
+// To use without statics/macros:
+//
+// UniquePtr<ProfilerCounter> myCounter;
+// ...
+// myCounter =
+//   MakeUnique<ProfilerCounter>("mything", "JIT", "Some JIT byte count"));
+// ...
+// void foo() { ... myCounter->Add(number_of_bytes_generated0; ... }
+
+class BaseProfilerCount {
+ public:
+  BaseProfilerCount(const char* aLabel, ProfilerAtomicSigned* aCounter,
+                    ProfilerAtomicUnsigned* aNumber, const char* aCategory,
+                    const char* aDescription)
+      : mLabel(aLabel),
+        mCategory(aCategory),
+        mDescription(aDescription),
+        mCounter(aCounter),
+        mNumber(aNumber) {
+#  define COUNTER_CANARY 0xDEADBEEF
+#  ifdef DEBUG
+    mCanary = COUNTER_CANARY;
+    mPrevNumber = 0;
+#  endif
+    // Can't call profiler_* here since this may be non-xul-library
+  }
+
+  virtual ~BaseProfilerCount() {
+#  ifdef DEBUG
+    mCanary = 0;
+#  endif
+  }
+
+  virtual void Sample(int64_t& aCounter, uint64_t& aNumber) {
+    MOZ_ASSERT(mCanary == COUNTER_CANARY);
+
+    aCounter = *mCounter;
+    aNumber = mNumber ? *mNumber : 0;
+#  ifdef DEBUG
+    MOZ_ASSERT(aNumber >= mPrevNumber);
+    mPrevNumber = aNumber;
+#  endif
+  }
+
+  // We don't define ++ and Add() here, since the static defines directly
+  // increment the atomic counters, and the subclasses implement ++ and
+  // Add() directly.
+
+  // These typically are static strings (for example if you use the macros
+  // below)
+  const char* mLabel;
+  const char* mCategory;
+  const char* mDescription;
+  // We're ok with these being un-ordered in race conditions.  These are
+  // pointers because we want to be able to use statics and increment them
+  // directly.  Otherwise we could just have them inline, and not need the
+  // constructor args.
+  // These can be static globals (using the macros below), though they
+  // don't have to be - their lifetime must be longer than the use of them
+  // by the profiler (see profiler_add/remove_sampled_counter()).  If you're
+  // using a lot of these, they probably should be allocated at runtime (see
+  // class ProfilerCountOnly below).
+  ProfilerAtomicSigned* mCounter;
+  ProfilerAtomicUnsigned* mNumber;  // may be null
+
+#  ifdef DEBUG
+  uint32_t mCanary;
+  uint64_t mPrevNumber;  // value of number from the last Sample()
+#  endif
+};
+
+// Designed to be allocated dynamically, and simply incremented with obj++
+// or obj->Add(n)
+class ProfilerCounter final : public BaseProfilerCount {
+ public:
+  ProfilerCounter(const char* aLabel, const char* aCategory,
+                  const char* aDescription)
+      : BaseProfilerCount(aLabel, &mCounter, nullptr, aCategory, aDescription) {
+    // Assume we're in libxul
+    profiler_add_sampled_counter(this);
+  }
+
+  virtual ~ProfilerCounter() { profiler_remove_sampled_counter(this); }
+
+  BaseProfilerCount& operator++() {
+    Add(1);
+    return *this;
+  }
+
+  void Add(int64_t aNumber) { mCounter += aNumber; }
+
+  ProfilerAtomicSigned mCounter;
+};
+
+// Also keeps a heatmap (number of calls to ++/Add())
+class ProfilerCounterTotal final : public BaseProfilerCount {
+ public:
+  ProfilerCounterTotal(const char* aLabel, const char* aCategory,
+                       const char* aDescription)
+      : BaseProfilerCount(aLabel, &mCounter, &mNumber, aCategory,
+                          aDescription) {
+    // Assume we're in libxul
+    profiler_add_sampled_counter(this);
+  }
+
+  virtual ~ProfilerCounterTotal() { profiler_remove_sampled_counter(this); }
+
+  BaseProfilerCount& operator++() {
+    Add(1);
+    return *this;
+  }
+
+  void Add(int64_t aNumber) {
+    mCounter += aNumber;
+    mNumber++;
+  }
+
+  ProfilerAtomicSigned mCounter;
+  ProfilerAtomicUnsigned mNumber;
+};
+
+// Defines a counter that is sampled on each profiler tick, with a running
+// count (signed), and number-of-instances. Note that because these are two
+// independent Atomics, there is a possiblity that count will not include
+// the last call, but number of uses will.  I think this is not worth
+// worrying about
+#  define PROFILER_DEFINE_COUNT_TOTAL(label, category, description) \
+    ProfilerAtomicSigned profiler_count_##label(0);                 \
+    ProfilerAtomicUnsigned profiler_number_##label(0);              \
+    const char profiler_category_##label[] = category;              \
+    const char profiler_description_##label[] = description;        \
+    mozilla::UniquePtr<BaseProfilerCount> AutoCount_##label;
+
+// This counts, but doesn't keep track of the number of calls to
+// AUTO_PROFILER_COUNT()
+#  define PROFILER_DEFINE_COUNT(label, category, description) \
+    ProfilerAtomicSigned profiler_count_##label(0);           \
+    const char profiler_category_##label[] = category;        \
+    const char profiler_description_##label[] = description;  \
+    mozilla::UniquePtr<BaseProfilerCount> AutoCount_##label;
+
+// This will create a static initializer if used, but avoids a possible
+// allocation.
+#  define PROFILER_DEFINE_STATIC_COUNT_TOTAL(label, category, description)  \
+    ProfilerAtomicSigned profiler_count_##label(0);                         \
+    ProfilerAtomicUnsigned profiler_number_##label(0);                      \
+    BaseProfilerCount AutoCount_##label(#label, &profiler_count_##label,    \
+                                        &profiler_number_##label, category, \
+                                        description);
+
+// If we didn't care about static initializers, we could avoid the need for
+// a ptr to the BaseProfilerCount object.
+
+// XXX It would be better to do this without the if() and without the
+// theoretical race to set the UniquePtr (i.e. possible leak).
+#  define AUTO_PROFILER_COUNT_TOTAL(label, count)                           \
+    do {                                                                    \
+      profiler_number_##label++; /* do this first*/                         \
+      profiler_count_##label += count;                                      \
+      if (!AutoCount_##label) {                                             \
+        /* Ignore that we could call this twice in theory, and that we leak \
+         * them                                                             \
+         */                                                                 \
+        AutoCount_##label.reset(new BaseProfilerCount(                      \
+            #label, &profiler_count_##label, &profiler_number_##label,      \
+            profiler_category_##label, profiler_description_##label));      \
+        profiler_add_sampled_counter(AutoCount_##label.get());              \
+      }                                                                     \
+    } while (0)
+
+#  define AUTO_PROFILER_COUNT(label, count)                                 \
+    do {                                                                    \
+      profiler_count_##label += count; /* do this first*/                   \
+      if (!AutoCount_##label) {                                             \
+        /* Ignore that we could call this twice in theory, and that we leak \
+         * them                                                             \
+         */                                                                 \
+        AutoCount_##label.reset(new BaseProfilerCount(                      \
+            #label, nullptr, &profiler_number_##label,                      \
+            profiler_category_##label, profiler_description_##label));      \
+        profiler_add_sampled_counter(AutoCount_##label.get());              \
+      }                                                                     \
+    } while (0)
+
+#  define AUTO_PROFILER_STATIC_COUNT(label, count)  \
+    do {                                            \
+      profiler_number_##label++; /* do this first*/ \
+      profiler_count_##label += count;              \
+    } while (0)
+
+// if we need to force the allocation
+#  define AUTO_PROFILER_FORCE_ALLOCATION(label)                             \
+    do {                                                                    \
+      if (!AutoCount_##label) {                                             \
+        /* Ignore that we could call this twice in theory, and that we leak \
+         * them                                                             \
+         */                                                                 \
+        AutoCount_##label.reset(new BaseProfilerCount(                      \
+            #label, &profiler_count_##label, &profiler_number_##label,      \
+            profiler_category_##label, profiler_description_##label));      \
+      }                                                                     \
+    } while (0)
+
+#endif  // !MOZ_GECKO_PROFILER
+
+#endif  // ProfilerCounts_h
diff --git a/tools/profiler/public/ProfilerMarkerTypes.h b/tools/profiler/public/ProfilerMarkerTypes.h
new file mode 100644
index 0000000000..347f58839c
--- /dev/null
+++ b/tools/profiler/public/ProfilerMarkerTypes.h
@@ -0,0 +1,41 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProfilerMarkerTypes_h
+#define ProfilerMarkerTypes_h
+
+// This header contains common marker type definitions that rely on xpcom.
+//
+// It #include's "mozilla/BaseProfilerMarkerTypess.h" and "ProfilerMarkers.h",
+// see these files for more marker types, how to define other marker types, and
+// how to add markers to the profiler buffers.
+
+// !!!                       /!\ WORK IN PROGRESS /!\                       !!!
+// This file contains draft marker definitions, but most are not used yet.
+// Further work is needed to complete these definitions, and use them to convert
+// existing PROFILER_ADD_MARKER calls. See meta bug 1661394.
+
+#include "mozilla/BaseProfilerMarkerTypes.h"
+#include "mozilla/ProfilerMarkers.h"
+
+#ifdef MOZ_GECKO_PROFILER
+
+#  include "js/ProfilingFrameIterator.h"
+#  include "js/Utility.h"
+#  include "mozilla/Preferences.h"
+#  include "mozilla/ServoTraversalStatistics.h"
+
+namespace geckoprofiler::markers {
+
+// Import some common markers from mozilla::baseprofiler::markers.
+using MediaSampleMarker = mozilla::baseprofiler::markers::MediaSampleMarker;
+using ContentBuildMarker = mozilla::baseprofiler::markers::ContentBuildMarker;
+
+}  // namespace geckoprofiler::markers
+
+#endif  // MOZ_GECKO_PROFILER
+
+#endif  // ProfilerMarkerTypes_h
diff --git a/tools/profiler/public/ProfilerMarkers.h b/tools/profiler/public/ProfilerMarkers.h
new file mode 100644
index 0000000000..de2e6f881d
--- /dev/null
+++ b/tools/profiler/public/ProfilerMarkers.h
@@ -0,0 +1,294 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// Markers are useful to delimit something important happening such as the first
+// paint. Unlike labels, which are only recorded in the profile buffer if a
+// sample is collected while the label is on the label stack, markers will
+// always be recorded in the profile buffer.
+//
+// This header contains definitions necessary to add markers to the Gecko
+// Profiler buffer.
+//
+// It #include's "mozilla/BaseProfilerMarkers.h", see that header for base
+// definitions necessary to create marker types.
+//
+// If common marker types are needed, #include "ProfilerMarkerTypes.h" instead.
+//
+// But if you want to create your own marker type locally, you can #include this
+// header only; look at ProfilerMarkerTypes.h for examples of how to define
+// types.
+//
+// To then record markers:
+// - Use `baseprofiler::AddMarker(...)` from mozglue or other libraries that are
+//   outside of xul, especially if they may happen outside of xpcom's lifetime
+//   (typically startup, shutdown, or tests).
+// - Otherwise #include "ProfilerMarkers.h" instead, and use
+//   `profiler_add_marker(...)`.
+// See these functions for more details.
+
+#ifndef ProfilerMarkers_h
+#define ProfilerMarkers_h
+
+#include "mozilla/BaseProfilerMarkers.h"
+#include "mozilla/ProfilerMarkersDetail.h"
+
+#ifndef MOZ_GECKO_PROFILER
+
+#  define PROFILER_MARKER_UNTYPED(markerName, categoryName, ...)
+#  define PROFILER_MARKER(markerName, categoryName, options, MarkerType, ...)
+#  define PROFILER_MARKER_TEXT(markerName, categoryName, options, text)
+#  define AUTO_PROFILER_MARKER_TEXT(markerName, categoryName, options, text)
+#  define AUTO_PROFILER_TRACING_MARKER(categoryString, markerName, categoryPair)
+#  define AUTO_PROFILER_TRACING_MARKER_DOCSHELL(categoryString, markerName, \
+                                                categoryPair, docShell)
+
+#else  // ndef MOZ_GECKO_PROFILER
+
+namespace mozilla {
+class ProfileChunkedBuffer;
+}
+
+bool profiler_can_accept_markers();
+bool profiler_capture_backtrace_into(
+    mozilla::ProfileChunkedBuffer& aChunkedBuffer);
+
+// Bring category names from Base Profiler into the geckoprofiler::category
+// namespace, for consistency with other Gecko Profiler identifiers.
+namespace geckoprofiler::category {
+using namespace ::mozilla::baseprofiler::category;
+}
+
+// Add a marker to a given buffer. `AddMarker()` and related macros should be
+// used in most cases, see below for more information about them and the
+// paramters; This function may be useful when markers need to be recorded in a
+// local buffer outside of the main profiler buffer.
+template <typename MarkerType, typename... PayloadArguments>
+mozilla::ProfileBufferBlockIndex AddMarkerToBuffer(
+    mozilla::ProfileChunkedBuffer& aBuffer,
+    const mozilla::ProfilerString8View& aName,
+    const mozilla::MarkerCategory& aCategory, mozilla::MarkerOptions&& aOptions,
+    MarkerType aMarkerType, const PayloadArguments&... aPayloadArguments) {
+  mozilla::Unused << aMarkerType;  // Only the empty object type is useful.
+  return mozilla::base_profiler_markers_detail::AddMarkerToBuffer<MarkerType>(
+      aBuffer, aName, aCategory, std::move(aOptions),
+      ::profiler_capture_backtrace_into, aPayloadArguments...);
+}
+
+// Add a marker (without payload) to a given buffer.
+inline mozilla::ProfileBufferBlockIndex AddMarkerToBuffer(
+    mozilla::ProfileChunkedBuffer& aBuffer,
+    const mozilla::ProfilerString8View& aName,
+    const mozilla::MarkerCategory& aCategory,
+    mozilla::MarkerOptions&& aOptions = {}) {
+  return AddMarkerToBuffer(aBuffer, aName, aCategory, std::move(aOptions),
+                           mozilla::baseprofiler::markers::NoPayload{});
+}
+
+// Add a marker to the Gecko Profiler buffer.
+// - aName: Main name of this marker.
+// - aCategory: Category for this marker.
+// - aOptions: Optional settings (such as timing, inner window id,
+//   backtrace...), see `MarkerOptions` for details.
+// - aMarkerType: Empty object that specifies the type of marker.
+// - aPayloadArguments: Arguments expected by this marker type's
+// ` StreamJSONMarkerData` function.
+template <typename MarkerType, typename... PayloadArguments>
+mozilla::ProfileBufferBlockIndex profiler_add_marker(
+    const mozilla::ProfilerString8View& aName,
+    const mozilla::MarkerCategory& aCategory, mozilla::MarkerOptions&& aOptions,
+    MarkerType aMarkerType, const PayloadArguments&... aPayloadArguments) {
+  if (!profiler_can_accept_markers()) {
+    return {};
+  }
+  return ::AddMarkerToBuffer(profiler_markers_detail::CachedCoreBuffer(), aName,
+                             aCategory, std::move(aOptions), aMarkerType,
+                             aPayloadArguments...);
+}
+
+// Add a marker (without payload) to the Gecko Profiler buffer.
+inline mozilla::ProfileBufferBlockIndex profiler_add_marker(
+    const mozilla::ProfilerString8View& aName,
+    const mozilla::MarkerCategory& aCategory,
+    mozilla::MarkerOptions&& aOptions = {}) {
+  return profiler_add_marker(aName, aCategory, std::move(aOptions),
+                             mozilla::baseprofiler::markers::NoPayload{});
+}
+
+// Same as `profiler_add_marker()` (without payload). This macro is safe to use
+// even if MOZ_GECKO_PROFILER is not #defined.
+#  define PROFILER_MARKER_UNTYPED(markerName, categoryName, ...)               \
+    do {                                                                       \
+      AUTO_PROFILER_STATS(PROFILER_MARKER_UNTYPED);                            \
+      ::profiler_add_marker(                                                   \
+          markerName, ::geckoprofiler::category::categoryName, ##__VA_ARGS__); \
+    } while (false)
+
+// Same as `profiler_add_marker()` (with payload). This macro is safe to use
+// even if MOZ_GECKO_PROFILER is not #defined.
+#  define PROFILER_MARKER(markerName, categoryName, options, MarkerType, ...) \
+    do {                                                                      \
+      AUTO_PROFILER_STATS(PROFILER_MARKER_with_##MarkerType);                 \
+      ::profiler_add_marker(                                                  \
+          markerName, ::geckoprofiler::category::categoryName, options,       \
+          ::geckoprofiler::markers::MarkerType{}, ##__VA_ARGS__);             \
+    } while (false)
+
+namespace geckoprofiler::markers {
+// Most common marker types. Others are in ProfilerMarkerTypes.h.
+using TextMarker = ::mozilla::baseprofiler::markers::TextMarker;
+using Tracing = mozilla::baseprofiler::markers::Tracing;
+}  // namespace geckoprofiler::markers
+
+// Add a text marker. This macro is safe to use even if MOZ_GECKO_PROFILER is
+// not #defined.
+#  define PROFILER_MARKER_TEXT(markerName, categoryName, options, text)       \
+    do {                                                                      \
+      AUTO_PROFILER_STATS(PROFILER_MARKER_TEXT);                              \
+      ::profiler_add_marker(markerName,                                       \
+                            ::geckoprofiler::category::categoryName, options, \
+                            ::geckoprofiler::markers::TextMarker{}, text);    \
+    } while (false)
+
+// RAII object that adds a PROFILER_MARKER_TEXT when destroyed; the marker's
+// timing will be the interval from construction (unless an instant or start
+// time is already specified in the provided options) until destruction.
+class MOZ_RAII AutoProfilerTextMarker {
+ public:
+  AutoProfilerTextMarker(const char* aMarkerName,
+                         const mozilla::MarkerCategory& aCategory,
+                         mozilla::MarkerOptions&& aOptions,
+                         const nsACString& aText)
+      : mMarkerName(aMarkerName),
+        mCategory(aCategory),
+        mOptions(std::move(aOptions)),
+        mText(aText) {
+    MOZ_ASSERT(mOptions.Timing().EndTime().IsNull(),
+               "AutoProfilerTextMarker options shouldn't have an end time");
+    if (mOptions.Timing().StartTime().IsNull()) {
+      mOptions.Set(mozilla::MarkerTiming::InstantNow());
+    }
+  }
+
+  ~AutoProfilerTextMarker() {
+    mOptions.TimingRef().SetIntervalEnd();
+    AUTO_PROFILER_STATS(AUTO_PROFILER_MARKER_TEXT);
+    profiler_add_marker(
+        mozilla::ProfilerString8View::WrapNullTerminatedString(mMarkerName),
+        mCategory, std::move(mOptions), geckoprofiler::markers::TextMarker{},
+        mText);
+  }
+
+ protected:
+  const char* mMarkerName;
+  mozilla::MarkerCategory mCategory;
+  mozilla::MarkerOptions mOptions;
+  nsCString mText;
+};
+
+// Creates an AutoProfilerTextMarker RAII object.  This macro is safe to use
+// even if MOZ_GECKO_PROFILER is not #defined.
+#  define AUTO_PROFILER_MARKER_TEXT(markerName, categoryName, options, text)  \
+    AutoProfilerTextMarker PROFILER_RAII(                                     \
+        markerName, ::mozilla::baseprofiler::category::categoryName, options, \
+        text)
+
+class MOZ_RAII AutoProfilerTracing {
+ public:
+  AutoProfilerTracing(const char* aCategoryString, const char* aMarkerName,
+                      mozilla::MarkerCategory aCategoryPair,
+                      const mozilla::Maybe<uint64_t>& aInnerWindowID)
+      : mCategoryString(aCategoryString),
+        mMarkerName(aMarkerName),
+        mCategoryPair(aCategoryPair),
+        mInnerWindowID(aInnerWindowID) {
+    profiler_add_marker(
+        mozilla::ProfilerString8View::WrapNullTerminatedString(mMarkerName),
+        mCategoryPair,
+        {mozilla::MarkerTiming::IntervalStart(),
+         mozilla::MarkerInnerWindowId(mInnerWindowID)},
+        geckoprofiler::markers::Tracing{},
+        mozilla::ProfilerString8View::WrapNullTerminatedString(
+            mCategoryString));
+  }
+
+  AutoProfilerTracing(
+      const char* aCategoryString, const char* aMarkerName,
+      mozilla::MarkerCategory aCategoryPair,
+      mozilla::UniquePtr<mozilla::ProfileChunkedBuffer> aBacktrace,
+      const mozilla::Maybe<uint64_t>& aInnerWindowID)
+      : mCategoryString(aCategoryString),
+        mMarkerName(aMarkerName),
+        mCategoryPair(aCategoryPair),
+        mInnerWindowID(aInnerWindowID) {
+    profiler_add_marker(
+        mozilla::ProfilerString8View::WrapNullTerminatedString(mMarkerName),
+        mCategoryPair,
+        {mozilla::MarkerTiming::IntervalStart(),
+         mozilla::MarkerInnerWindowId(mInnerWindowID),
+         mozilla::MarkerStack::TakeBacktrace(std::move(aBacktrace))},
+        geckoprofiler::markers::Tracing{},
+        mozilla::ProfilerString8View::WrapNullTerminatedString(
+            mCategoryString));
+  }
+
+  ~AutoProfilerTracing() {
+    profiler_add_marker(
+        mozilla::ProfilerString8View::WrapNullTerminatedString(mMarkerName),
+        mCategoryPair,
+        {mozilla::MarkerTiming::IntervalEnd(),
+         mozilla::MarkerInnerWindowId(mInnerWindowID)},
+        geckoprofiler::markers::Tracing{},
+        mozilla::ProfilerString8View::WrapNullTerminatedString(
+            mCategoryString));
+  }
+
+ protected:
+  const char* mCategoryString;
+  const char* mMarkerName;
+  const mozilla::MarkerCategory mCategoryPair;
+  const mozilla::Maybe<uint64_t> mInnerWindowID;
+};
+
+// Adds a START/END pair of tracing markers.
+#  define AUTO_PROFILER_TRACING_MARKER(categoryString, markerName,           \
+                                       categoryPair)                         \
+    AutoProfilerTracing PROFILER_RAII(categoryString, markerName,            \
+                                      geckoprofiler::category::categoryPair, \
+                                      mozilla::Nothing())
+#  define AUTO_PROFILER_TRACING_MARKER_DOCSHELL(categoryString, markerName, \
+                                                categoryPair, docShell)     \
+    AutoProfilerTracing PROFILER_RAII(                                      \
+        categoryString, markerName, geckoprofiler::category::categoryPair,  \
+        profiler_get_inner_window_id_from_docshell(docShell))
+
+extern template mozilla::ProfileBufferBlockIndex AddMarkerToBuffer(
+    mozilla::ProfileChunkedBuffer&, const mozilla::ProfilerString8View&,
+    const mozilla::MarkerCategory&, mozilla::MarkerOptions&&,
+    mozilla::baseprofiler::markers::NoPayload);
+
+extern template mozilla::ProfileBufferBlockIndex AddMarkerToBuffer(
+    mozilla::ProfileChunkedBuffer&, const mozilla::ProfilerString8View&,
+    const mozilla::MarkerCategory&, mozilla::MarkerOptions&&,
+    mozilla::baseprofiler::markers::TextMarker, const std::string&);
+
+extern template mozilla::ProfileBufferBlockIndex profiler_add_marker(
+    const mozilla::ProfilerString8View&, const mozilla::MarkerCategory&,
+    mozilla::MarkerOptions&&, mozilla::baseprofiler::markers::TextMarker,
+    const std::string&);
+
+extern template mozilla::ProfileBufferBlockIndex profiler_add_marker(
+    const mozilla::ProfilerString8View&, const mozilla::MarkerCategory&,
+    mozilla::MarkerOptions&&, mozilla::baseprofiler::markers::TextMarker,
+    const nsCString&);
+
+extern template mozilla::ProfileBufferBlockIndex profiler_add_marker(
+    const mozilla::ProfilerString8View&, const mozilla::MarkerCategory&,
+    mozilla::MarkerOptions&&, mozilla::baseprofiler::markers::Tracing,
+    const mozilla::ProfilerString8View&);
+
+#endif  // nfed MOZ_GECKO_PROFILER else
+
+#endif  // ProfilerMarkers_h
diff --git a/tools/profiler/public/ProfilerMarkersDetail.h b/tools/profiler/public/ProfilerMarkersDetail.h
new file mode 100644
index 0000000000..22396b5d2f
--- /dev/null
+++ b/tools/profiler/public/ProfilerMarkersDetail.h
@@ -0,0 +1,42 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProfilerMarkersDetail_h
+#define ProfilerMarkersDetail_h
+
+#ifndef ProfilerMarkers_h
+#  error "This header should only be #included by ProfilerMarkers.h"
+#endif
+
+#include "mozilla/ProfilerMarkersPrerequisites.h"
+
+#ifdef MOZ_GECKO_PROFILER
+
+//                        ~~ HERE BE DRAGONS ~~
+//
+// Everything below is internal implementation detail, you shouldn't need to
+// look at it unless working on the profiler code.
+
+// Header that specializes the (de)serializers for xpcom types.
+#  include "mozilla/ProfileBufferEntrySerializationGeckoExtensions.h"
+
+// Implemented in platform.cpp
+mozilla::ProfileChunkedBuffer& profiler_get_core_buffer();
+
+namespace profiler_markers_detail {
+
+// Get the core buffer from the profiler, and cache it in a
+// non-templated-function static reference.
+inline mozilla::ProfileChunkedBuffer& CachedCoreBuffer() {
+  static mozilla::ProfileChunkedBuffer& coreBuffer = profiler_get_core_buffer();
+  return coreBuffer;
+}
+
+}  // namespace profiler_markers_detail
+
+#endif  // MOZ_GECKO_PROFILER
+
+#endif  // ProfilerMarkersDetail_h
diff --git a/tools/profiler/public/ProfilerMarkersPrerequisites.h b/tools/profiler/public/ProfilerMarkersPrerequisites.h
new file mode 100644
index 0000000000..93868b0524
--- /dev/null
+++ b/tools/profiler/public/ProfilerMarkersPrerequisites.h
@@ -0,0 +1,30 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// This header contains basic definitions required to create marker types, and
+// to add markers to the profiler buffers.
+//
+// In most cases, #include "mozilla/ProfilerMarkers.h" instead, or
+// #include "mozilla/ProfilerMarkerTypes.h" for common marker types.
+
+#ifndef ProfilerMarkersPrerequisites_h
+#define ProfilerMarkersPrerequisites_h
+
+#include "mozilla/BaseProfilerMarkersPrerequisites.h"
+
+#ifdef MOZ_GECKO_PROFILER
+
+namespace geckoprofiler::markers {
+
+// Default marker payload types, with no extra information, not even a marker
+// type and payload. This is intended for label-only markers.
+using NoPayload = ::mozilla::baseprofiler::markers::NoPayload;
+
+}  // namespace geckoprofiler::markers
+
+#endif  // MOZ_GECKO_PROFILER
+
+#endif  // ProfilerMarkersPrerequisites_h
diff --git a/tools/profiler/public/ProfilerParent.h b/tools/profiler/public/ProfilerParent.h
new file mode 100644
index 0000000000..fe9457e678
--- /dev/null
+++ b/tools/profiler/public/ProfilerParent.h
@@ -0,0 +1,95 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProfilerParent_h
+#define ProfilerParent_h
+
+#include "mozilla/PProfilerParent.h"
+#include "mozilla/RefPtr.h"
+
+class nsIProfilerStartParams;
+
+namespace mozilla {
+
+class ProfileBufferGlobalController;
+class ProfilerParentTracker;
+
+// This is the main process side of the PProfiler protocol.
+// ProfilerParent instances only exist on the main thread of the main process.
+// The other side (ProfilerChild) lives on a background thread in the other
+// process.
+// The creation of PProfiler actors is initiated from the main process, after
+// the other process has been launched.
+// ProfilerParent instances are destroyed once the message channel closes,
+// which can be triggered by either process, depending on which one shuts down
+// first.
+// All ProfilerParent instances are registered with a manager class called
+// ProfilerParentTracker, which has the list of living ProfilerParent instances
+// and handles shutdown.
+class ProfilerParent final : public PProfilerParent {
+ public:
+  NS_INLINE_DECL_REFCOUNTING(ProfilerParent)
+
+  static mozilla::ipc::Endpoint<PProfilerChild> CreateForProcess(
+      base::ProcessId aOtherPid);
+
+  typedef MozPromise<Shmem, ResponseRejectReason, true>
+      SingleProcessProfilePromise;
+
+  // The following static methods can be called on any thread, but they are
+  // no-ops on anything other than the main thread.
+  // If called on the main thread, the call will be broadcast to all
+  // registered processes (all processes for which we have a ProfilerParent
+  // object).
+  // At the moment, the main process always calls these methods on the main
+  // thread, and that's the only process in which we need to forward these
+  // calls to other processes. The other processes will call these methods on
+  // the ProfilerChild background thread, but those processes don't need to
+  // forward these calls any further.
+
+  // Returns the number of profiles to expect. The gathered profiles will be
+  // provided asynchronously with a call to
+  // ProfileGatherer::ReceiveGatheredProfile.
+  static nsTArray<RefPtr<SingleProcessProfilePromise>> GatherProfiles();
+
+  static void ProfilerStarted(nsIProfilerStartParams* aParams);
+  static void ProfilerWillStopIfStarted();
+  static void ProfilerStopped();
+  static void ProfilerPaused();
+  static void ProfilerResumed();
+  static void ProfilerPausedSampling();
+  static void ProfilerResumedSampling();
+  static void ClearAllPages();
+
+  // Create a "Final" update that the Child can return to its Parent.
+  static ProfileBufferChunkManagerUpdate MakeFinalUpdate();
+
+  // True if the ProfilerParent holds a lock on this thread.
+  static bool IsLockedOnCurrentThread();
+
+ private:
+  friend class ProfileBufferGlobalController;
+  friend class ProfilerParentTracker;
+
+  explicit ProfilerParent(base::ProcessId aChildPid);
+  virtual ~ProfilerParent();
+
+  void Init();
+  void ActorDestroy(ActorDestroyReason aActorDestroyReason) override;
+  void ActorDealloc() override;
+
+  void RequestChunkManagerUpdate();
+
+  RefPtr<ProfilerParent> mSelfRef;
+  base::ProcessId mChildPid;
+  nsTArray<MozPromiseHolder<SingleProcessProfilePromise>>
+      mPendingRequestedProfiles;
+  bool mDestroyed;
+};
+
+}  // namespace mozilla
+
+#endif  // ProfilerParent_h
diff --git a/tools/profiler/public/shared-libraries.h b/tools/profiler/public/shared-libraries.h
new file mode 100644
index 0000000000..2397fbd84f
--- /dev/null
+++ b/tools/profiler/public/shared-libraries.h
@@ -0,0 +1,155 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef SHARED_LIBRARIES_H_
+#define SHARED_LIBRARIES_H_
+
+#ifndef MOZ_GECKO_PROFILER
+#  error This header does not have a useful implementation on your platform!
+#endif
+
+#include "nsNativeCharsetUtils.h"
+#include "nsString.h"
+#include <nsID.h>
+
+#include <algorithm>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string>
+#include <vector>
+
+class SharedLibrary {
+ public:
+  SharedLibrary(uintptr_t aStart, uintptr_t aEnd, uintptr_t aOffset,
+                const nsCString& aBreakpadId, const nsString& aModuleName,
+                const nsString& aModulePath, const nsString& aDebugName,
+                const nsString& aDebugPath, const nsCString& aVersion,
+                const char* aArch)
+      : mStart(aStart),
+        mEnd(aEnd),
+        mOffset(aOffset),
+        mBreakpadId(aBreakpadId),
+        mModuleName(aModuleName),
+        mModulePath(aModulePath),
+        mDebugName(aDebugName),
+        mDebugPath(aDebugPath),
+        mVersion(aVersion),
+        mArch(aArch) {}
+
+  SharedLibrary(const SharedLibrary& aEntry)
+      : mStart(aEntry.mStart),
+        mEnd(aEntry.mEnd),
+        mOffset(aEntry.mOffset),
+        mBreakpadId(aEntry.mBreakpadId),
+        mModuleName(aEntry.mModuleName),
+        mModulePath(aEntry.mModulePath),
+        mDebugName(aEntry.mDebugName),
+        mDebugPath(aEntry.mDebugPath),
+        mVersion(aEntry.mVersion),
+        mArch(aEntry.mArch) {}
+
+  SharedLibrary& operator=(const SharedLibrary& aEntry) {
+    // Gracefully handle self assignment
+    if (this == &aEntry) return *this;
+
+    mStart = aEntry.mStart;
+    mEnd = aEntry.mEnd;
+    mOffset = aEntry.mOffset;
+    mBreakpadId = aEntry.mBreakpadId;
+    mModuleName = aEntry.mModuleName;
+    mModulePath = aEntry.mModulePath;
+    mDebugName = aEntry.mDebugName;
+    mDebugPath = aEntry.mDebugPath;
+    mVersion = aEntry.mVersion;
+    mArch = aEntry.mArch;
+    return *this;
+  }
+
+  bool operator==(const SharedLibrary& other) const {
+    return (mStart == other.mStart) && (mEnd == other.mEnd) &&
+           (mOffset == other.mOffset) && (mModuleName == other.mModuleName) &&
+           (mModulePath == other.mModulePath) &&
+           (mDebugName == other.mDebugName) &&
+           (mDebugPath == other.mDebugPath) &&
+           (mBreakpadId == other.mBreakpadId) && (mVersion == other.mVersion) &&
+           (mArch == other.mArch);
+  }
+
+  uintptr_t GetStart() const { return mStart; }
+  uintptr_t GetEnd() const { return mEnd; }
+  uintptr_t GetOffset() const { return mOffset; }
+  const nsCString& GetBreakpadId() const { return mBreakpadId; }
+  const nsString& GetModuleName() const { return mModuleName; }
+  const nsString& GetModulePath() const { return mModulePath; }
+  const std::string GetNativeDebugPath() const {
+    nsAutoCString debugPathStr;
+
+    NS_CopyUnicodeToNative(mDebugPath, debugPathStr);
+
+    return debugPathStr.get();
+  }
+  const nsString& GetDebugName() const { return mDebugName; }
+  const nsString& GetDebugPath() const { return mDebugPath; }
+  const nsCString& GetVersion() const { return mVersion; }
+  const std::string& GetArch() const { return mArch; }
+
+ private:
+  SharedLibrary() : mStart{0}, mEnd{0}, mOffset{0} {}
+
+  uintptr_t mStart;
+  uintptr_t mEnd;
+  uintptr_t mOffset;
+  nsCString mBreakpadId;
+  nsString mModuleName;
+  nsString mModulePath;
+  nsString mDebugName;
+  nsString mDebugPath;
+  nsCString mVersion;
+  std::string mArch;
+};
+
+static bool CompareAddresses(const SharedLibrary& first,
+                             const SharedLibrary& second) {
+  return first.GetStart() < second.GetStart();
+}
+
+class SharedLibraryInfo {
+ public:
+  static SharedLibraryInfo GetInfoForSelf();
+  static void Initialize();
+
+  SharedLibraryInfo() {}
+
+  void AddSharedLibrary(SharedLibrary entry) { mEntries.push_back(entry); }
+
+  const SharedLibrary& GetEntry(size_t i) const { return mEntries[i]; }
+
+  SharedLibrary& GetMutableEntry(size_t i) { return mEntries[i]; }
+
+  // Removes items in the range [first, last)
+  // i.e. element at the "last" index is not removed
+  void RemoveEntries(size_t first, size_t last) {
+    mEntries.erase(mEntries.begin() + first, mEntries.begin() + last);
+  }
+
+  bool Contains(const SharedLibrary& searchItem) const {
+    return (mEntries.end() !=
+            std::find(mEntries.begin(), mEntries.end(), searchItem));
+  }
+
+  size_t GetSize() const { return mEntries.size(); }
+
+  void SortByAddress() {
+    std::sort(mEntries.begin(), mEntries.end(), CompareAddresses);
+  }
+
+  void Clear() { mEntries.clear(); }
+
+ private:
+  std::vector<SharedLibrary> mEntries;
+};
+
+#endif
diff --git a/tools/profiler/rust-helper/Cargo.toml b/tools/profiler/rust-helper/Cargo.toml
new file mode 100644
index 0000000000..28f8276ee1
--- /dev/null
+++ b/tools/profiler/rust-helper/Cargo.toml
@@ -0,0 +1,30 @@
+[package]
+name = "profiler_helper"
+version = "0.1.0"
+authors = ["Markus Stange <mstange@themasta.com>"]
+
+[dependencies]
+memmap = "0.7"
+rustc-demangle = "0.1"
+uuid = "0.8"
+
+[dependencies.object]
+version = "0.16"
+optional = true
+default-features = false
+features = ["std", "read"]
+
+[dependencies.goblin]
+optional = true
+# The version and features of goblin need to match what's in object's Cargo.toml,
+# because we really want object's goblin and not another instance of goblin.
+version = "0.1"
+features = ["endian_fd", "elf32", "elf64", "mach32", "mach64", "pe32", "pe64", "archive"]
+default-features = false
+
+[dependencies.thin-vec]
+version = "0.2.1"
+features = ["gecko-ffi"]
+
+[features]
+parse_elf = ["object", "goblin"]
diff --git a/tools/profiler/rust-helper/src/compact_symbol_table.rs b/tools/profiler/rust-helper/src/compact_symbol_table.rs
new file mode 100644
index 0000000000..12c4ca081b
--- /dev/null
+++ b/tools/profiler/rust-helper/src/compact_symbol_table.rs
@@ -0,0 +1,40 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+use std::collections::HashMap;
+use thin_vec::ThinVec;
+
+#[repr(C)]
+pub struct CompactSymbolTable {
+    pub addr: ThinVec<u32>,
+    pub index: ThinVec<u32>,
+    pub buffer: ThinVec<u8>,
+}
+
+impl CompactSymbolTable {
+    pub fn new() -> Self {
+        Self {
+            addr: ThinVec::new(),
+            index: ThinVec::new(),
+            buffer: ThinVec::new(),
+        }
+    }
+
+    pub fn from_map(map: HashMap<u32, &str>) -> Self {
+        let mut table = Self::new();
+        let mut entries: Vec<_> = map.into_iter().collect();
+        entries.sort_by_key(|&(addr, _)| addr);
+        for (addr, name) in entries {
+            table.addr.push(addr);
+            table.index.push(table.buffer.len() as u32);
+            table.add_name(name);
+        }
+        table.index.push(table.buffer.len() as u32);
+        table
+    }
+
+    fn add_name(&mut self, name: &str) {
+        self.buffer.extend_from_slice(name.as_bytes());
+    }
+}
diff --git a/tools/profiler/rust-helper/src/elf.rs b/tools/profiler/rust-helper/src/elf.rs
new file mode 100644
index 0000000000..168f5f8837
--- /dev/null
+++ b/tools/profiler/rust-helper/src/elf.rs
@@ -0,0 +1,100 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+use compact_symbol_table::CompactSymbolTable;
+use goblin::elf;
+use object::read::{ElfFile, Object};
+use object::SymbolKind;
+use std::cmp;
+use std::collections::HashMap;
+use uuid::Uuid;
+
+const UUID_SIZE: usize = 16;
+const PAGE_SIZE: usize = 4096;
+
+fn get_symbol_map<'a, 'b, T>(object_file: &'b T) -> HashMap<u32, &'a str>
+where
+    T: Object<'a, 'b>,
+{
+    object_file
+        .dynamic_symbols()
+        .chain(object_file.symbols())
+        .filter(|(_, symbol)| symbol.kind() == SymbolKind::Text)
+        .filter_map(|(_, symbol)| symbol.name().map(|name| (symbol.address() as u32, name)))
+        .collect()
+}
+
+pub fn get_compact_symbol_table(
+    buffer: &[u8],
+    breakpad_id: Option<&str>,
+) -> Option<CompactSymbolTable> {
+    let elf_file = ElfFile::parse(buffer).ok()?;
+    let elf_id = get_elf_id(&elf_file, buffer)?;
+    if !breakpad_id.map_or(true, |id| id == format!("{:X}0", elf_id.to_simple_ref())) {
+        return None;
+    }
+    return Some(CompactSymbolTable::from_map(get_symbol_map(&elf_file)));
+}
+
+fn create_elf_id(identifier: &[u8], little_endian: bool) -> Uuid {
+    // Make sure that we have exactly UUID_SIZE bytes available
+    let mut data = [0 as u8; UUID_SIZE];
+    let len = cmp::min(identifier.len(), UUID_SIZE);
+    data[0..len].copy_from_slice(&identifier[0..len]);
+
+    if little_endian {
+        // The file ELF file targets a little endian architecture. Convert to
+        // network byte order (big endian) to match the Breakpad processor's
+        // expectations. For big endian object files, this is not needed.
+        data[0..4].reverse(); // uuid field 1
+        data[4..6].reverse(); // uuid field 2
+        data[6..8].reverse(); // uuid field 3
+    }
+
+    Uuid::from_bytes(data)
+}
+
+/// Tries to obtain the object identifier of an ELF object.
+///
+/// As opposed to Mach-O, ELF does not specify a unique ID for object files in
+/// its header. Compilers and linkers usually add either `SHT_NOTE` sections or
+/// `PT_NOTE` program header elements for this purpose. If one of these notes
+/// is present, ElfFile's build_id() method will find it.
+///
+/// If neither of the above are present, this function will hash the first page
+/// of the `.text` section (program code). This matches what the Breakpad
+/// processor does.
+///
+/// If all of the above fails, this function will return `None`.
+pub fn get_elf_id(elf_file: &ElfFile, data: &[u8]) -> Option<Uuid> {
+    if let Some(identifier) = elf_file.build_id() {
+        return Some(create_elf_id(identifier, elf_file.elf().little_endian));
+    }
+
+    // We were not able to locate the build ID, so fall back to hashing the
+    // first page of the ".text" (program code) section. This algorithm XORs
+    // 16-byte chunks directly into a UUID buffer.
+    if let Some(section_data) = find_text_section(elf_file.elf(), data) {
+        let mut hash = [0; UUID_SIZE];
+        for i in 0..cmp::min(section_data.len(), PAGE_SIZE) {
+            hash[i % UUID_SIZE] ^= section_data[i];
+        }
+
+        return Some(create_elf_id(&hash, elf_file.elf().little_endian));
+    }
+
+    None
+}
+
+/// Returns a reference to the data of the the .text section in an ELF binary.
+fn find_text_section<'elf, 'data>(elf: &'elf elf::Elf, data: &'data [u8]) -> Option<&'data [u8]> {
+    elf.section_headers.iter().find_map(|header| {
+        match (header.sh_type, elf.shdr_strtab.get(header.sh_name)) {
+            (elf::section_header::SHT_PROGBITS, Some(Ok(".text"))) => {
+                Some(&data[header.sh_offset as usize..][..header.sh_size as usize])
+            }
+            _ => None,
+        }
+    })
+}
diff --git a/tools/profiler/rust-helper/src/lib.rs b/tools/profiler/rust-helper/src/lib.rs
new file mode 100644
index 0000000000..a22e631852
--- /dev/null
+++ b/tools/profiler/rust-helper/src/lib.rs
@@ -0,0 +1,111 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+extern crate memmap;
+extern crate rustc_demangle;
+extern crate thin_vec;
+extern crate uuid;
+
+#[cfg(feature = "parse_elf")]
+extern crate goblin;
+#[cfg(feature = "parse_elf")]
+extern crate object;
+
+mod compact_symbol_table;
+
+#[cfg(feature = "parse_elf")]
+mod elf;
+
+#[cfg(feature = "parse_elf")]
+use memmap::MmapOptions;
+#[cfg(feature = "parse_elf")]
+use std::fs::File;
+
+use compact_symbol_table::CompactSymbolTable;
+use rustc_demangle::try_demangle;
+use std::ffi::CStr;
+use std::mem;
+use std::os::raw::c_char;
+use std::ptr;
+
+#[cfg(feature = "parse_elf")]
+pub fn get_compact_symbol_table_from_file(
+    debug_path: &str,
+    breakpad_id: Option<&str>,
+) -> Option<CompactSymbolTable> {
+    let file = File::open(debug_path).ok()?;
+    let buffer = unsafe { MmapOptions::new().map(&file).ok()? };
+    elf::get_compact_symbol_table(&buffer, breakpad_id)
+}
+
+#[cfg(not(feature = "parse_elf"))]
+pub fn get_compact_symbol_table_from_file(
+    _debug_path: &str,
+    _breakpad_id: Option<&str>,
+) -> Option<CompactSymbolTable> {
+    None
+}
+
+#[no_mangle]
+pub extern "C" fn profiler_get_symbol_table(
+    debug_path: *const c_char,
+    breakpad_id: *const c_char,
+    symbol_table: &mut CompactSymbolTable,
+) -> bool {
+    let debug_path = unsafe { CStr::from_ptr(debug_path).to_string_lossy() };
+    let breakpad_id = if breakpad_id.is_null() {
+        None
+    } else {
+        match unsafe { CStr::from_ptr(breakpad_id).to_str() } {
+            Ok(s) => Some(s),
+            Err(_) => return false,
+        }
+    };
+
+    match get_compact_symbol_table_from_file(&debug_path, breakpad_id.map(|id| id.as_ref())) {
+        Some(mut st) => {
+            std::mem::swap(symbol_table, &mut st);
+            true
+        }
+        None => false,
+    }
+}
+
+#[no_mangle]
+pub extern "C" fn profiler_demangle_rust(
+    mangled: *const c_char,
+    buffer: *mut c_char,
+    buffer_len: usize,
+) -> bool {
+    assert!(!mangled.is_null());
+    assert!(!buffer.is_null());
+
+    if buffer_len == 0 {
+        return false;
+    }
+
+    let buffer: *mut u8 = unsafe { mem::transmute(buffer) };
+    let mangled = match unsafe { CStr::from_ptr(mangled).to_str() } {
+        Ok(s) => s,
+        Err(_) => return false,
+    };
+
+    match try_demangle(mangled) {
+        Ok(demangled) => {
+            let mut demangled = format!("{:#}", demangled);
+            if !demangled.is_ascii() {
+                return false;
+            }
+            demangled.truncate(buffer_len - 1);
+
+            let bytes = demangled.as_bytes();
+            unsafe {
+                ptr::copy(bytes.as_ptr(), buffer, bytes.len());
+                ptr::write(buffer.offset(bytes.len() as isize), 0);
+            }
+            true
+        }
+        Err(_) => false,
+    }
+}
diff --git a/tools/profiler/tasktracer/GeckoTaskTracer.cpp b/tools/profiler/tasktracer/GeckoTaskTracer.cpp
new file mode 100644
index 0000000000..5a8ca8625c
--- /dev/null
+++ b/tools/profiler/tasktracer/GeckoTaskTracer.cpp
@@ -0,0 +1,464 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "GeckoTaskTracer.h"
+#include "GeckoTaskTracerImpl.h"
+
+#include "platform.h"
+
+#include "mozilla/DebugOnly.h"
+#include "mozilla/MathAlgorithms.h"
+#include "mozilla/StaticMutex.h"
+#include "mozilla/ThreadLocal.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Unused.h"
+#include "nsString.h"
+#include "nsThreadUtils.h"
+#include "prtime.h"
+
+#include <stdarg.h>
+
+#define MAX_SIZE_LOG (1024 * 128)
+
+// NS_ENSURE_TRUE_VOID() without the warning on the debug build.
+#define ENSURE_TRUE_VOID(x)   \
+  do {                        \
+    if (MOZ_UNLIKELY(!(x))) { \
+      return;                 \
+    }                         \
+  } while (0)
+
+// NS_ENSURE_TRUE() without the warning on the debug build.
+#define ENSURE_TRUE(x, ret)   \
+  do {                        \
+    if (MOZ_UNLIKELY(!(x))) { \
+      return ret;             \
+    }                         \
+  } while (0)
+
+namespace mozilla {
+namespace tasktracer {
+
+#define SOURCE_EVENT_NAME(type) \
+  const char* CreateSourceEvent##type() { return "SourceEvent" #type; }
+#include "SourceEventTypeMap.h"
+#undef SOURCE_EVENT_NAME
+
+static MOZ_THREAD_LOCAL(TraceInfo*) sTraceInfoTLS;
+static mozilla::StaticMutex sMutex;
+
+// The generation of TraceInfo. It will be > 0 if the Task Tracer is started and
+// <= 0 if stopped.
+bool gStarted(false);
+static nsTArray<UniquePtr<TraceInfo>>* sTraceInfos = nullptr;
+static PRTime sStartTime;
+
+static const char sJSLabelPrefix[] = "#tt#";
+
+namespace {
+
+static PRTime GetTimestamp() { return PR_Now() / 1000; }
+
+static TraceInfo* AllocTraceInfo(int aTid) {
+  sMutex.AssertCurrentThreadOwns();
+  MOZ_ASSERT(sTraceInfos);
+  auto* info = sTraceInfos->AppendElement(MakeUnique<TraceInfo>(aTid));
+
+  return info->get();
+}
+
+static void CreateSourceEvent(SourceEventType aType) {
+  // Create a new unique task id.
+  uint64_t newId = GenNewUniqueTaskId();
+  {
+    TraceInfoHolder info = GetOrCreateTraceInfo();
+    ENSURE_TRUE_VOID(info);
+
+    info->mCurTraceSourceId = newId;
+    info->mCurTraceSourceType = aType;
+    info->mCurTaskId = newId;
+  }
+
+  uintptr_t* namePtr;
+#define SOURCE_EVENT_NAME(type)                     \
+  case SourceEventType::type: {                     \
+    namePtr = (uintptr_t*)&CreateSourceEvent##type; \
+    break;                                          \
+  }
+
+  switch (aType) {
+#include "SourceEventTypeMap.h"
+    default:
+      MOZ_CRASH("Unknown SourceEvent.");
+  }
+#undef SOURCE_EVENT_NAME
+
+  // Log a fake dispatch and start for this source event.
+  LogDispatch(newId, newId, newId, aType);
+  LogVirtualTablePtr(newId, newId, namePtr);
+  LogBegin(newId, newId);
+}
+
+static void DestroySourceEvent() {
+  // Log a fake end for this source event.
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  uint64_t curTraceSourceId;
+  curTraceSourceId = info->mCurTraceSourceId;
+  info.Reset();
+
+  LogEnd(curTraceSourceId, curTraceSourceId);
+}
+
+inline static void ObsoleteCurrentTraceInfos() {
+  MOZ_ASSERT(sTraceInfos);
+  for (uint32_t i = 0; i < sTraceInfos->Length(); ++i) {
+    (*sTraceInfos)[i]->mObsolete = true;
+  }
+}
+
+static void SetLogStarted(bool aIsStartLogging) {
+  MOZ_ASSERT(aIsStartLogging != gStarted);
+  StaticMutexAutoLock lock(sMutex);
+
+  gStarted = aIsStartLogging;
+
+  if (aIsStartLogging && sTraceInfos == nullptr) {
+    sTraceInfos = new nsTArray<UniquePtr<TraceInfo>>();
+  }
+
+  if (!aIsStartLogging && sTraceInfos) {
+    ObsoleteCurrentTraceInfos();
+  }
+}
+
+}  // namespace
+
+TraceInfoLogType* TraceInfo::AppendLog() {
+  if (mLogsSize >= MAX_SIZE_LOG) {
+    return nullptr;
+  }
+  TraceInfoLogNode* node = new TraceInfoLogNode;
+  node->mNext = nullptr;
+  if (mLogsTail) {
+    mLogsTail->mNext = node;
+    mLogsTail = node;
+  } else {
+    mLogsTail = mLogsHead = node;
+  }
+  mLogsSize++;
+  return &node->mLog;
+}
+
+void InitTaskTracer(uint32_t aFlags) {
+  StaticMutexAutoLock lock(sMutex);
+
+  if (aFlags & FORKED_AFTER_NUWA) {
+    ObsoleteCurrentTraceInfos();
+    return;
+  }
+
+  MOZ_ASSERT(!sTraceInfos);
+
+  bool success = sTraceInfoTLS.init();
+  if (!success) {
+    MOZ_CRASH();
+  }
+}
+
+void ShutdownTaskTracer() {
+  if (IsStartLogging()) {
+    SetLogStarted(false);
+
+    StaticMutexAutoLock lock(sMutex);
+    // Make sure all threads are out of holding mutics.
+    // See |GetOrCreateTraceInfo()|
+    for (auto& traceinfo : *sTraceInfos) {
+      MutexAutoLock lock(traceinfo->mLogsMutex);
+    }
+    delete sTraceInfos;
+    sTraceInfos = nullptr;
+  }
+}
+
+static void FreeTraceInfo(TraceInfo* aTraceInfo) {
+  sMutex.AssertCurrentThreadOwns();
+  if (aTraceInfo) {
+    UniquePtr<TraceInfo> traceinfo(aTraceInfo);
+    mozilla::DebugOnly<bool> removed = sTraceInfos->RemoveElement(traceinfo);
+    MOZ_ASSERT(removed);
+    Unused << traceinfo.release();  // A dirty hack to prevent double free.
+  }
+}
+
+void FreeTraceInfo() {
+  StaticMutexAutoLock lock(sMutex);
+  if (sTraceInfos) {
+    FreeTraceInfo(sTraceInfoTLS.get());
+  }
+}
+
+TraceInfoHolder GetOrCreateTraceInfo() {
+  TraceInfo* info = sTraceInfoTLS.get();
+  StaticMutexAutoLock lock(sMutex);
+  ENSURE_TRUE(IsStartLogging(), TraceInfoHolder{});
+
+  if (info && info->mObsolete) {
+    // TraceInfo is obsolete: remove it.
+    FreeTraceInfo(info);
+    info = nullptr;
+  }
+
+  if (!info) {
+    info = AllocTraceInfo(profiler_current_thread_id());
+    sTraceInfoTLS.set(info);
+  }
+
+  return TraceInfoHolder{info};  // |mLogsMutex| will be held, then
+                                 // ||sMutex| will be released for
+                                 // efficiency reason.
+}
+
+uint64_t GenNewUniqueTaskId() {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE(info, 0);
+
+  int tid = profiler_current_thread_id();
+  uint64_t taskid = ((uint64_t)tid << 32) | ++info->mLastUniqueTaskId;
+  return taskid;
+}
+
+AutoSaveCurTraceInfoImpl::AutoSaveCurTraceInfoImpl() {
+  GetCurTraceInfo(&mSavedSourceEventId, &mSavedTaskId, &mSavedSourceEventType);
+}
+
+AutoSaveCurTraceInfoImpl::~AutoSaveCurTraceInfoImpl() {
+  SetCurTraceInfo(mSavedSourceEventId, mSavedTaskId, mSavedSourceEventType);
+}
+
+void SetCurTraceInfo(uint64_t aSourceEventId, uint64_t aParentTaskId,
+                     SourceEventType aSourceEventType) {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  info->mCurTraceSourceId = aSourceEventId;
+  info->mCurTaskId = aParentTaskId;
+  info->mCurTraceSourceType = aSourceEventType;
+}
+
+void GetCurTraceInfo(uint64_t* aOutSourceEventId, uint64_t* aOutParentTaskId,
+                     SourceEventType* aOutSourceEventType) {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  *aOutSourceEventId = info->mCurTraceSourceId;
+  *aOutParentTaskId = info->mCurTaskId;
+  *aOutSourceEventType = info->mCurTraceSourceType;
+}
+
+void LogDispatch(uint64_t aTaskId, uint64_t aParentTaskId,
+                 uint64_t aSourceEventId, SourceEventType aSourceEventType) {
+  LogDispatch(aTaskId, aParentTaskId, aSourceEventId, aSourceEventType, 0);
+}
+
+void LogDispatch(uint64_t aTaskId, uint64_t aParentTaskId,
+                 uint64_t aSourceEventId, SourceEventType aSourceEventType,
+                 int aDelayTimeMs) {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  // aDelayTimeMs is the expected delay time in milliseconds, thus the dispatch
+  // time calculated of it might be slightly off in the real world.
+  uint64_t time =
+      (aDelayTimeMs <= 0) ? GetTimestamp() : GetTimestamp() + aDelayTimeMs;
+
+  // Log format:
+  // [0 taskId dispatchTime sourceEventId sourceEventType parentTaskId]
+  TraceInfoLogType* log = info->AppendLog();
+  if (log) {
+    log->mDispatch.mType = ACTION_DISPATCH;
+    log->mDispatch.mTaskId = aTaskId;
+    log->mDispatch.mTime = time;
+    log->mDispatch.mSourceEventId = aSourceEventId;
+    log->mDispatch.mSourceEventType = aSourceEventType;
+    log->mDispatch.mParentTaskId = aParentTaskId;
+  }
+}
+
+void LogBegin(uint64_t aTaskId, uint64_t aSourceEventId) {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  // Log format:
+  // [1 taskId beginTime processId threadId]
+  TraceInfoLogType* log = info->AppendLog();
+  if (log) {
+    log->mBegin.mType = ACTION_BEGIN;
+    log->mBegin.mTaskId = aTaskId;
+    log->mBegin.mTime = GetTimestamp();
+    log->mBegin.mPid = profiler_current_process_id();
+    log->mBegin.mTid = profiler_current_thread_id();
+
+    MOZ_ASSERT(log->mBegin.mPid >= 0,
+               "native process ID is < 0 (signed integer overflow)");
+    MOZ_ASSERT(log->mBegin.mTid >= 0,
+               "native thread ID is < 0  (signed integer overflow)");
+  }
+}
+
+void LogEnd(uint64_t aTaskId, uint64_t aSourceEventId) {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  // Log format:
+  // [2 taskId endTime]
+  TraceInfoLogType* log = info->AppendLog();
+  if (log) {
+    log->mEnd.mType = ACTION_END;
+    log->mEnd.mTaskId = aTaskId;
+    log->mEnd.mTime = GetTimestamp();
+  }
+}
+
+void LogVirtualTablePtr(uint64_t aTaskId, uint64_t aSourceEventId,
+                        uintptr_t* aVptr) {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  // Log format:
+  // [4 taskId address]
+  TraceInfoLogType* log = info->AppendLog();
+  if (log) {
+    // Since addr2line used by the Gecko Profiler addon can not solve
+    // non-function addresses, we use the first entry of vtable as the symbol
+    // to solve. We should find a better solution later.
+    log->mVPtr.mType = ACTION_GET_VTABLE;
+    log->mVPtr.mTaskId = aTaskId;
+    log->mVPtr.mVPtr = reinterpret_cast<uintptr_t>(aVptr);
+  }
+}
+
+void AutoSourceEvent::StartScope(SourceEventType aType) {
+  CreateSourceEvent(aType);
+}
+
+void AutoSourceEvent::StopScope() { DestroySourceEvent(); }
+
+void AutoScopedLabel::Init(const char* aFormat, va_list& aArgs) {
+  nsCString label;
+  va_list& args = aArgs;
+  label.AppendPrintf(aFormat, args);
+  mLabel = strdup(label.get());
+  AddLabel("Begin %s", mLabel);
+}
+
+void DoAddLabel(const char* aFormat, va_list& aArgs) {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  // Log format:
+  // [3 taskId "label"]
+  TraceInfoLogType* log = info->AppendLog();
+  if (log) {
+    va_list& args = aArgs;
+    nsCString& buffer = *info->mStrs.AppendElement();
+    buffer.AppendPrintf(aFormat, args);
+
+    log->mLabel.mType = ACTION_ADD_LABEL;
+    log->mLabel.mTaskId = info->mCurTaskId;
+    log->mLabel.mTime = GetTimestamp();
+    log->mLabel.mStrIdx = info->mStrs.Length() - 1;
+  }
+}
+
+// Functions used by GeckoProfiler.
+
+void StartLogging() {
+  sStartTime = GetTimestamp();
+  SetLogStarted(true);
+}
+
+void StopLogging() { SetLogStarted(false); }
+
+UniquePtr<Vector<nsCString>> GetLoggedData(TimeStamp aTimeStamp) {
+  auto result = MakeUnique<Vector<nsCString>>();
+
+  // TODO: This is called from a signal handler. Use semaphore instead.
+  StaticMutexAutoLock lock(sMutex);
+
+  if (sTraceInfos == nullptr) {
+    return result;
+  }
+
+  for (uint32_t i = 0; i < sTraceInfos->Length(); ++i) {
+    TraceInfo* info = (*sTraceInfos)[i].get();
+    MutexAutoLock lockLogs(info->mLogsMutex);
+    if (info->mObsolete) {
+      continue;
+    }
+
+    nsTArray<nsCString>& strs = info->mStrs;
+    for (TraceInfoLogNode* node = info->mLogsHead; node; node = node->mNext) {
+      TraceInfoLogType& log = node->mLog;
+      MOZ_RELEASE_ASSERT(result->append(nsCString()));
+      nsCString& buffer = result->back();
+
+      switch (log.mType) {
+        case ACTION_DISPATCH:
+          buffer.AppendPrintf("%d %llu %llu %llu %d %llu", ACTION_DISPATCH,
+                              (unsigned long long)log.mDispatch.mTaskId,
+                              (unsigned long long)log.mDispatch.mTime,
+                              (unsigned long long)log.mDispatch.mSourceEventId,
+                              log.mDispatch.mSourceEventType,
+                              (unsigned long long)log.mDispatch.mParentTaskId);
+          break;
+
+        case ACTION_BEGIN:
+          buffer.AppendPrintf("%d %llu %llu %d %d", ACTION_BEGIN,
+                              (unsigned long long)log.mBegin.mTaskId,
+                              (unsigned long long)log.mBegin.mTime,
+                              log.mBegin.mPid, log.mBegin.mTid);
+          break;
+
+        case ACTION_END:
+          buffer.AppendPrintf("%d %llu %llu", ACTION_END,
+                              (unsigned long long)log.mEnd.mTaskId,
+                              (unsigned long long)log.mEnd.mTime);
+          break;
+
+        case ACTION_GET_VTABLE:
+          buffer.AppendPrintf("%d %llu %p", ACTION_GET_VTABLE,
+                              (unsigned long long)log.mVPtr.mTaskId,
+                              (void*)log.mVPtr.mVPtr);
+          break;
+
+        case ACTION_ADD_LABEL:
+          buffer.AppendPrintf("%d %llu %llu2 \"%s\"", ACTION_ADD_LABEL,
+                              (unsigned long long)log.mLabel.mTaskId,
+                              (unsigned long long)log.mLabel.mTime,
+                              strs[log.mLabel.mStrIdx].get());
+          break;
+
+        default:
+          MOZ_CRASH("Unknow TaskTracer log type!");
+      }
+    }
+  }
+
+  return result;
+}
+
+PRTime GetStartTime() { return sStartTime; }
+
+const char* GetJSLabelPrefix() { return sJSLabelPrefix; }
+
+#undef ENSURE_TRUE_VOID
+#undef ENSURE_TRUE
+
+}  // namespace tasktracer
+}  // namespace mozilla
diff --git a/tools/profiler/tasktracer/GeckoTaskTracer.h b/tools/profiler/tasktracer/GeckoTaskTracer.h
new file mode 100644
index 0000000000..dc299ac8fd
--- /dev/null
+++ b/tools/profiler/tasktracer/GeckoTaskTracer.h
@@ -0,0 +1,182 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef GECKO_TASK_TRACER_H
+#define GECKO_TASK_TRACER_H
+
+#include "mozilla/Atomics.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Vector.h"
+#include "nsCOMPtr.h"
+#include "nsStringFwd.h"
+
+#include <stdarg.h>
+
+/**
+ * TaskTracer provides a way to trace the correlation between different tasks
+ * across threads and processes. Unlike sampling based profilers, TaskTracer can
+ * tell you where a task is dispatched from, what its original source was, how
+ * long it waited in the event queue, and how long it took to execute.
+ *
+ * Source Events are usually some kinds of I/O events we're interested in, such
+ * as touch events, timer events, network events, etc. When a source event is
+ * created, TaskTracer records the entire chain of Tasks and nsRunnables as they
+ * are dispatched to different threads and processes. It records latency,
+ * execution time, etc. for each Task and nsRunnable that chains back to the
+ * original source event.
+ */
+
+class nsIRunnable;
+
+namespace mozilla {
+
+class TimeStamp;
+class Runnable;
+
+namespace tasktracer {
+
+extern bool gStarted;
+
+/**
+ * Check if the TaskTracer has been started.
+ */
+inline bool IsStartLogging() {
+  // |gStarted| is not an atomic variable, but it is fine for it is a
+  // boolean value and will be changed under the protection of
+  // |sMutex|.
+  //
+  // There is a latency between the change of the value and the
+  // observation of threads.  |gStarted| would be checked again with
+  // the protection of mutex in logging functions; for example,
+  // |AddLabel()|, so all false positive would be blocked with the
+  // double checks.  For false negative, it is fine to lose some
+  // records at begin of logging.
+  return gStarted;
+}
+
+enum { FORKED_AFTER_NUWA = 1 << 0 };
+
+enum SourceEventType {
+#define SOURCE_EVENT_NAME(x) x,
+#include "SourceEventTypeMap.h"
+#undef SOURCE_EVENT_NAME
+};
+
+class AutoSaveCurTraceInfoImpl {
+  uint64_t mSavedTaskId;
+  uint64_t mSavedSourceEventId;
+  SourceEventType mSavedSourceEventType;
+
+ public:
+  AutoSaveCurTraceInfoImpl();
+  ~AutoSaveCurTraceInfoImpl();
+};
+
+class AutoSaveCurTraceInfo {
+  Maybe<AutoSaveCurTraceInfoImpl> mSaved;
+
+ public:
+  AutoSaveCurTraceInfo() {
+    if (IsStartLogging()) {
+      mSaved.emplace();
+    }
+  }
+
+  /**
+   * The instance had saved TraceInfo.
+   *
+   * It means that TaskTrace had been enabled when the instance was
+   * created.
+   */
+  bool HasSavedTraceInfo() { return !!mSaved; }
+};
+
+class AutoSourceEvent : public AutoSaveCurTraceInfo {
+  void StartScope(SourceEventType aType);
+  void StopScope();
+
+ public:
+  explicit AutoSourceEvent(SourceEventType aType) : AutoSaveCurTraceInfo() {
+    if (HasSavedTraceInfo()) {
+      StartScope(aType);
+    }
+  }
+
+  ~AutoSourceEvent() {
+    if (HasSavedTraceInfo()) {
+      StopScope();
+    }
+  }
+};
+
+void InitTaskTracer(uint32_t aFlags = 0);
+void ShutdownTaskTracer();
+
+void DoAddLabel(const char* aFormat, va_list& aArgs);
+
+// Add a label to the currently running task, aFormat is the message to log,
+// followed by corresponding parameters.
+inline void AddLabel(const char* aFormat, ...) MOZ_FORMAT_PRINTF(1, 2);
+inline void AddLabel(const char* aFormat, ...) {
+  if (IsStartLogging()) {
+    va_list args;
+    va_start(args, aFormat);
+    DoAddLabel(aFormat, args);
+    va_end(args);
+  }
+}
+
+void StartLogging();
+void StopLogging();
+UniquePtr<Vector<nsCString>> GetLoggedData(TimeStamp aStartTime);
+
+// Returns the timestamp when Task Tracer is enabled in this process.
+PRTime GetStartTime();
+
+/**
+ * Internal functions.
+ */
+
+already_AddRefed<nsIRunnable> CreateTracedRunnable(
+    already_AddRefed<nsIRunnable>&& aRunnable);
+
+// Free the TraceInfo allocated on a thread's TLS. Currently we are wrapping
+// tasks running on nsThreads and base::thread, so FreeTraceInfo is called at
+// where nsThread and base::thread release themselves.
+void FreeTraceInfo();
+
+const char* GetJSLabelPrefix();
+
+void GetCurTraceInfo(uint64_t* aOutSourceEventId, uint64_t* aOutParentTaskId,
+                     SourceEventType* aOutSourceEventType);
+
+class AutoScopedLabel {
+  char* mLabel;
+  void Init(const char* aFormat, va_list& aArgs);
+
+ public:
+  explicit AutoScopedLabel(const char* aFormat, ...) : mLabel(nullptr) {
+    if (IsStartLogging()) {
+      va_list args;
+      va_start(args, aFormat);
+      Init(aFormat, args);
+      va_end(args);
+    }
+  }
+
+  ~AutoScopedLabel() {
+    if (mLabel) {
+      AddLabel("End %s", mLabel);
+      free(mLabel);
+    }
+  }
+};
+
+}  // namespace tasktracer
+}  // namespace mozilla.
+
+#endif
diff --git a/tools/profiler/tasktracer/GeckoTaskTracerImpl.h b/tools/profiler/tasktracer/GeckoTaskTracerImpl.h
new file mode 100644
index 0000000000..2b44a0f904
--- /dev/null
+++ b/tools/profiler/tasktracer/GeckoTaskTracerImpl.h
@@ -0,0 +1,180 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef GECKO_TASK_TRACER_IMPL_H
+#define GECKO_TASK_TRACER_IMPL_H
+
+#include "GeckoTaskTracer.h"
+
+#include "mozilla/Mutex.h"
+#include "nsTArray.h"
+
+namespace mozilla {
+namespace tasktracer {
+
+struct LogRecDispatch {
+  uint32_t mType;
+  uint32_t mSourceEventType;
+  uint64_t mTaskId;
+  uint64_t mTime;
+  uint64_t mSourceEventId;
+  uint64_t mParentTaskId;
+};
+
+struct LogRecBegin {
+  uint32_t mType;
+  uint64_t mTaskId;
+  uint64_t mTime;
+  uint32_t mPid;
+  uint32_t mTid;
+};
+
+struct LogRecEnd {
+  uint32_t mType;
+  uint64_t mTaskId;
+  uint64_t mTime;
+};
+
+struct LogRecVPtr {
+  uint32_t mType;
+  uint64_t mTaskId;
+  uintptr_t mVPtr;
+};
+
+struct LogRecLabel {
+  uint32_t mType;
+  uint32_t mStrIdx;
+  uint64_t mTaskId;
+  uint64_t mTime;
+};
+
+union TraceInfoLogType {
+  uint32_t mType;
+  LogRecDispatch mDispatch;
+  LogRecBegin mBegin;
+  LogRecEnd mEnd;
+  LogRecVPtr mVPtr;
+  LogRecLabel mLabel;
+};
+
+struct TraceInfoLogNode {
+  TraceInfoLogType mLog;
+  TraceInfoLogNode* mNext;
+};
+
+struct TraceInfo {
+  explicit TraceInfo(uint32_t aThreadId)
+      : mCurTraceSourceId(0),
+        mCurTaskId(0),
+        mCurTraceSourceType(Unknown),
+        mThreadId(aThreadId),
+        mLastUniqueTaskId(0),
+        mObsolete(false),
+        mLogsMutex("TraceInfoMutex"),
+        mLogsHead(nullptr),
+        mLogsTail(nullptr),
+        mLogsSize(0) {
+    MOZ_COUNT_CTOR(TraceInfo);
+  }
+
+  ~TraceInfo() {
+    MOZ_COUNT_DTOR(TraceInfo);
+    while (mLogsHead) {
+      auto node = mLogsHead;
+      mLogsHead = node->mNext;
+      delete node;
+    }
+  }
+
+  TraceInfoLogType* AppendLog();
+
+  uint64_t mCurTraceSourceId;
+  uint64_t mCurTaskId;
+  SourceEventType mCurTraceSourceType;
+  uint32_t mThreadId;
+  uint32_t mLastUniqueTaskId;
+  mozilla::Atomic<bool> mObsolete;
+
+  // This mutex protects the following log
+  mozilla::Mutex mLogsMutex;
+  TraceInfoLogNode* mLogsHead;
+  TraceInfoLogNode* mLogsTail;
+  int mLogsSize;
+  nsTArray<nsCString> mStrs;
+};
+
+class TraceInfoHolder {
+ public:
+  TraceInfoHolder() : mInfo(nullptr) {}
+  explicit TraceInfoHolder(TraceInfo* aInfo) : mInfo(aInfo) {
+    aInfo->mLogsMutex.AssertNotCurrentThreadOwns();  // in case of recursive
+    aInfo->mLogsMutex.Lock();
+    MOZ_ASSERT(aInfo);
+  }
+  TraceInfoHolder(const TraceInfoHolder& aOther) = delete;
+  TraceInfoHolder(TraceInfoHolder&& aOther) : mInfo(aOther.mInfo) {
+    if (!!aOther) {
+      aOther->mLogsMutex.AssertCurrentThreadOwns();
+    }
+    aOther.mInfo = nullptr;
+  }
+  ~TraceInfoHolder() {
+    if (mInfo) mInfo->mLogsMutex.Unlock();
+  }
+  explicit operator bool() const { return !!mInfo; }
+  TraceInfo* operator->() { return mInfo; }
+  bool operator==(TraceInfo* aOther) const { return mInfo == aOther; }
+  bool operator==(const TraceInfoHolder& aOther) const {
+    return mInfo == aOther.mInfo;
+  }
+  void Reset() {
+    if (mInfo) {
+      mInfo->mLogsMutex.Unlock();
+      mInfo = nullptr;
+    }
+  }
+
+ private:
+  TraceInfo* mInfo;
+};
+
+// Return the TraceInfo of current thread, allocate a new one if not exit.
+TraceInfoHolder GetOrCreateTraceInfo();
+
+uint64_t GenNewUniqueTaskId();
+
+void SetCurTraceInfo(uint64_t aSourceEventId, uint64_t aParentTaskId,
+                     SourceEventType aSourceEventType);
+
+/**
+ * Logging functions of different trace actions.
+ */
+enum ActionType {
+  ACTION_DISPATCH = 0,
+  ACTION_BEGIN,
+  ACTION_END,
+  ACTION_ADD_LABEL,
+  ACTION_GET_VTABLE
+};
+
+void LogDispatch(uint64_t aTaskId, uint64_t aParentTaskId,
+                 uint64_t aSourceEventId, SourceEventType aSourceEventType);
+
+void LogDispatch(uint64_t aTaskId, uint64_t aParentTaskId,
+                 uint64_t aSourceEventId, SourceEventType aSourceEventType,
+                 int aDelayTimeMs);
+
+void LogBegin(uint64_t aTaskId, uint64_t aSourceEventId);
+
+void LogEnd(uint64_t aTaskId, uint64_t aSourceEventId);
+
+void LogVirtualTablePtr(uint64_t aTaskId, uint64_t aSourceEventId,
+                        uintptr_t* aVptr);
+
+}  // namespace tasktracer
+}  // namespace mozilla
+
+#endif
diff --git a/tools/profiler/tasktracer/SourceEventTypeMap.h b/tools/profiler/tasktracer/SourceEventTypeMap.h
new file mode 100644
index 0000000000..6e687ecb1e
--- /dev/null
+++ b/tools/profiler/tasktracer/SourceEventTypeMap.h
@@ -0,0 +1,16 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef GECKO_TASK_TRACER_H
+#  error "Don't include this file directly"
+#endif
+
+SOURCE_EVENT_NAME(Unknown)
+SOURCE_EVENT_NAME(Touch)
+SOURCE_EVENT_NAME(Mouse)
+SOURCE_EVENT_NAME(Key)
+SOURCE_EVENT_NAME(Bluetooth)
+SOURCE_EVENT_NAME(Unixsocket)
+SOURCE_EVENT_NAME(Wifi)
+SOURCE_EVENT_NAME(SocketIO)
diff --git a/tools/profiler/tasktracer/TracedTaskCommon.cpp b/tools/profiler/tasktracer/TracedTaskCommon.cpp
new file mode 100644
index 0000000000..4b5d4d4cc6
--- /dev/null
+++ b/tools/profiler/tasktracer/TracedTaskCommon.cpp
@@ -0,0 +1,128 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "TracedTaskCommon.h"
+
+#include "GeckoTaskTracerImpl.h"
+
+// NS_ENSURE_TRUE_VOID() without the warning on the debug build.
+#define ENSURE_TRUE_VOID(x)   \
+  do {                        \
+    if (MOZ_UNLIKELY(!(x))) { \
+      return;                 \
+    }                         \
+  } while (0)
+
+namespace mozilla {
+namespace tasktracer {
+
+TracedTaskCommon::TracedTaskCommon()
+    : mSourceEventType(SourceEventType::Unknown),
+      mSourceEventId(0),
+      mParentTaskId(0),
+      mTaskId(0),
+      mIsTraceInfoInit(false) {}
+
+TracedTaskCommon::~TracedTaskCommon() {}
+
+void TracedTaskCommon::Init() {
+  // Keep the following line before GetOrCreateTraceInfo() to avoid a
+  // deadlock.
+  uint64_t taskid = GenNewUniqueTaskId();
+
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  mTaskId = taskid;
+  mSourceEventId = info->mCurTraceSourceId;
+  mSourceEventType = info->mCurTraceSourceType;
+  mParentTaskId = info->mCurTaskId;
+  mIsTraceInfoInit = true;
+}
+
+void TracedTaskCommon::DispatchTask(int aDelayTimeMs) {
+  LogDispatch(mTaskId, mParentTaskId, mSourceEventId, mSourceEventType,
+              aDelayTimeMs);
+}
+
+void TracedTaskCommon::DoGetTLSTraceInfo() {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+  MOZ_ASSERT(!mIsTraceInfoInit);
+
+  mSourceEventType = info->mCurTraceSourceType;
+  mSourceEventId = info->mCurTraceSourceId;
+  mTaskId = info->mCurTaskId;
+  mIsTraceInfoInit = true;
+}
+
+void TracedTaskCommon::DoSetTLSTraceInfo() {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  if (mIsTraceInfoInit) {
+    info->mCurTraceSourceId = mSourceEventId;
+    info->mCurTraceSourceType = mSourceEventType;
+    info->mCurTaskId = mTaskId;
+  }
+}
+
+void TracedTaskCommon::ClearTLSTraceInfo() {
+  TraceInfoHolder info = GetOrCreateTraceInfo();
+  ENSURE_TRUE_VOID(info);
+
+  info->mCurTraceSourceId = 0;
+  info->mCurTraceSourceType = SourceEventType::Unknown;
+  info->mCurTaskId = 0;
+}
+
+/**
+ * Implementation of class TracedRunnable.
+ */
+
+NS_IMPL_ISUPPORTS(TracedRunnable, nsIRunnable);
+
+TracedRunnable::TracedRunnable(already_AddRefed<nsIRunnable>&& aOriginalObj)
+    : TracedTaskCommon(), mOriginalObj(std::move(aOriginalObj)) {
+  Init();
+  LogVirtualTablePtr(mTaskId, mSourceEventId,
+                     *reinterpret_cast<uintptr_t**>(mOriginalObj.get()));
+}
+
+TracedRunnable::~TracedRunnable() {}
+
+NS_IMETHODIMP
+TracedRunnable::Run() {
+  SetTLSTraceInfo();
+  LogBegin(mTaskId, mSourceEventId);
+  nsresult rv = mOriginalObj->Run();
+  LogEnd(mTaskId, mSourceEventId);
+  ClearTLSTraceInfo();
+
+  return rv;
+}
+
+/**
+ * CreateTracedRunnable() returns a TracedRunnable wrapping the original
+ * nsIRunnable object, aRunnable.
+ */
+already_AddRefed<nsIRunnable> CreateTracedRunnable(
+    already_AddRefed<nsIRunnable>&& aRunnable) {
+  RefPtr<nsIRunnable> runnable = new TracedRunnable(std::move(aRunnable));
+  return runnable.forget();
+}
+
+void VirtualTask::AutoRunTask::StartScope(VirtualTask* aTask) {
+  mTask->SetTLSTraceInfo();
+  LogBegin(mTask->mTaskId, mTask->mSourceEventId);
+}
+
+void VirtualTask::AutoRunTask::StopScope() {
+  LogEnd(mTask->mTaskId, mTask->mSourceEventId);
+}
+
+}  // namespace tasktracer
+}  // namespace mozilla
diff --git a/tools/profiler/tasktracer/TracedTaskCommon.h b/tools/profiler/tasktracer/TracedTaskCommon.h
new file mode 100644
index 0000000000..d93e1b38e7
--- /dev/null
+++ b/tools/profiler/tasktracer/TracedTaskCommon.h
@@ -0,0 +1,130 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef TRACED_TASK_COMMON_H
+#define TRACED_TASK_COMMON_H
+
+#include "GeckoTaskTracer.h"
+
+#include "nsCOMPtr.h"
+#include "nsThreadUtils.h"
+
+namespace mozilla {
+namespace tasktracer {
+
+class TracedTaskCommon {
+ public:
+  TracedTaskCommon();
+  TracedTaskCommon(const TracedTaskCommon& aSrc)
+      : mSourceEventType(aSrc.mSourceEventType),
+        mSourceEventId(aSrc.mSourceEventId),
+        mParentTaskId(aSrc.mParentTaskId),
+        mTaskId(aSrc.mTaskId),
+        mIsTraceInfoInit(aSrc.mIsTraceInfoInit) {}
+  virtual ~TracedTaskCommon();
+
+  void DispatchTask(int aDelayTimeMs = 0);
+
+  void SetTLSTraceInfo() {
+    if (mIsTraceInfoInit) {
+      DoSetTLSTraceInfo();
+    }
+  }
+  void GetTLSTraceInfo() {
+    if (IsStartLogging()) {
+      DoGetTLSTraceInfo();
+    }
+  }
+  void ClearTLSTraceInfo();
+
+ private:
+  void DoSetTLSTraceInfo();
+  void DoGetTLSTraceInfo();
+
+ protected:
+  void Init();
+
+  // TraceInfo of TLS will be set by the following parameters, including source
+  // event type, source event ID, parent task ID, and task ID of this traced
+  // task/runnable.
+  SourceEventType mSourceEventType;
+  uint64_t mSourceEventId;
+  uint64_t mParentTaskId;
+  uint64_t mTaskId;
+  bool mIsTraceInfoInit;
+};
+
+class TracedRunnable : public TracedTaskCommon, public nsIRunnable {
+ public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIRUNNABLE
+
+  explicit TracedRunnable(already_AddRefed<nsIRunnable>&& aOriginalObj);
+
+ private:
+  virtual ~TracedRunnable();
+
+  nsCOMPtr<nsIRunnable> mOriginalObj;
+};
+
+/**
+ * This class is used to create a logical task, without a real
+ * runnable.
+ */
+class VirtualTask : public TracedTaskCommon {
+ public:
+  VirtualTask() : TracedTaskCommon() {}
+
+  VirtualTask(const VirtualTask& aSrc) : TracedTaskCommon(aSrc) {}
+
+  /**
+   * Initialize the task to create an unique ID, and store other
+   * information.
+   *
+   * This method may be called for one or more times.
+   */
+  void Init(uintptr_t* aVPtr = nullptr) {
+    TracedTaskCommon::Init();
+    if (aVPtr) {
+      extern void LogVirtualTablePtr(uint64_t aTaskId, uint64_t aSourceEventId,
+                                     uintptr_t * aVptr);
+      LogVirtualTablePtr(mTaskId, mSourceEventId, aVPtr);
+    }
+    DispatchTask();
+  }
+
+  /**
+   * Define the life-span of a VirtualTask.
+   *
+   * VirtualTask is not a real task, goes without a runnable, it's
+   * instances are never dispatched and ran by event loops.  This
+   * class used to define running time as the life-span of it's
+   * instance.
+   */
+  class AutoRunTask : public AutoSaveCurTraceInfo {
+    VirtualTask* mTask;
+    void StartScope(VirtualTask* aTask);
+    void StopScope();
+
+   public:
+    explicit AutoRunTask(VirtualTask* aTask)
+        : AutoSaveCurTraceInfo(), mTask(aTask) {
+      if (HasSavedTraceInfo()) {
+        StartScope(aTask);
+      }
+    }
+    ~AutoRunTask() {
+      if (HasSavedTraceInfo()) {
+        StopScope();
+      }
+    }
+  };
+};
+
+}  // namespace tasktracer
+}  // namespace mozilla
+
+#endif
diff --git a/tools/profiler/tests/browser/browser.ini b/tools/profiler/tests/browser/browser.ini
new file mode 100644
index 0000000000..afbccd1b00
--- /dev/null
+++ b/tools/profiler/tests/browser/browser.ini
@@ -0,0 +1,18 @@
+[DEFAULT]
+skip-if = tsan # TSan times out on pretty much all of these tests
+support-files =
+  ../shared-head.js
+  head.js
+  do_work_500ms.html
+  fixed_height.html
+  multi_frame.html
+  simple.html
+  single_frame.html
+
+[browser_test_feature_ipcmessages.js]
+[browser_test_feature_jsallocations.js]
+[browser_test_feature_nostacksampling.js]
+[browser_test_feature_preferencereads.js]
+[browser_test_markers_parent_process.js]
+[browser_test_profile_single_frame_page_info.js]
+[browser_test_profile_multi_frame_page_info.js]
diff --git a/tools/profiler/tests/browser/browser_test_feature_ipcmessages.js b/tools/profiler/tests/browser/browser_test_feature_ipcmessages.js
new file mode 100644
index 0000000000..b199f74198
--- /dev/null
+++ b/tools/profiler/tests/browser/browser_test_feature_ipcmessages.js
@@ -0,0 +1,110 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+requestLongerTimeout(10);
+
+async function waitForLoad() {
+  return SpecialPowers.spawn(gBrowser.selectedBrowser, [], () => {
+    return new Promise(function(resolve) {
+      if (content.document.readyState !== "complete") {
+        content.document.addEventListener("readystatechange", () => {
+          if (content.document.readyState === "complete") {
+            resolve();
+          }
+        });
+      } else {
+        resolve();
+      }
+    });
+  });
+}
+
+/**
+ * Test the IPCMessages feature.
+ */
+add_task(async function test_profile_feature_ipcmessges() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  Assert.ok(
+    !Services.profiler.IsActive(),
+    "The profiler is not currently active"
+  );
+
+  const url = BASE_URL + "simple.html";
+
+  info("Open a tab while profiling IPC messages.");
+  startProfiler({ features: ["threads", "leaf", "ipcmessages"] });
+  info("Started the profiler sucessfully! Now, let's open a tab.");
+
+  await BrowserTestUtils.withNewTab(url, async contentBrowser => {
+    info("We opened a tab!");
+    const contentPid = await SpecialPowers.spawn(
+      contentBrowser,
+      [],
+      () => Services.appinfo.processID
+    );
+    info("Now let's wait until it's fully loaded.");
+    await waitForLoad();
+
+    info(
+      "Check that some IPC profile markers were generated when " +
+        "the feature is enabled."
+    );
+    {
+      const { parentThread, contentThread } = await stopProfilerAndGetThreads(
+        contentPid
+      );
+
+      Assert.greater(
+        getPayloadsOfType(parentThread, "IPC").length,
+        0,
+        "IPC profile markers were recorded for the parent process' main " +
+          "thread when the IPCMessages feature was turned on."
+      );
+
+      Assert.greater(
+        getPayloadsOfType(contentThread, "IPC").length,
+        0,
+        "IPC profile markers were recorded for the content process' main " +
+          "thread when the IPCMessages feature was turned on."
+      );
+    }
+  });
+
+  info("Now open a tab without profiling IPC messages.");
+  startProfiler({ features: ["threads", "leaf"] });
+
+  await BrowserTestUtils.withNewTab(url, async contentBrowser => {
+    const contentPid = await SpecialPowers.spawn(
+      contentBrowser,
+      [],
+      () => Services.appinfo.processID
+    );
+    await waitForLoad();
+
+    info(
+      "Check that no IPC profile markers were recorded when the " +
+        "feature is turned off."
+    );
+    {
+      const { parentThread, contentThread } = await stopProfilerAndGetThreads(
+        contentPid
+      );
+      Assert.equal(
+        getPayloadsOfType(parentThread, "IPC").length,
+        0,
+        "No IPC profile markers were recorded for the parent process' main " +
+          "thread when the IPCMessages feature was turned off."
+      );
+
+      Assert.equal(
+        getPayloadsOfType(contentThread, "IPC").length,
+        0,
+        "No IPC profile markers were recorded for the content process' main " +
+          "thread when the IPCMessages feature was turned off."
+      );
+    }
+  });
+});
diff --git a/tools/profiler/tests/browser/browser_test_feature_jsallocations.js b/tools/profiler/tests/browser/browser_test_feature_jsallocations.js
new file mode 100644
index 0000000000..ae925e1fcd
--- /dev/null
+++ b/tools/profiler/tests/browser/browser_test_feature_jsallocations.js
@@ -0,0 +1,81 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+requestLongerTimeout(10);
+
+/**
+ * Test the JS Allocations feature. This is done as a browser test to ensure that
+ * we realistically try out how the JS allocations are running. This ensures that
+ * we are collecting allocations for the content process and the parent process.
+ */
+add_task(async function test_profile_feature_jsallocations() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  Assert.ok(
+    !Services.profiler.IsActive(),
+    "The profiler is not currently active"
+  );
+
+  startProfiler({ features: ["threads", "js", "jsallocations"] });
+
+  const url = BASE_URL + "do_work_500ms.html";
+  await BrowserTestUtils.withNewTab(url, async contentBrowser => {
+    const contentPid = await SpecialPowers.spawn(
+      contentBrowser,
+      [],
+      () => Services.appinfo.processID
+    );
+
+    // Wait 500ms so that the tab finishes executing.
+    await wait(500);
+
+    // Check that we can get some allocations when the feature is turned on.
+    {
+      const {
+        parentThread,
+        contentThread,
+      } = await stopProfilerNowAndGetThreads(contentPid);
+      Assert.greater(
+        getPayloadsOfType(parentThread, "JS allocation").length,
+        0,
+        "Allocations were recorded for the parent process' main thread when the " +
+          "JS Allocation feature was turned on."
+      );
+      Assert.greater(
+        getPayloadsOfType(contentThread, "JS allocation").length,
+        0,
+        "Allocations were recorded for the content process' main thread when the " +
+          "JS Allocation feature was turned on."
+      );
+    }
+
+    startProfiler({ features: ["threads", "js"] });
+    // Now reload the tab with a clean run.
+    gBrowser.reload();
+    await wait(500);
+
+    // Check that no allocations were recorded, and allocation tracking was correctly
+    // turned off.
+    {
+      const {
+        parentThread,
+        contentThread,
+      } = await stopProfilerNowAndGetThreads(contentPid);
+      Assert.equal(
+        getPayloadsOfType(parentThread, "JS allocation").length,
+        0,
+        "No allocations were recorded for the parent processes' main thread when " +
+          "JS allocation was not turned on."
+      );
+
+      Assert.equal(
+        getPayloadsOfType(contentThread, "JS allocation").length,
+        0,
+        "No allocations were recorded for the content processes' main thread when " +
+          "JS allocation was not turned on."
+      );
+    }
+  });
+});
diff --git a/tools/profiler/tests/browser/browser_test_feature_nostacksampling.js b/tools/profiler/tests/browser/browser_test_feature_nostacksampling.js
new file mode 100644
index 0000000000..0fdae614ee
--- /dev/null
+++ b/tools/profiler/tests/browser/browser_test_feature_nostacksampling.js
@@ -0,0 +1,78 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Test the No Stack Sampling feature.
+ */
+add_task(async function test_profile_feature_nostacksampling() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  Assert.ok(
+    !Services.profiler.IsActive(),
+    "The profiler is not currently active"
+  );
+
+  startProfiler({ features: ["threads", "js", "nostacksampling"] });
+
+  const url = BASE_URL + "do_work_500ms.html";
+  await BrowserTestUtils.withNewTab(url, async contentBrowser => {
+    const contentPid = await SpecialPowers.spawn(
+      contentBrowser,
+      [],
+      () => Services.appinfo.processID
+    );
+
+    // Wait 500ms so that the tab finishes executing.
+    await wait(500);
+
+    // Check that we can get no stacks when the feature is turned on.
+    {
+      const {
+        parentThread,
+        contentThread,
+      } = await stopProfilerNowAndGetThreads(contentPid);
+      Assert.equal(
+        parentThread.samples.data.length,
+        0,
+        "Stack samples were recorded from the parent process' main thread" +
+          "when the No Stack Sampling feature was turned on."
+      );
+      Assert.equal(
+        contentThread.samples.data.length,
+        0,
+        "Stack samples were recorded from the content process' main thread" +
+          "when the No Stack Sampling feature was turned on."
+      );
+    }
+
+    // Flush out any straggling allocation markers that may have not been collected
+    // yet by starting and stopping the profiler once.
+    startProfiler({ features: ["threads", "js"] });
+
+    // Now reload the tab with a clean run.
+    gBrowser.reload();
+    await wait(500);
+
+    // Check that stack samples were recorded.
+    {
+      const { parentThread, contentThread } = await stopProfilerAndGetThreads(
+        contentPid
+      );
+      Assert.greater(
+        parentThread.samples.data.length,
+        0,
+        "No Stack samples were recorded from the parent process' main thread" +
+          "when the No Stack Sampling feature was not turned on."
+      );
+
+      Assert.greater(
+        contentThread.samples.data.length,
+        0,
+        "No Stack samples were recorded from the content process' main thread" +
+          "when the No Stack Sampling feature was not turned on."
+      );
+    }
+  });
+});
diff --git a/tools/profiler/tests/browser/browser_test_feature_preferencereads.js b/tools/profiler/tests/browser/browser_test_feature_preferencereads.js
new file mode 100644
index 0000000000..ff1b869a47
--- /dev/null
+++ b/tools/profiler/tests/browser/browser_test_feature_preferencereads.js
@@ -0,0 +1,109 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+requestLongerTimeout(10);
+
+function countDpiPrefReadsInThread(thread) {
+  let count = 0;
+  for (let payload of getPayloadsOfType(thread, "PreferenceRead")) {
+    if (payload.prefName === "layout.css.dpi") {
+      count++;
+    }
+  }
+  return count;
+}
+
+async function waitForPaintAfterLoad() {
+  return SpecialPowers.spawn(gBrowser.selectedBrowser, [], () => {
+    return new Promise(function(resolve) {
+      function listener() {
+        if (content.document.readyState == "complete") {
+          content.requestAnimationFrame(() => content.setTimeout(resolve, 0));
+        }
+      }
+      if (content.document.readyState != "complete") {
+        content.document.addEventListener("readystatechange", listener);
+      } else {
+        listener();
+      }
+    });
+  });
+}
+
+/**
+ * Test the PreferenceRead feature.
+ */
+add_task(async function test_profile_feature_preferencereads() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  Assert.ok(
+    !Services.profiler.IsActive(),
+    "The profiler is not currently active"
+  );
+
+  startProfiler({ features: ["threads", "leaf", "preferencereads"] });
+
+  const url = BASE_URL + "fixed_height.html";
+  await BrowserTestUtils.withNewTab(url, async contentBrowser => {
+    const contentPid = await SpecialPowers.spawn(
+      contentBrowser,
+      [],
+      () => Services.appinfo.processID
+    );
+
+    await waitForPaintAfterLoad();
+
+    // Check that some PreferenceRead profile markers were generated when the
+    // feature is enabled.
+    {
+      const { contentThread } = await stopProfilerNowAndGetThreads(contentPid);
+
+      const timesReadDpiInContent = countDpiPrefReadsInThread(contentThread);
+
+      Assert.greater(
+        timesReadDpiInContent,
+        0,
+        "PreferenceRead profile markers for layout.css.dpi were recorded " +
+          "when the PreferenceRead feature was turned on."
+      );
+    }
+
+    startProfiler({ features: ["threads", "leaf"] });
+    // Now reload the tab with a clean run.
+    await ContentTask.spawn(contentBrowser, null, () => {
+      return new Promise(resolve => {
+        addEventListener("pageshow", () => resolve(), {
+          capturing: true,
+          once: true,
+        });
+        content.location.reload();
+      });
+    });
+
+    await waitForPaintAfterLoad();
+
+    // Check that no PreferenceRead markers were recorded when the feature
+    // is turned off.
+    {
+      const {
+        parentThread,
+        contentThread,
+      } = await stopProfilerNowAndGetThreads(contentPid);
+      Assert.equal(
+        getPayloadsOfType(parentThread, "PreferenceRead").length,
+        0,
+        "No PreferenceRead profile markers for layout.css.dpi were recorded " +
+          "when the PreferenceRead feature was turned on."
+      );
+
+      Assert.equal(
+        getPayloadsOfType(contentThread, "PreferenceRead").length,
+        0,
+        "No PreferenceRead profile markers for layout.css.dpi were recorded " +
+          "when the PreferenceRead feature was turned on."
+      );
+    }
+  });
+});
diff --git a/tools/profiler/tests/browser/browser_test_markers_parent_process.js b/tools/profiler/tests/browser/browser_test_markers_parent_process.js
new file mode 100644
index 0000000000..177222c3a9
--- /dev/null
+++ b/tools/profiler/tests/browser/browser_test_markers_parent_process.js
@@ -0,0 +1,40 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+add_task(async function test_markers_parent_process() {
+  info("Test markers that are generated by the browser's parent process.");
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  info("Start the profiler in nostacksampling mode.");
+  startProfiler({ features: ["nostacksampling"] });
+
+  info("Dispatch a DOMEvent");
+  window.dispatchEvent(new Event("synthetic"));
+
+  info("Stop the profiler and get the profile.");
+  const profile = await stopAndGetProfile();
+
+  const markers = getInflatedMarkerData(profile.threads[0]);
+  {
+    const domEventStart = markers.find(
+      ({ phase, data }) =>
+        phase === INTERVAL_START && data?.eventType === "synthetic"
+    );
+    const domEventEnd = markers.find(
+      ({ phase, data }) =>
+        phase === INTERVAL_END && data?.eventType === "synthetic"
+    );
+    ok(domEventStart, "A start DOMEvent was generated");
+    ok(domEventEnd, "An end DOMEvent was generated");
+    ok(
+      domEventEnd.data.latency > 0,
+      "DOMEvent had a a latency value generated."
+    );
+    ok(domEventEnd.data.type === "DOMEvent");
+    ok(domEventEnd.name === "DOMEvent");
+  }
+  // Add more marker tests.
+});
diff --git a/tools/profiler/tests/browser/browser_test_profile_multi_frame_page_info.js b/tools/profiler/tests/browser/browser_test_profile_multi_frame_page_info.js
new file mode 100644
index 0000000000..2549c83e39
--- /dev/null
+++ b/tools/profiler/tests/browser/browser_test_profile_multi_frame_page_info.js
@@ -0,0 +1,88 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+if (SpecialPowers.useRemoteSubframes) {
+  // Bug 1586105: these tests could time out in some extremely slow conditions,
+  // when fission is enabled.
+  // Requesting a longer timeout should make it pass.
+  requestLongerTimeout(2);
+}
+
+add_task(async function test_profile_multi_frame_page_info() {
+  // Requesting the complete log to be able to debug Bug 1586105.
+  SimpleTest.requestCompleteLog();
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  Assert.ok(!Services.profiler.IsActive());
+  info("Clear the previous pages just in case we still some open tabs.");
+  await Services.profiler.ClearAllPages();
+
+  info(
+    "Start the profiler to test the page information with multi frame page."
+  );
+  startProfiler();
+
+  info("Open a tab with multi_frame.html in it.");
+  // multi_frame.html embeds single_frame.html inside an iframe.
+  const url = BASE_URL + "multi_frame.html";
+  await BrowserTestUtils.withNewTab(url, async function(contentBrowser) {
+    const contentPid = await SpecialPowers.spawn(contentBrowser, [], () => {
+      return Services.appinfo.processID;
+    });
+
+    info("Capture the profile data.");
+    const profile = await Services.profiler.getProfileDataAsync();
+    Services.profiler.StopProfiler();
+
+    let foundPage = 0;
+    // We need to find the correct content process for that tab.
+    let contentProcess = profile.processes.find(
+      p => p.threads[0].pid == contentPid
+    );
+
+    if (!contentProcess) {
+      throw new Error(
+        `Could not find the content process with given pid: ${contentPid}`
+      );
+    }
+
+    info(
+      "Check if the captured pages are the ones with correct values we created."
+    );
+
+    let parentPage;
+    for (const page of contentProcess.pages) {
+      // Parent page
+      if (page.url == url) {
+        Assert.equal(page.url, url);
+        Assert.equal(typeof page.browsingContextID, "number");
+        Assert.equal(typeof page.innerWindowID, "number");
+        // Top level document will have no embedder.
+        Assert.equal(page.embedderInnerWindowID, 0);
+        parentPage = page;
+        foundPage++;
+        break;
+      }
+    }
+
+    Assert.notEqual(typeof parentPage, "undefined");
+
+    for (const page of contentProcess.pages) {
+      // Child page (iframe)
+      if (page.url == BASE_URL + "single_frame.html") {
+        Assert.equal(page.url, BASE_URL + "single_frame.html");
+        Assert.equal(typeof page.browsingContextID, "number");
+        Assert.equal(typeof page.innerWindowID, "number");
+        Assert.equal(typeof page.embedderInnerWindowID, "number");
+        Assert.notEqual(typeof parentPage, "undefined");
+        Assert.equal(page.embedderInnerWindowID, parentPage.innerWindowID);
+        foundPage++;
+        break;
+      }
+    }
+
+    Assert.equal(foundPage, 2);
+  });
+});
diff --git a/tools/profiler/tests/browser/browser_test_profile_single_frame_page_info.js b/tools/profiler/tests/browser/browser_test_profile_single_frame_page_info.js
new file mode 100644
index 0000000000..4acd6df51d
--- /dev/null
+++ b/tools/profiler/tests/browser/browser_test_profile_single_frame_page_info.js
@@ -0,0 +1,67 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+if (SpecialPowers.useRemoteSubframes) {
+  // Bug 1586105: these tests could time out in some extremely slow conditions,
+  // when fission is enabled.
+  // Requesting a longer timeout should make it pass.
+  requestLongerTimeout(2);
+}
+
+add_task(async function test_profile_single_frame_page_info() {
+  // Requesting the complete log to be able to debug Bug 1586105.
+  SimpleTest.requestCompleteLog();
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  Assert.ok(!Services.profiler.IsActive());
+  info("Clear the previous pages just in case we still some open tabs.");
+  await Services.profiler.ClearAllPages();
+
+  info(
+    "Start the profiler to test the page information with single frame page."
+  );
+  startProfiler();
+
+  info("Open a tab with single_frame.html in it.");
+  const url = BASE_URL + "single_frame.html";
+  await BrowserTestUtils.withNewTab(url, async function(contentBrowser) {
+    const contentPid = await SpecialPowers.spawn(contentBrowser, [], () => {
+      return Services.appinfo.processID;
+    });
+
+    info("Capture the profile data.");
+    const profile = await Services.profiler.getProfileDataAsync();
+    Services.profiler.StopProfiler();
+
+    let pageFound = false;
+    // We need to find the correct content process for that tab.
+    let contentProcess = profile.processes.find(
+      p => p.threads[0].pid == contentPid
+    );
+
+    if (!contentProcess) {
+      throw new Error(
+        `Could not find the content process with given pid: ${contentPid}`
+      );
+    }
+
+    info(
+      "Check if the captured page is the one with correct values we created."
+    );
+
+    for (const page of contentProcess.pages) {
+      if (page.url == url) {
+        Assert.equal(page.url, url);
+        Assert.equal(typeof page.browsingContextID, "number");
+        Assert.equal(typeof page.innerWindowID, "number");
+        // Top level document will have no embedder.
+        Assert.equal(page.embedderInnerWindowID, 0);
+        pageFound = true;
+        break;
+      }
+    }
+    Assert.equal(pageFound, true);
+  });
+});
diff --git a/tools/profiler/tests/browser/do_work_500ms.html b/tools/profiler/tests/browser/do_work_500ms.html
new file mode 100644
index 0000000000..9713a80671
--- /dev/null
+++ b/tools/profiler/tests/browser/do_work_500ms.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Do some work for 500ms</title>
+  <script>
+    const milliseconds = 500;
+    const millisecondsPerBatch = 10;
+    const end = Date.now() + milliseconds;
+    window.total = 0;
+    let i = 0;
+
+    /**
+     * Do work for a set number of milliseconds, but only do the work in batches
+     * so the browser does not get unresponsive.
+     */
+    function doWork() {
+      const batchEnd = Date.now() + millisecondsPerBatch;
+      // Do some work for a set amount of time.
+      while (Date.now() < end) {
+        // Do some kind of work that is non-deterministic to guard against optimizations.
+        window.total += Math.random();
+        i++;
+
+        // Check if a batch is done yet.
+        if (Date.now() > batchEnd) {
+          // Defer the rest of the work into a micro task. Keep on doing this until
+          // the total milliseconds have elapsed.
+          setTimeout(doWork, 0);
+          return;
+        }
+      }
+    }
+
+    doWork();
+  </script>
+</head>
+<body>
+  Do some work for 500ms.
+</body>
+</html>
diff --git a/tools/profiler/tests/browser/fixed_height.html b/tools/profiler/tests/browser/fixed_height.html
new file mode 100644
index 0000000000..7d21f3b746
--- /dev/null
+++ b/tools/profiler/tests/browser/fixed_height.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+	<meta charset="utf-8"/>
+    <!--
+      Using an absolute value here should invoke Firefox to get
+      the layout.css.dpi preference.
+    -->
+    <style type="text/css">
+    div.fixed_height {
+      height: 15in;
+    }
+    </style>
+  </head>
+  <body>
+    <div class="fixed_height">Testing</div>
+  </body>
+</html>
diff --git a/tools/profiler/tests/browser/head.js b/tools/profiler/tests/browser/head.js
new file mode 100644
index 0000000000..eebcf4d383
--- /dev/null
+++ b/tools/profiler/tests/browser/head.js
@@ -0,0 +1,70 @@
+/* import-globals-from ../shared-head.js */
+
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/tools/profiler/tests/browser/shared-head.js",
+  this
+);
+
+const { BrowserTestUtils } = ChromeUtils.import(
+  "resource://testing-common/BrowserTestUtils.jsm"
+);
+
+const BASE_URL = "http://example.com/browser/tools/profiler/tests/browser/";
+
+registerCleanupFunction(() => {
+  if (Services.profiler.IsActive()) {
+    info(
+      "The profiler was found to still be running at the end of the test, which means that some error likely occured. Let's stop it to prevent issues with following tests!"
+    );
+    Services.profiler.StopProfiler();
+  }
+});
+
+/**
+ * This is a helper function that will stop the profiler of the browser running
+ * with PID contentPid.
+ * This happens immediately, without waiting for any sampling to happen or
+ * finish. Use stopProfilerAndGetThreads (without "Now") below instead to wait
+ * for samples before stopping.
+ *
+ * @param {number} contentPid
+ * @returns {Promise}
+ */
+async function stopProfilerNowAndGetThreads(contentPid) {
+  const profile = await Services.profiler.getProfileDataAsync();
+  Services.profiler.StopProfiler();
+
+  const parentThread = profile.threads[0];
+  const contentProcess = profile.processes.find(
+    p => p.threads[0].pid == contentPid
+  );
+  if (!contentProcess) {
+    throw new Error("Could not find the content process.");
+  }
+  const contentThread = contentProcess.threads[0];
+
+  if (!parentThread) {
+    throw new Error("The parent thread was not found in the profile.");
+  }
+
+  if (!contentThread) {
+    throw new Error("The content thread was not found in the profile.");
+  }
+
+  return { parentThread, contentThread };
+}
+
+/**
+ * This is a helper function that will stop the profiler of the browser running
+ * with PID contentPid.
+ * As opposed to stopProfilerNowAndGetThreads (with "Now") above, the profiler
+ * in that PID will not stop until there is at least one periodic sample taken.
+ *
+ * @param {number} contentPid
+ * @returns {Promise}
+ */
+async function stopProfilerAndGetThreads(contentPid) {
+  await Services.profiler.waitOnePeriodicSampling();
+
+  return stopProfilerNowAndGetThreads(contentPid);
+}
diff --git a/tools/profiler/tests/browser/multi_frame.html b/tools/profiler/tests/browser/multi_frame.html
new file mode 100644
index 0000000000..b2efcedd50
--- /dev/null
+++ b/tools/profiler/tests/browser/multi_frame.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Multi Frame</title>
+</head>
+<body>
+  Multi Frame
+  <iframe src="single_frame.html"></iframe>
+</body>
+</html>
diff --git a/tools/profiler/tests/browser/simple.html b/tools/profiler/tests/browser/simple.html
new file mode 100644
index 0000000000..f7c32d02c3
--- /dev/null
+++ b/tools/profiler/tests/browser/simple.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8"/>
+  </head>
+  <body>
+    Testing
+  </body>
+</html>
diff --git a/tools/profiler/tests/browser/single_frame.html b/tools/profiler/tests/browser/single_frame.html
new file mode 100644
index 0000000000..ebdfc41da2
--- /dev/null
+++ b/tools/profiler/tests/browser/single_frame.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Single Frame</title>
+</head>
+<body>
+  Single Frame
+</body>
+</html>
diff --git a/tools/profiler/tests/chrome/chrome.ini b/tools/profiler/tests/chrome/chrome.ini
new file mode 100644
index 0000000000..76c0b2eaf1
--- /dev/null
+++ b/tools/profiler/tests/chrome/chrome.ini
@@ -0,0 +1,7 @@
+[DEFAULT]
+support-files=profiler_test_utils.js
+
+[test_profile_worker_bug_1428076.html]
+skip-if = os == 'android' && processor == 'arm' # Bug 1541291
+[test_profile_worker.html]
+skip-if = os == 'android' && processor == 'arm' # Bug 1541291
diff --git a/tools/profiler/tests/chrome/profiler_test_utils.js b/tools/profiler/tests/chrome/profiler_test_utils.js
new file mode 100644
index 0000000000..b89a25995a
--- /dev/null
+++ b/tools/profiler/tests/chrome/profiler_test_utils.js
@@ -0,0 +1,64 @@
+"use strict";
+
+(function() {
+  const { Services } = ChromeUtils.import(
+    "resource://gre/modules/Services.jsm"
+  );
+
+  function startProfiler(settings) {
+    Services.profiler.StartProfiler(
+      settings.entries,
+      settings.interval,
+      settings.features,
+      settings.threads,
+      0,
+      settings.duration
+    );
+
+    info("Profiler has started");
+  }
+
+  function getProfile() {
+    const profile = Services.profiler.getProfileData();
+    info(
+      "We got a profile, run the mochitest with `--keep-open true` to see the logged profile in the Web Console."
+    );
+
+    // Run the mochitest with `--keep-open true` to see the logged profile in the
+    // Web console.
+    console.log(profile);
+
+    return profile;
+  }
+
+  function stopProfiler() {
+    Services.profiler.StopProfiler();
+    info("Profiler has stopped");
+  }
+
+  function end(error) {
+    if (error) {
+      ok(false, `We got an error: ${error}`);
+    } else {
+      ok(true, "We ran the whole process");
+    }
+    SimpleTest.finish();
+  }
+
+  async function runTest(settings, workload) {
+    SimpleTest.waitForExplicitFinish();
+    try {
+      await startProfiler(settings);
+      await workload();
+      await getProfile();
+      await stopProfiler();
+      await end();
+    } catch (e) {
+      // By catching and handling the error, we're being nice to mochitest
+      // runners: instead of waiting for the timeout, we fail right away.
+      await end(e);
+    }
+  }
+
+  window.runTest = runTest;
+})();
diff --git a/tools/profiler/tests/chrome/test_profile_worker.html b/tools/profiler/tests/chrome/test_profile_worker.html
new file mode 100644
index 0000000000..d32d36bb41
--- /dev/null
+++ b/tools/profiler/tests/chrome/test_profile_worker.html
@@ -0,0 +1,66 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1428076
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1428076</title>
+  <link rel="stylesheet" type="text/css" href="chrome://global/skin"/>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1428076">Mozilla Bug 1428076</a>
+
+<script src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+<script type="application/javascript" src="profiler_test_utils.js"></script>
+<script type="application/javascript">
+/* globals runTest */
+
+"use strict";
+
+const settings = {
+  entries: 1000000, // 9MB
+  interval: 1, // ms
+  features: ["js", "threads", "leaf", "stackwalk"],
+  threads: ["GeckoMain", "Compositor", "Worker"], // most common combination
+};
+
+const workerCode = `
+  console.log('hello world');
+  setTimeout(() => postMessage('message from worker'), 50);
+`;
+
+function startWorker() {
+  // We use a Blob for the worker content to avoid an external JS file, and data
+  // URLs seem to be blocked in a chrome environment.
+  const workerContent = new Blob(
+    [ workerCode ],
+    { type: "application/javascript" }
+  );
+  const blobURL = URL.createObjectURL(workerContent);
+
+  // We start a worker and then terminate it right away to trigger our bug.
+  info("Starting the worker...");
+  const myWorker = new Worker(blobURL);
+  return { worker: myWorker, url: blobURL };
+}
+
+function workload() {
+  const { worker, url } = startWorker();
+
+  return new Promise(resolve => {
+    worker.onmessage = () => {
+      info("Got a message, terminating the worker.");
+      worker.terminate();
+      URL.revokeObjectURL(url);
+      resolve();
+    };
+  });
+}
+
+runTest(settings, workload);
+
+</script>
+</body>
+</html>
diff --git a/tools/profiler/tests/chrome/test_profile_worker_bug_1428076.html b/tools/profiler/tests/chrome/test_profile_worker_bug_1428076.html
new file mode 100644
index 0000000000..30245b5b46
--- /dev/null
+++ b/tools/profiler/tests/chrome/test_profile_worker_bug_1428076.html
@@ -0,0 +1,58 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1428076
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1428076</title>
+  <link rel="stylesheet" type="text/css" href="chrome://global/skin"/>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1428076">Mozilla Bug 1428076</a>
+
+<script src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+<script type="application/javascript" src="profiler_test_utils.js"></script>
+<script type="application/javascript">
+/** Test for Bug 1428076 **/
+
+/* globals runTest */
+
+"use strict";
+
+const settings = {
+  entries: 1000000, // 9MB
+  interval: 1, // ms
+  features: ["js", "threads", "leaf", "stackwalk"],
+  threads: ["GeckoMain", "Compositor", "Worker"], // most common combination
+};
+
+function workload() {
+  // We use a Blob for the worker content to avoid an external JS file, and data
+  // URLs seem to be blocked in a chrome environment.
+  const workerContent = new Blob(
+    [ "console.log('hello world!')" ],
+    { type: "application/javascript" }
+  );
+  const blobURL = URL.createObjectURL(workerContent);
+
+  // We start a worker and then terminate it right away to trigger our bug.
+  info("Starting the worker, and terminate it right away.");
+  const myWorker = new Worker(blobURL);
+  myWorker.terminate();
+
+  URL.revokeObjectURL(blobURL);
+
+  // We're deferring some little time so that the worker has the time to be
+  // properly cleaned up and the profiler actually saves the worker data.
+  return new Promise(resolve => {
+    setTimeout(resolve, 50);
+  });
+}
+
+runTest(settings, workload);
+
+</script>
+</body>
+</html>
diff --git a/tools/profiler/tests/gtest/GeckoProfiler.cpp b/tools/profiler/tests/gtest/GeckoProfiler.cpp
new file mode 100644
index 0000000000..bacf34e3d5
--- /dev/null
+++ b/tools/profiler/tests/gtest/GeckoProfiler.cpp
@@ -0,0 +1,2284 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// This file tests a lot of the profiler_*() functions in GeckoProfiler.h.
+// Most of the tests just check that nothing untoward (e.g. crashes, deadlocks)
+// happens when calling these functions. They don't do much inspection of
+// profiler internals.
+
+#include "GeckoProfiler.h"
+#include "mozilla/ProfilerMarkerTypes.h"
+#include "mozilla/ProfilerMarkers.h"
+#include "platform.h"
+#include "ProfileBuffer.h"
+
+#include "js/Initialization.h"
+#include "js/Printf.h"
+#include "jsapi.h"
+#include "json/json.h"
+#include "mozilla/Atomics.h"
+#include "mozilla/BlocksRingBuffer.h"
+#include "mozilla/ProfileBufferEntrySerializationGeckoExtensions.h"
+#include "mozilla/ProfileJSONWriter.h"
+#include "mozilla/UniquePtrExtensions.h"
+#include "mozilla/net/HttpBaseChannel.h"
+#include "nsIThread.h"
+#include "nsThreadUtils.h"
+
+#include "gtest/gtest.h"
+
+#include <cstring>
+#include <set>
+#include <thread>
+
+// Note: profiler_init() has already been called in XRE_main(), so we can't
+// test it here. Likewise for profiler_shutdown(), and AutoProfilerInit
+// (which is just an RAII wrapper for profiler_init() and profiler_shutdown()).
+
+using namespace mozilla;
+
+TEST(BaseProfiler, BlocksRingBuffer)
+{
+  constexpr uint32_t MBSize = 256;
+  uint8_t buffer[MBSize * 3];
+  for (size_t i = 0; i < MBSize * 3; ++i) {
+    buffer[i] = uint8_t('A' + i);
+  }
+  BlocksRingBuffer rb(BlocksRingBuffer::ThreadSafety::WithMutex,
+                      &buffer[MBSize], MakePowerOfTwo32<MBSize>());
+
+  {
+    nsCString cs("nsCString"_ns);
+    nsString s(u"nsString"_ns);
+    nsAutoCString acs("nsAutoCString"_ns);
+    nsAutoString as(u"nsAutoString"_ns);
+    nsAutoCStringN<8> acs8("nsAutoCStringN"_ns);
+    nsAutoStringN<8> as8(u"nsAutoStringN"_ns);
+    JS::UniqueChars jsuc = JS_smprintf("%s", "JS::UniqueChars");
+
+    rb.PutObjects(cs, s, acs, as, acs8, as8, jsuc);
+  }
+
+  rb.ReadEach([](ProfileBufferEntryReader& aER) {
+    ASSERT_EQ(aER.ReadObject<nsCString>(), "nsCString"_ns);
+    ASSERT_EQ(aER.ReadObject<nsString>(), u"nsString"_ns);
+    ASSERT_EQ(aER.ReadObject<nsAutoCString>(), "nsAutoCString"_ns);
+    ASSERT_EQ(aER.ReadObject<nsAutoString>(), u"nsAutoString"_ns);
+    ASSERT_EQ(aER.ReadObject<nsAutoCStringN<8>>(), "nsAutoCStringN"_ns);
+    ASSERT_EQ(aER.ReadObject<nsAutoStringN<8>>(), u"nsAutoStringN"_ns);
+    auto jsuc2 = aER.ReadObject<JS::UniqueChars>();
+    ASSERT_TRUE(!!jsuc2);
+    ASSERT_TRUE(strcmp(jsuc2.get(), "JS::UniqueChars") == 0);
+  });
+
+  // Everything around the sub-buffer should be unchanged.
+  for (size_t i = 0; i < MBSize; ++i) {
+    ASSERT_EQ(buffer[i], uint8_t('A' + i));
+  }
+  for (size_t i = MBSize * 2; i < MBSize * 3; ++i) {
+    ASSERT_EQ(buffer[i], uint8_t('A' + i));
+  }
+}
+
+// Common JSON checks.
+
+// Does the GETTER return a non-null TYPE? (Non-critical)
+#define EXPECT_HAS_JSON(GETTER, TYPE)                                         \
+  do {                                                                        \
+    if ((GETTER).isNull()) {                                                  \
+      EXPECT_FALSE((GETTER).isNull()) << #GETTER " doesn't exist or is null"; \
+    } else if (!(GETTER).is##TYPE()) {                                        \
+      EXPECT_TRUE((GETTER).is##TYPE())                                        \
+          << #GETTER " didn't return type " #TYPE;                            \
+    }                                                                         \
+  } while (false)
+
+// Does the GETTER return a non-null TYPE? (Critical)
+#define ASSERT_HAS_JSON(GETTER, TYPE) \
+  do {                                \
+    ASSERT_FALSE((GETTER).isNull());  \
+    ASSERT_TRUE((GETTER).is##TYPE()); \
+  } while (false)
+
+// Does the GETTER return a non-null TYPE? (Critical)
+// If yes, store the value into VARIABLE.
+#define GET_JSON(VARIABLE, GETTER, TYPE) \
+  ASSERT_HAS_JSON(GETTER, TYPE);         \
+  const Json::Value& VARIABLE = (GETTER)
+
+// Checks that the GETTER's value is present, is of the expected TYPE, and has
+// the expected VALUE. (Non-critical)
+#define EXPECT_EQ_JSON(GETTER, TYPE, VALUE)                                   \
+  do {                                                                        \
+    if ((GETTER).isNull()) {                                                  \
+      EXPECT_FALSE((GETTER).isNull()) << #GETTER " doesn't exist or is null"; \
+    } else if (!(GETTER).is##TYPE()) {                                        \
+      EXPECT_TRUE((GETTER).is##TYPE())                                        \
+          << #GETTER " didn't return type " #TYPE;                            \
+    } else {                                                                  \
+      EXPECT_EQ((GETTER).as##TYPE(), (VALUE));                                \
+    }                                                                         \
+  } while (false)
+
+// Checks that the GETTER's value is present, and is a valid index into the
+// STRINGTABLE array, pointing at the expected STRING.
+#define EXPECT_EQ_STRINGTABLE(GETTER, STRINGTABLE, STRING)                    \
+  do {                                                                        \
+    if ((GETTER).isNull()) {                                                  \
+      EXPECT_FALSE((GETTER).isNull()) << #GETTER " doesn't exist or is null"; \
+    } else if (!(GETTER).isUInt()) {                                          \
+      EXPECT_TRUE((GETTER).isUInt()) << #GETTER " didn't return an index";    \
+    } else {                                                                  \
+      EXPECT_LT((GETTER).asUInt(), (STRINGTABLE).size());                     \
+      EXPECT_EQ_JSON((STRINGTABLE)[(GETTER).asUInt()], String, (STRING));     \
+    }                                                                         \
+  } while (false)
+
+#define EXPECT_JSON_ARRAY_CONTAINS(GETTER, TYPE, VALUE)                       \
+  do {                                                                        \
+    if ((GETTER).isNull()) {                                                  \
+      EXPECT_FALSE((GETTER).isNull()) << #GETTER " doesn't exist or is null"; \
+    } else if (!(GETTER).isArray()) {                                         \
+      EXPECT_TRUE((GETTER).is##TYPE()) << #GETTER " is not an array";         \
+    } else if (const Json::ArrayIndex size = (GETTER).size(); size == 0u) {   \
+      EXPECT_NE(size, 0u) << #GETTER " is an empty array";                    \
+    } else {                                                                  \
+      bool found = false;                                                     \
+      for (Json::ArrayIndex i = 0; i < size; ++i) {                           \
+        if (!(GETTER)[i].is##TYPE()) {                                        \
+          EXPECT_TRUE((GETTER)[i].is##TYPE())                                 \
+              << #GETTER "[" << i << "] is not " #TYPE;                       \
+          break;                                                              \
+        }                                                                     \
+        if ((GETTER)[i].as##TYPE() == (VALUE)) {                              \
+          found = true;                                                       \
+          break;                                                              \
+        }                                                                     \
+      }                                                                       \
+      EXPECT_TRUE(found) << #GETTER " doesn't contain " #VALUE;               \
+    }                                                                         \
+  } while (false)
+
+// Check that the given process root contains all the expected properties.
+static void JSONRootCheck(const Json::Value& aRoot,
+                          bool aWithMainThread = true) {
+  ASSERT_TRUE(aRoot.isObject());
+
+  EXPECT_HAS_JSON(aRoot["libs"], Array);
+
+  GET_JSON(meta, aRoot["meta"], Object);
+  EXPECT_HAS_JSON(meta["version"], UInt);
+  EXPECT_HAS_JSON(meta["startTime"], Double);
+
+  EXPECT_HAS_JSON(aRoot["pages"], Array);
+
+  EXPECT_HAS_JSON(aRoot["profilerOverhead"], Object);
+
+  GET_JSON(threads, aRoot["threads"], Array);
+  const Json::ArrayIndex threadCount = threads.size();
+  for (Json::ArrayIndex i = 0; i < threadCount; ++i) {
+    GET_JSON(thread, threads[i], Object);
+    EXPECT_HAS_JSON(thread["processType"], String);
+    EXPECT_HAS_JSON(thread["name"], String);
+    EXPECT_HAS_JSON(thread["registerTime"], Double);
+    EXPECT_HAS_JSON(thread["samples"], Object);
+    EXPECT_HAS_JSON(thread["markers"], Object);
+    EXPECT_HAS_JSON(thread["pid"], UInt);
+    EXPECT_HAS_JSON(thread["tid"], UInt);
+    EXPECT_HAS_JSON(thread["stackTable"], Object);
+    EXPECT_HAS_JSON(thread["frameTable"], Object);
+    EXPECT_HAS_JSON(thread["stringTable"], Array);
+  }
+
+  if (aWithMainThread) {
+    ASSERT_GT(threadCount, 0u);
+    GET_JSON(thread0, threads[0], Object);
+    EXPECT_EQ_JSON(thread0["name"], String, "GeckoMain");
+  }
+
+  EXPECT_HAS_JSON(aRoot["pausedRanges"], Array);
+
+  const Json::Value& processes = aRoot["processes"];
+  if (!processes.isNull()) {
+    ASSERT_TRUE(processes.isArray());
+    const Json::ArrayIndex processCount = processes.size();
+    for (Json::ArrayIndex i = 0; i < processCount; ++i) {
+      GET_JSON(process, processes[i], Object);
+      JSONRootCheck(process, aWithMainThread);
+    }
+  }
+}
+
+// Check that various expected top properties are in the JSON, and then call the
+// provided `aJSONCheckFunction` with the JSON root object.
+template <typename JSONCheckFunction>
+void JSONOutputCheck(const char* aOutput,
+                     JSONCheckFunction&& aJSONCheckFunction) {
+  ASSERT_NE(aOutput, nullptr);
+
+  // Extract JSON.
+  Json::Value parsedRoot;
+  Json::CharReaderBuilder builder;
+  const std::unique_ptr<Json::CharReader> reader(builder.newCharReader());
+  ASSERT_TRUE(
+      reader->parse(aOutput, strchr(aOutput, '\0'), &parsedRoot, nullptr));
+
+  JSONRootCheck(parsedRoot);
+
+  std::forward<JSONCheckFunction>(aJSONCheckFunction)(parsedRoot);
+}
+
+typedef Vector<const char*> StrVec;
+
+static void InactiveFeaturesAndParamsCheck() {
+  int entries;
+  Maybe<double> duration;
+  double interval;
+  uint32_t features;
+  StrVec filters;
+  uint64_t activeBrowsingContextID;
+
+  ASSERT_TRUE(!profiler_is_active());
+  ASSERT_TRUE(!profiler_feature_active(ProfilerFeature::MainThreadIO));
+  ASSERT_TRUE(!profiler_feature_active(ProfilerFeature::NativeAllocations));
+
+  profiler_get_start_params(&entries, &duration, &interval, &features, &filters,
+                            &activeBrowsingContextID);
+
+  ASSERT_TRUE(entries == 0);
+  ASSERT_TRUE(duration == Nothing());
+  ASSERT_TRUE(interval == 0);
+  ASSERT_TRUE(features == 0);
+  ASSERT_TRUE(filters.empty());
+  ASSERT_TRUE(activeBrowsingContextID == 0);
+}
+
+static void ActiveParamsCheck(int aEntries, double aInterval,
+                              uint32_t aFeatures, const char** aFilters,
+                              size_t aFiltersLen,
+                              uint64_t aActiveBrowsingContextID,
+                              const Maybe<double>& aDuration = Nothing()) {
+  int entries;
+  Maybe<double> duration;
+  double interval;
+  uint32_t features;
+  StrVec filters;
+  uint64_t activeBrowsingContextID;
+
+  profiler_get_start_params(&entries, &duration, &interval, &features, &filters,
+                            &activeBrowsingContextID);
+
+  ASSERT_TRUE(entries == aEntries);
+  ASSERT_TRUE(duration == aDuration);
+  ASSERT_TRUE(interval == aInterval);
+  ASSERT_TRUE(features == aFeatures);
+  ASSERT_TRUE(filters.length() == aFiltersLen);
+  ASSERT_TRUE(activeBrowsingContextID == aActiveBrowsingContextID);
+  for (size_t i = 0; i < aFiltersLen; i++) {
+    ASSERT_TRUE(strcmp(filters[i], aFilters[i]) == 0);
+  }
+}
+
+TEST(GeckoProfiler, Utilities)
+{
+  // We'll assume that this test runs in the main thread (which should be true
+  // when called from the `main` function).
+  const int mainThreadId = profiler_current_thread_id();
+
+  MOZ_RELEASE_ASSERT(profiler_main_thread_id() == mainThreadId);
+  MOZ_RELEASE_ASSERT(profiler_is_main_thread());
+
+  std::thread testThread([&]() {
+    const int testThreadId = profiler_current_thread_id();
+    MOZ_RELEASE_ASSERT(testThreadId != mainThreadId);
+
+    MOZ_RELEASE_ASSERT(profiler_main_thread_id() != testThreadId);
+    MOZ_RELEASE_ASSERT(!profiler_is_main_thread());
+  });
+  testThread.join();
+}
+
+TEST(GeckoProfiler, FeaturesAndParams)
+{
+  InactiveFeaturesAndParamsCheck();
+
+  // Try a couple of features and filters.
+  {
+    uint32_t features = ProfilerFeature::JS | ProfilerFeature::Threads;
+    const char* filters[] = {"GeckoMain", "Compositor"};
+
+    profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                   features, filters, MOZ_ARRAY_LENGTH(filters), 100,
+                   Some(PROFILER_DEFAULT_DURATION));
+
+    ASSERT_TRUE(profiler_is_active());
+    ASSERT_TRUE(!profiler_feature_active(ProfilerFeature::MainThreadIO));
+    ASSERT_TRUE(!profiler_feature_active(ProfilerFeature::IPCMessages));
+
+    ActiveParamsCheck(PROFILER_DEFAULT_ENTRIES.Value(),
+                      PROFILER_DEFAULT_INTERVAL, features, filters,
+                      MOZ_ARRAY_LENGTH(filters), 100,
+                      Some(PROFILER_DEFAULT_DURATION));
+
+    profiler_stop();
+
+    InactiveFeaturesAndParamsCheck();
+  }
+
+  // Try some different features and filters.
+  {
+    uint32_t features =
+        ProfilerFeature::MainThreadIO | ProfilerFeature::IPCMessages;
+    const char* filters[] = {"GeckoMain", "Foo", "Bar"};
+
+    // Testing with some arbitrary buffer size (as could be provided by
+    // external code), which we convert to the appropriate power of 2.
+    profiler_start(PowerOfTwo32(999999), 3, features, filters,
+                   MOZ_ARRAY_LENGTH(filters), 123, Some(25.0));
+
+    ASSERT_TRUE(profiler_is_active());
+    ASSERT_TRUE(profiler_feature_active(ProfilerFeature::MainThreadIO));
+    ASSERT_TRUE(profiler_feature_active(ProfilerFeature::IPCMessages));
+
+    // Profiler::Threads is added because filters has multiple entries.
+    ActiveParamsCheck(PowerOfTwo32(999999).Value(), 3,
+                      features | ProfilerFeature::Threads, filters,
+                      MOZ_ARRAY_LENGTH(filters), 123, Some(25.0));
+
+    profiler_stop();
+
+    InactiveFeaturesAndParamsCheck();
+  }
+
+  // Try with no duration
+  {
+    uint32_t features =
+        ProfilerFeature::MainThreadIO | ProfilerFeature::IPCMessages;
+    const char* filters[] = {"GeckoMain", "Foo", "Bar"};
+
+    profiler_start(PowerOfTwo32(999999), 3, features, filters,
+                   MOZ_ARRAY_LENGTH(filters), 0, Nothing());
+
+    ASSERT_TRUE(profiler_is_active());
+    ASSERT_TRUE(profiler_feature_active(ProfilerFeature::MainThreadIO));
+    ASSERT_TRUE(profiler_feature_active(ProfilerFeature::IPCMessages));
+
+    // Profiler::Threads is added because filters has multiple entries.
+    ActiveParamsCheck(PowerOfTwo32(999999).Value(), 3,
+                      features | ProfilerFeature::Threads, filters,
+                      MOZ_ARRAY_LENGTH(filters), 0, Nothing());
+
+    profiler_stop();
+
+    InactiveFeaturesAndParamsCheck();
+  }
+
+  // Try all supported features, and filters that match all threads.
+  {
+    uint32_t availableFeatures = profiler_get_available_features();
+    const char* filters[] = {""};
+
+    profiler_start(PowerOfTwo32(88888), 10, availableFeatures, filters,
+                   MOZ_ARRAY_LENGTH(filters), 0, Some(15.0));
+
+    ASSERT_TRUE(profiler_is_active());
+    ASSERT_TRUE(profiler_feature_active(ProfilerFeature::MainThreadIO));
+    ASSERT_TRUE(profiler_feature_active(ProfilerFeature::IPCMessages));
+
+    ActiveParamsCheck(PowerOfTwo32(88888).Value(), 10, availableFeatures,
+                      filters, MOZ_ARRAY_LENGTH(filters), 0, Some(15.0));
+
+    // Don't call profiler_stop() here.
+  }
+
+  // Try no features, and filters that match no threads.
+  {
+    uint32_t features = 0;
+    const char* filters[] = {"NoThreadWillMatchThis"};
+
+    // Second profiler_start() call in a row without an intervening
+    // profiler_stop(); this will do an implicit profiler_stop() and restart.
+    profiler_start(PowerOfTwo32(0), 0, features, filters,
+                   MOZ_ARRAY_LENGTH(filters), 0, Some(0.0));
+
+    ASSERT_TRUE(profiler_is_active());
+    ASSERT_TRUE(!profiler_feature_active(ProfilerFeature::MainThreadIO));
+    ASSERT_TRUE(!profiler_feature_active(ProfilerFeature::IPCMessages));
+
+    // Entries and intervals go to defaults if 0 is specified.
+    ActiveParamsCheck(PROFILER_DEFAULT_ENTRIES.Value(),
+                      PROFILER_DEFAULT_INTERVAL,
+                      features | ProfilerFeature::Threads, filters,
+                      MOZ_ARRAY_LENGTH(filters), 0, Nothing());
+
+    profiler_stop();
+
+    InactiveFeaturesAndParamsCheck();
+
+    // These calls are no-ops.
+    profiler_stop();
+    profiler_stop();
+
+    InactiveFeaturesAndParamsCheck();
+  }
+}
+
+TEST(GeckoProfiler, EnsureStarted)
+{
+  InactiveFeaturesAndParamsCheck();
+
+  uint32_t features = ProfilerFeature::JS | ProfilerFeature::Threads;
+  const char* filters[] = {"GeckoMain", "Compositor"};
+  {
+    // Inactive -> Active
+    profiler_ensure_started(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                            features, filters, MOZ_ARRAY_LENGTH(filters), 0,
+                            Some(PROFILER_DEFAULT_DURATION));
+
+    ActiveParamsCheck(
+        PROFILER_DEFAULT_ENTRIES.Value(), PROFILER_DEFAULT_INTERVAL, features,
+        filters, MOZ_ARRAY_LENGTH(filters), 0, Some(PROFILER_DEFAULT_DURATION));
+  }
+
+  {
+    // Active -> Active with same settings
+
+    Maybe<ProfilerBufferInfo> info0 = profiler_get_buffer_info();
+    ASSERT_TRUE(info0->mRangeEnd > 0);
+
+    // First, write some samples into the buffer.
+    PR_Sleep(PR_MillisecondsToInterval(500));
+
+    Maybe<ProfilerBufferInfo> info1 = profiler_get_buffer_info();
+    ASSERT_TRUE(info1->mRangeEnd > info0->mRangeEnd);
+
+    // Call profiler_ensure_started with the same settings as before.
+    // This operation must not clear our buffer!
+    profiler_ensure_started(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                            features, filters, MOZ_ARRAY_LENGTH(filters), 0,
+                            Some(PROFILER_DEFAULT_DURATION));
+
+    ActiveParamsCheck(
+        PROFILER_DEFAULT_ENTRIES.Value(), PROFILER_DEFAULT_INTERVAL, features,
+        filters, MOZ_ARRAY_LENGTH(filters), 0, Some(PROFILER_DEFAULT_DURATION));
+
+    // Check that our position in the buffer stayed the same or advanced, but
+    // not by much, and the range-start after profiler_ensure_started shouldn't
+    // have passed the range-end before.
+    Maybe<ProfilerBufferInfo> info2 = profiler_get_buffer_info();
+    ASSERT_TRUE(info2->mRangeEnd >= info1->mRangeEnd);
+    ASSERT_TRUE(info2->mRangeEnd - info1->mRangeEnd <
+                info1->mRangeEnd - info0->mRangeEnd);
+    ASSERT_TRUE(info2->mRangeStart < info1->mRangeEnd);
+  }
+
+  {
+    // Active -> Active with *different* settings
+
+    Maybe<ProfilerBufferInfo> info1 = profiler_get_buffer_info();
+
+    // Call profiler_ensure_started with a different feature set than the one
+    // it's currently running with. This is supposed to stop and restart the
+    // profiler, thereby discarding the buffer contents.
+    uint32_t differentFeatures = features | ProfilerFeature::Leaf;
+    profiler_ensure_started(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                            differentFeatures, filters,
+                            MOZ_ARRAY_LENGTH(filters), 0);
+
+    ActiveParamsCheck(PROFILER_DEFAULT_ENTRIES.Value(),
+                      PROFILER_DEFAULT_INTERVAL, differentFeatures, filters,
+                      MOZ_ARRAY_LENGTH(filters), 0);
+
+    // Check the the buffer was cleared, so its range-start should be at/after
+    // its range-end before.
+    Maybe<ProfilerBufferInfo> info2 = profiler_get_buffer_info();
+    ASSERT_TRUE(info2->mRangeStart >= info1->mRangeEnd);
+  }
+
+  {
+    // Active -> Inactive
+
+    profiler_stop();
+
+    InactiveFeaturesAndParamsCheck();
+  }
+}
+
+TEST(GeckoProfiler, MultiRegistration)
+{
+  // This whole test only checks that function calls don't crash, they don't
+  // actually verify that threads get profiled or not.
+  char top;
+  profiler_register_thread("Main thread again", &top);
+
+  {
+    std::thread thread([]() {
+      char top;
+      profiler_register_thread("thread, no unreg", &top);
+    });
+    thread.join();
+  }
+
+  {
+    std::thread thread([]() { profiler_unregister_thread(); });
+    thread.join();
+  }
+
+  {
+    std::thread thread([]() {
+      char top;
+      profiler_register_thread("thread 1st", &top);
+      profiler_unregister_thread();
+      profiler_register_thread("thread 2nd", &top);
+      profiler_unregister_thread();
+    });
+    thread.join();
+  }
+
+  {
+    std::thread thread([]() {
+      char top;
+      profiler_register_thread("thread once", &top);
+      profiler_register_thread("thread again", &top);
+      profiler_unregister_thread();
+    });
+    thread.join();
+  }
+
+  {
+    std::thread thread([]() {
+      char top;
+      profiler_register_thread("thread to unreg twice", &top);
+      profiler_unregister_thread();
+      profiler_unregister_thread();
+    });
+    thread.join();
+  }
+}
+
+TEST(GeckoProfiler, DifferentThreads)
+{
+  InactiveFeaturesAndParamsCheck();
+
+  nsCOMPtr<nsIThread> thread;
+  nsresult rv = NS_NewNamedThread("GeckoProfGTest", getter_AddRefs(thread));
+  ASSERT_TRUE(NS_SUCCEEDED(rv));
+
+  // Control the profiler on a background thread and verify flags on the
+  // main thread.
+  {
+    uint32_t features = ProfilerFeature::JS | ProfilerFeature::Threads;
+    const char* filters[] = {"GeckoMain", "Compositor"};
+
+    thread->Dispatch(
+        NS_NewRunnableFunction("GeckoProfiler_DifferentThreads_Test::TestBody",
+                               [&]() {
+                                 profiler_start(PROFILER_DEFAULT_ENTRIES,
+                                                PROFILER_DEFAULT_INTERVAL,
+                                                features, filters,
+                                                MOZ_ARRAY_LENGTH(filters), 0);
+                               }),
+        NS_DISPATCH_SYNC);
+
+    ASSERT_TRUE(profiler_is_active());
+    ASSERT_TRUE(!profiler_feature_active(ProfilerFeature::MainThreadIO));
+    ASSERT_TRUE(!profiler_feature_active(ProfilerFeature::IPCMessages));
+
+    ActiveParamsCheck(PROFILER_DEFAULT_ENTRIES.Value(),
+                      PROFILER_DEFAULT_INTERVAL, features, filters,
+                      MOZ_ARRAY_LENGTH(filters), 0);
+
+    thread->Dispatch(
+        NS_NewRunnableFunction("GeckoProfiler_DifferentThreads_Test::TestBody",
+                               [&]() { profiler_stop(); }),
+        NS_DISPATCH_SYNC);
+
+    InactiveFeaturesAndParamsCheck();
+  }
+
+  // Control the profiler on the main thread and verify flags on a
+  // background thread.
+  {
+    uint32_t features = ProfilerFeature::JS | ProfilerFeature::Threads;
+    const char* filters[] = {"GeckoMain", "Compositor"};
+
+    profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                   features, filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+    thread->Dispatch(
+        NS_NewRunnableFunction(
+            "GeckoProfiler_DifferentThreads_Test::TestBody",
+            [&]() {
+              ASSERT_TRUE(profiler_is_active());
+              ASSERT_TRUE(
+                  !profiler_feature_active(ProfilerFeature::MainThreadIO));
+              ASSERT_TRUE(
+                  !profiler_feature_active(ProfilerFeature::IPCMessages));
+
+              ActiveParamsCheck(PROFILER_DEFAULT_ENTRIES.Value(),
+                                PROFILER_DEFAULT_INTERVAL, features, filters,
+                                MOZ_ARRAY_LENGTH(filters), 0);
+            }),
+        NS_DISPATCH_SYNC);
+
+    profiler_stop();
+
+    thread->Dispatch(
+        NS_NewRunnableFunction("GeckoProfiler_DifferentThreads_Test::TestBody",
+                               [&]() { InactiveFeaturesAndParamsCheck(); }),
+        NS_DISPATCH_SYNC);
+  }
+
+  thread->Shutdown();
+}
+
+TEST(GeckoProfiler, GetBacktrace)
+{
+  ASSERT_TRUE(!profiler_get_backtrace());
+
+  {
+    uint32_t features = ProfilerFeature::StackWalk;
+    const char* filters[] = {"GeckoMain"};
+
+    profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                   features, filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+    // These will be destroyed while the profiler is active.
+    static const int N = 100;
+    {
+      UniqueProfilerBacktrace u[N];
+      for (int i = 0; i < N; i++) {
+        u[i] = profiler_get_backtrace();
+        ASSERT_TRUE(u[i]);
+      }
+    }
+
+    // These will be destroyed after the profiler stops.
+    UniqueProfilerBacktrace u[N];
+    for (int i = 0; i < N; i++) {
+      u[i] = profiler_get_backtrace();
+      ASSERT_TRUE(u[i]);
+    }
+
+    profiler_stop();
+  }
+
+  ASSERT_TRUE(!profiler_get_backtrace());
+}
+
+TEST(GeckoProfiler, Pause)
+{
+  uint32_t features = ProfilerFeature::StackWalk;
+  const char* filters[] = {"GeckoMain"};
+
+  ASSERT_TRUE(!profiler_is_paused());
+  ASSERT_TRUE(!profiler_can_accept_markers());
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+  ASSERT_TRUE(!profiler_is_paused());
+  ASSERT_TRUE(profiler_can_accept_markers());
+
+  // Check that we are writing samples while not paused.
+  Maybe<ProfilerBufferInfo> info1 = profiler_get_buffer_info();
+  PR_Sleep(PR_MillisecondsToInterval(500));
+  Maybe<ProfilerBufferInfo> info2 = profiler_get_buffer_info();
+  ASSERT_TRUE(info1->mRangeEnd != info2->mRangeEnd);
+
+  // Check that we are writing markers while not paused.
+  info1 = profiler_get_buffer_info();
+  PROFILER_MARKER_UNTYPED("Not paused", OTHER, {});
+  info2 = profiler_get_buffer_info();
+  ASSERT_TRUE(info1->mRangeEnd != info2->mRangeEnd);
+
+  profiler_pause();
+
+  ASSERT_TRUE(profiler_is_paused());
+  ASSERT_TRUE(!profiler_can_accept_markers());
+
+  // Check that we are not writing samples while paused.
+  info1 = profiler_get_buffer_info();
+  PR_Sleep(PR_MillisecondsToInterval(500));
+  info2 = profiler_get_buffer_info();
+  ASSERT_TRUE(info1->mRangeEnd == info2->mRangeEnd);
+
+  // Check that we are now writing markers while paused.
+  info1 = profiler_get_buffer_info();
+  PROFILER_MARKER_UNTYPED("Paused", OTHER, {});
+  info2 = profiler_get_buffer_info();
+  ASSERT_TRUE(info1->mRangeEnd == info2->mRangeEnd);
+  PROFILER_MARKER_UNTYPED("Paused v2", OTHER, {});
+  Maybe<ProfilerBufferInfo> info3 = profiler_get_buffer_info();
+  ASSERT_TRUE(info2->mRangeEnd == info3->mRangeEnd);
+
+  profiler_resume();
+
+  ASSERT_TRUE(!profiler_is_paused());
+  ASSERT_TRUE(profiler_can_accept_markers());
+
+  profiler_stop();
+
+  ASSERT_TRUE(!profiler_is_paused());
+  ASSERT_TRUE(!profiler_can_accept_markers());
+}
+
+TEST(GeckoProfiler, Markers)
+{
+  uint32_t features = ProfilerFeature::StackWalk;
+  const char* filters[] = {"GeckoMain"};
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+  PROFILER_MARKER("tracing event", OTHER, {}, Tracing, "A");
+  PROFILER_MARKER("tracing start", OTHER, MarkerTiming::IntervalStart(),
+                  Tracing, "A");
+  PROFILER_MARKER("tracing end", OTHER, MarkerTiming::IntervalEnd(), Tracing,
+                  "A");
+
+  auto bt = profiler_capture_backtrace();
+  PROFILER_MARKER("tracing event with stack", OTHER,
+                  MarkerStack::TakeBacktrace(std::move(bt)), Tracing, "B");
+
+  { AUTO_PROFILER_TRACING_MARKER("C", "auto tracing", OTHER); }
+
+  PROFILER_MARKER_UNTYPED("M1", OTHER, {});
+  PROFILER_MARKER_UNTYPED("M3", OTHER, {});
+
+  // Create three strings: two that are the maximum allowed length, and one that
+  // is one char longer.
+  static const size_t kMax = ProfileBuffer::kMaxFrameKeyLength;
+  UniquePtr<char[]> okstr1 = MakeUnique<char[]>(kMax);
+  UniquePtr<char[]> okstr2 = MakeUnique<char[]>(kMax);
+  UniquePtr<char[]> longstr = MakeUnique<char[]>(kMax + 1);
+  UniquePtr<char[]> longstrCut = MakeUnique<char[]>(kMax + 1);
+  for (size_t i = 0; i < kMax; i++) {
+    okstr1[i] = 'a';
+    okstr2[i] = 'b';
+    longstr[i] = 'c';
+    longstrCut[i] = 'c';
+  }
+  okstr1[kMax - 1] = '\0';
+  okstr2[kMax - 1] = '\0';
+  longstr[kMax] = '\0';
+  longstrCut[kMax] = '\0';
+  // Should be output as-is.
+  AUTO_PROFILER_LABEL_DYNAMIC_CSTR("", LAYOUT, "");
+  AUTO_PROFILER_LABEL_DYNAMIC_CSTR("", LAYOUT, okstr1.get());
+  // Should be output as label + space + okstr2.
+  AUTO_PROFILER_LABEL_DYNAMIC_CSTR("okstr2", LAYOUT, okstr2.get());
+  // Should be output with kMax length, ending with "...\0".
+  AUTO_PROFILER_LABEL_DYNAMIC_CSTR("", LAYOUT, longstr.get());
+  ASSERT_EQ(longstrCut[kMax - 4], 'c');
+  longstrCut[kMax - 4] = '.';
+  ASSERT_EQ(longstrCut[kMax - 3], 'c');
+  longstrCut[kMax - 3] = '.';
+  ASSERT_EQ(longstrCut[kMax - 2], 'c');
+  longstrCut[kMax - 2] = '.';
+  ASSERT_EQ(longstrCut[kMax - 1], 'c');
+  longstrCut[kMax - 1] = '\0';
+
+  // Test basic markers 2.0.
+  MOZ_RELEASE_ASSERT(
+      profiler_add_marker("default-templated markers 2.0 with empty options",
+                          geckoprofiler::category::OTHER, {}));
+
+  PROFILER_MARKER_UNTYPED(
+      "default-templated markers 2.0 with option", OTHER,
+      MarkerStack::TakeBacktrace(profiler_capture_backtrace()));
+
+  PROFILER_MARKER("explicitly-default-templated markers 2.0 with empty options",
+                  OTHER, {}, NoPayload);
+
+  MOZ_RELEASE_ASSERT(profiler_add_marker(
+      "explicitly-default-templated markers 2.0 with option",
+      geckoprofiler::category::OTHER, {},
+      ::geckoprofiler::markers::NoPayload{}));
+
+  // Used in markers below.
+  TimeStamp ts1 = TimeStamp::NowUnfuzzed();
+
+  // Sleep briefly to ensure a sample is taken and the pending markers are
+  // processed.
+  PR_Sleep(PR_MillisecondsToInterval(500));
+
+  // Used in markers below.
+  TimeStamp ts2 = TimeStamp::NowUnfuzzed();
+  // ts1 and ts2 should be different thanks to the sleep.
+  EXPECT_NE(ts1, ts2);
+
+  // Test most marker payloads.
+
+  // Keep this one first! (It's used to record `ts1` and `ts2`, to compare
+  // to serialized numbers in other markers.)
+  MOZ_RELEASE_ASSERT(profiler_add_marker(
+      "FirstMarker", geckoprofiler::category::OTHER,
+      MarkerTiming::Interval(ts1, ts2), geckoprofiler::markers::TextMarker{},
+      "First Marker"));
+
+  // User-defined marker type with different properties, and fake schema.
+  struct GtestMarker {
+    static constexpr Span<const char> MarkerTypeName() {
+      return MakeStringSpan("markers-gtest");
+    }
+    static void StreamJSONMarkerData(
+        mozilla::baseprofiler::SpliceableJSONWriter& aWriter, int aInt,
+        double aDouble, const mozilla::ProfilerString8View& aText,
+        const mozilla::ProfilerString8View& aUniqueText,
+        const mozilla::TimeStamp& aTime) {
+      aWriter.NullProperty("null");
+      aWriter.BoolProperty("bool-false", false);
+      aWriter.BoolProperty("bool-true", true);
+      aWriter.IntProperty("int", aInt);
+      aWriter.DoubleProperty("double", aDouble);
+      aWriter.StringProperty("text", aText);
+      aWriter.UniqueStringProperty("unique text", aUniqueText);
+      aWriter.UniqueStringProperty("unique text again", aUniqueText);
+      aWriter.TimeProperty("time", aTime);
+    }
+    static mozilla::MarkerSchema MarkerTypeDisplay() {
+      // Note: This is an test function that is not intended to actually output
+      // that correctly matches StreamJSONMarkerData data above! Instead we only
+      // test that it outputs the expected JSON at the end.
+      using MS = mozilla::MarkerSchema;
+      MS schema{MS::Location::markerChart,      MS::Location::markerTable,
+                MS::Location::timelineOverview, MS::Location::timelineMemory,
+                MS::Location::timelineIPC,      MS::Location::timelineFileIO,
+                MS::Location::stackChart};
+      // All label functions.
+      schema.SetChartLabel("chart label");
+      schema.SetTooltipLabel("tooltip label");
+      schema.SetTableLabel("table label");
+      // All data functions, all formats, all "searchable" values.
+      schema.AddKeyFormat("key with url", MS::Format::url);
+      schema.AddKeyLabelFormat("key with label filePath", "label filePath",
+                               MS::Format::filePath);
+      schema.AddKeyFormatSearchable("key with string not-searchable",
+                                    MS::Format::string,
+                                    MS::Searchable::notSearchable);
+      schema.AddKeyLabelFormatSearchable("key with label duration searchable",
+                                         "label duration", MS::Format::duration,
+                                         MS::Searchable::searchable);
+      schema.AddKeyFormat("key with time", MS::Format::time);
+      schema.AddKeyFormat("key with seconds", MS::Format::seconds);
+      schema.AddKeyFormat("key with milliseconds", MS::Format::milliseconds);
+      schema.AddKeyFormat("key with microseconds", MS::Format::microseconds);
+      schema.AddKeyFormat("key with nanoseconds", MS::Format::nanoseconds);
+      schema.AddKeyFormat("key with bytes", MS::Format::bytes);
+      schema.AddKeyFormat("key with percentage", MS::Format::percentage);
+      schema.AddKeyFormat("key with integer", MS::Format::integer);
+      schema.AddKeyFormat("key with decimal", MS::Format::decimal);
+      schema.AddStaticLabelValue("static label", "static value");
+      return schema;
+    }
+  };
+  MOZ_RELEASE_ASSERT(
+      profiler_add_marker("Gtest custom marker", geckoprofiler::category::OTHER,
+                          MarkerTiming::Interval(ts1, ts2), GtestMarker{}, 42,
+                          43.0, "gtest text", "gtest unique text", ts1));
+
+  // User-defined marker type with no data, special frontend schema.
+  struct GtestSpecialMarker {
+    static constexpr Span<const char> MarkerTypeName() {
+      return MakeStringSpan("markers-gtest-special");
+    }
+    static void StreamJSONMarkerData(
+        mozilla::baseprofiler::SpliceableJSONWriter& aWriter) {}
+    static mozilla::MarkerSchema MarkerTypeDisplay() {
+      return mozilla::MarkerSchema::SpecialFrontendLocation{};
+    }
+  };
+  MOZ_RELEASE_ASSERT(profiler_add_marker("Gtest special marker",
+                                         geckoprofiler::category::OTHER, {},
+                                         GtestSpecialMarker{}));
+
+  // User-defined marker type that is never used, so it shouldn't appear in the
+  // output.
+  struct GtestUnusedMarker {
+    static constexpr Span<const char> MarkerTypeName() {
+      return MakeStringSpan("markers-gtest-unused");
+    }
+    static void StreamJSONMarkerData(
+        mozilla::baseprofiler::SpliceableJSONWriter& aWriter) {}
+    static mozilla::MarkerSchema MarkerTypeDisplay() {
+      return mozilla::MarkerSchema::SpecialFrontendLocation{};
+    }
+  };
+
+  // Make sure the compiler doesn't complain about this unused struct.
+  mozilla::Unused << GtestUnusedMarker{};
+
+  // Other markers in alphabetical order of payload class names.
+
+  nsCOMPtr<nsIURI> uri;
+  ASSERT_TRUE(
+      NS_SUCCEEDED(NS_NewURI(getter_AddRefs(uri), "http://mozilla.org/"_ns)));
+  // The marker name will be "Load <aChannelId>: <aURI>".
+  profiler_add_network_marker(
+      /* nsIURI* aURI */ uri,
+      /* const nsACString& aRequestMethod */ "GET"_ns,
+      /* int32_t aPriority */ 34,
+      /* uint64_t aChannelId */ 1,
+      /* NetworkLoadType aType */ NetworkLoadType::LOAD_START,
+      /* mozilla::TimeStamp aStart */ ts1,
+      /* mozilla::TimeStamp aEnd */ ts2,
+      /* int64_t aCount */ 56,
+      /* mozilla::net::CacheDisposition aCacheDisposition */
+      net::kCacheHit,
+      /* uint64_t aInnerWindowID */ 78
+      /* const mozilla::net::TimingStruct* aTimings = nullptr */
+      /* nsIURI* aRedirectURI = nullptr */
+      /* mozilla::UniquePtr<mozilla::ProfileChunkedBuffer> aSource =
+         nullptr */
+      /* const mozilla::Maybe<nsDependentCString>& aContentType =
+         mozilla::Nothing() */);
+
+  profiler_add_network_marker(
+      /* nsIURI* aURI */ uri,
+      /* const nsACString& aRequestMethod */ "GET"_ns,
+      /* int32_t aPriority */ 34,
+      /* uint64_t aChannelId */ 12,
+      /* NetworkLoadType aType */ NetworkLoadType::LOAD_STOP,
+      /* mozilla::TimeStamp aStart */ ts1,
+      /* mozilla::TimeStamp aEnd */ ts2,
+      /* int64_t aCount */ 56,
+      /* mozilla::net::CacheDisposition aCacheDisposition */
+      net::kCacheUnresolved,
+      /* uint64_t aInnerWindowID */ 78,
+      /* const mozilla::net::TimingStruct* aTimings = nullptr */ nullptr,
+      /* nsIURI* aRedirectURI = nullptr */ nullptr,
+      /* mozilla::UniquePtr<mozilla::ProfileChunkedBuffer> aSource =
+         nullptr */
+      nullptr,
+      /* const mozilla::Maybe<nsDependentCString>& aContentType =
+         mozilla::Nothing() */
+      Some(nsDependentCString("text/html")));
+
+  nsCOMPtr<nsIURI> redirectURI;
+  ASSERT_TRUE(NS_SUCCEEDED(
+      NS_NewURI(getter_AddRefs(redirectURI), "http://example.com/"_ns)));
+  profiler_add_network_marker(
+      /* nsIURI* aURI */ uri,
+      /* const nsACString& aRequestMethod */ "GET"_ns,
+      /* int32_t aPriority */ 34,
+      /* uint64_t aChannelId */ 123,
+      /* NetworkLoadType aType */ NetworkLoadType::LOAD_REDIRECT,
+      /* mozilla::TimeStamp aStart */ ts1,
+      /* mozilla::TimeStamp aEnd */ ts2,
+      /* int64_t aCount */ 56,
+      /* mozilla::net::CacheDisposition aCacheDisposition */
+      net::kCacheUnresolved,
+      /* uint64_t aInnerWindowID */ 78,
+      /* const mozilla::net::TimingStruct* aTimings = nullptr */ nullptr,
+      /* nsIURI* aRedirectURI = nullptr */ redirectURI
+      /* mozilla::UniquePtr<mozilla::ProfileChunkedBuffer> aSource =
+         nullptr */
+      /* const mozilla::Maybe<nsDependentCString>& aContentType =
+         mozilla::Nothing() */);
+
+  MOZ_RELEASE_ASSERT(profiler_add_marker(
+      "Text in main thread with stack", geckoprofiler::category::OTHER,
+      {MarkerStack::Capture(), MarkerTiming::Interval(ts1, ts2)},
+      geckoprofiler::markers::TextMarker{}, ""));
+  MOZ_RELEASE_ASSERT(profiler_add_marker(
+      "Text from main thread with stack", geckoprofiler::category::OTHER,
+      MarkerOptions(MarkerThreadId::MainThread(), MarkerStack::Capture()),
+      geckoprofiler::markers::TextMarker{}, ""));
+
+  std::thread registeredThread([]() {
+    AUTO_PROFILER_REGISTER_THREAD("Marker test sub-thread");
+    // Marker in non-profiled thread won't be stored.
+    MOZ_RELEASE_ASSERT(profiler_add_marker(
+        "Text in registered thread with stack", geckoprofiler::category::OTHER,
+        MarkerStack::Capture(), geckoprofiler::markers::TextMarker{}, ""));
+    // Marker will be stored in main thread, with stack from registered thread.
+    MOZ_RELEASE_ASSERT(profiler_add_marker(
+        "Text from registered thread with stack",
+        geckoprofiler::category::OTHER,
+        MarkerOptions(MarkerThreadId::MainThread(), MarkerStack::Capture()),
+        geckoprofiler::markers::TextMarker{}, ""));
+  });
+  registeredThread.join();
+
+  std::thread unregisteredThread([]() {
+    // Marker in unregistered thread won't be stored.
+    MOZ_RELEASE_ASSERT(profiler_add_marker(
+        "Text in unregistered thread with stack",
+        geckoprofiler::category::OTHER, MarkerStack::Capture(),
+        geckoprofiler::markers::TextMarker{}, ""));
+    // Marker will be stored in main thread, but stack cannot be captured in an
+    // unregistered thread.
+    MOZ_RELEASE_ASSERT(profiler_add_marker(
+        "Text from unregistered thread with stack",
+        geckoprofiler::category::OTHER,
+        MarkerOptions(MarkerThreadId::MainThread(), MarkerStack::Capture()),
+        geckoprofiler::markers::TextMarker{}, ""));
+  });
+  unregisteredThread.join();
+
+  MOZ_RELEASE_ASSERT(
+      profiler_add_marker("Tracing", geckoprofiler::category::OTHER, {},
+                          geckoprofiler::markers::Tracing{}, "category"));
+
+  MOZ_RELEASE_ASSERT(
+      profiler_add_marker("Text", geckoprofiler::category::OTHER, {},
+                          geckoprofiler::markers::TextMarker{}, "Text text"));
+
+  MOZ_RELEASE_ASSERT(profiler_add_marker(
+      "MediaSample", geckoprofiler::category::OTHER, {},
+      geckoprofiler::markers::MediaSampleMarker{}, 123, 456));
+
+  SpliceableChunkedJSONWriter w;
+  w.Start();
+  EXPECT_TRUE(::profiler_stream_json_for_this_process(w));
+  w.End();
+
+  UniquePtr<char[]> profile = w.ChunkedWriteFunc().CopyData();
+  ASSERT_TRUE(!!profile.get());
+
+  // Expected markers, in order.
+  enum State {
+    S_tracing_event,
+    S_tracing_start,
+    S_tracing_end,
+    S_tracing_event_with_stack,
+    S_tracing_auto_tracing_start,
+    S_tracing_auto_tracing_end,
+    S_M1,
+    S_M3,
+    S_Markers2DefaultEmptyOptions,
+    S_Markers2DefaultWithOptions,
+    S_Markers2ExplicitDefaultEmptyOptions,
+    S_Markers2ExplicitDefaultWithOptions,
+    S_FirstMarker,
+    S_CustomMarker,
+    S_SpecialMarker,
+    S_NetworkMarkerPayload_start,
+    S_NetworkMarkerPayload_stop,
+    S_NetworkMarkerPayload_redirect,
+    S_TextWithStack,
+    S_TextToMTWithStack,
+    S_RegThread_TextToMTWithStack,
+    S_UnregThread_TextToMTWithStack,
+
+    S_LAST,
+  } state = State(0);
+
+  // These will be set when first read from S_FirstMarker, then
+  // compared in following markers.
+  // TODO: Compute these values from the timestamps.
+  double ts1Double = 0.0;
+  double ts2Double = 0.0;
+
+  JSONOutputCheck(profile.get(), [&](const Json::Value& root) {
+    {
+      GET_JSON(threads, root["threads"], Array);
+      ASSERT_EQ(threads.size(), 1u);
+
+      {
+        GET_JSON(thread0, threads[0], Object);
+
+        // Keep a reference to the string table in this block, it will be used
+        // below.
+        GET_JSON(stringTable, thread0["stringTable"], Array);
+        ASSERT_TRUE(stringTable.isArray());
+
+        // Test the expected labels in the string table.
+        bool foundEmpty = false;
+        bool foundOkstr1 = false;
+        bool foundOkstr2 = false;
+        const std::string okstr2Label = std::string("okstr2 ") + okstr2.get();
+        bool foundTooLong = false;
+        for (const auto& s : stringTable) {
+          ASSERT_TRUE(s.isString());
+          std::string sString = s.asString();
+          if (sString.empty()) {
+            EXPECT_FALSE(foundEmpty);
+            foundEmpty = true;
+          } else if (sString == okstr1.get()) {
+            EXPECT_FALSE(foundOkstr1);
+            foundOkstr1 = true;
+          } else if (sString == okstr2Label) {
+            EXPECT_FALSE(foundOkstr2);
+            foundOkstr2 = true;
+          } else if (sString == longstrCut.get()) {
+            EXPECT_FALSE(foundTooLong);
+            foundTooLong = true;
+          } else {
+            EXPECT_NE(sString, longstr.get());
+          }
+        }
+        EXPECT_TRUE(foundEmpty);
+        EXPECT_TRUE(foundOkstr1);
+        EXPECT_TRUE(foundOkstr2);
+        EXPECT_TRUE(foundTooLong);
+
+        {
+          GET_JSON(markers, thread0["markers"], Object);
+
+          {
+            GET_JSON(data, markers["data"], Array);
+
+            for (const Json::Value& marker : data) {
+              // Name the indexes into the marker tuple:
+              // [name, startTime, endTime, phase, category, payload]
+              const unsigned int NAME = 0u;
+              const unsigned int START_TIME = 1u;
+              const unsigned int END_TIME = 2u;
+              const unsigned int PHASE = 3u;
+              const unsigned int CATEGORY = 4u;
+              const unsigned int PAYLOAD = 5u;
+
+              const unsigned int PHASE_INSTANT = 0;
+              const unsigned int PHASE_INTERVAL = 1;
+              const unsigned int PHASE_START = 2;
+              const unsigned int PHASE_END = 3;
+
+              const unsigned int SIZE_WITHOUT_PAYLOAD = 5u;
+              const unsigned int SIZE_WITH_PAYLOAD = 6u;
+
+              ASSERT_TRUE(marker.isArray());
+              // The payload is optional.
+              ASSERT_GE(marker.size(), SIZE_WITHOUT_PAYLOAD);
+              ASSERT_LE(marker.size(), SIZE_WITH_PAYLOAD);
+
+              // root.threads[0].markers.data[i] is an array with 5 or 6
+              // elements.
+
+              ASSERT_TRUE(marker[NAME].isUInt());  // name id
+              GET_JSON(name, stringTable[marker[NAME].asUInt()], String);
+              std::string nameString = name.asString();
+
+              EXPECT_TRUE(marker[START_TIME].isNumeric());
+              EXPECT_TRUE(marker[END_TIME].isNumeric());
+              EXPECT_TRUE(marker[PHASE].isUInt());
+              EXPECT_TRUE(marker[PHASE].asUInt() < 4);
+              EXPECT_TRUE(marker[CATEGORY].isUInt());
+
+#define EXPECT_TIMING_INSTANT                  \
+  EXPECT_NE(marker[START_TIME].asDouble(), 0); \
+  EXPECT_EQ(marker[END_TIME].asDouble(), 0);   \
+  EXPECT_EQ(marker[PHASE].asUInt(), PHASE_INSTANT);
+#define EXPECT_TIMING_INTERVAL                 \
+  EXPECT_NE(marker[START_TIME].asDouble(), 0); \
+  EXPECT_NE(marker[END_TIME].asDouble(), 0);   \
+  EXPECT_EQ(marker[PHASE].asUInt(), PHASE_INTERVAL);
+#define EXPECT_TIMING_START                    \
+  EXPECT_NE(marker[START_TIME].asDouble(), 0); \
+  EXPECT_EQ(marker[END_TIME].asDouble(), 0);   \
+  EXPECT_EQ(marker[PHASE].asUInt(), PHASE_START);
+#define EXPECT_TIMING_END                      \
+  EXPECT_EQ(marker[START_TIME].asDouble(), 0); \
+  EXPECT_NE(marker[END_TIME].asDouble(), 0);   \
+  EXPECT_EQ(marker[PHASE].asUInt(), PHASE_END);
+
+#define EXPECT_TIMING_INSTANT_AT(t)            \
+  EXPECT_EQ(marker[START_TIME].asDouble(), t); \
+  EXPECT_EQ(marker[END_TIME].asDouble(), 0);   \
+  EXPECT_EQ(marker[PHASE].asUInt(), PHASE_INSTANT);
+#define EXPECT_TIMING_INTERVAL_AT(start, end)      \
+  EXPECT_EQ(marker[START_TIME].asDouble(), start); \
+  EXPECT_EQ(marker[END_TIME].asDouble(), end);     \
+  EXPECT_EQ(marker[PHASE].asUInt(), PHASE_INTERVAL);
+#define EXPECT_TIMING_START_AT(start)              \
+  EXPECT_EQ(marker[START_TIME].asDouble(), start); \
+  EXPECT_EQ(marker[END_TIME].asDouble(), 0);       \
+  EXPECT_EQ(marker[PHASE].asUInt(), PHASE_START);
+#define EXPECT_TIMING_END_AT(end)              \
+  EXPECT_EQ(marker[START_TIME].asDouble(), 0); \
+  EXPECT_EQ(marker[END_TIME].asDouble(), end); \
+  EXPECT_EQ(marker[PHASE].asUInt(), PHASE_END);
+
+              if (marker.size() == SIZE_WITHOUT_PAYLOAD) {
+                // root.threads[0].markers.data[i] is an array with 5 elements,
+                // so there is no payload.
+                if (nameString == "M1") {
+                  ASSERT_EQ(state, S_M1);
+                  state = State(state + 1);
+                } else if (nameString == "M3") {
+                  ASSERT_EQ(state, S_M3);
+                  state = State(state + 1);
+                } else if (nameString ==
+                           "default-templated markers 2.0 with empty options") {
+                  EXPECT_EQ(state, S_Markers2DefaultEmptyOptions);
+                  state = State(S_Markers2DefaultEmptyOptions + 1);
+// TODO: Re-enable this when bug 1646714 lands, and check for stack.
+#if 0
+              } else if (nameString ==
+                         "default-templated markers 2.0 with option") {
+                EXPECT_EQ(state, S_Markers2DefaultWithOptions);
+                state = State(S_Markers2DefaultWithOptions + 1);
+#endif
+                } else if (nameString ==
+                           "explicitly-default-templated markers 2.0 with "
+                           "empty "
+                           "options") {
+                  EXPECT_EQ(state, S_Markers2ExplicitDefaultEmptyOptions);
+                  state = State(S_Markers2ExplicitDefaultEmptyOptions + 1);
+                } else if (nameString ==
+                           "explicitly-default-templated markers 2.0 with "
+                           "option") {
+                  EXPECT_EQ(state, S_Markers2ExplicitDefaultWithOptions);
+                  state = State(S_Markers2ExplicitDefaultWithOptions + 1);
+                }
+              } else {
+                // root.threads[0].markers.data[i] is an array with 6 elements,
+                // so there is a payload.
+                GET_JSON(payload, marker[PAYLOAD], Object);
+
+                // root.threads[0].markers.data[i][PAYLOAD] is an object
+                // (payload).
+
+                // It should at least have a "type" string.
+                GET_JSON(type, payload["type"], String);
+                std::string typeString = type.asString();
+
+                if (nameString == "tracing event") {
+                  EXPECT_EQ(state, S_tracing_event);
+                  state = State(S_tracing_event + 1);
+                  EXPECT_EQ(typeString, "tracing");
+                  EXPECT_TIMING_INSTANT;
+                  EXPECT_EQ_JSON(payload["category"], String, "A");
+                  EXPECT_TRUE(payload["stack"].isNull());
+
+                } else if (nameString == "tracing start") {
+                  EXPECT_EQ(state, S_tracing_start);
+                  state = State(S_tracing_start + 1);
+                  EXPECT_EQ(typeString, "tracing");
+                  EXPECT_TIMING_START;
+                  EXPECT_EQ_JSON(payload["category"], String, "A");
+                  EXPECT_TRUE(payload["stack"].isNull());
+
+                } else if (nameString == "tracing end") {
+                  EXPECT_EQ(state, S_tracing_end);
+                  state = State(S_tracing_end + 1);
+                  EXPECT_EQ(typeString, "tracing");
+                  EXPECT_TIMING_END;
+                  EXPECT_EQ_JSON(payload["category"], String, "A");
+                  EXPECT_TRUE(payload["stack"].isNull());
+
+                } else if (nameString == "tracing event with stack") {
+                  EXPECT_EQ(state, S_tracing_event_with_stack);
+                  state = State(S_tracing_event_with_stack + 1);
+                  EXPECT_EQ(typeString, "tracing");
+                  EXPECT_TIMING_INSTANT;
+                  EXPECT_EQ_JSON(payload["category"], String, "B");
+                  EXPECT_TRUE(payload["stack"].isObject());
+
+                } else if (nameString == "auto tracing") {
+                  switch (state) {
+                    case S_tracing_auto_tracing_start:
+                      state = State(S_tracing_auto_tracing_start + 1);
+                      EXPECT_EQ(typeString, "tracing");
+                      EXPECT_TIMING_START;
+                      EXPECT_EQ_JSON(payload["category"], String, "C");
+                      EXPECT_TRUE(payload["stack"].isNull());
+                      break;
+                    case S_tracing_auto_tracing_end:
+                      state = State(S_tracing_auto_tracing_end + 1);
+                      EXPECT_EQ(typeString, "tracing");
+                      EXPECT_TIMING_END;
+                      EXPECT_EQ_JSON(payload["category"], String, "C");
+                      ASSERT_TRUE(payload["stack"].isNull());
+                      break;
+                    default:
+                      EXPECT_TRUE(state == S_tracing_auto_tracing_start ||
+                                  state == S_tracing_auto_tracing_end);
+                      break;
+                  }
+
+                } else if (nameString ==
+                           "default-templated markers 2.0 with option") {
+                  // TODO: Remove this when bug 1646714 lands.
+                  EXPECT_EQ(state, S_Markers2DefaultWithOptions);
+                  state = State(S_Markers2DefaultWithOptions + 1);
+                  EXPECT_EQ(typeString, "NoPayloadUserData");
+                  EXPECT_FALSE(payload["stack"].isNull());
+
+                } else if (nameString == "FirstMarker") {
+                  // Record start and end times, to compare with timestamps in
+                  // following markers.
+                  EXPECT_EQ(state, S_FirstMarker);
+                  ts1Double = marker[START_TIME].asDouble();
+                  ts2Double = marker[END_TIME].asDouble();
+                  state = State(S_FirstMarker + 1);
+                  EXPECT_EQ(typeString, "Text");
+                  EXPECT_EQ_JSON(payload["name"], String, "First Marker");
+
+                } else if (nameString == "Gtest custom marker") {
+                  EXPECT_EQ(state, S_CustomMarker);
+                  state = State(S_CustomMarker + 1);
+                  EXPECT_EQ(typeString, "markers-gtest");
+                  EXPECT_EQ(payload.size(), 1u + 9u);
+                  EXPECT_TRUE(payload["null"].isNull());
+                  EXPECT_EQ_JSON(payload["bool-false"], Bool, false);
+                  EXPECT_EQ_JSON(payload["bool-true"], Bool, true);
+                  EXPECT_EQ_JSON(payload["int"], Int64, 42);
+                  EXPECT_EQ_JSON(payload["double"], Double, 43.0);
+                  EXPECT_EQ_JSON(payload["text"], String, "gtest text");
+                  // Unique strings can be fetched from the string table.
+                  ASSERT_TRUE(payload["unique text"].isUInt());
+                  auto textIndex = payload["unique text"].asUInt();
+                  GET_JSON(uniqueText, stringTable[textIndex], String);
+                  ASSERT_TRUE(uniqueText.isString());
+                  ASSERT_EQ(uniqueText.asString(), "gtest unique text");
+                  // The duplicate unique text should have the exact same index.
+                  EXPECT_EQ_JSON(payload["unique text again"], UInt, textIndex);
+                  EXPECT_EQ_JSON(payload["time"], Double, ts1Double);
+
+                } else if (nameString == "Gtest special marker") {
+                  EXPECT_EQ(state, S_SpecialMarker);
+                  state = State(S_SpecialMarker + 1);
+                  EXPECT_EQ(typeString, "markers-gtest-special");
+                  EXPECT_EQ(payload.size(), 1u) << "Only 'type' in the payload";
+
+                } else if (nameString == "Load 1: http://mozilla.org/") {
+                  EXPECT_EQ(state, S_NetworkMarkerPayload_start);
+                  state = State(S_NetworkMarkerPayload_start + 1);
+                  EXPECT_EQ(typeString, "Network");
+                  EXPECT_EQ_JSON(payload["startTime"], Double, ts1Double);
+                  EXPECT_EQ_JSON(payload["endTime"], Double, ts2Double);
+                  EXPECT_EQ_JSON(payload["id"], Int64, 1);
+                  EXPECT_EQ_JSON(payload["URI"], String, "http://mozilla.org/");
+                  EXPECT_EQ_JSON(payload["requestMethod"], String, "GET");
+                  EXPECT_EQ_JSON(payload["pri"], Int64, 34);
+                  EXPECT_EQ_JSON(payload["count"], Int64, 56);
+                  EXPECT_EQ_JSON(payload["cache"], String, "Hit");
+                  EXPECT_TRUE(payload["RedirectURI"].isNull());
+                  EXPECT_TRUE(payload["contentType"].isNull());
+
+                } else if (nameString == "Load 12: http://mozilla.org/") {
+                  EXPECT_EQ(state, S_NetworkMarkerPayload_stop);
+                  state = State(S_NetworkMarkerPayload_stop + 1);
+                  EXPECT_EQ(typeString, "Network");
+                  EXPECT_EQ_JSON(payload["startTime"], Double, ts1Double);
+                  EXPECT_EQ_JSON(payload["endTime"], Double, ts2Double);
+                  EXPECT_EQ_JSON(payload["id"], Int64, 12);
+                  EXPECT_EQ_JSON(payload["URI"], String, "http://mozilla.org/");
+                  EXPECT_EQ_JSON(payload["requestMethod"], String, "GET");
+                  EXPECT_EQ_JSON(payload["pri"], Int64, 34);
+                  EXPECT_EQ_JSON(payload["count"], Int64, 56);
+                  EXPECT_EQ_JSON(payload["cache"], String, "Unresolved");
+                  EXPECT_TRUE(payload["RedirectURI"].isNull());
+                  EXPECT_EQ_JSON(payload["contentType"], String, "text/html");
+
+                } else if (nameString == "Load 123: http://mozilla.org/") {
+                  EXPECT_EQ(state, S_NetworkMarkerPayload_redirect);
+                  state = State(S_NetworkMarkerPayload_redirect + 1);
+                  EXPECT_EQ(typeString, "Network");
+                  EXPECT_EQ_JSON(payload["startTime"], Double, ts1Double);
+                  EXPECT_EQ_JSON(payload["endTime"], Double, ts2Double);
+                  EXPECT_EQ_JSON(payload["id"], Int64, 123);
+                  EXPECT_EQ_JSON(payload["URI"], String, "http://mozilla.org/");
+                  EXPECT_EQ_JSON(payload["requestMethod"], String, "GET");
+                  EXPECT_EQ_JSON(payload["pri"], Int64, 34);
+                  EXPECT_EQ_JSON(payload["count"], Int64, 56);
+                  EXPECT_EQ_JSON(payload["cache"], String, "Unresolved");
+                  EXPECT_EQ_JSON(payload["RedirectURI"], String,
+                                 "http://example.com/");
+                  EXPECT_TRUE(payload["contentType"].isNull());
+
+                } else if (nameString == "Text in main thread with stack") {
+                  EXPECT_EQ(state, S_TextWithStack);
+                  state = State(S_TextWithStack + 1);
+                  EXPECT_EQ(typeString, "Text");
+                  EXPECT_FALSE(payload["stack"].isNull());
+                  EXPECT_TIMING_INTERVAL_AT(ts1Double, ts2Double);
+                  EXPECT_EQ_JSON(payload["name"], String, "");
+
+                } else if (nameString == "Text from main thread with stack") {
+                  EXPECT_EQ(state, S_TextToMTWithStack);
+                  state = State(S_TextToMTWithStack + 1);
+                  EXPECT_EQ(typeString, "Text");
+                  EXPECT_FALSE(payload["stack"].isNull());
+                  EXPECT_EQ_JSON(payload["name"], String, "");
+
+                } else if (nameString ==
+                           "Text in registered thread with stack") {
+                  ADD_FAILURE()
+                      << "Unexpected 'Text in registered thread with stack'";
+
+                } else if (nameString ==
+                           "Text from registered thread with stack") {
+                  EXPECT_EQ(state, S_RegThread_TextToMTWithStack);
+                  state = State(S_RegThread_TextToMTWithStack + 1);
+                  EXPECT_EQ(typeString, "Text");
+                  EXPECT_FALSE(payload["stack"].isNull());
+                  EXPECT_EQ_JSON(payload["name"], String, "");
+
+                } else if (nameString ==
+                           "Text in unregistered thread with stack") {
+                  ADD_FAILURE()
+                      << "Unexpected 'Text in unregistered thread with stack'";
+
+                } else if (nameString ==
+                           "Text from unregistered thread with stack") {
+                  EXPECT_EQ(state, S_UnregThread_TextToMTWithStack);
+                  state = State(S_UnregThread_TextToMTWithStack + 1);
+                  EXPECT_EQ(typeString, "Text");
+                  EXPECT_TRUE(payload["stack"].isNull());
+                  EXPECT_EQ_JSON(payload["name"], String, "");
+                }
+              }  // marker with payload
+            }    // for (marker : data)
+          }      // markers.data
+        }        // markers
+      }          // thread0
+    }            // threads
+    // We should have read all expected markers.
+    EXPECT_EQ(state, S_LAST);
+
+    {
+      GET_JSON(meta, root["meta"], Object);
+
+      {
+        GET_JSON(markerSchema, meta["markerSchema"], Array);
+
+        std::set<std::string> testedSchemaNames;
+
+        for (const Json::Value& schema : markerSchema) {
+          GET_JSON(name, schema["name"], String);
+          const std::string nameString = name.asString();
+
+          GET_JSON(display, schema["display"], Array);
+
+          GET_JSON(data, schema["data"], Array);
+
+          EXPECT_TRUE(
+              testedSchemaNames
+                  .insert(std::string(nameString.data(), nameString.size()))
+                  .second)
+              << "Each schema name should be unique (inserted once in the set)";
+
+          if (nameString == "Text") {
+            EXPECT_EQ(display.size(), 2u);
+            EXPECT_EQ(display[0u].asString(), "marker-chart");
+            EXPECT_EQ(display[1u].asString(), "marker-table");
+
+            ASSERT_EQ(data.size(), 1u);
+
+            ASSERT_TRUE(data[0u].isObject());
+            EXPECT_EQ_JSON(data[0u]["key"], String, "name");
+            EXPECT_EQ_JSON(data[0u]["label"], String, "Details");
+            EXPECT_EQ_JSON(data[0u]["format"], String, "string");
+
+          } else if (nameString == "NoPayloadUserData") {
+            // TODO: Remove this when bug 1646714 lands.
+            EXPECT_EQ(display.size(), 2u);
+            EXPECT_EQ(display[0u].asString(), "marker-chart");
+            EXPECT_EQ(display[1u].asString(), "marker-table");
+
+            ASSERT_EQ(data.size(), 0u);
+
+          } else if (nameString == "FileIO") {
+            // These are defined in ProfilerIOInterposeObserver.cpp
+
+          } else if (nameString == "tracing") {
+            EXPECT_EQ(display.size(), 3u);
+            EXPECT_EQ(display[0u].asString(), "marker-chart");
+            EXPECT_EQ(display[1u].asString(), "marker-table");
+            EXPECT_EQ(display[2u].asString(), "timeline-overview");
+
+            ASSERT_EQ(data.size(), 1u);
+
+            ASSERT_TRUE(data[0u].isObject());
+            EXPECT_EQ_JSON(data[0u]["key"], String, "category");
+            EXPECT_EQ_JSON(data[0u]["label"], String, "Type");
+            EXPECT_EQ_JSON(data[0u]["format"], String, "string");
+
+          } else if (nameString == "BHR-detected hang") {
+            EXPECT_EQ(display.size(), 2u);
+            EXPECT_EQ(display[0u].asString(), "marker-chart");
+            EXPECT_EQ(display[1u].asString(), "marker-table");
+
+            ASSERT_EQ(data.size(), 0u);
+
+          } else if (nameString == "MainThreadLongTask") {
+            EXPECT_EQ(display.size(), 2u);
+            EXPECT_EQ(display[0u].asString(), "marker-chart");
+            EXPECT_EQ(display[1u].asString(), "marker-table");
+
+            ASSERT_EQ(data.size(), 1u);
+
+            ASSERT_TRUE(data[0u].isObject());
+            EXPECT_EQ_JSON(data[0u]["key"], String, "category");
+            EXPECT_EQ_JSON(data[0u]["label"], String, "Type");
+            EXPECT_EQ_JSON(data[0u]["format"], String, "string");
+
+          } else if (nameString == "Log") {
+            EXPECT_EQ(display.size(), 1u);
+            EXPECT_EQ(display[0u].asString(), "marker-table");
+
+            ASSERT_EQ(data.size(), 2u);
+
+            ASSERT_TRUE(data[0u].isObject());
+            EXPECT_EQ_JSON(data[0u]["key"], String, "module");
+            EXPECT_EQ_JSON(data[0u]["label"], String, "Module");
+            EXPECT_EQ_JSON(data[0u]["format"], String, "string");
+
+            ASSERT_TRUE(data[1u].isObject());
+            EXPECT_EQ_JSON(data[1u]["key"], String, "name");
+            EXPECT_EQ_JSON(data[1u]["label"], String, "Name");
+            EXPECT_EQ_JSON(data[1u]["format"], String, "string");
+
+          } else if (nameString == "MediaSample") {
+            EXPECT_EQ(display.size(), 2u);
+            EXPECT_EQ(display[0u].asString(), "marker-chart");
+            EXPECT_EQ(display[1u].asString(), "marker-table");
+
+            ASSERT_EQ(data.size(), 2u);
+
+            ASSERT_TRUE(data[0u].isObject());
+            EXPECT_EQ_JSON(data[0u]["key"], String, "sampleStartTimeUs");
+            EXPECT_EQ_JSON(data[0u]["label"], String, "Sample start time");
+            EXPECT_EQ_JSON(data[0u]["format"], String, "microseconds");
+
+            ASSERT_TRUE(data[1u].isObject());
+            EXPECT_EQ_JSON(data[1u]["key"], String, "sampleEndTimeUs");
+            EXPECT_EQ_JSON(data[1u]["label"], String, "Sample end time");
+            EXPECT_EQ_JSON(data[1u]["format"], String, "microseconds");
+
+          } else if (nameString == "Budget") {
+            EXPECT_EQ(display.size(), 2u);
+            EXPECT_EQ(display[0u].asString(), "marker-chart");
+            EXPECT_EQ(display[1u].asString(), "marker-table");
+
+            ASSERT_EQ(data.size(), 0u);
+
+          } else if (nameString == "markers-gtest") {
+            EXPECT_EQ(display.size(), 7u);
+            EXPECT_EQ(display[0u].asString(), "marker-chart");
+            EXPECT_EQ(display[1u].asString(), "marker-table");
+            EXPECT_EQ(display[2u].asString(), "timeline-overview");
+            EXPECT_EQ(display[3u].asString(), "timeline-memory");
+            EXPECT_EQ(display[4u].asString(), "timeline-ipc");
+            EXPECT_EQ(display[5u].asString(), "timeline-fileio");
+            EXPECT_EQ(display[6u].asString(), "stack-chart");
+
+            EXPECT_EQ_JSON(schema["chartLabel"], String, "chart label");
+            EXPECT_EQ_JSON(schema["tooltipLabel"], String, "tooltip label");
+            EXPECT_EQ_JSON(schema["tableLabel"], String, "table label");
+
+            ASSERT_EQ(data.size(), 14u);
+
+            ASSERT_TRUE(data[0u].isObject());
+            EXPECT_EQ_JSON(data[0u]["key"], String, "key with url");
+            EXPECT_TRUE(data[0u]["label"].isNull());
+            EXPECT_EQ_JSON(data[0u]["format"], String, "url");
+            EXPECT_TRUE(data[0u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[1u].isObject());
+            EXPECT_EQ_JSON(data[1u]["key"], String, "key with label filePath");
+            EXPECT_EQ_JSON(data[1u]["label"], String, "label filePath");
+            EXPECT_EQ_JSON(data[1u]["format"], String, "file-path");
+            EXPECT_TRUE(data[1u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[2u].isObject());
+            EXPECT_EQ_JSON(data[2u]["key"], String,
+                           "key with string not-searchable");
+            EXPECT_TRUE(data[2u]["label"].isNull());
+            EXPECT_EQ_JSON(data[2u]["format"], String, "string");
+            EXPECT_EQ_JSON(data[2u]["searchable"], Bool, false);
+
+            ASSERT_TRUE(data[3u].isObject());
+            EXPECT_EQ_JSON(data[3u]["key"], String,
+                           "key with label duration searchable");
+            EXPECT_TRUE(data[3u]["label duration"].isNull());
+            EXPECT_EQ_JSON(data[3u]["format"], String, "duration");
+            EXPECT_EQ_JSON(data[3u]["searchable"], Bool, true);
+
+            ASSERT_TRUE(data[4u].isObject());
+            EXPECT_EQ_JSON(data[4u]["key"], String, "key with time");
+            EXPECT_TRUE(data[4u]["label"].isNull());
+            EXPECT_EQ_JSON(data[4u]["format"], String, "time");
+            EXPECT_TRUE(data[4u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[5u].isObject());
+            EXPECT_EQ_JSON(data[5u]["key"], String, "key with seconds");
+            EXPECT_TRUE(data[5u]["label"].isNull());
+            EXPECT_EQ_JSON(data[5u]["format"], String, "seconds");
+            EXPECT_TRUE(data[5u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[6u].isObject());
+            EXPECT_EQ_JSON(data[6u]["key"], String, "key with milliseconds");
+            EXPECT_TRUE(data[6u]["label"].isNull());
+            EXPECT_EQ_JSON(data[6u]["format"], String, "milliseconds");
+            EXPECT_TRUE(data[6u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[7u].isObject());
+            EXPECT_EQ_JSON(data[7u]["key"], String, "key with microseconds");
+            EXPECT_TRUE(data[7u]["label"].isNull());
+            EXPECT_EQ_JSON(data[7u]["format"], String, "microseconds");
+            EXPECT_TRUE(data[7u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[8u].isObject());
+            EXPECT_EQ_JSON(data[8u]["key"], String, "key with nanoseconds");
+            EXPECT_TRUE(data[8u]["label"].isNull());
+            EXPECT_EQ_JSON(data[8u]["format"], String, "nanoseconds");
+            EXPECT_TRUE(data[8u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[9u].isObject());
+            EXPECT_EQ_JSON(data[9u]["key"], String, "key with bytes");
+            EXPECT_TRUE(data[9u]["label"].isNull());
+            EXPECT_EQ_JSON(data[9u]["format"], String, "bytes");
+            EXPECT_TRUE(data[9u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[10u].isObject());
+            EXPECT_EQ_JSON(data[10u]["key"], String, "key with percentage");
+            EXPECT_TRUE(data[10u]["label"].isNull());
+            EXPECT_EQ_JSON(data[10u]["format"], String, "percentage");
+            EXPECT_TRUE(data[10u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[11u].isObject());
+            EXPECT_EQ_JSON(data[11u]["key"], String, "key with integer");
+            EXPECT_TRUE(data[11u]["label"].isNull());
+            EXPECT_EQ_JSON(data[11u]["format"], String, "integer");
+            EXPECT_TRUE(data[11u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[12u].isObject());
+            EXPECT_EQ_JSON(data[12u]["key"], String, "key with decimal");
+            EXPECT_TRUE(data[12u]["label"].isNull());
+            EXPECT_EQ_JSON(data[12u]["format"], String, "decimal");
+            EXPECT_TRUE(data[12u]["searchable"].isNull());
+
+            ASSERT_TRUE(data[13u].isObject());
+            EXPECT_EQ_JSON(data[13u]["label"], String, "static label");
+            EXPECT_EQ_JSON(data[13u]["value"], String, "static value");
+
+          } else if (nameString == "markers-gtest-special") {
+            EXPECT_EQ(display.size(), 0u);
+            ASSERT_EQ(data.size(), 0u);
+
+          } else if (nameString == "markers-gtest-unused") {
+            ADD_FAILURE() << "Schema for GtestUnusedMarker should not be here";
+
+          } else {
+            printf("FYI: Unknown marker schema '%s'\n", nameString.c_str());
+          }
+        }
+
+        // Check that we've got all expected schema.
+        EXPECT_TRUE(testedSchemaNames.find("Text") != testedSchemaNames.end());
+        EXPECT_TRUE(testedSchemaNames.find("tracing") !=
+                    testedSchemaNames.end());
+        EXPECT_TRUE(testedSchemaNames.find("MediaSample") !=
+                    testedSchemaNames.end());
+      }  // markerSchema
+    }    // meta
+  });
+
+  Maybe<ProfilerBufferInfo> info = profiler_get_buffer_info();
+  MOZ_RELEASE_ASSERT(info.isSome());
+  printf("Profiler buffer range: %llu .. %llu (%llu bytes)\n",
+         static_cast<unsigned long long>(info->mRangeStart),
+         static_cast<unsigned long long>(info->mRangeEnd),
+         // sizeof(ProfileBufferEntry) == 9
+         (static_cast<unsigned long long>(info->mRangeEnd) -
+          static_cast<unsigned long long>(info->mRangeStart)) *
+             9);
+  printf("Stats:         min(us) .. mean(us) .. max(us)  [count]\n");
+  printf("- Intervals:   %7.1f .. %7.1f  .. %7.1f  [%u]\n",
+         info->mIntervalsUs.min, info->mIntervalsUs.sum / info->mIntervalsUs.n,
+         info->mIntervalsUs.max, info->mIntervalsUs.n);
+  printf("- Overheads:   %7.1f .. %7.1f  .. %7.1f  [%u]\n",
+         info->mOverheadsUs.min, info->mOverheadsUs.sum / info->mOverheadsUs.n,
+         info->mOverheadsUs.max, info->mOverheadsUs.n);
+  printf("  - Locking:   %7.1f .. %7.1f  .. %7.1f  [%u]\n",
+         info->mLockingsUs.min, info->mLockingsUs.sum / info->mLockingsUs.n,
+         info->mLockingsUs.max, info->mLockingsUs.n);
+  printf("  - Clearning: %7.1f .. %7.1f  .. %7.1f  [%u]\n",
+         info->mCleaningsUs.min, info->mCleaningsUs.sum / info->mCleaningsUs.n,
+         info->mCleaningsUs.max, info->mCleaningsUs.n);
+  printf("  - Counters:  %7.1f .. %7.1f  .. %7.1f  [%u]\n",
+         info->mCountersUs.min, info->mCountersUs.sum / info->mCountersUs.n,
+         info->mCountersUs.max, info->mCountersUs.n);
+  printf("  - Threads:   %7.1f .. %7.1f  .. %7.1f  [%u]\n",
+         info->mThreadsUs.min, info->mThreadsUs.sum / info->mThreadsUs.n,
+         info->mThreadsUs.max, info->mThreadsUs.n);
+
+  profiler_stop();
+
+  // Try to add markers while the profiler is stopped.
+  PROFILER_MARKER_UNTYPED("marker after profiler_stop", OTHER);
+
+  // Warning: this could be racy
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+  // This last marker shouldn't get streamed.
+  SpliceableChunkedJSONWriter w2;
+  w2.Start();
+  EXPECT_TRUE(::profiler_stream_json_for_this_process(w2));
+  w2.End();
+  UniquePtr<char[]> profile2 = w.ChunkedWriteFunc().CopyData();
+  ASSERT_TRUE(!!profile2.get());
+  EXPECT_TRUE(
+      std::string_view(profile2.get()).find("marker after profiler_stop") ==
+      std::string_view::npos);
+
+  profiler_stop();
+}
+
+#define COUNTER_NAME "TestCounter"
+#define COUNTER_DESCRIPTION "Test of counters in profiles"
+#define COUNTER_NAME2 "Counter2"
+#define COUNTER_DESCRIPTION2 "Second Test of counters in profiles"
+
+PROFILER_DEFINE_COUNT_TOTAL(TestCounter, COUNTER_NAME, COUNTER_DESCRIPTION);
+PROFILER_DEFINE_COUNT_TOTAL(TestCounter2, COUNTER_NAME2, COUNTER_DESCRIPTION2);
+
+TEST(GeckoProfiler, Counters)
+{
+  uint32_t features = ProfilerFeature::Threads;
+  const char* filters[] = {"GeckoMain", "Compositor"};
+
+  // Inactive -> Active
+  profiler_ensure_started(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                          features, filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+  AUTO_PROFILER_COUNT_TOTAL(TestCounter, 10);
+  PR_Sleep(PR_MillisecondsToInterval(200));
+  AUTO_PROFILER_COUNT_TOTAL(TestCounter, 7);
+  PR_Sleep(PR_MillisecondsToInterval(200));
+  AUTO_PROFILER_COUNT_TOTAL(TestCounter, -17);
+  PR_Sleep(PR_MillisecondsToInterval(200));
+
+  // Verify we got counters in the output
+  SpliceableChunkedJSONWriter w;
+  ASSERT_TRUE(::profiler_stream_json_for_this_process(w));
+
+  UniquePtr<char[]> profile = w.ChunkedWriteFunc().CopyData();
+
+  // counter name and description should appear as is.
+  ASSERT_TRUE(strstr(profile.get(), COUNTER_NAME));
+  ASSERT_TRUE(strstr(profile.get(), COUNTER_DESCRIPTION));
+  ASSERT_FALSE(strstr(profile.get(), COUNTER_NAME2));
+  ASSERT_FALSE(strstr(profile.get(), COUNTER_DESCRIPTION2));
+
+  AUTO_PROFILER_COUNT_TOTAL(TestCounter2, 10);
+  PR_Sleep(PR_MillisecondsToInterval(200));
+
+  ASSERT_TRUE(::profiler_stream_json_for_this_process(w));
+
+  profile = w.ChunkedWriteFunc().CopyData();
+  ASSERT_TRUE(strstr(profile.get(), COUNTER_NAME));
+  ASSERT_TRUE(strstr(profile.get(), COUNTER_DESCRIPTION));
+  ASSERT_TRUE(strstr(profile.get(), COUNTER_NAME2));
+  ASSERT_TRUE(strstr(profile.get(), COUNTER_DESCRIPTION2));
+
+  profiler_stop();
+}
+
+TEST(GeckoProfiler, Time)
+{
+  uint32_t features = ProfilerFeature::StackWalk;
+  const char* filters[] = {"GeckoMain"};
+
+  double t1 = profiler_time();
+  double t2 = profiler_time();
+  ASSERT_TRUE(t1 <= t2);
+
+  // profiler_start() restarts the timer used by profiler_time().
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+  double t3 = profiler_time();
+  double t4 = profiler_time();
+  ASSERT_TRUE(t3 <= t4);
+
+  profiler_stop();
+
+  double t5 = profiler_time();
+  double t6 = profiler_time();
+  ASSERT_TRUE(t4 <= t5 && t1 <= t6);
+}
+
+TEST(GeckoProfiler, GetProfile)
+{
+  uint32_t features = ProfilerFeature::StackWalk;
+  const char* filters[] = {"GeckoMain"};
+
+  ASSERT_TRUE(!profiler_get_profile());
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+  mozilla::Maybe<uint32_t> activeFeatures = profiler_features_if_active();
+  ASSERT_TRUE(activeFeatures.isSome());
+  // Not all platforms support stack-walking.
+  const bool hasStackWalk = ProfilerFeature::HasStackWalk(*activeFeatures);
+  // "threads" may automatically be added when `filters` is not empty.
+  const bool hasThreads = ProfilerFeature::HasThreads(*activeFeatures);
+
+  UniquePtr<char[]> profile = profiler_get_profile();
+  JSONOutputCheck(profile.get(), [&](const Json::Value& aRoot) {
+    GET_JSON(meta, aRoot["meta"], Object);
+    {
+      GET_JSON(configuration, meta["configuration"], Object);
+      {
+        GET_JSON(features, configuration["features"], Array);
+        {
+          EXPECT_EQ(features.size(),
+                    (hasStackWalk ? 1u : 0u) + (hasThreads ? 1u : 0u));
+          if (hasStackWalk) {
+            EXPECT_JSON_ARRAY_CONTAINS(features, String, "stackwalk");
+          }
+          if (hasThreads) {
+            EXPECT_JSON_ARRAY_CONTAINS(features, String, "threads");
+          }
+        }
+        GET_JSON(threads, configuration["threads"], Array);
+        {
+          EXPECT_EQ(threads.size(), 1u);
+          EXPECT_JSON_ARRAY_CONTAINS(threads, String, "GeckoMain");
+        }
+      }
+    }
+  });
+
+  profiler_stop();
+
+  ASSERT_TRUE(!profiler_get_profile());
+}
+
+TEST(GeckoProfiler, StreamJSONForThisProcess)
+{
+  uint32_t features = ProfilerFeature::StackWalk;
+  const char* filters[] = {"GeckoMain"};
+
+  SpliceableChunkedJSONWriter w;
+  ASSERT_TRUE(!::profiler_stream_json_for_this_process(w));
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+  w.Start();
+  ASSERT_TRUE(::profiler_stream_json_for_this_process(w));
+  w.End();
+
+  UniquePtr<char[]> profile = w.ChunkedWriteFunc().CopyData();
+
+  JSONOutputCheck(profile.get(), [](const Json::Value&) {});
+
+  profiler_stop();
+
+  ASSERT_TRUE(!::profiler_stream_json_for_this_process(w));
+}
+
+TEST(GeckoProfiler, StreamJSONForThisProcessThreaded)
+{
+  // Same as the previous test, but calling some things on background threads.
+  nsCOMPtr<nsIThread> thread;
+  nsresult rv = NS_NewNamedThread("GeckoProfGTest", getter_AddRefs(thread));
+  ASSERT_TRUE(NS_SUCCEEDED(rv));
+
+  uint32_t features = ProfilerFeature::StackWalk;
+  const char* filters[] = {"GeckoMain"};
+
+  SpliceableChunkedJSONWriter w;
+  ASSERT_TRUE(!::profiler_stream_json_for_this_process(w));
+
+  // Start the profiler on the main thread.
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+  // Call profiler_stream_json_for_this_process on a background thread.
+  thread->Dispatch(
+      NS_NewRunnableFunction(
+          "GeckoProfiler_StreamJSONForThisProcessThreaded_Test::TestBody",
+          [&]() {
+            w.Start();
+            ASSERT_TRUE(::profiler_stream_json_for_this_process(w));
+            w.End();
+          }),
+      NS_DISPATCH_SYNC);
+
+  UniquePtr<char[]> profile = w.ChunkedWriteFunc().CopyData();
+
+  JSONOutputCheck(profile.get(), [](const Json::Value&) {});
+
+  // Stop the profiler and call profiler_stream_json_for_this_process on a
+  // background thread.
+  thread->Dispatch(
+      NS_NewRunnableFunction(
+          "GeckoProfiler_StreamJSONForThisProcessThreaded_Test::TestBody",
+          [&]() {
+            profiler_stop();
+            ASSERT_TRUE(!::profiler_stream_json_for_this_process(w));
+          }),
+      NS_DISPATCH_SYNC);
+  thread->Shutdown();
+
+  // Call profiler_stream_json_for_this_process on the main thread.
+  ASSERT_TRUE(!::profiler_stream_json_for_this_process(w));
+}
+
+TEST(GeckoProfiler, ProfilingStack)
+{
+  uint32_t features = ProfilerFeature::StackWalk;
+  const char* filters[] = {"GeckoMain"};
+
+  AUTO_PROFILER_LABEL("A::B", OTHER);
+
+  UniqueFreePtr<char> dynamic(strdup("dynamic"));
+  {
+    AUTO_PROFILER_LABEL_DYNAMIC_CSTR("A::C", JS, dynamic.get());
+    AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING("A::C2", JS,
+                                          nsDependentCString(dynamic.get()));
+    AUTO_PROFILER_LABEL_DYNAMIC_LOSSY_NSSTRING(
+        "A::C3", JS, NS_ConvertUTF8toUTF16(dynamic.get()));
+
+    profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                   features, filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+    ASSERT_TRUE(profiler_get_backtrace());
+  }
+
+  AutoProfilerLabel label1("A", nullptr, JS::ProfilingCategoryPair::DOM);
+  AutoProfilerLabel label2("A", dynamic.get(),
+                           JS::ProfilingCategoryPair::NETWORK);
+  ASSERT_TRUE(profiler_get_backtrace());
+
+  profiler_stop();
+
+  ASSERT_TRUE(!profiler_get_profile());
+}
+
+TEST(GeckoProfiler, Bug1355807)
+{
+  uint32_t features = ProfilerFeature::JS;
+  const char* manyThreadsFilter[] = {""};
+  const char* fewThreadsFilter[] = {"GeckoMain"};
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 manyThreadsFilter, MOZ_ARRAY_LENGTH(manyThreadsFilter), 0);
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 fewThreadsFilter, MOZ_ARRAY_LENGTH(fewThreadsFilter), 0);
+
+  // In bug 1355807 this caused an assertion failure in StopJSSampling().
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 fewThreadsFilter, MOZ_ARRAY_LENGTH(fewThreadsFilter), 0);
+
+  profiler_stop();
+}
+
+class GTestStackCollector final : public ProfilerStackCollector {
+ public:
+  GTestStackCollector() : mSetIsMainThread(0), mFrames(0) {}
+
+  virtual void SetIsMainThread() { mSetIsMainThread++; }
+
+  virtual void CollectNativeLeafAddr(void* aAddr) { mFrames++; }
+  virtual void CollectJitReturnAddr(void* aAddr) { mFrames++; }
+  virtual void CollectWasmFrame(const char* aLabel) { mFrames++; }
+  virtual void CollectProfilingStackFrame(
+      const js::ProfilingStackFrame& aFrame) {
+    mFrames++;
+  }
+
+  int mSetIsMainThread;
+  int mFrames;
+};
+
+void DoSuspendAndSample(int aTid, nsIThread* aThread) {
+  aThread->Dispatch(
+      NS_NewRunnableFunction("GeckoProfiler_SuspendAndSample_Test::TestBody",
+                             [&]() {
+                               uint32_t features = ProfilerFeature::Leaf;
+                               GTestStackCollector collector;
+                               profiler_suspend_and_sample_thread(
+                                   aTid, features, collector,
+                                   /* sampleNative = */ true);
+
+                               ASSERT_TRUE(collector.mSetIsMainThread == 1);
+                               ASSERT_TRUE(collector.mFrames > 0);
+                             }),
+      NS_DISPATCH_SYNC);
+}
+
+TEST(GeckoProfiler, SuspendAndSample)
+{
+  nsCOMPtr<nsIThread> thread;
+  nsresult rv = NS_NewNamedThread("GeckoProfGTest", getter_AddRefs(thread));
+  ASSERT_TRUE(NS_SUCCEEDED(rv));
+
+  int tid = profiler_current_thread_id();
+
+  ASSERT_TRUE(!profiler_is_active());
+
+  // Suspend and sample while the profiler is inactive.
+  DoSuspendAndSample(tid, thread);
+
+  uint32_t features = ProfilerFeature::JS | ProfilerFeature::Threads;
+  const char* filters[] = {"GeckoMain", "Compositor"};
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL, features,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+
+  ASSERT_TRUE(profiler_is_active());
+
+  // Suspend and sample while the profiler is active.
+  DoSuspendAndSample(tid, thread);
+
+  profiler_stop();
+
+  ASSERT_TRUE(!profiler_is_active());
+}
+
+// Returns `static_cast<SamplingState>(-1)` if callback could not be installed.
+static SamplingState WaitForSamplingState() {
+  Atomic<int> samplingState{-1};
+
+  if (!profiler_callback_after_sampling([&](SamplingState aSamplingState) {
+        samplingState = static_cast<int>(aSamplingState);
+      })) {
+    return static_cast<SamplingState>(-1);
+  }
+
+  while (samplingState == -1) {
+  }
+
+  return static_cast<SamplingState>(static_cast<int>(samplingState));
+}
+
+TEST(GeckoProfiler, PostSamplingCallback)
+{
+  const char* filters[] = {"GeckoMain"};
+
+  ASSERT_TRUE(!profiler_is_active());
+  ASSERT_TRUE(!profiler_callback_after_sampling(
+      [&](SamplingState) { ASSERT_TRUE(false); }));
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                 ProfilerFeature::StackWalk, filters, MOZ_ARRAY_LENGTH(filters),
+                 0);
+  {
+    // Stack sampling -> This label should appear at least once.
+    AUTO_PROFILER_LABEL("PostSamplingCallback completed", OTHER);
+    ASSERT_EQ(WaitForSamplingState(), SamplingState::SamplingCompleted);
+  }
+  UniquePtr<char[]> profileCompleted = profiler_get_profile();
+  JSONOutputCheck(profileCompleted.get(), [](const Json::Value& aRoot) {
+    GET_JSON(threads, aRoot["threads"], Array);
+    {
+      GET_JSON(thread0, threads[0], Object);
+      {
+        EXPECT_JSON_ARRAY_CONTAINS(thread0["stringTable"], String,
+                                   "PostSamplingCallback completed");
+      }
+    }
+  });
+
+  profiler_pause();
+  {
+    // Paused -> This label should not appear.
+    AUTO_PROFILER_LABEL("PostSamplingCallback paused", OTHER);
+    ASSERT_EQ(WaitForSamplingState(), SamplingState::SamplingPaused);
+  }
+  UniquePtr<char[]> profilePaused = profiler_get_profile();
+  JSONOutputCheck(profilePaused.get(), [](const Json::Value& aRoot) {});
+  // This string shouldn't appear *anywhere* in the profile.
+  ASSERT_FALSE(strstr(profilePaused.get(), "PostSamplingCallback paused"));
+
+  profiler_resume();
+  {
+    // Stack sampling -> This label should appear at least once.
+    AUTO_PROFILER_LABEL("PostSamplingCallback resumed", OTHER);
+    ASSERT_EQ(WaitForSamplingState(), SamplingState::SamplingCompleted);
+  }
+  UniquePtr<char[]> profileResumed = profiler_get_profile();
+  JSONOutputCheck(profileResumed.get(), [](const Json::Value& aRoot) {
+    GET_JSON(threads, aRoot["threads"], Array);
+    {
+      GET_JSON(thread0, threads[0], Object);
+      {
+        EXPECT_JSON_ARRAY_CONTAINS(thread0["stringTable"], String,
+                                   "PostSamplingCallback resumed");
+      }
+    }
+  });
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                 ProfilerFeature::StackWalk | ProfilerFeature::NoStackSampling,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+  {
+    // No stack sampling -> This label should not appear.
+    AUTO_PROFILER_LABEL("PostSamplingCallback completed (no stacks)", OTHER);
+    ASSERT_EQ(WaitForSamplingState(), SamplingState::NoStackSamplingCompleted);
+  }
+  UniquePtr<char[]> profileNoStacks = profiler_get_profile();
+  JSONOutputCheck(profileNoStacks.get(), [](const Json::Value& aRoot) {});
+  // This string shouldn't appear *anywhere* in the profile.
+  ASSERT_FALSE(strstr(profileNoStacks.get(),
+                      "PostSamplingCallback completed (no stacks)"));
+
+  // Note: There is no non-racy way to test for SamplingState::JustStopped, as
+  // it would require coordination between `profiler_stop()` and another thread
+  // doing `profiler_callback_after_sampling()` at just the right moment.
+
+  profiler_stop();
+  ASSERT_TRUE(!profiler_is_active());
+  ASSERT_TRUE(!profiler_callback_after_sampling(
+      [&](SamplingState) { ASSERT_TRUE(false); }));
+}
+
+TEST(GeckoProfiler, BaseProfilerHandOff)
+{
+  const char* filters[] = {"GeckoMain"};
+
+  ASSERT_TRUE(!baseprofiler::profiler_is_active());
+  ASSERT_TRUE(!profiler_is_active());
+
+  // Start the Base Profiler.
+  baseprofiler::profiler_start(
+      PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+      ProfilerFeature::StackWalk, filters, MOZ_ARRAY_LENGTH(filters));
+
+  ASSERT_TRUE(baseprofiler::profiler_is_active());
+  ASSERT_TRUE(!profiler_is_active());
+
+  // Add at least a marker, which should go straight into the buffer.
+  Maybe<baseprofiler::ProfilerBufferInfo> info0 =
+      baseprofiler::profiler_get_buffer_info();
+  BASE_PROFILER_MARKER_UNTYPED("Marker from base profiler", OTHER, {});
+  Maybe<baseprofiler::ProfilerBufferInfo> info1 =
+      baseprofiler::profiler_get_buffer_info();
+  ASSERT_GT(info1->mRangeEnd, info0->mRangeEnd);
+
+  // Start the Gecko Profiler, which should grab the Base Profiler profile and
+  // stop it.
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                 ProfilerFeature::StackWalk, filters, MOZ_ARRAY_LENGTH(filters),
+                 0);
+
+  ASSERT_TRUE(!baseprofiler::profiler_is_active());
+  ASSERT_TRUE(profiler_is_active());
+
+  // Write some Gecko Profiler samples.
+  ASSERT_EQ(WaitForSamplingState(), SamplingState::SamplingCompleted);
+
+  // Check that the Gecko Profiler profile contains at least the Base Profiler
+  // main thread samples.
+  UniquePtr<char[]> profile = profiler_get_profile();
+  JSONOutputCheck(profile.get(), [](const Json::Value& aRoot) {
+    GET_JSON(threads, aRoot["threads"], Array);
+    {
+      bool found = false;
+      for (const Json::Value& thread : threads) {
+        ASSERT_TRUE(thread.isObject());
+        GET_JSON(name, thread["name"], String);
+        if (name.asString() == "GeckoMain (pre-xul)") {
+          found = true;
+          EXPECT_JSON_ARRAY_CONTAINS(thread["stringTable"], String,
+                                     "Marker from base profiler");
+          break;
+        }
+      }
+      EXPECT_TRUE(found);
+    }
+  });
+
+  profiler_stop();
+  ASSERT_TRUE(!profiler_is_active());
+}
+
+TEST(GeckoProfiler, CPUUsage)
+{
+  const char* filters[] = {"GeckoMain"};
+
+  ASSERT_TRUE(!profiler_is_active());
+  ASSERT_TRUE(!profiler_callback_after_sampling(
+      [&](SamplingState) { ASSERT_TRUE(false); }));
+
+  profiler_start(PROFILER_DEFAULT_ENTRIES, PROFILER_DEFAULT_INTERVAL,
+                 ProfilerFeature::StackWalk | ProfilerFeature::CPUUtilization,
+                 filters, MOZ_ARRAY_LENGTH(filters), 0);
+  // Grab a few samples.
+  static constexpr unsigned MinSamplings = 10;
+  for (unsigned i = MinSamplings; i != 0; --i) {
+    ASSERT_EQ(WaitForSamplingState(), SamplingState::SamplingCompleted);
+  }
+  UniquePtr<char[]> profile = profiler_get_profile();
+  JSONOutputCheck(profile.get(), [](const Json::Value& aRoot) {
+    // Check that the "cpu" feature is present.
+    GET_JSON(meta, aRoot["meta"], Object);
+    {
+      GET_JSON(configuration, meta["configuration"], Object);
+      {
+        GET_JSON(features, configuration["features"], Array);
+        { EXPECT_JSON_ARRAY_CONTAINS(features, String, "cpu"); }
+      }
+    }
+
+    {
+      GET_JSON(sampleUnits, meta["sampleUnits"], Object);
+      {
+        EXPECT_EQ_JSON(sampleUnits["time"], String, "ms");
+        EXPECT_EQ_JSON(sampleUnits["eventDelay"], String, "ms");
+#if defined(GP_OS_windows) || defined(GP_OS_darwin) || defined(GP_OS_linux) || \
+    defined(GP_OS_android) || defined(GP_OS_freebsd)
+        // Note: The exact string is not important here.
+        EXPECT_TRUE(sampleUnits["threadCPUDelta"].isString())
+            << "There should be a sampleUnits.threadCPUDelta on this platform";
+#else
+        EXPECT_FALSE(sampleUnits.isMember("threadCPUDelta"))
+            << "Unexpected sampleUnits.threadCPUDelta on this platform";;
+#endif
+      }
+    }
+
+    // Check that the sample schema contains "threadCPUDelta".
+    GET_JSON(threads, aRoot["threads"], Array);
+    {
+      GET_JSON(thread0, threads[0], Object);
+      {
+        GET_JSON(samples, thread0["samples"], Object);
+        {
+          Json::ArrayIndex threadCPUDeltaIndex = 0;
+          GET_JSON(schema, samples["schema"], Object);
+          {
+            GET_JSON(index, schema["threadCPUDelta"], UInt);
+            threadCPUDeltaIndex = index.asUInt();
+          }
+
+          unsigned threadCPUDeltaCount = 0;
+          GET_JSON(data, samples["data"], Array);
+          EXPECT_GE(data.size(), MinSamplings);
+          for (const Json::Value& sample : data) {
+            ASSERT_TRUE(sample.isArray());
+            if (sample.isValidIndex(threadCPUDeltaIndex)) {
+              if (!sample[threadCPUDeltaIndex].isNull()) {
+                EXPECT_TRUE(sample[threadCPUDeltaIndex].isUInt64());
+                ++threadCPUDeltaCount;
+              }
+            }
+          }
+
+#if defined(GP_OS_windows) || defined(GP_OS_darwin) || defined(GP_OS_linux) || \
+    defined(GP_OS_android) || defined(GP_OS_freebsd)
+          EXPECT_GE(threadCPUDeltaCount, data.size() - 1u)
+              << "There should be 'threadCPUDelta' values in all but 1 samples";
+#else
+          // All "threadCPUDelta" data should be absent or null on unsupported
+          // platforms.
+          EXPECT_EQ(threadCPUDeltaCount, 0u);
+#endif
+        }
+      }
+    }
+  });
+
+  // Note: There is no non-racy way to test for SamplingState::JustStopped, as
+  // it would require coordination between `profiler_stop()` and another thread
+  // doing `profiler_callback_after_sampling()` at just the right moment.
+
+  profiler_stop();
+  ASSERT_TRUE(!profiler_is_active());
+  ASSERT_TRUE(!profiler_callback_after_sampling(
+      [&](SamplingState) { ASSERT_TRUE(false); }));
+}
diff --git a/tools/profiler/tests/gtest/LulTest.cpp b/tools/profiler/tests/gtest/LulTest.cpp
new file mode 100644
index 0000000000..94a0b2fd29
--- /dev/null
+++ b/tools/profiler/tests/gtest/LulTest.cpp
@@ -0,0 +1,51 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "gtest/gtest.h"
+#include "mozilla/Atomics.h"
+#include "LulMain.h"
+#include "GeckoProfiler.h"       // for TracingKind
+#include "platform-linux-lul.h"  // for read_procmaps
+
+// Set this to 0 to make LUL be completely silent during tests.
+// Set it to 1 to get logging output from LUL, presumably for
+// the purpose of debugging it.
+#define DEBUG_LUL_TEST 0
+
+// LUL needs a callback for its logging sink.
+static void gtest_logging_sink_for_LulIntegration(const char* str) {
+  if (DEBUG_LUL_TEST == 0) {
+    return;
+  }
+  // Ignore any trailing \n, since LOG will add one anyway.
+  size_t n = strlen(str);
+  if (n > 0 && str[n - 1] == '\n') {
+    char* tmp = strdup(str);
+    tmp[n - 1] = 0;
+    fprintf(stderr, "LUL-in-gtest: %s\n", tmp);
+    free(tmp);
+  } else {
+    fprintf(stderr, "LUL-in-gtest: %s\n", str);
+  }
+}
+
+TEST(LulIntegration, unwind_consistency)
+{
+  // Set up LUL and get it to read unwind info for libxul.so, which is
+  // all we care about here, plus (incidentally) practically every
+  // other object in the process too.
+  lul::LUL* lul = new lul::LUL(gtest_logging_sink_for_LulIntegration);
+  read_procmaps(lul);
+
+  // Run unwind tests and receive information about how many there
+  // were and how many were successful.
+  lul->EnableUnwinding();
+  int nTests = 0, nTestsPassed = 0;
+  RunLulUnitTests(&nTests, &nTestsPassed, lul);
+  EXPECT_TRUE(nTests == 6) << "Unexpected number of tests";
+  EXPECT_TRUE(nTestsPassed == nTests) << "Not all tests passed";
+
+  delete lul;
+}
diff --git a/tools/profiler/tests/gtest/LulTestDwarf.cpp b/tools/profiler/tests/gtest/LulTestDwarf.cpp
new file mode 100644
index 0000000000..b76f524483
--- /dev/null
+++ b/tools/profiler/tests/gtest/LulTestDwarf.cpp
@@ -0,0 +1,2724 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "gtest/gtest.h"
+#include "gmock/gmock.h"
+#include "LulCommonExt.h"
+#include "LulDwarfExt.h"
+#include "LulDwarfInt.h"
+#include "LulTestInfrastructure.h"
+
+using lul_test::CFISection;
+using lul_test::test_assembler::kBigEndian;
+using lul_test::test_assembler::kLittleEndian;
+using lul_test::test_assembler::Label;
+using testing::_;
+using testing::InSequence;
+using testing::Return;
+using testing::Sequence;
+using testing::Test;
+
+#define PERHAPS_WRITE_DEBUG_FRAME_FILE(name, section) /**/
+#define PERHAPS_WRITE_EH_FRAME_FILE(name, section)    /**/
+
+// Set this to 0 to make LUL be completely silent during tests.
+// Set it to 1 to get logging output from LUL, presumably for
+// the purpose of debugging it.
+#define DEBUG_LUL_TEST_DWARF 0
+
+// LUL needs a callback for its logging sink.
+static void gtest_logging_sink_for_LulTestDwarf(const char* str) {
+  if (DEBUG_LUL_TEST_DWARF == 0) {
+    return;
+  }
+  // Ignore any trailing \n, since LOG will add one anyway.
+  size_t n = strlen(str);
+  if (n > 0 && str[n - 1] == '\n') {
+    char* tmp = strdup(str);
+    tmp[n - 1] = 0;
+    fprintf(stderr, "LUL-in-gtest: %s\n", tmp);
+    free(tmp);
+  } else {
+    fprintf(stderr, "LUL-in-gtest: %s\n", str);
+  }
+}
+
+namespace lul {
+
+class MockCallFrameInfoHandler : public CallFrameInfo::Handler {
+ public:
+  MOCK_METHOD6(Entry,
+               bool(size_t offset, uint64 address, uint64 length, uint8 version,
+                    const std::string& augmentation, unsigned return_address));
+  MOCK_METHOD2(UndefinedRule, bool(uint64 address, int reg));
+  MOCK_METHOD2(SameValueRule, bool(uint64 address, int reg));
+  MOCK_METHOD4(OffsetRule,
+               bool(uint64 address, int reg, int base_register, long offset));
+  MOCK_METHOD4(ValOffsetRule,
+               bool(uint64 address, int reg, int base_register, long offset));
+  MOCK_METHOD3(RegisterRule, bool(uint64 address, int reg, int base_register));
+  MOCK_METHOD3(ExpressionRule,
+               bool(uint64 address, int reg, const std::string& expression));
+  MOCK_METHOD3(ValExpressionRule,
+               bool(uint64 address, int reg, const std::string& expression));
+  MOCK_METHOD0(End, bool());
+  MOCK_METHOD2(PersonalityRoutine, bool(uint64 address, bool indirect));
+  MOCK_METHOD2(LanguageSpecificDataArea, bool(uint64 address, bool indirect));
+  MOCK_METHOD0(SignalHandler, bool());
+};
+
+class MockCallFrameErrorReporter : public CallFrameInfo::Reporter {
+ public:
+  MockCallFrameErrorReporter()
+      : Reporter(gtest_logging_sink_for_LulTestDwarf, "mock filename",
+                 "mock section") {}
+  MOCK_METHOD2(Incomplete, void(uint64, CallFrameInfo::EntryKind));
+  MOCK_METHOD1(EarlyEHTerminator, void(uint64));
+  MOCK_METHOD2(CIEPointerOutOfRange, void(uint64, uint64));
+  MOCK_METHOD2(BadCIEId, void(uint64, uint64));
+  MOCK_METHOD2(UnrecognizedVersion, void(uint64, int version));
+  MOCK_METHOD2(UnrecognizedAugmentation, void(uint64, const string&));
+  MOCK_METHOD2(InvalidPointerEncoding, void(uint64, uint8));
+  MOCK_METHOD2(UnusablePointerEncoding, void(uint64, uint8));
+  MOCK_METHOD2(RestoreInCIE, void(uint64, uint64));
+  MOCK_METHOD3(BadInstruction, void(uint64, CallFrameInfo::EntryKind, uint64));
+  MOCK_METHOD3(NoCFARule, void(uint64, CallFrameInfo::EntryKind, uint64));
+  MOCK_METHOD3(EmptyStateStack, void(uint64, CallFrameInfo::EntryKind, uint64));
+  MOCK_METHOD3(ClearingCFARule, void(uint64, CallFrameInfo::EntryKind, uint64));
+};
+
+struct CFIFixture {
+  enum { kCFARegister = CallFrameInfo::Handler::kCFARegister };
+
+  CFIFixture() {
+    // Default expectations for the data handler.
+    //
+    // - Leave Entry and End without expectations, as it's probably a
+    //   good idea to set those explicitly in each test.
+    //
+    // - Expect the *Rule functions to not be called,
+    //   so that each test can simply list the calls they expect.
+    //
+    // I gather I could use StrictMock for this, but the manual seems
+    // to suggest using that only as a last resort, and this isn't so
+    // bad.
+    EXPECT_CALL(handler, UndefinedRule(_, _)).Times(0);
+    EXPECT_CALL(handler, SameValueRule(_, _)).Times(0);
+    EXPECT_CALL(handler, OffsetRule(_, _, _, _)).Times(0);
+    EXPECT_CALL(handler, ValOffsetRule(_, _, _, _)).Times(0);
+    EXPECT_CALL(handler, RegisterRule(_, _, _)).Times(0);
+    EXPECT_CALL(handler, ExpressionRule(_, _, _)).Times(0);
+    EXPECT_CALL(handler, ValExpressionRule(_, _, _)).Times(0);
+    EXPECT_CALL(handler, PersonalityRoutine(_, _)).Times(0);
+    EXPECT_CALL(handler, LanguageSpecificDataArea(_, _)).Times(0);
+    EXPECT_CALL(handler, SignalHandler()).Times(0);
+
+    // Default expectations for the error/warning reporer.
+    EXPECT_CALL(reporter, Incomplete(_, _)).Times(0);
+    EXPECT_CALL(reporter, EarlyEHTerminator(_)).Times(0);
+    EXPECT_CALL(reporter, CIEPointerOutOfRange(_, _)).Times(0);
+    EXPECT_CALL(reporter, BadCIEId(_, _)).Times(0);
+    EXPECT_CALL(reporter, UnrecognizedVersion(_, _)).Times(0);
+    EXPECT_CALL(reporter, UnrecognizedAugmentation(_, _)).Times(0);
+    EXPECT_CALL(reporter, InvalidPointerEncoding(_, _)).Times(0);
+    EXPECT_CALL(reporter, UnusablePointerEncoding(_, _)).Times(0);
+    EXPECT_CALL(reporter, RestoreInCIE(_, _)).Times(0);
+    EXPECT_CALL(reporter, BadInstruction(_, _, _)).Times(0);
+    EXPECT_CALL(reporter, NoCFARule(_, _, _)).Times(0);
+    EXPECT_CALL(reporter, EmptyStateStack(_, _, _)).Times(0);
+    EXPECT_CALL(reporter, ClearingCFARule(_, _, _)).Times(0);
+  }
+
+  MockCallFrameInfoHandler handler;
+  MockCallFrameErrorReporter reporter;
+};
+
+class LulDwarfCFI : public CFIFixture, public Test {};
+
+TEST_F(LulDwarfCFI, EmptyRegion) {
+  EXPECT_CALL(handler, Entry(_, _, _, _, _, _)).Times(0);
+  EXPECT_CALL(handler, End()).Times(0);
+  static const char data[1] = {42};
+
+  ByteReader reader(ENDIANNESS_BIG);
+  CallFrameInfo parser(data, 0, &reader, &handler, &reporter);
+  EXPECT_TRUE(parser.Start());
+}
+
+TEST_F(LulDwarfCFI, IncompleteLength32) {
+  CFISection section(kBigEndian, 8);
+  section
+      // Not even long enough for an initial length.
+      .D16(0xa0f)
+      // Padding to keep valgrind happy. We subtract these off when we
+      // construct the parser.
+      .D16(0);
+
+  EXPECT_CALL(handler, Entry(_, _, _, _, _, _)).Times(0);
+  EXPECT_CALL(handler, End()).Times(0);
+
+  EXPECT_CALL(reporter, Incomplete(_, CallFrameInfo::kUnknown))
+      .WillOnce(Return());
+
+  string contents;
+  ASSERT_TRUE(section.GetContents(&contents));
+
+  ByteReader reader(ENDIANNESS_BIG);
+  reader.SetAddressSize(8);
+  CallFrameInfo parser(contents.data(), contents.size() - 2, &reader, &handler,
+                       &reporter);
+  EXPECT_FALSE(parser.Start());
+}
+
+TEST_F(LulDwarfCFI, IncompleteLength64) {
+  CFISection section(kLittleEndian, 4);
+  section
+      // An incomplete 64-bit DWARF initial length.
+      .D32(0xffffffff)
+      .D32(0x71fbaec2)
+      // Padding to keep valgrind happy. We subtract these off when we
+      // construct the parser.
+      .D32(0);
+
+  EXPECT_CALL(handler, Entry(_, _, _, _, _, _)).Times(0);
+  EXPECT_CALL(handler, End()).Times(0);
+
+  EXPECT_CALL(reporter, Incomplete(_, CallFrameInfo::kUnknown))
+      .WillOnce(Return());
+
+  string contents;
+  ASSERT_TRUE(section.GetContents(&contents));
+
+  ByteReader reader(ENDIANNESS_LITTLE);
+  reader.SetAddressSize(4);
+  CallFrameInfo parser(contents.data(), contents.size() - 4, &reader, &handler,
+                       &reporter);
+  EXPECT_FALSE(parser.Start());
+}
+
+TEST_F(LulDwarfCFI, IncompleteId32) {
+  CFISection section(kBigEndian, 8);
+  section
+      .D32(3)  // Initial length, not long enough for id
+      .D8(0xd7)
+      .D8(0xe5)
+      .D8(0xf1)  // incomplete id
+      .CIEHeader(8727, 3983, 8889, 3, "")
+      .FinishEntry();
+
+  EXPECT_CALL(handler, Entry(_, _, _, _, _, _)).Times(0);
+  EXPECT_CALL(handler, End()).Times(0);
+
+  EXPECT_CALL(reporter, Incomplete(_, CallFrameInfo::kUnknown))
+      .WillOnce(Return());
+
+  string contents;
+  ASSERT_TRUE(section.GetContents(&contents));
+
+  ByteReader reader(ENDIANNESS_BIG);
+  reader.SetAddressSize(8);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_FALSE(parser.Start());
+}
+
+TEST_F(LulDwarfCFI, BadId32) {
+  CFISection section(kBigEndian, 8);
+  section
+      .D32(0x100)                // Initial length
+      .D32(0xe802fade)           // bogus ID
+      .Append(0x100 - 4, 0x42);  // make the length true
+  section.CIEHeader(1672, 9872, 8529, 3, "").FinishEntry();
+
+  EXPECT_CALL(handler, Entry(_, _, _, _, _, _)).Times(0);
+  EXPECT_CALL(handler, End()).Times(0);
+
+  EXPECT_CALL(reporter, CIEPointerOutOfRange(_, 0xe802fade)).WillOnce(Return());
+
+  string contents;
+  ASSERT_TRUE(section.GetContents(&contents));
+
+  ByteReader reader(ENDIANNESS_BIG);
+  reader.SetAddressSize(8);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_FALSE(parser.Start());
+}
+
+// A lone CIE shouldn't cause any handler calls.
+TEST_F(LulDwarfCFI, SingleCIE) {
+  CFISection section(kLittleEndian, 4);
+  section.CIEHeader(0xffe799a8, 0x3398dcdd, 0x6e9683de, 3, "");
+  section.Append(10, lul::DW_CFA_nop);
+  section.FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("SingleCIE", section);
+
+  EXPECT_CALL(handler, Entry(_, _, _, _, _, _)).Times(0);
+  EXPECT_CALL(handler, End()).Times(0);
+
+  string contents;
+  EXPECT_TRUE(section.GetContents(&contents));
+  ByteReader reader(ENDIANNESS_LITTLE);
+  reader.SetAddressSize(4);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_TRUE(parser.Start());
+}
+
+// One FDE, one CIE.
+TEST_F(LulDwarfCFI, OneFDE) {
+  CFISection section(kBigEndian, 4);
+  Label cie;
+  section.Mark(&cie)
+      .CIEHeader(0x4be22f75, 0x2492236e, 0x6b6efb87, 3, "")
+      .FinishEntry()
+      .FDEHeader(cie, 0x7714740d, 0x3d5a10cd)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("OneFDE", section);
+
+  {
+    InSequence s;
+    EXPECT_CALL(handler, Entry(_, 0x7714740d, 0x3d5a10cd, 3, "", 0x6b6efb87))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  string contents;
+  EXPECT_TRUE(section.GetContents(&contents));
+  ByteReader reader(ENDIANNESS_BIG);
+  reader.SetAddressSize(4);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_TRUE(parser.Start());
+}
+
+// Two FDEs share a CIE.
+TEST_F(LulDwarfCFI, TwoFDEsOneCIE) {
+  CFISection section(kBigEndian, 4);
+  Label cie;
+  section
+      // First FDE. readelf complains about this one because it makes
+      // a forward reference to its CIE.
+      .FDEHeader(cie, 0xa42744df, 0xa3b42121)
+      .FinishEntry()
+      // CIE.
+      .Mark(&cie)
+      .CIEHeader(0x04f7dc7b, 0x3d00c05f, 0xbd43cb59, 3, "")
+      .FinishEntry()
+      // Second FDE.
+      .FDEHeader(cie, 0x6057d391, 0x700f608d)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("TwoFDEsOneCIE", section);
+
+  {
+    InSequence s;
+    EXPECT_CALL(handler, Entry(_, 0xa42744df, 0xa3b42121, 3, "", 0xbd43cb59))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+  {
+    InSequence s;
+    EXPECT_CALL(handler, Entry(_, 0x6057d391, 0x700f608d, 3, "", 0xbd43cb59))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  string contents;
+  EXPECT_TRUE(section.GetContents(&contents));
+  ByteReader reader(ENDIANNESS_BIG);
+  reader.SetAddressSize(4);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_TRUE(parser.Start());
+}
+
+// Two FDEs, two CIEs.
+TEST_F(LulDwarfCFI, TwoFDEsTwoCIEs) {
+  CFISection section(kLittleEndian, 8);
+  Label cie1, cie2;
+  section
+      // First CIE.
+      .Mark(&cie1)
+      .CIEHeader(0x694d5d45, 0x4233221b, 0xbf45e65a, 3, "")
+      .FinishEntry()
+      // First FDE which cites second CIE. readelf complains about
+      // this one because it makes a forward reference to its CIE.
+      .FDEHeader(cie2, 0x778b27dfe5871f05ULL, 0x324ace3448070926ULL)
+      .FinishEntry()
+      // Second FDE, which cites first CIE.
+      .FDEHeader(cie1, 0xf6054ca18b10bf5fULL, 0x45fdb970d8bca342ULL)
+      .FinishEntry()
+      // Second CIE.
+      .Mark(&cie2)
+      .CIEHeader(0xfba3fad7, 0x6287e1fd, 0x61d2c581, 2, "")
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("TwoFDEsTwoCIEs", section);
+
+  {
+    InSequence s;
+    EXPECT_CALL(handler, Entry(_, 0x778b27dfe5871f05ULL, 0x324ace3448070926ULL,
+                               2, "", 0x61d2c581))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+  {
+    InSequence s;
+    EXPECT_CALL(handler, Entry(_, 0xf6054ca18b10bf5fULL, 0x45fdb970d8bca342ULL,
+                               3, "", 0xbf45e65a))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  string contents;
+  EXPECT_TRUE(section.GetContents(&contents));
+  ByteReader reader(ENDIANNESS_LITTLE);
+  reader.SetAddressSize(8);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_TRUE(parser.Start());
+}
+
+// An FDE whose CIE specifies a version we don't recognize.
+TEST_F(LulDwarfCFI, BadVersion) {
+  CFISection section(kBigEndian, 4);
+  Label cie1, cie2;
+  section.Mark(&cie1)
+      .CIEHeader(0xca878cf0, 0x7698ec04, 0x7b616f54, 0x52, "")
+      .FinishEntry()
+      // We should skip this entry, as its CIE specifies a version we
+      // don't recognize.
+      .FDEHeader(cie1, 0x08852292, 0x2204004a)
+      .FinishEntry()
+      // Despite the above, we should visit this entry.
+      .Mark(&cie2)
+      .CIEHeader(0x7c3ae7c9, 0xb9b9a512, 0x96cb3264, 3, "")
+      .FinishEntry()
+      .FDEHeader(cie2, 0x2094735a, 0x6e875501)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("BadVersion", section);
+
+  EXPECT_CALL(reporter, UnrecognizedVersion(_, 0x52)).WillOnce(Return());
+
+  {
+    InSequence s;
+    // We should see no mention of the first FDE, but we should get
+    // a call to Entry for the second.
+    EXPECT_CALL(handler, Entry(_, 0x2094735a, 0x6e875501, 3, "", 0x96cb3264))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  string contents;
+  EXPECT_TRUE(section.GetContents(&contents));
+  ByteReader reader(ENDIANNESS_BIG);
+  reader.SetAddressSize(4);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_FALSE(parser.Start());
+}
+
+// An FDE whose CIE specifies an augmentation we don't recognize.
+TEST_F(LulDwarfCFI, BadAugmentation) {
+  CFISection section(kBigEndian, 4);
+  Label cie1, cie2;
+  section.Mark(&cie1)
+      .CIEHeader(0x4be22f75, 0x2492236e, 0x6b6efb87, 3, "spaniels!")
+      .FinishEntry()
+      // We should skip this entry, as its CIE specifies an
+      // augmentation we don't recognize.
+      .FDEHeader(cie1, 0x7714740d, 0x3d5a10cd)
+      .FinishEntry()
+      // Despite the above, we should visit this entry.
+      .Mark(&cie2)
+      .CIEHeader(0xf8bc4399, 0x8cf09931, 0xf2f519b2, 3, "")
+      .FinishEntry()
+      .FDEHeader(cie2, 0x7bf0fda0, 0xcbcd28d8)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("BadAugmentation", section);
+
+  EXPECT_CALL(reporter, UnrecognizedAugmentation(_, "spaniels!"))
+      .WillOnce(Return());
+
+  {
+    InSequence s;
+    // We should see no mention of the first FDE, but we should get
+    // a call to Entry for the second.
+    EXPECT_CALL(handler, Entry(_, 0x7bf0fda0, 0xcbcd28d8, 3, "", 0xf2f519b2))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  string contents;
+  EXPECT_TRUE(section.GetContents(&contents));
+  ByteReader reader(ENDIANNESS_BIG);
+  reader.SetAddressSize(4);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_FALSE(parser.Start());
+}
+
+// The return address column field is a byte in CFI version 1
+// (DWARF2), but a ULEB128 value in version 3 (DWARF3).
+TEST_F(LulDwarfCFI, CIEVersion1ReturnColumn) {
+  CFISection section(kBigEndian, 4);
+  Label cie;
+  section
+      // CIE, using the version 1 format: return column is a ubyte.
+      .Mark(&cie)
+      // Use a value for the return column that is parsed differently
+      // as a ubyte and as a ULEB128.
+      .CIEHeader(0xbcdea24f, 0x5be28286, 0x9f, 1, "")
+      .FinishEntry()
+      // FDE, citing that CIE.
+      .FDEHeader(cie, 0xb8d347b5, 0x825e55dc)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("CIEVersion1ReturnColumn", section);
+
+  {
+    InSequence s;
+    EXPECT_CALL(handler, Entry(_, 0xb8d347b5, 0x825e55dc, 1, "", 0x9f))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  string contents;
+  EXPECT_TRUE(section.GetContents(&contents));
+  ByteReader reader(ENDIANNESS_BIG);
+  reader.SetAddressSize(4);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_TRUE(parser.Start());
+}
+
+// The return address column field is a byte in CFI version 1
+// (DWARF2), but a ULEB128 value in version 3 (DWARF3).
+TEST_F(LulDwarfCFI, CIEVersion3ReturnColumn) {
+  CFISection section(kBigEndian, 4);
+  Label cie;
+  section
+      // CIE, using the version 3 format: return column is a ULEB128.
+      .Mark(&cie)
+      // Use a value for the return column that is parsed differently
+      // as a ubyte and as a ULEB128.
+      .CIEHeader(0x0ab4758d, 0xc010fdf7, 0x89, 3, "")
+      .FinishEntry()
+      // FDE, citing that CIE.
+      .FDEHeader(cie, 0x86763f2b, 0x2a66dc23)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("CIEVersion3ReturnColumn", section);
+
+  {
+    InSequence s;
+    EXPECT_CALL(handler, Entry(_, 0x86763f2b, 0x2a66dc23, 3, "", 0x89))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  string contents;
+  EXPECT_TRUE(section.GetContents(&contents));
+  ByteReader reader(ENDIANNESS_BIG);
+  reader.SetAddressSize(4);
+  CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                       &reporter);
+  EXPECT_TRUE(parser.Start());
+}
+
+struct CFIInsnFixture : public CFIFixture {
+  CFIInsnFixture() : CFIFixture() {
+    data_factor = 0xb6f;
+    return_register = 0x9be1ed9f;
+    version = 3;
+    cfa_base_register = 0x383a3aa;
+    cfa_offset = 0xf748;
+  }
+
+  // Prepare SECTION to receive FDE instructions.
+  //
+  // - Append a stock CIE header that establishes the fixture's
+  //   code_factor, data_factor, return_register, version, and
+  //   augmentation values.
+  // - Have the CIE set up a CFA rule using cfa_base_register and
+  //   cfa_offset.
+  // - Append a stock FDE header, referring to the above CIE, for the
+  //   fde_size bytes at fde_start. Choose fde_start and fde_size
+  //   appropriately for the section's address size.
+  // - Set appropriate expectations on handler in sequence s for the
+  //   frame description entry and the CIE's CFA rule.
+  //
+  // On return, SECTION is ready to have FDE instructions appended to
+  // it, and its FinishEntry member called.
+  void StockCIEAndFDE(CFISection* section) {
+    // Choose appropriate constants for our address size.
+    if (section->AddressSize() == 4) {
+      fde_start = 0xc628ecfbU;
+      fde_size = 0x5dee04a2;
+      code_factor = 0x60b;
+    } else {
+      assert(section->AddressSize() == 8);
+      fde_start = 0x0005c57ce7806bd3ULL;
+      fde_size = 0x2699521b5e333100ULL;
+      code_factor = 0x01008e32855274a8ULL;
+    }
+
+    // Create the CIE.
+    (*section)
+        .Mark(&cie_label)
+        .CIEHeader(code_factor, data_factor, return_register, version, "")
+        .D8(lul::DW_CFA_def_cfa)
+        .ULEB128(cfa_base_register)
+        .ULEB128(cfa_offset)
+        .FinishEntry();
+
+    // Create the FDE.
+    section->FDEHeader(cie_label, fde_start, fde_size);
+
+    // Expect an Entry call for the FDE and a ValOffsetRule call for the
+    // CIE's CFA rule.
+    EXPECT_CALL(handler,
+                Entry(_, fde_start, fde_size, version, "", return_register))
+        .InSequence(s)
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, ValOffsetRule(fde_start, kCFARegister,
+                                       cfa_base_register, cfa_offset))
+        .InSequence(s)
+        .WillOnce(Return(true));
+  }
+
+  // Run the contents of SECTION through a CallFrameInfo parser,
+  // expecting parser.Start to return SUCCEEDS.  Caller may optionally
+  // supply, via READER, its own ByteReader.  If that's absent, a
+  // local one is used.
+  void ParseSection(CFISection* section, bool succeeds = true,
+                    ByteReader* reader = nullptr) {
+    string contents;
+    EXPECT_TRUE(section->GetContents(&contents));
+    lul::Endianness endianness;
+    if (section->endianness() == kBigEndian)
+      endianness = ENDIANNESS_BIG;
+    else {
+      assert(section->endianness() == kLittleEndian);
+      endianness = ENDIANNESS_LITTLE;
+    }
+    ByteReader local_reader(endianness);
+    ByteReader* reader_to_use = reader ? reader : &local_reader;
+    reader_to_use->SetAddressSize(section->AddressSize());
+    CallFrameInfo parser(contents.data(), contents.size(), reader_to_use,
+                         &handler, &reporter);
+    if (succeeds)
+      EXPECT_TRUE(parser.Start());
+    else
+      EXPECT_FALSE(parser.Start());
+  }
+
+  Label cie_label;
+  Sequence s;
+  uint64 code_factor;
+  int data_factor;
+  unsigned return_register;
+  unsigned version;
+  unsigned cfa_base_register;
+  int cfa_offset;
+  uint64 fde_start, fde_size;
+};
+
+class LulDwarfCFIInsn : public CFIInsnFixture, public Test {};
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_set_loc) {
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_set_loc)
+      .D32(0xb1ee3e7a)
+      // Use DW_CFA_def_cfa to force a handler call that we can use to
+      // check the effect of the DW_CFA_set_loc.
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x4defb431)
+      .ULEB128(0x6d17b0ee)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("DW_CFA_set_loc", section);
+
+  EXPECT_CALL(handler,
+              ValOffsetRule(0xb1ee3e7a, kCFARegister, 0x4defb431, 0x6d17b0ee))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_advance_loc) {
+  CFISection section(kBigEndian, 8);
+  StockCIEAndFDE(&section);
+  section
+      .D8(lul::DW_CFA_advance_loc | 0x2a)
+      // Use DW_CFA_def_cfa to force a handler call that we can use to
+      // check the effect of the DW_CFA_advance_loc.
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x5bbb3715)
+      .ULEB128(0x0186c7bf)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("DW_CFA_advance_loc", section);
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start + 0x2a * code_factor,
+                                     kCFARegister, 0x5bbb3715, 0x0186c7bf))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_advance_loc1) {
+  CFISection section(kLittleEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_advance_loc1)
+      .D8(0xd8)
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x69d5696a)
+      .ULEB128(0x1eb7fc93)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("DW_CFA_advance_loc1", section);
+
+  EXPECT_CALL(handler, ValOffsetRule((fde_start + 0xd8 * code_factor),
+                                     kCFARegister, 0x69d5696a, 0x1eb7fc93))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_advance_loc2) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_advance_loc2)
+      .D16(0x3adb)
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x3a368bed)
+      .ULEB128(0x3194ee37)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("DW_CFA_advance_loc2", section);
+
+  EXPECT_CALL(handler, ValOffsetRule((fde_start + 0x3adb * code_factor),
+                                     kCFARegister, 0x3a368bed, 0x3194ee37))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_advance_loc4) {
+  CFISection section(kBigEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_advance_loc4)
+      .D32(0x15813c88)
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x135270c5)
+      .ULEB128(0x24bad7cb)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("DW_CFA_advance_loc4", section);
+
+  EXPECT_CALL(handler, ValOffsetRule((fde_start + 0x15813c88ULL * code_factor),
+                                     kCFARegister, 0x135270c5, 0x24bad7cb))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_MIPS_advance_loc8) {
+  code_factor = 0x2d;
+  CFISection section(kBigEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_MIPS_advance_loc8)
+      .D64(0x3c4f3945b92c14ULL)
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0xe17ed602)
+      .ULEB128(0x3d162e7f)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("DW_CFA_advance_loc8", section);
+
+  EXPECT_CALL(handler,
+              ValOffsetRule((fde_start + 0x3c4f3945b92c14ULL * code_factor),
+                            kCFARegister, 0xe17ed602, 0x3d162e7f))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_def_cfa) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x4e363a85)
+      .ULEB128(0x815f9aa7)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("DW_CFA_def_cfa", section);
+
+  EXPECT_CALL(handler,
+              ValOffsetRule(fde_start, kCFARegister, 0x4e363a85, 0x815f9aa7))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_def_cfa_sf) {
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_def_cfa_sf)
+      .ULEB128(0x8ccb32b7)
+      .LEB128(0x9ea)
+      .D8(lul::DW_CFA_def_cfa_sf)
+      .ULEB128(0x9b40f5da)
+      .LEB128(-0x40a2)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, kCFARegister, 0x8ccb32b7,
+                                     0x9ea * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, kCFARegister, 0x9b40f5da,
+                                     -0x40a2 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_def_cfa_register) {
+  CFISection section(kLittleEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_def_cfa_register).ULEB128(0x3e7e9363).FinishEntry();
+
+  EXPECT_CALL(handler,
+              ValOffsetRule(fde_start, kCFARegister, 0x3e7e9363, cfa_offset))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+// DW_CFA_def_cfa_register should have no effect when applied to a
+// non-base/offset rule.
+TEST_F(LulDwarfCFIInsn, DW_CFA_def_cfa_registerBadRule) {
+  ByteReader reader(ENDIANNESS_BIG);
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_def_cfa_expression)
+      .Block("needle in a haystack")
+      .D8(lul::DW_CFA_def_cfa_register)
+      .ULEB128(0xf1b49e49)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValExpressionRule(fde_start, kCFARegister,
+                                         "needle in a haystack"))
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_def_cfa_offset) {
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_def_cfa_offset).ULEB128(0x1e8e3b9b).FinishEntry();
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, kCFARegister, cfa_base_register,
+                                     0x1e8e3b9b))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_def_cfa_offset_sf) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_def_cfa_offset_sf)
+      .LEB128(0x970)
+      .D8(lul::DW_CFA_def_cfa_offset_sf)
+      .LEB128(-0x2cd)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, kCFARegister, cfa_base_register,
+                                     0x970 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, kCFARegister, cfa_base_register,
+                                     -0x2cd * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+// DW_CFA_def_cfa_offset should have no effect when applied to a
+// non-base/offset rule.
+TEST_F(LulDwarfCFIInsn, DW_CFA_def_cfa_offsetBadRule) {
+  ByteReader reader(ENDIANNESS_BIG);
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_def_cfa_expression)
+      .Block("six ways to Sunday")
+      .D8(lul::DW_CFA_def_cfa_offset)
+      .ULEB128(0x1e8e3b9b)
+      .FinishEntry();
+
+  EXPECT_CALL(handler,
+              ValExpressionRule(fde_start, kCFARegister, "six ways to Sunday"))
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_def_cfa_expression) {
+  ByteReader reader(ENDIANNESS_LITTLE);
+  CFISection section(kLittleEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_def_cfa_expression).Block("eating crow").FinishEntry();
+
+  EXPECT_CALL(handler,
+              ValExpressionRule(fde_start, kCFARegister, "eating crow"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_undefined) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_undefined).ULEB128(0x300ce45d).FinishEntry();
+
+  EXPECT_CALL(handler, UndefinedRule(fde_start, 0x300ce45d))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_same_value) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_same_value).ULEB128(0x3865a760).FinishEntry();
+
+  EXPECT_CALL(handler, SameValueRule(fde_start, 0x3865a760))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_offset) {
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_offset | 0x2c).ULEB128(0x9f6).FinishEntry();
+
+  EXPECT_CALL(handler,
+              OffsetRule(fde_start, 0x2c, kCFARegister, 0x9f6 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_offset_extended) {
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_offset_extended)
+      .ULEB128(0x402b)
+      .ULEB128(0xb48)
+      .FinishEntry();
+
+  EXPECT_CALL(handler,
+              OffsetRule(fde_start, 0x402b, kCFARegister, 0xb48 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_offset_extended_sf) {
+  CFISection section(kBigEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_offset_extended_sf)
+      .ULEB128(0x997c23ee)
+      .LEB128(0x2d00)
+      .D8(lul::DW_CFA_offset_extended_sf)
+      .ULEB128(0x9519eb82)
+      .LEB128(-0xa77)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, OffsetRule(fde_start, 0x997c23ee, kCFARegister,
+                                  0x2d00 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(fde_start, 0x9519eb82, kCFARegister,
+                                  -0xa77 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_val_offset) {
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_val_offset)
+      .ULEB128(0x623562fe)
+      .ULEB128(0x673)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, 0x623562fe, kCFARegister,
+                                     0x673 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_val_offset_sf) {
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_val_offset_sf)
+      .ULEB128(0x6f4f)
+      .LEB128(0xaab)
+      .D8(lul::DW_CFA_val_offset_sf)
+      .ULEB128(0x2483)
+      .LEB128(-0x8a2)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, 0x6f4f, kCFARegister,
+                                     0xaab * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, 0x2483, kCFARegister,
+                                     -0x8a2 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_register) {
+  CFISection section(kLittleEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_register)
+      .ULEB128(0x278d18f9)
+      .ULEB128(0x1a684414)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, RegisterRule(fde_start, 0x278d18f9, 0x1a684414))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_expression) {
+  ByteReader reader(ENDIANNESS_BIG);
+  CFISection section(kBigEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_expression)
+      .ULEB128(0xa1619fb2)
+      .Block("plus ça change, plus c'est la même chose")
+      .FinishEntry();
+
+  EXPECT_CALL(handler,
+              ExpressionRule(fde_start, 0xa1619fb2,
+                             "plus ça change, plus c'est la même chose"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_val_expression) {
+  ByteReader reader(ENDIANNESS_BIG);
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_val_expression)
+      .ULEB128(0xc5e4a9e3)
+      .Block("he who has the gold makes the rules")
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValExpressionRule(fde_start, 0xc5e4a9e3,
+                                         "he who has the gold makes the rules"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_restore) {
+  CFISection section(kLittleEndian, 8);
+  code_factor = 0x01bd188a9b1fa083ULL;
+  data_factor = -0x1ac8;
+  return_register = 0x8c35b049;
+  version = 2;
+  fde_start = 0x2d70fe998298bbb1ULL;
+  fde_size = 0x46ccc2e63cf0b108ULL;
+  Label cie;
+  section.Mark(&cie)
+      .CIEHeader(code_factor, data_factor, return_register, version, "")
+      // Provide a CFA rule, because register rules require them.
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x6ca1d50e)
+      .ULEB128(0x372e38e8)
+      // Provide an offset(N) rule for register 0x3c.
+      .D8(lul::DW_CFA_offset | 0x3c)
+      .ULEB128(0xb348)
+      .FinishEntry()
+      // In the FDE...
+      .FDEHeader(cie, fde_start, fde_size)
+      // At a second address, provide a new offset(N) rule for register 0x3c.
+      .D8(lul::DW_CFA_advance_loc | 0x13)
+      .D8(lul::DW_CFA_offset | 0x3c)
+      .ULEB128(0x9a50)
+      // At a third address, restore the original rule for register 0x3c.
+      .D8(lul::DW_CFA_advance_loc | 0x01)
+      .D8(lul::DW_CFA_restore | 0x3c)
+      .FinishEntry();
+
+  {
+    InSequence s;
+    EXPECT_CALL(handler,
+                Entry(_, fde_start, fde_size, version, "", return_register))
+        .WillOnce(Return(true));
+    // CIE's CFA rule.
+    EXPECT_CALL(handler,
+                ValOffsetRule(fde_start, kCFARegister, 0x6ca1d50e, 0x372e38e8))
+        .WillOnce(Return(true));
+    // CIE's rule for register 0x3c.
+    EXPECT_CALL(handler,
+                OffsetRule(fde_start, 0x3c, kCFARegister, 0xb348 * data_factor))
+        .WillOnce(Return(true));
+    // FDE's rule for register 0x3c.
+    EXPECT_CALL(handler, OffsetRule(fde_start + 0x13 * code_factor, 0x3c,
+                                    kCFARegister, 0x9a50 * data_factor))
+        .WillOnce(Return(true));
+    // Restore CIE's rule for register 0x3c.
+    EXPECT_CALL(handler, OffsetRule(fde_start + (0x13 + 0x01) * code_factor,
+                                    0x3c, kCFARegister, 0xb348 * data_factor))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_restoreNoRule) {
+  CFISection section(kBigEndian, 4);
+  code_factor = 0x005f78143c1c3b82ULL;
+  data_factor = 0x25d0;
+  return_register = 0xe8;
+  version = 1;
+  fde_start = 0x4062e30f;
+  fde_size = 0x5302a389;
+  Label cie;
+  section.Mark(&cie)
+      .CIEHeader(code_factor, data_factor, return_register, version, "")
+      // Provide a CFA rule, because register rules require them.
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x470aa334)
+      .ULEB128(0x099ef127)
+      .FinishEntry()
+      // In the FDE...
+      .FDEHeader(cie, fde_start, fde_size)
+      // At a second address, provide an offset(N) rule for register 0x2c.
+      .D8(lul::DW_CFA_advance_loc | 0x7)
+      .D8(lul::DW_CFA_offset | 0x2c)
+      .ULEB128(0x1f47)
+      // At a third address, restore the (missing) CIE rule for register 0x2c.
+      .D8(lul::DW_CFA_advance_loc | 0xb)
+      .D8(lul::DW_CFA_restore | 0x2c)
+      .FinishEntry();
+
+  {
+    InSequence s;
+    EXPECT_CALL(handler,
+                Entry(_, fde_start, fde_size, version, "", return_register))
+        .WillOnce(Return(true));
+    // CIE's CFA rule.
+    EXPECT_CALL(handler,
+                ValOffsetRule(fde_start, kCFARegister, 0x470aa334, 0x099ef127))
+        .WillOnce(Return(true));
+    // FDE's rule for register 0x2c.
+    EXPECT_CALL(handler, OffsetRule(fde_start + 0x7 * code_factor, 0x2c,
+                                    kCFARegister, 0x1f47 * data_factor))
+        .WillOnce(Return(true));
+    // Restore CIE's (missing) rule for register 0x2c.
+    EXPECT_CALL(handler,
+                SameValueRule(fde_start + (0x7 + 0xb) * code_factor, 0x2c))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_restore_extended) {
+  CFISection section(kBigEndian, 4);
+  code_factor = 0x126e;
+  data_factor = -0xd8b;
+  return_register = 0x77711787;
+  version = 3;
+  fde_start = 0x01f55a45;
+  fde_size = 0x452adb80;
+  Label cie;
+  section.Mark(&cie)
+      .CIEHeader(code_factor, data_factor, return_register, version, "",
+                 true /* dwarf64 */)
+      // Provide a CFA rule, because register rules require them.
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x56fa0edd)
+      .ULEB128(0x097f78a5)
+      // Provide an offset(N) rule for register 0x0f9b8a1c.
+      .D8(lul::DW_CFA_offset_extended)
+      .ULEB128(0x0f9b8a1c)
+      .ULEB128(0xc979)
+      .FinishEntry()
+      // In the FDE...
+      .FDEHeader(cie, fde_start, fde_size)
+      // At a second address, provide a new offset(N) rule for reg 0x0f9b8a1c.
+      .D8(lul::DW_CFA_advance_loc | 0x3)
+      .D8(lul::DW_CFA_offset_extended)
+      .ULEB128(0x0f9b8a1c)
+      .ULEB128(0x3b7b)
+      // At a third address, restore the original rule for register 0x0f9b8a1c.
+      .D8(lul::DW_CFA_advance_loc | 0x04)
+      .D8(lul::DW_CFA_restore_extended)
+      .ULEB128(0x0f9b8a1c)
+      .FinishEntry();
+
+  {
+    InSequence s;
+    EXPECT_CALL(handler,
+                Entry(_, fde_start, fde_size, version, "", return_register))
+        .WillOnce(Return(true));
+    // CIE's CFA rule.
+    EXPECT_CALL(handler,
+                ValOffsetRule(fde_start, kCFARegister, 0x56fa0edd, 0x097f78a5))
+        .WillOnce(Return(true));
+    // CIE's rule for register 0x0f9b8a1c.
+    EXPECT_CALL(handler, OffsetRule(fde_start, 0x0f9b8a1c, kCFARegister,
+                                    0xc979 * data_factor))
+        .WillOnce(Return(true));
+    // FDE's rule for register 0x0f9b8a1c.
+    EXPECT_CALL(handler, OffsetRule(fde_start + 0x3 * code_factor, 0x0f9b8a1c,
+                                    kCFARegister, 0x3b7b * data_factor))
+        .WillOnce(Return(true));
+    // Restore CIE's rule for register 0x0f9b8a1c.
+    EXPECT_CALL(handler,
+                OffsetRule(fde_start + (0x3 + 0x4) * code_factor, 0x0f9b8a1c,
+                           kCFARegister, 0xc979 * data_factor))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_remember_and_restore_state) {
+  CFISection section(kLittleEndian, 8);
+  StockCIEAndFDE(&section);
+
+  // We create a state, save it, modify it, and then restore. We
+  // refer to the state that is overridden the restore as the
+  // "outgoing" state, and the restored state the "incoming" state.
+  //
+  // Register         outgoing        incoming        expect
+  // 1                offset(N)       no rule         new "same value" rule
+  // 2                register(R)     offset(N)       report changed rule
+  // 3                offset(N)       offset(M)       report changed offset
+  // 4                offset(N)       offset(N)       no report
+  // 5                offset(N)       no rule         new "same value" rule
+  section
+      // Create the "incoming" state, which we will save and later restore.
+      .D8(lul::DW_CFA_offset | 2)
+      .ULEB128(0x9806)
+      .D8(lul::DW_CFA_offset | 3)
+      .ULEB128(0x995d)
+      .D8(lul::DW_CFA_offset | 4)
+      .ULEB128(0x7055)
+      .D8(lul::DW_CFA_remember_state)
+      // Advance to a new instruction; an implementation could legitimately
+      // ignore all but the final rule for a given register at a given address.
+      .D8(lul::DW_CFA_advance_loc | 1)
+      // Create the "outgoing" state, which we will discard.
+      .D8(lul::DW_CFA_offset | 1)
+      .ULEB128(0xea1a)
+      .D8(lul::DW_CFA_register)
+      .ULEB128(2)
+      .ULEB128(0x1d2a3767)
+      .D8(lul::DW_CFA_offset | 3)
+      .ULEB128(0xdd29)
+      .D8(lul::DW_CFA_offset | 5)
+      .ULEB128(0xf1ce)
+      // At a third address, restore the incoming state.
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  uint64 addr = fde_start;
+
+  // Expect the incoming rules to be reported.
+  EXPECT_CALL(handler, OffsetRule(addr, 2, kCFARegister, 0x9806 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(addr, 3, kCFARegister, 0x995d * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(addr, 4, kCFARegister, 0x7055 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+
+  addr += code_factor;
+
+  // After the save, we establish the outgoing rule set.
+  EXPECT_CALL(handler, OffsetRule(addr, 1, kCFARegister, 0xea1a * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, RegisterRule(addr, 2, 0x1d2a3767))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(addr, 3, kCFARegister, 0xdd29 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(addr, 5, kCFARegister, 0xf1ce * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+
+  addr += code_factor;
+
+  // Finally, after the restore, expect to see the differences from
+  // the outgoing to the incoming rules reported.
+  EXPECT_CALL(handler, SameValueRule(addr, 1))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(addr, 2, kCFARegister, 0x9806 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(addr, 3, kCFARegister, 0x995d * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, SameValueRule(addr, 5))
+      .InSequence(s)
+      .WillOnce(Return(true));
+
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+// Check that restoring a rule set reports changes to the CFA rule.
+TEST_F(LulDwarfCFIInsn, DW_CFA_remember_and_restore_stateCFA) {
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+
+  section.D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_def_cfa_offset)
+      .ULEB128(0x90481102)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start + code_factor, kCFARegister,
+                                     cfa_base_register, 0x90481102))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(fde_start + code_factor * 2, kCFARegister,
+                                     cfa_base_register, cfa_offset))
+      .InSequence(s)
+      .WillOnce(Return(true));
+
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_nop) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_nop)
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x3fb8d4f1)
+      .ULEB128(0x078dc67b)
+      .D8(lul::DW_CFA_nop)
+      .FinishEntry();
+
+  EXPECT_CALL(handler,
+              ValOffsetRule(fde_start, kCFARegister, 0x3fb8d4f1, 0x078dc67b))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_GNU_window_save) {
+  CFISection section(kBigEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_GNU_window_save).FinishEntry();
+
+  // Don't include all the rules in any particular sequence.
+
+  // The caller's %o0-%o7 have become the callee's %i0-%i7. This is
+  // the GCC register numbering.
+  for (int i = 8; i < 16; i++)
+    EXPECT_CALL(handler, RegisterRule(fde_start, i, i + 16))
+        .WillOnce(Return(true));
+  // The caller's %l0-%l7 and %i0-%i7 have been saved at the top of
+  // its frame.
+  for (int i = 16; i < 32; i++)
+    EXPECT_CALL(handler, OffsetRule(fde_start, i, kCFARegister, (i - 16) * 4))
+        .WillOnce(Return(true));
+
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_GNU_args_size) {
+  CFISection section(kLittleEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_GNU_args_size)
+      .ULEB128(0xeddfa520)
+      // Verify that we see this, meaning we parsed the above properly.
+      .D8(lul::DW_CFA_offset | 0x23)
+      .ULEB128(0x269)
+      .FinishEntry();
+
+  EXPECT_CALL(handler,
+              OffsetRule(fde_start, 0x23, kCFARegister, 0x269 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIInsn, DW_CFA_GNU_negative_offset_extended) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_GNU_negative_offset_extended)
+      .ULEB128(0x430cc87a)
+      .ULEB128(0x613)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, OffsetRule(fde_start, 0x430cc87a, kCFARegister,
+                                  -0x613 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+// Three FDEs: skip the second
+TEST_F(LulDwarfCFIInsn, SkipFDE) {
+  CFISection section(kBigEndian, 4);
+  Label cie;
+  section
+      // CIE, used by all FDEs.
+      .Mark(&cie)
+      .CIEHeader(0x010269f2, 0x9177, 0xedca5849, 2, "")
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(0x42ed390b)
+      .ULEB128(0x98f43aad)
+      .FinishEntry()
+      // First FDE.
+      .FDEHeader(cie, 0xa870ebdd, 0x60f6aa4)
+      .D8(lul::DW_CFA_register)
+      .ULEB128(0x3a860351)
+      .ULEB128(0x6c9a6bcf)
+      .FinishEntry()
+      // Second FDE.
+      .FDEHeader(cie, 0xc534f7c0, 0xf6552e9, true /* dwarf64 */)
+      .D8(lul::DW_CFA_register)
+      .ULEB128(0x1b62c234)
+      .ULEB128(0x26586b18)
+      .FinishEntry()
+      // Third FDE.
+      .FDEHeader(cie, 0xf681cfc8, 0x7e4594e)
+      .D8(lul::DW_CFA_register)
+      .ULEB128(0x26c53934)
+      .ULEB128(0x18eeb8a4)
+      .FinishEntry();
+
+  {
+    InSequence s;
+
+    // Process the first FDE.
+    EXPECT_CALL(handler, Entry(_, 0xa870ebdd, 0x60f6aa4, 2, "", 0xedca5849))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler,
+                ValOffsetRule(0xa870ebdd, kCFARegister, 0x42ed390b, 0x98f43aad))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, RegisterRule(0xa870ebdd, 0x3a860351, 0x6c9a6bcf))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+    // Skip the second FDE.
+    EXPECT_CALL(handler, Entry(_, 0xc534f7c0, 0xf6552e9, 2, "", 0xedca5849))
+        .WillOnce(Return(false));
+
+    // Process the third FDE.
+    EXPECT_CALL(handler, Entry(_, 0xf681cfc8, 0x7e4594e, 2, "", 0xedca5849))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler,
+                ValOffsetRule(0xf681cfc8, kCFARegister, 0x42ed390b, 0x98f43aad))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, RegisterRule(0xf681cfc8, 0x26c53934, 0x18eeb8a4))
+        .WillOnce(Return(true));
+    EXPECT_CALL(handler, End()).WillOnce(Return(true));
+  }
+
+  ParseSection(&section);
+}
+
+// Quit processing in the middle of an entry's instructions.
+TEST_F(LulDwarfCFIInsn, QuitMidentry) {
+  CFISection section(kLittleEndian, 8);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_register)
+      .ULEB128(0xe0cf850d)
+      .ULEB128(0x15aab431)
+      .D8(lul::DW_CFA_expression)
+      .ULEB128(0x46750aa5)
+      .Block("meat")
+      .FinishEntry();
+
+  EXPECT_CALL(handler, RegisterRule(fde_start, 0xe0cf850d, 0x15aab431))
+      .InSequence(s)
+      .WillOnce(Return(false));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseSection(&section, false);
+}
+
+class LulDwarfCFIRestore : public CFIInsnFixture, public Test {};
+
+TEST_F(LulDwarfCFIRestore, RestoreUndefinedRuleUnchanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_undefined)
+      .ULEB128(0x0bac878e)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, UndefinedRule(fde_start, 0x0bac878e))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreUndefinedRuleChanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_undefined)
+      .ULEB128(0x7dedff5f)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_same_value)
+      .ULEB128(0x7dedff5f)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, UndefinedRule(fde_start, 0x7dedff5f))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, SameValueRule(fde_start + code_factor, 0x7dedff5f))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(fde_start + 2 * code_factor, 0x7dedff5f))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreSameValueRuleUnchanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_same_value)
+      .ULEB128(0xadbc9b3a)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, SameValueRule(fde_start, 0xadbc9b3a))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreSameValueRuleChanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_same_value)
+      .ULEB128(0x3d90dcb5)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_undefined)
+      .ULEB128(0x3d90dcb5)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, SameValueRule(fde_start, 0x3d90dcb5))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(fde_start + code_factor, 0x3d90dcb5))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, SameValueRule(fde_start + 2 * code_factor, 0x3d90dcb5))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreOffsetRuleUnchanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_offset | 0x14)
+      .ULEB128(0xb6f)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler,
+              OffsetRule(fde_start, 0x14, kCFARegister, 0xb6f * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreOffsetRuleChanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_offset | 0x21)
+      .ULEB128(0xeb7)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_undefined)
+      .ULEB128(0x21)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler,
+              OffsetRule(fde_start, 0x21, kCFARegister, 0xeb7 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(fde_start + code_factor, 0x21))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(fde_start + 2 * code_factor, 0x21,
+                                  kCFARegister, 0xeb7 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreOffsetRuleChangedOffset) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_offset | 0x21)
+      .ULEB128(0x134)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_offset | 0x21)
+      .ULEB128(0xf4f)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler,
+              OffsetRule(fde_start, 0x21, kCFARegister, 0x134 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(fde_start + code_factor, 0x21, kCFARegister,
+                                  0xf4f * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, OffsetRule(fde_start + 2 * code_factor, 0x21,
+                                  kCFARegister, 0x134 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreValOffsetRuleUnchanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_val_offset)
+      .ULEB128(0x829caee6)
+      .ULEB128(0xe4c)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, 0x829caee6, kCFARegister,
+                                     0xe4c * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreValOffsetRuleChanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_val_offset)
+      .ULEB128(0xf17c36d6)
+      .ULEB128(0xeb7)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_undefined)
+      .ULEB128(0xf17c36d6)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, 0xf17c36d6, kCFARegister,
+                                     0xeb7 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(fde_start + code_factor, 0xf17c36d6))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(fde_start + 2 * code_factor, 0xf17c36d6,
+                                     kCFARegister, 0xeb7 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreValOffsetRuleChangedValOffset) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_val_offset)
+      .ULEB128(0x2cf0ab1b)
+      .ULEB128(0x562)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_val_offset)
+      .ULEB128(0x2cf0ab1b)
+      .ULEB128(0xe88)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValOffsetRule(fde_start, 0x2cf0ab1b, kCFARegister,
+                                     0x562 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(fde_start + code_factor, 0x2cf0ab1b,
+                                     kCFARegister, 0xe88 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(fde_start + 2 * code_factor, 0x2cf0ab1b,
+                                     kCFARegister, 0x562 * data_factor))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreRegisterRuleUnchanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_register)
+      .ULEB128(0x77514acc)
+      .ULEB128(0x464de4ce)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, RegisterRule(fde_start, 0x77514acc, 0x464de4ce))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreRegisterRuleChanged) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_register)
+      .ULEB128(0xe39acce5)
+      .ULEB128(0x095f1559)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_undefined)
+      .ULEB128(0xe39acce5)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, RegisterRule(fde_start, 0xe39acce5, 0x095f1559))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(fde_start + code_factor, 0xe39acce5))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler,
+              RegisterRule(fde_start + 2 * code_factor, 0xe39acce5, 0x095f1559))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreRegisterRuleChangedRegister) {
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_register)
+      .ULEB128(0xd40e21b1)
+      .ULEB128(0x16607d6a)
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_register)
+      .ULEB128(0xd40e21b1)
+      .ULEB128(0xbabb4742)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, RegisterRule(fde_start, 0xd40e21b1, 0x16607d6a))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler,
+              RegisterRule(fde_start + code_factor, 0xd40e21b1, 0xbabb4742))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler,
+              RegisterRule(fde_start + 2 * code_factor, 0xd40e21b1, 0x16607d6a))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreExpressionRuleUnchanged) {
+  ByteReader reader(ENDIANNESS_LITTLE);
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_expression)
+      .ULEB128(0x666ae152)
+      .Block("dwarf")
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ExpressionRule(fde_start, 0x666ae152, "dwarf"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreExpressionRuleChanged) {
+  ByteReader reader(ENDIANNESS_LITTLE);
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_expression)
+      .ULEB128(0xb5ca5c46)
+      .Block("elf")
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_undefined)
+      .ULEB128(0xb5ca5c46)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ExpressionRule(fde_start, 0xb5ca5c46, "elf"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(fde_start + code_factor, 0xb5ca5c46))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler,
+              ExpressionRule(fde_start + 2 * code_factor, 0xb5ca5c46, "elf"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreExpressionRuleChangedExpression) {
+  ByteReader reader(ENDIANNESS_LITTLE);
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_expression)
+      .ULEB128(0x500f5739)
+      .Block("smurf")
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_expression)
+      .ULEB128(0x500f5739)
+      .Block("orc")
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ExpressionRule(fde_start, 0x500f5739, "smurf"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler,
+              ExpressionRule(fde_start + code_factor, 0x500f5739, "orc"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  // Expectations are not wishes.
+  EXPECT_CALL(handler,
+              ExpressionRule(fde_start + 2 * code_factor, 0x500f5739, "smurf"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreValExpressionRuleUnchanged) {
+  ByteReader reader(ENDIANNESS_LITTLE);
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_val_expression)
+      .ULEB128(0x666ae152)
+      .Block("hideous")
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  EXPECT_CALL(handler, ValExpressionRule(fde_start, 0x666ae152, "hideous"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreValExpressionRuleChanged) {
+  ByteReader reader(ENDIANNESS_LITTLE);
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_val_expression)
+      .ULEB128(0xb5ca5c46)
+      .Block("revolting")
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_undefined)
+      .ULEB128(0xb5ca5c46)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("RestoreValExpressionRuleChanged", section);
+
+  EXPECT_CALL(handler, ValExpressionRule(fde_start, 0xb5ca5c46, "revolting"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(fde_start + code_factor, 0xb5ca5c46))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValExpressionRule(fde_start + 2 * code_factor,
+                                         0xb5ca5c46, "revolting"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+TEST_F(LulDwarfCFIRestore, RestoreValExpressionRuleChangedValExpression) {
+  ByteReader reader(ENDIANNESS_LITTLE);
+  CFISection section(kLittleEndian, 4);
+  StockCIEAndFDE(&section);
+  section.D8(lul::DW_CFA_val_expression)
+      .ULEB128(0x500f5739)
+      .Block("repulsive")
+      .D8(lul::DW_CFA_remember_state)
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_val_expression)
+      .ULEB128(0x500f5739)
+      .Block("nauseous")
+      .D8(lul::DW_CFA_advance_loc | 1)
+      .D8(lul::DW_CFA_restore_state)
+      .FinishEntry();
+
+  PERHAPS_WRITE_DEBUG_FRAME_FILE("RestoreValExpressionRuleChangedValExpression",
+                                 section);
+
+  EXPECT_CALL(handler, ValExpressionRule(fde_start, 0x500f5739, "repulsive"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValExpressionRule(fde_start + code_factor, 0x500f5739,
+                                         "nauseous"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  // Expectations are not wishes.
+  EXPECT_CALL(handler, ValExpressionRule(fde_start + 2 * code_factor,
+                                         0x500f5739, "repulsive"))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).WillOnce(Return(true));
+
+  ParseSection(&section, true, &reader);
+}
+
+struct EHFrameFixture : public CFIInsnFixture {
+  EHFrameFixture() : CFIInsnFixture(), section(kBigEndian, 4, true) {
+    encoded_pointer_bases.cfi = 0x7f496cb2;
+    encoded_pointer_bases.text = 0x540f67b6;
+    encoded_pointer_bases.data = 0xe3eab768;
+    section.SetEncodedPointerBases(encoded_pointer_bases);
+  }
+  CFISection section;
+  CFISection::EncodedPointerBases encoded_pointer_bases;
+
+  // Parse CFIInsnFixture::ParseSection, but parse the section as
+  // .eh_frame data, supplying stock base addresses.
+  void ParseEHFrameSection(CFISection* section, bool succeeds = true) {
+    EXPECT_TRUE(section->ContainsEHFrame());
+    string contents;
+    EXPECT_TRUE(section->GetContents(&contents));
+    lul::Endianness endianness;
+    if (section->endianness() == kBigEndian)
+      endianness = ENDIANNESS_BIG;
+    else {
+      assert(section->endianness() == kLittleEndian);
+      endianness = ENDIANNESS_LITTLE;
+    }
+    ByteReader reader(endianness);
+    reader.SetAddressSize(section->AddressSize());
+    reader.SetCFIDataBase(encoded_pointer_bases.cfi, contents.data());
+    reader.SetTextBase(encoded_pointer_bases.text);
+    reader.SetDataBase(encoded_pointer_bases.data);
+    CallFrameInfo parser(contents.data(), contents.size(), &reader, &handler,
+                         &reporter, true);
+    if (succeeds)
+      EXPECT_TRUE(parser.Start());
+    else
+      EXPECT_FALSE(parser.Start());
+  }
+};
+
+class LulDwarfEHFrame : public EHFrameFixture, public Test {};
+
+// A simple CIE, an FDE, and a terminator.
+TEST_F(LulDwarfEHFrame, Terminator) {
+  Label cie;
+  section.Mark(&cie)
+      .CIEHeader(9968, 2466, 67, 1, "")
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(3772)
+      .ULEB128(1372)
+      .FinishEntry()
+      .FDEHeader(cie, 0x848037a1, 0x7b30475e)
+      .D8(lul::DW_CFA_set_loc)
+      .D32(0x17713850)
+      .D8(lul::DW_CFA_undefined)
+      .ULEB128(5721)
+      .FinishEntry()
+      .D32(0)  // Terminate the sequence.
+      // This FDE should be ignored.
+      .FDEHeader(cie, 0xf19629fe, 0x439fb09b)
+      .FinishEntry();
+
+  PERHAPS_WRITE_EH_FRAME_FILE("EHFrame.Terminator", section);
+
+  EXPECT_CALL(handler, Entry(_, 0x848037a1, 0x7b30475e, 1, "", 67))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(0x848037a1, kCFARegister, 3772, 1372))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(0x17713850, 5721))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+  EXPECT_CALL(reporter, EarlyEHTerminator(_)).InSequence(s).WillOnce(Return());
+
+  ParseEHFrameSection(&section);
+}
+
+// The parser should recognize the Linux Standards Base 'z' augmentations.
+TEST_F(LulDwarfEHFrame, SimpleFDE) {
+  lul::DwarfPointerEncoding lsda_encoding = lul::DwarfPointerEncoding(
+      lul::DW_EH_PE_indirect | lul::DW_EH_PE_datarel | lul::DW_EH_PE_sdata2);
+  lul::DwarfPointerEncoding fde_encoding =
+      lul::DwarfPointerEncoding(lul::DW_EH_PE_textrel | lul::DW_EH_PE_udata2);
+
+  section.SetPointerEncoding(fde_encoding);
+  section.SetEncodedPointerBases(encoded_pointer_bases);
+  Label cie;
+  section.Mark(&cie)
+      .CIEHeader(4873, 7012, 100, 1, "zSLPR")
+      .ULEB128(7)               // Augmentation data length
+      .D8(lsda_encoding)        // LSDA pointer format
+      .D8(lul::DW_EH_PE_pcrel)  // personality pointer format
+      .EncodedPointer(0x97baa00, lul::DW_EH_PE_pcrel)  // and value
+      .D8(fde_encoding)                                // FDE pointer format
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(6706)
+      .ULEB128(31)
+      .FinishEntry()
+      .FDEHeader(cie, 0x540f6b56, 0xf686)
+      .ULEB128(2)                                 // Augmentation data length
+      .EncodedPointer(0xe3eab475, lsda_encoding)  // LSDA pointer, signed
+      .D8(lul::DW_CFA_set_loc)
+      .EncodedPointer(0x540fa4ce, fde_encoding)
+      .D8(lul::DW_CFA_undefined)
+      .ULEB128(0x675e)
+      .FinishEntry()
+      .D32(0);  // terminator
+
+  PERHAPS_WRITE_EH_FRAME_FILE("EHFrame.SimpleFDE", section);
+
+  EXPECT_CALL(handler, Entry(_, 0x540f6b56, 0xf686, 1, "zSLPR", 100))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, PersonalityRoutine(0x97baa00, false))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, LanguageSpecificDataArea(0xe3eab475, true))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, SignalHandler()).InSequence(s).WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(0x540f6b56, kCFARegister, 6706, 31))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(0x540fa4ce, 0x675e))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseEHFrameSection(&section);
+}
+
+// Check that we can handle an empty 'z' augmentation.
+TEST_F(LulDwarfEHFrame, EmptyZ) {
+  Label cie;
+  section.Mark(&cie)
+      .CIEHeader(5955, 5805, 228, 1, "z")
+      .ULEB128(0)  // Augmentation data length
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(3629)
+      .ULEB128(247)
+      .FinishEntry()
+      .FDEHeader(cie, 0xda007738, 0xfb55c641)
+      .ULEB128(0)  // Augmentation data length
+      .D8(lul::DW_CFA_advance_loc1)
+      .D8(11)
+      .D8(lul::DW_CFA_undefined)
+      .ULEB128(3769)
+      .FinishEntry();
+
+  PERHAPS_WRITE_EH_FRAME_FILE("EHFrame.EmptyZ", section);
+
+  EXPECT_CALL(handler, Entry(_, 0xda007738, 0xfb55c641, 1, "z", 228))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, ValOffsetRule(0xda007738, kCFARegister, 3629, 247))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, UndefinedRule(0xda007738 + 11 * 5955, 3769))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseEHFrameSection(&section);
+}
+
+// Check that we recognize bad 'z' augmentation characters.
+TEST_F(LulDwarfEHFrame, BadZ) {
+  Label cie;
+  section.Mark(&cie)
+      .CIEHeader(6937, 1045, 142, 1, "zQ")
+      .ULEB128(0)  // Augmentation data length
+      .D8(lul::DW_CFA_def_cfa)
+      .ULEB128(9006)
+      .ULEB128(7725)
+      .FinishEntry()
+      .FDEHeader(cie, 0x1293efa8, 0x236f53f2)
+      .ULEB128(0)  // Augmentation data length
+      .D8(lul::DW_CFA_advance_loc | 12)
+      .D8(lul::DW_CFA_register)
+      .ULEB128(5667)
+      .ULEB128(3462)
+      .FinishEntry();
+
+  PERHAPS_WRITE_EH_FRAME_FILE("EHFrame.BadZ", section);
+
+  EXPECT_CALL(reporter, UnrecognizedAugmentation(_, "zQ")).WillOnce(Return());
+
+  ParseEHFrameSection(&section, false);
+}
+
+TEST_F(LulDwarfEHFrame, zL) {
+  Label cie;
+  lul::DwarfPointerEncoding lsda_encoding =
+      lul::DwarfPointerEncoding(lul::DW_EH_PE_funcrel | lul::DW_EH_PE_udata2);
+  section.Mark(&cie)
+      .CIEHeader(9285, 9959, 54, 1, "zL")
+      .ULEB128(1)         // Augmentation data length
+      .D8(lsda_encoding)  // encoding for LSDA pointer in FDE
+
+      .FinishEntry()
+      .FDEHeader(cie, 0xd40091aa, 0x9aa6e746)
+      .ULEB128(2)                                 // Augmentation data length
+      .EncodedPointer(0xd40099cd, lsda_encoding)  // LSDA pointer
+      .FinishEntry()
+      .D32(0);  // terminator
+
+  PERHAPS_WRITE_EH_FRAME_FILE("EHFrame.zL", section);
+
+  EXPECT_CALL(handler, Entry(_, 0xd40091aa, 0x9aa6e746, 1, "zL", 54))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, LanguageSpecificDataArea(0xd40099cd, false))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseEHFrameSection(&section);
+}
+
+TEST_F(LulDwarfEHFrame, zP) {
+  Label cie;
+  lul::DwarfPointerEncoding personality_encoding =
+      lul::DwarfPointerEncoding(lul::DW_EH_PE_datarel | lul::DW_EH_PE_udata2);
+  section.Mark(&cie)
+      .CIEHeader(1097, 6313, 17, 1, "zP")
+      .ULEB128(3)                // Augmentation data length
+      .D8(personality_encoding)  // encoding for personality routine
+      .EncodedPointer(0xe3eaccac, personality_encoding)  // value
+      .FinishEntry()
+      .FDEHeader(cie, 0x0c8350c9, 0xbef11087)
+      .ULEB128(0)  // Augmentation data length
+      .FinishEntry()
+      .D32(0);  // terminator
+
+  PERHAPS_WRITE_EH_FRAME_FILE("EHFrame.zP", section);
+
+  EXPECT_CALL(handler, Entry(_, 0x0c8350c9, 0xbef11087, 1, "zP", 17))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, PersonalityRoutine(0xe3eaccac, false))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseEHFrameSection(&section);
+}
+
+TEST_F(LulDwarfEHFrame, zR) {
+  Label cie;
+  lul::DwarfPointerEncoding pointer_encoding =
+      lul::DwarfPointerEncoding(lul::DW_EH_PE_textrel | lul::DW_EH_PE_sdata2);
+  section.SetPointerEncoding(pointer_encoding);
+  section.Mark(&cie)
+      .CIEHeader(8011, 5496, 75, 1, "zR")
+      .ULEB128(1)            // Augmentation data length
+      .D8(pointer_encoding)  // encoding for FDE addresses
+      .FinishEntry()
+      .FDEHeader(cie, 0x540f9431, 0xbd0)
+      .ULEB128(0)  // Augmentation data length
+      .FinishEntry()
+      .D32(0);  // terminator
+
+  PERHAPS_WRITE_EH_FRAME_FILE("EHFrame.zR", section);
+
+  EXPECT_CALL(handler, Entry(_, 0x540f9431, 0xbd0, 1, "zR", 75))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseEHFrameSection(&section);
+}
+
+TEST_F(LulDwarfEHFrame, zS) {
+  Label cie;
+  section.Mark(&cie)
+      .CIEHeader(9217, 7694, 57, 1, "zS")
+      .ULEB128(0)  // Augmentation data length
+      .FinishEntry()
+      .FDEHeader(cie, 0xd40091aa, 0x9aa6e746)
+      .ULEB128(0)  // Augmentation data length
+      .FinishEntry()
+      .D32(0);  // terminator
+
+  PERHAPS_WRITE_EH_FRAME_FILE("EHFrame.zS", section);
+
+  EXPECT_CALL(handler, Entry(_, 0xd40091aa, 0x9aa6e746, 1, "zS", 57))
+      .InSequence(s)
+      .WillOnce(Return(true));
+  EXPECT_CALL(handler, SignalHandler()).InSequence(s).WillOnce(Return(true));
+  EXPECT_CALL(handler, End()).InSequence(s).WillOnce(Return(true));
+
+  ParseEHFrameSection(&section);
+}
+
+// These tests require manual inspection of the test output.
+struct CFIReporterFixture {
+  CFIReporterFixture()
+      : reporter(gtest_logging_sink_for_LulTestDwarf, "test file name",
+                 "test section name") {}
+  CallFrameInfo::Reporter reporter;
+};
+
+class LulDwarfCFIReporter : public CFIReporterFixture, public Test {};
+
+TEST_F(LulDwarfCFIReporter, Incomplete) {
+  reporter.Incomplete(0x0102030405060708ULL, CallFrameInfo::kUnknown);
+}
+
+TEST_F(LulDwarfCFIReporter, EarlyEHTerminator) {
+  reporter.EarlyEHTerminator(0x0102030405060708ULL);
+}
+
+TEST_F(LulDwarfCFIReporter, CIEPointerOutOfRange) {
+  reporter.CIEPointerOutOfRange(0x0123456789abcdefULL, 0xfedcba9876543210ULL);
+}
+
+TEST_F(LulDwarfCFIReporter, BadCIEId) {
+  reporter.BadCIEId(0x0123456789abcdefULL, 0xfedcba9876543210ULL);
+}
+
+TEST_F(LulDwarfCFIReporter, UnrecognizedVersion) {
+  reporter.UnrecognizedVersion(0x0123456789abcdefULL, 43);
+}
+
+TEST_F(LulDwarfCFIReporter, UnrecognizedAugmentation) {
+  reporter.UnrecognizedAugmentation(0x0123456789abcdefULL, "poodles");
+}
+
+TEST_F(LulDwarfCFIReporter, InvalidPointerEncoding) {
+  reporter.InvalidPointerEncoding(0x0123456789abcdefULL, 0x42);
+}
+
+TEST_F(LulDwarfCFIReporter, UnusablePointerEncoding) {
+  reporter.UnusablePointerEncoding(0x0123456789abcdefULL, 0x42);
+}
+
+TEST_F(LulDwarfCFIReporter, RestoreInCIE) {
+  reporter.RestoreInCIE(0x0123456789abcdefULL, 0xfedcba9876543210ULL);
+}
+
+TEST_F(LulDwarfCFIReporter, BadInstruction) {
+  reporter.BadInstruction(0x0123456789abcdefULL, CallFrameInfo::kFDE,
+                          0xfedcba9876543210ULL);
+}
+
+TEST_F(LulDwarfCFIReporter, NoCFARule) {
+  reporter.NoCFARule(0x0123456789abcdefULL, CallFrameInfo::kCIE,
+                     0xfedcba9876543210ULL);
+}
+
+TEST_F(LulDwarfCFIReporter, EmptyStateStack) {
+  reporter.EmptyStateStack(0x0123456789abcdefULL, CallFrameInfo::kTerminator,
+                           0xfedcba9876543210ULL);
+}
+
+TEST_F(LulDwarfCFIReporter, ClearingCFARule) {
+  reporter.ClearingCFARule(0x0123456789abcdefULL, CallFrameInfo::kFDE,
+                           0xfedcba9876543210ULL);
+}
+class LulDwarfExpr : public Test {};
+
+class MockSummariser : public Summariser {
+ public:
+  MockSummariser() : Summariser(nullptr, 0, nullptr) {}
+  MOCK_METHOD2(Entry, void(uintptr_t, uintptr_t));
+  MOCK_METHOD0(End, void());
+  MOCK_METHOD5(Rule, void(uintptr_t, int, LExprHow, int16_t, int64_t));
+  MOCK_METHOD1(AddPfxInstr, uint32_t(PfxInstr));
+};
+
+TEST_F(LulDwarfExpr, SimpleTransliteration) {
+  MockSummariser summ;
+  ByteReader reader(ENDIANNESS_LITTLE);
+
+  CFISection section(kLittleEndian, 8);
+  section.D8(DW_OP_lit0)
+      .D8(DW_OP_lit31)
+      .D8(DW_OP_breg0 + 17)
+      .LEB128(-1234)
+      .D8(DW_OP_const4s)
+      .D32(0xFEDC9876)
+      .D8(DW_OP_deref)
+      .D8(DW_OP_and)
+      .D8(DW_OP_plus)
+      .D8(DW_OP_minus)
+      .D8(DW_OP_shl)
+      .D8(DW_OP_ge);
+  string expr;
+  bool ok = section.GetContents(&expr);
+  EXPECT_TRUE(ok);
+
+  {
+    InSequence s;
+    // required start marker
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_Start, 0)));
+    // DW_OP_lit0
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_SImm32, 0)));
+    // DW_OP_lit31
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_SImm32, 31)));
+    // DW_OP_breg17 -1234
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_DwReg, 17)));
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_SImm32, -1234)));
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_Add)));
+    // DW_OP_const4s 0xFEDC9876
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_SImm32, 0xFEDC9876)));
+    // DW_OP_deref
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_Deref)));
+    // DW_OP_and
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_And)));
+    // DW_OP_plus
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_Add)));
+    // DW_OP_minus
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_Sub)));
+    // DW_OP_shl
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_Shl)));
+    // DW_OP_ge
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_CmpGES)));
+    // required end marker
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_End)));
+  }
+
+  int32_t ix = parseDwarfExpr(&summ, &reader, expr, false, false, false);
+  EXPECT_TRUE(ix >= 0);
+}
+
+TEST_F(LulDwarfExpr, UnknownOpcode) {
+  MockSummariser summ;
+  ByteReader reader(ENDIANNESS_LITTLE);
+
+  CFISection section(kLittleEndian, 8);
+  section.D8(DW_OP_lo_user - 1);
+  string expr;
+  bool ok = section.GetContents(&expr);
+  EXPECT_TRUE(ok);
+
+  {
+    InSequence s;
+    // required start marker
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_Start, 0)));
+  }
+
+  int32_t ix = parseDwarfExpr(&summ, &reader, expr, false, false, false);
+  EXPECT_TRUE(ix == -1);
+}
+
+TEST_F(LulDwarfExpr, ExpressionOverrun) {
+  MockSummariser summ;
+  ByteReader reader(ENDIANNESS_LITTLE);
+
+  CFISection section(kLittleEndian, 8);
+  section.D8(DW_OP_const4s).D8(0x12).D8(0x34).D8(0x56);
+  string expr;
+  bool ok = section.GetContents(&expr);
+  EXPECT_TRUE(ok);
+
+  {
+    InSequence s;
+    // required start marker
+    EXPECT_CALL(summ, AddPfxInstr(PfxInstr(PX_Start, 0)));
+    // DW_OP_const4s followed by 3 (a.k.a. not enough) bytes
+    // We expect PfxInstr(PX_Simm32, not-known-for-sure-32-bit-immediate)
+    // Hence must use _ as the argument.
+    EXPECT_CALL(summ, AddPfxInstr(_));
+  }
+
+  int32_t ix = parseDwarfExpr(&summ, &reader, expr, false, false, false);
+  EXPECT_TRUE(ix == -1);
+}
+
+// We'll need to mention specific Dwarf registers in the EvaluatePfxExpr tests,
+// and those names are arch-specific, so a bit of macro magic is helpful.
+#if defined(GP_ARCH_arm)
+#  define TESTED_REG_STRUCT_NAME r11
+#  define TESTED_REG_DWARF_NAME DW_REG_ARM_R11
+#elif defined(GP_ARCH_arm64)
+#  define TESTED_REG_STRUCT_NAME x29
+#  define TESTED_REG_DWARF_NAME DW_REG_AARCH64_X29
+#elif defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
+#  define TESTED_REG_STRUCT_NAME xbp
+#  define TESTED_REG_DWARF_NAME DW_REG_INTEL_XBP
+#else
+#  error "Unknown plat"
+#endif
+
+struct EvaluatePfxExprFixture {
+  // Creates:
+  // initial stack, AVMA 0x12345678, at offset 4 bytes = 0xdeadbeef
+  // initial regs, with XBP = 0x14141356
+  // initial CFA = 0x5432ABCD
+  EvaluatePfxExprFixture() {
+    // The test stack.
+    si.mStartAvma = 0x12345678;
+    si.mLen = 0;
+#define XX(_byte)                      \
+  do {                                 \
+    si.mContents[si.mLen++] = (_byte); \
+  } while (0)
+    XX(0x55);
+    XX(0x55);
+    XX(0x55);
+    XX(0x55);
+    if (sizeof(void*) == 8) {
+      // le64
+      XX(0xEF);
+      XX(0xBE);
+      XX(0xAD);
+      XX(0xDE);
+      XX(0);
+      XX(0);
+      XX(0);
+      XX(0);
+    } else {
+      // le32
+      XX(0xEF);
+      XX(0xBE);
+      XX(0xAD);
+      XX(0xDE);
+    }
+    XX(0xAA);
+    XX(0xAA);
+    XX(0xAA);
+    XX(0xAA);
+#undef XX
+    // The initial CFA.
+    initialCFA = TaggedUWord(0x5432ABCD);
+    // The initial register state.
+    memset(&regs, 0, sizeof(regs));
+    regs.TESTED_REG_STRUCT_NAME = TaggedUWord(0x14141356);
+  }
+
+  StackImage si;
+  TaggedUWord initialCFA;
+  UnwindRegs regs;
+};
+
+class LulDwarfEvaluatePfxExpr : public EvaluatePfxExprFixture, public Test {};
+
+TEST_F(LulDwarfEvaluatePfxExpr, NormalEvaluation) {
+  vector<PfxInstr> instrs;
+  // Put some junk at the start of the insn sequence.
+  instrs.push_back(PfxInstr(PX_End));
+  instrs.push_back(PfxInstr(PX_End));
+
+  // Now the real sequence
+  // stack is empty
+  instrs.push_back(PfxInstr(PX_Start, 1));
+  // 0x5432ABCD
+  instrs.push_back(PfxInstr(PX_SImm32, 0x31415927));
+  // 0x5432ABCD 0x31415927
+  instrs.push_back(PfxInstr(PX_DwReg, TESTED_REG_DWARF_NAME));
+  // 0x5432ABCD 0x31415927 0x14141356
+  instrs.push_back(PfxInstr(PX_SImm32, 42));
+  // 0x5432ABCD 0x31415927 0x14141356 42
+  instrs.push_back(PfxInstr(PX_Sub));
+  // 0x5432ABCD 0x31415927 0x1414132c
+  instrs.push_back(PfxInstr(PX_Add));
+  // 0x5432ABCD 0x45556c53
+  instrs.push_back(PfxInstr(PX_SImm32, si.mStartAvma + 4));
+  // 0x5432ABCD 0x45556c53 0x1234567c
+  instrs.push_back(PfxInstr(PX_Deref));
+  // 0x5432ABCD 0x45556c53 0xdeadbeef
+  instrs.push_back(PfxInstr(PX_SImm32, 0xFE01DC23));
+  // 0x5432ABCD 0x45556c53 0xdeadbeef 0xFE01DC23
+  instrs.push_back(PfxInstr(PX_And));
+  // 0x5432ABCD 0x45556c53 0xde019c23
+  instrs.push_back(PfxInstr(PX_SImm32, 7));
+  // 0x5432ABCD 0x45556c53 0xde019c23 7
+  instrs.push_back(PfxInstr(PX_Shl));
+  // 0x5432ABCD 0x45556c53 0x6f00ce1180
+  instrs.push_back(PfxInstr(PX_SImm32, 0x7fffffff));
+  // 0x5432ABCD 0x45556c53 0x6f00ce1180 7fffffff
+  instrs.push_back(PfxInstr(PX_And));
+  // 0x5432ABCD 0x45556c53 0x00ce1180
+  instrs.push_back(PfxInstr(PX_Add));
+  // 0x5432ABCD 0x46237dd3
+  instrs.push_back(PfxInstr(PX_Sub));
+  // 0xe0f2dfa
+
+  instrs.push_back(PfxInstr(PX_End));
+
+  TaggedUWord res = EvaluatePfxExpr(2 /*offset of start insn*/, &regs,
+                                    initialCFA, &si, instrs);
+  EXPECT_TRUE(res.Valid());
+  EXPECT_TRUE(res.Value() == 0xe0f2dfa);
+}
+
+TEST_F(LulDwarfEvaluatePfxExpr, EmptySequence) {
+  vector<PfxInstr> instrs;
+  TaggedUWord res = EvaluatePfxExpr(0, &regs, initialCFA, &si, instrs);
+  EXPECT_FALSE(res.Valid());
+}
+
+TEST_F(LulDwarfEvaluatePfxExpr, BogusStartPoint) {
+  vector<PfxInstr> instrs;
+  instrs.push_back(PfxInstr(PX_SImm32, 42));
+  instrs.push_back(PfxInstr(PX_SImm32, 24));
+  instrs.push_back(PfxInstr(PX_SImm32, 4224));
+  TaggedUWord res = EvaluatePfxExpr(1, &regs, initialCFA, &si, instrs);
+  EXPECT_FALSE(res.Valid());
+}
+
+TEST_F(LulDwarfEvaluatePfxExpr, MissingEndMarker) {
+  vector<PfxInstr> instrs;
+  instrs.push_back(PfxInstr(PX_Start, 0));
+  instrs.push_back(PfxInstr(PX_SImm32, 24));
+  TaggedUWord res = EvaluatePfxExpr(0, &regs, initialCFA, &si, instrs);
+  EXPECT_FALSE(res.Valid());
+}
+
+TEST_F(LulDwarfEvaluatePfxExpr, StackUnderflow) {
+  vector<PfxInstr> instrs;
+  instrs.push_back(PfxInstr(PX_Start, 0));
+  instrs.push_back(PfxInstr(PX_End));
+  TaggedUWord res = EvaluatePfxExpr(0, &regs, initialCFA, &si, instrs);
+  EXPECT_FALSE(res.Valid());
+}
+
+TEST_F(LulDwarfEvaluatePfxExpr, StackNoUnderflow) {
+  vector<PfxInstr> instrs;
+  instrs.push_back(PfxInstr(PX_Start, 1 /*push the initial CFA*/));
+  instrs.push_back(PfxInstr(PX_End));
+  TaggedUWord res = EvaluatePfxExpr(0, &regs, initialCFA, &si, instrs);
+  EXPECT_TRUE(res.Valid());
+  EXPECT_TRUE(res == initialCFA);
+}
+
+TEST_F(LulDwarfEvaluatePfxExpr, StackOverflow) {
+  vector<PfxInstr> instrs;
+  instrs.push_back(PfxInstr(PX_Start, 0));
+  for (int i = 0; i < 10 + 1; i++) {
+    instrs.push_back(PfxInstr(PX_SImm32, i + 100));
+  }
+  instrs.push_back(PfxInstr(PX_End));
+  TaggedUWord res = EvaluatePfxExpr(0, &regs, initialCFA, &si, instrs);
+  EXPECT_FALSE(res.Valid());
+}
+
+TEST_F(LulDwarfEvaluatePfxExpr, StackNoOverflow) {
+  vector<PfxInstr> instrs;
+  instrs.push_back(PfxInstr(PX_Start, 0));
+  for (int i = 0; i < 10 + 0; i++) {
+    instrs.push_back(PfxInstr(PX_SImm32, i + 100));
+  }
+  instrs.push_back(PfxInstr(PX_End));
+  TaggedUWord res = EvaluatePfxExpr(0, &regs, initialCFA, &si, instrs);
+  EXPECT_TRUE(res.Valid());
+  EXPECT_TRUE(res == TaggedUWord(109));
+}
+
+TEST_F(LulDwarfEvaluatePfxExpr, OutOfRangeShl) {
+  vector<PfxInstr> instrs;
+  instrs.push_back(PfxInstr(PX_Start, 0));
+  instrs.push_back(PfxInstr(PX_SImm32, 1234));
+  instrs.push_back(PfxInstr(PX_SImm32, 5678));
+  instrs.push_back(PfxInstr(PX_Shl));
+  TaggedUWord res = EvaluatePfxExpr(0, &regs, initialCFA, &si, instrs);
+  EXPECT_TRUE(!res.Valid());
+}
+
+TEST_F(LulDwarfEvaluatePfxExpr, TestCmpGES) {
+  const int32_t argsL[6] = {0, 0, 1, -2, -1, -2};
+  const int32_t argsR[6] = {0, 1, 0, -2, -2, -1};
+  // expecting:              t  f  t  t   t    f   = 101110 = 0x2E
+  vector<PfxInstr> instrs;
+  instrs.push_back(PfxInstr(PX_Start, 0));
+  // The "running total"
+  instrs.push_back(PfxInstr(PX_SImm32, 0));
+  for (unsigned int i = 0; i < sizeof(argsL) / sizeof(argsL[0]); i++) {
+    // Shift the "running total" at the bottom of the stack left by one bit
+    instrs.push_back(PfxInstr(PX_SImm32, 1));
+    instrs.push_back(PfxInstr(PX_Shl));
+    // Push both test args and do the comparison
+    instrs.push_back(PfxInstr(PX_SImm32, argsL[i]));
+    instrs.push_back(PfxInstr(PX_SImm32, argsR[i]));
+    instrs.push_back(PfxInstr(PX_CmpGES));
+    // Or the result into the running total
+    instrs.push_back(PfxInstr(PX_Or));
+  }
+  instrs.push_back(PfxInstr(PX_End));
+  TaggedUWord res = EvaluatePfxExpr(0, &regs, initialCFA, &si, instrs);
+  EXPECT_TRUE(res.Valid());
+  EXPECT_TRUE(res == TaggedUWord(0x2E));
+}
+
+}  // namespace lul
diff --git a/tools/profiler/tests/gtest/LulTestInfrastructure.cpp b/tools/profiler/tests/gtest/LulTestInfrastructure.cpp
new file mode 100644
index 0000000000..43154b06ad
--- /dev/null
+++ b/tools/profiler/tests/gtest/LulTestInfrastructure.cpp
@@ -0,0 +1,494 @@
+// Copyright (c) 2010, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Original author: Jim Blandy <jimb@mozilla.com> <jimb@red-bean.com>
+
+// Derived from:
+// test_assembler.cc: Implementation of google_breakpad::TestAssembler.
+// See test_assembler.h for details.
+
+// Derived from:
+// cfi_assembler.cc: Implementation of google_breakpad::CFISection class.
+// See cfi_assembler.h for details.
+
+#include "LulTestInfrastructure.h"
+
+namespace lul_test {
+namespace test_assembler {
+
+using std::back_insert_iterator;
+
+Label::Label() : value_(new Binding()) {}
+Label::Label(uint64_t value) : value_(new Binding(value)) {}
+Label::Label(const Label& label) {
+  value_ = label.value_;
+  value_->Acquire();
+}
+Label::~Label() {
+  if (value_->Release()) delete value_;
+}
+
+Label& Label::operator=(uint64_t value) {
+  value_->Set(NULL, value);
+  return *this;
+}
+
+Label& Label::operator=(const Label& label) {
+  value_->Set(label.value_, 0);
+  return *this;
+}
+
+Label Label::operator+(uint64_t addend) const {
+  Label l;
+  l.value_->Set(this->value_, addend);
+  return l;
+}
+
+Label Label::operator-(uint64_t subtrahend) const {
+  Label l;
+  l.value_->Set(this->value_, -subtrahend);
+  return l;
+}
+
+// When NDEBUG is #defined, assert doesn't evaluate its argument. This
+// means you can't simply use assert to check the return value of a
+// function with necessary side effects.
+//
+// ALWAYS_EVALUATE_AND_ASSERT(x) evaluates x regardless of whether
+// NDEBUG is #defined; when NDEBUG is not #defined, it further asserts
+// that x is true.
+#ifdef NDEBUG
+#  define ALWAYS_EVALUATE_AND_ASSERT(x) x
+#else
+#  define ALWAYS_EVALUATE_AND_ASSERT(x) assert(x)
+#endif
+
+uint64_t Label::operator-(const Label& label) const {
+  uint64_t offset;
+  ALWAYS_EVALUATE_AND_ASSERT(IsKnownOffsetFrom(label, &offset));
+  return offset;
+}
+
+bool Label::IsKnownConstant(uint64_t* value_p) const {
+  Binding* base;
+  uint64_t addend;
+  value_->Get(&base, &addend);
+  if (base != NULL) return false;
+  if (value_p) *value_p = addend;
+  return true;
+}
+
+bool Label::IsKnownOffsetFrom(const Label& label, uint64_t* offset_p) const {
+  Binding *label_base, *this_base;
+  uint64_t label_addend, this_addend;
+  label.value_->Get(&label_base, &label_addend);
+  value_->Get(&this_base, &this_addend);
+  // If this and label are related, Get will find their final
+  // common ancestor, regardless of how indirect the relation is. This
+  // comparison also handles the constant vs. constant case.
+  if (this_base != label_base) return false;
+  if (offset_p) *offset_p = this_addend - label_addend;
+  return true;
+}
+
+Label::Binding::Binding() : base_(this), addend_(), reference_count_(1) {}
+
+Label::Binding::Binding(uint64_t addend)
+    : base_(NULL), addend_(addend), reference_count_(1) {}
+
+Label::Binding::~Binding() {
+  assert(reference_count_ == 0);
+  if (base_ && base_ != this && base_->Release()) delete base_;
+}
+
+void Label::Binding::Set(Binding* binding, uint64_t addend) {
+  if (!base_ && !binding) {
+    // We're equating two constants. This could be okay.
+    assert(addend_ == addend);
+  } else if (!base_) {
+    // We are a known constant, but BINDING may not be, so turn the
+    // tables and try to set BINDING's value instead.
+    binding->Set(NULL, addend_ - addend);
+  } else {
+    if (binding) {
+      // Find binding's final value. Since the final value is always either
+      // completely unconstrained or a constant, never a reference to
+      // another variable (otherwise, it wouldn't be final), this
+      // guarantees we won't create cycles here, even for code like this:
+      //   l = m, m = n, n = l;
+      uint64_t binding_addend;
+      binding->Get(&binding, &binding_addend);
+      addend += binding_addend;
+    }
+
+    // It seems likely that setting a binding to itself is a bug
+    // (although I can imagine this might turn out to be helpful to
+    // permit).
+    assert(binding != this);
+
+    if (base_ != this) {
+      // Set the other bindings on our chain as well. Note that this
+      // is sufficient even though binding relationships form trees:
+      // All binding operations traverse their chains to the end, and
+      // all bindings related to us share some tail of our chain, so
+      // they will see the changes we make here.
+      base_->Set(binding, addend - addend_);
+      // We're not going to use base_ any more.
+      if (base_->Release()) delete base_;
+    }
+
+    // Adopt BINDING as our base. Note that it should be correct to
+    // acquire here, after the release above, even though the usual
+    // reference-counting rules call for acquiring first, and then
+    // releasing: the self-reference assertion above should have
+    // complained if BINDING were 'this' or anywhere along our chain,
+    // so we didn't release BINDING.
+    if (binding) binding->Acquire();
+    base_ = binding;
+    addend_ = addend;
+  }
+}
+
+void Label::Binding::Get(Binding** base, uint64_t* addend) {
+  if (base_ && base_ != this) {
+    // Recurse to find the end of our reference chain (the root of our
+    // tree), and then rewrite every binding along the chain to refer
+    // to it directly, adjusting addends appropriately. (This is why
+    // this member function isn't this-const.)
+    Binding* final_base;
+    uint64_t final_addend;
+    base_->Get(&final_base, &final_addend);
+    if (final_base) final_base->Acquire();
+    if (base_->Release()) delete base_;
+    base_ = final_base;
+    addend_ += final_addend;
+  }
+  *base = base_;
+  *addend = addend_;
+}
+
+template <typename Inserter>
+static inline void InsertEndian(test_assembler::Endianness endianness,
+                                size_t size, uint64_t number, Inserter dest) {
+  assert(size > 0);
+  if (endianness == kLittleEndian) {
+    for (size_t i = 0; i < size; i++) {
+      *dest++ = (char)(number & 0xff);
+      number >>= 8;
+    }
+  } else {
+    assert(endianness == kBigEndian);
+    // The loop condition is odd, but it's correct for size_t.
+    for (size_t i = size - 1; i < size; i--)
+      *dest++ = (char)((number >> (i * 8)) & 0xff);
+  }
+}
+
+Section& Section::Append(Endianness endianness, size_t size, uint64_t number) {
+  InsertEndian(endianness, size, number,
+               back_insert_iterator<string>(contents_));
+  return *this;
+}
+
+Section& Section::Append(Endianness endianness, size_t size,
+                         const Label& label) {
+  // If this label's value is known, there's no reason to waste an
+  // entry in references_ on it.
+  uint64_t value;
+  if (label.IsKnownConstant(&value)) return Append(endianness, size, value);
+
+  // This will get caught when the references are resolved, but it's
+  // nicer to find out earlier.
+  assert(endianness != kUnsetEndian);
+
+  references_.push_back(Reference(contents_.size(), endianness, size, label));
+  contents_.append(size, 0);
+  return *this;
+}
+
+#define ENDIANNESS_L kLittleEndian
+#define ENDIANNESS_B kBigEndian
+#define ENDIANNESS(e) ENDIANNESS_##e
+
+#define DEFINE_SHORT_APPEND_NUMBER_ENDIAN(e, bits)         \
+  Section& Section::e##bits(uint##bits##_t v) {            \
+    InsertEndian(ENDIANNESS(e), bits / 8, v,               \
+                 back_insert_iterator<string>(contents_)); \
+    return *this;                                          \
+  }
+
+#define DEFINE_SHORT_APPEND_LABEL_ENDIAN(e, bits) \
+  Section& Section::e##bits(const Label& v) {     \
+    return Append(ENDIANNESS(e), bits / 8, v);    \
+  }
+
+// Define L16, B32, and friends.
+#define DEFINE_SHORT_APPEND_ENDIAN(e, bits)  \
+  DEFINE_SHORT_APPEND_NUMBER_ENDIAN(e, bits) \
+  DEFINE_SHORT_APPEND_LABEL_ENDIAN(e, bits)
+
+DEFINE_SHORT_APPEND_LABEL_ENDIAN(L, 8);
+DEFINE_SHORT_APPEND_LABEL_ENDIAN(B, 8);
+DEFINE_SHORT_APPEND_ENDIAN(L, 16);
+DEFINE_SHORT_APPEND_ENDIAN(L, 32);
+DEFINE_SHORT_APPEND_ENDIAN(L, 64);
+DEFINE_SHORT_APPEND_ENDIAN(B, 16);
+DEFINE_SHORT_APPEND_ENDIAN(B, 32);
+DEFINE_SHORT_APPEND_ENDIAN(B, 64);
+
+#define DEFINE_SHORT_APPEND_NUMBER_DEFAULT(bits)           \
+  Section& Section::D##bits(uint##bits##_t v) {            \
+    InsertEndian(endianness_, bits / 8, v,                 \
+                 back_insert_iterator<string>(contents_)); \
+    return *this;                                          \
+  }
+#define DEFINE_SHORT_APPEND_LABEL_DEFAULT(bits) \
+  Section& Section::D##bits(const Label& v) {   \
+    return Append(endianness_, bits / 8, v);    \
+  }
+#define DEFINE_SHORT_APPEND_DEFAULT(bits)  \
+  DEFINE_SHORT_APPEND_NUMBER_DEFAULT(bits) \
+  DEFINE_SHORT_APPEND_LABEL_DEFAULT(bits)
+
+DEFINE_SHORT_APPEND_LABEL_DEFAULT(8)
+DEFINE_SHORT_APPEND_DEFAULT(16);
+DEFINE_SHORT_APPEND_DEFAULT(32);
+DEFINE_SHORT_APPEND_DEFAULT(64);
+
+Section& Section::LEB128(long long value) {
+  while (value < -0x40 || 0x3f < value) {
+    contents_ += (value & 0x7f) | 0x80;
+    if (value < 0)
+      value = (value >> 7) | ~(((unsigned long long)-1) >> 7);
+    else
+      value = (value >> 7);
+  }
+  contents_ += value & 0x7f;
+  return *this;
+}
+
+Section& Section::ULEB128(uint64_t value) {
+  while (value > 0x7f) {
+    contents_ += (value & 0x7f) | 0x80;
+    value = (value >> 7);
+  }
+  contents_ += value;
+  return *this;
+}
+
+Section& Section::Align(size_t alignment, uint8_t pad_byte) {
+  // ALIGNMENT must be a power of two.
+  assert(((alignment - 1) & alignment) == 0);
+  size_t new_size = (contents_.size() + alignment - 1) & ~(alignment - 1);
+  contents_.append(new_size - contents_.size(), pad_byte);
+  assert((contents_.size() & (alignment - 1)) == 0);
+  return *this;
+}
+
+bool Section::GetContents(string* contents) {
+  // For each label reference, find the label's value, and patch it into
+  // the section's contents.
+  for (size_t i = 0; i < references_.size(); i++) {
+    Reference& r = references_[i];
+    uint64_t value;
+    if (!r.label.IsKnownConstant(&value)) {
+      fprintf(stderr, "Undefined label #%zu at offset 0x%zx\n", i, r.offset);
+      return false;
+    }
+    assert(r.offset < contents_.size());
+    assert(contents_.size() - r.offset >= r.size);
+    InsertEndian(r.endianness, r.size, value, contents_.begin() + r.offset);
+  }
+  contents->clear();
+  std::swap(contents_, *contents);
+  references_.clear();
+  return true;
+}
+
+}  // namespace test_assembler
+}  // namespace lul_test
+
+namespace lul_test {
+
+CFISection& CFISection::CIEHeader(uint64_t code_alignment_factor,
+                                  int data_alignment_factor,
+                                  unsigned return_address_register,
+                                  uint8_t version, const string& augmentation,
+                                  bool dwarf64) {
+  assert(!entry_length_);
+  entry_length_ = new PendingLength();
+  in_fde_ = false;
+
+  if (dwarf64) {
+    D32(kDwarf64InitialLengthMarker);
+    D64(entry_length_->length);
+    entry_length_->start = Here();
+    D64(eh_frame_ ? kEHFrame64CIEIdentifier : kDwarf64CIEIdentifier);
+  } else {
+    D32(entry_length_->length);
+    entry_length_->start = Here();
+    D32(eh_frame_ ? kEHFrame32CIEIdentifier : kDwarf32CIEIdentifier);
+  }
+  D8(version);
+  AppendCString(augmentation);
+  ULEB128(code_alignment_factor);
+  LEB128(data_alignment_factor);
+  if (version == 1)
+    D8(return_address_register);
+  else
+    ULEB128(return_address_register);
+  return *this;
+}
+
+CFISection& CFISection::FDEHeader(Label cie_pointer, uint64_t initial_location,
+                                  uint64_t address_range, bool dwarf64) {
+  assert(!entry_length_);
+  entry_length_ = new PendingLength();
+  in_fde_ = true;
+  fde_start_address_ = initial_location;
+
+  if (dwarf64) {
+    D32(0xffffffff);
+    D64(entry_length_->length);
+    entry_length_->start = Here();
+    if (eh_frame_)
+      D64(Here() - cie_pointer);
+    else
+      D64(cie_pointer);
+  } else {
+    D32(entry_length_->length);
+    entry_length_->start = Here();
+    if (eh_frame_)
+      D32(Here() - cie_pointer);
+    else
+      D32(cie_pointer);
+  }
+  EncodedPointer(initial_location);
+  // The FDE length in an .eh_frame section uses the same encoding as the
+  // initial location, but ignores the base address (selected by the upper
+  // nybble of the encoding), as it's a length, not an address that can be
+  // made relative.
+  EncodedPointer(address_range, DwarfPointerEncoding(pointer_encoding_ & 0x0f));
+  return *this;
+}
+
+CFISection& CFISection::FinishEntry() {
+  assert(entry_length_);
+  Align(address_size_, lul::DW_CFA_nop);
+  entry_length_->length = Here() - entry_length_->start;
+  delete entry_length_;
+  entry_length_ = NULL;
+  in_fde_ = false;
+  return *this;
+}
+
+CFISection& CFISection::EncodedPointer(uint64_t address,
+                                       DwarfPointerEncoding encoding,
+                                       const EncodedPointerBases& bases) {
+  // Omitted data is extremely easy to emit.
+  if (encoding == lul::DW_EH_PE_omit) return *this;
+
+  // If (encoding & lul::DW_EH_PE_indirect) != 0, then we assume
+  // that ADDRESS is the address at which the pointer is stored --- in
+  // other words, that bit has no effect on how we write the pointer.
+  encoding = DwarfPointerEncoding(encoding & ~lul::DW_EH_PE_indirect);
+
+  // Find the base address to which this pointer is relative. The upper
+  // nybble of the encoding specifies this.
+  uint64_t base;
+  switch (encoding & 0xf0) {
+    case lul::DW_EH_PE_absptr:
+      base = 0;
+      break;
+    case lul::DW_EH_PE_pcrel:
+      base = bases.cfi + Size();
+      break;
+    case lul::DW_EH_PE_textrel:
+      base = bases.text;
+      break;
+    case lul::DW_EH_PE_datarel:
+      base = bases.data;
+      break;
+    case lul::DW_EH_PE_funcrel:
+      base = fde_start_address_;
+      break;
+    case lul::DW_EH_PE_aligned:
+      base = 0;
+      break;
+    default:
+      abort();
+  };
+
+  // Make ADDRESS relative. Yes, this is appropriate even for "absptr"
+  // values; see gcc/unwind-pe.h.
+  address -= base;
+
+  // Align the pointer, if required.
+  if ((encoding & 0xf0) == lul::DW_EH_PE_aligned) Align(AddressSize());
+
+  // Append ADDRESS to this section in the appropriate form. For the
+  // fixed-width forms, we don't need to differentiate between signed and
+  // unsigned encodings, because ADDRESS has already been extended to 64
+  // bits before it was passed to us.
+  switch (encoding & 0x0f) {
+    case lul::DW_EH_PE_absptr:
+      Address(address);
+      break;
+
+    case lul::DW_EH_PE_uleb128:
+      ULEB128(address);
+      break;
+
+    case lul::DW_EH_PE_sleb128:
+      LEB128(address);
+      break;
+
+    case lul::DW_EH_PE_udata2:
+    case lul::DW_EH_PE_sdata2:
+      D16(address);
+      break;
+
+    case lul::DW_EH_PE_udata4:
+    case lul::DW_EH_PE_sdata4:
+      D32(address);
+      break;
+
+    case lul::DW_EH_PE_udata8:
+    case lul::DW_EH_PE_sdata8:
+      D64(address);
+      break;
+
+    default:
+      abort();
+  }
+
+  return *this;
+};
+
+}  // namespace lul_test
diff --git a/tools/profiler/tests/gtest/LulTestInfrastructure.h b/tools/profiler/tests/gtest/LulTestInfrastructure.h
new file mode 100644
index 0000000000..772579d538
--- /dev/null
+++ b/tools/profiler/tests/gtest/LulTestInfrastructure.h
@@ -0,0 +1,706 @@
+// -*- mode: C++ -*-
+
+// Copyright (c) 2010, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Original author: Jim Blandy <jimb@mozilla.com> <jimb@red-bean.com>
+
+// Derived from:
+// cfi_assembler.h: Define CFISection, a class for creating properly
+// (and improperly) formatted DWARF CFI data for unit tests.
+
+// Derived from:
+// test-assembler.h: interface to class for building complex binary streams.
+
+// To test the Breakpad symbol dumper and processor thoroughly, for
+// all combinations of host system and minidump processor
+// architecture, we need to be able to easily generate complex test
+// data like debugging information and minidump files.
+//
+// For example, if we want our unit tests to provide full code
+// coverage for stack walking, it may be difficult to persuade the
+// compiler to generate every possible sort of stack walking
+// information that we want to support; there are probably DWARF CFI
+// opcodes that GCC never emits. Similarly, if we want to test our
+// error handling, we will need to generate damaged minidumps or
+// debugging information that (we hope) the client or compiler will
+// never produce on its own.
+//
+// google_breakpad::TestAssembler provides a predictable and
+// (relatively) simple way to generate complex formatted data streams
+// like minidumps and CFI. Furthermore, because TestAssembler is
+// portable, developers without access to (say) Visual Studio or a
+// SPARC assembler can still work on test data for those targets.
+
+#ifndef LUL_TEST_INFRASTRUCTURE_H
+#define LUL_TEST_INFRASTRUCTURE_H
+
+#include <string>
+#include <vector>
+
+using std::string;
+using std::vector;
+
+namespace lul_test {
+namespace test_assembler {
+
+// A Label represents a value not yet known that we need to store in a
+// section. As long as all the labels a section refers to are defined
+// by the time we retrieve its contents as bytes, we can use undefined
+// labels freely in that section's construction.
+//
+// A label can be in one of three states:
+// - undefined,
+// - defined as the sum of some other label and a constant, or
+// - a constant.
+//
+// A label's value never changes, but it can accumulate constraints.
+// Adding labels and integers is permitted, and yields a label.
+// Subtracting a constant from a label is permitted, and also yields a
+// label. Subtracting two labels that have some relationship to each
+// other is permitted, and yields a constant.
+//
+// For example:
+//
+//   Label a;               // a's value is undefined
+//   Label b;               // b's value is undefined
+//   {
+//     Label c = a + 4;     // okay, even though a's value is unknown
+//     b = c + 4;           // also okay; b is now a+8
+//   }
+//   Label d = b - 2;       // okay; d == a+6, even though c is gone
+//   d.Value();             // error: d's value is not yet known
+//   d - a;                 // is 6, even though their values are not known
+//   a = 12;                // now b == 20, and d == 18
+//   d.Value();             // 18: no longer an error
+//   b.Value();             // 20
+//   d = 10;                // error: d is already defined.
+//
+// Label objects' lifetimes are unconstrained: notice that, in the
+// above example, even though a and b are only related through c, and
+// c goes out of scope, the assignment to a sets b's value as well. In
+// particular, it's not necessary to ensure that a Label lives beyond
+// Sections that refer to it.
+class Label {
+ public:
+  Label();                         // An undefined label.
+  explicit Label(uint64_t value);  // A label with a fixed value
+  Label(const Label& value);       // A label equal to another.
+  ~Label();
+
+  Label& operator=(uint64_t value);
+  Label& operator=(const Label& value);
+  Label operator+(uint64_t addend) const;
+  Label operator-(uint64_t subtrahend) const;
+  uint64_t operator-(const Label& subtrahend) const;
+
+  // We could also provide == and != that work on undefined, but
+  // related, labels.
+
+  // Return true if this label's value is known. If VALUE_P is given,
+  // set *VALUE_P to the known value if returning true.
+  bool IsKnownConstant(uint64_t* value_p = NULL) const;
+
+  // Return true if the offset from LABEL to this label is known. If
+  // OFFSET_P is given, set *OFFSET_P to the offset when returning true.
+  //
+  // You can think of l.KnownOffsetFrom(m, &d) as being like 'd = l-m',
+  // except that it also returns a value indicating whether the
+  // subtraction is possible given what we currently know of l and m.
+  // It can be possible even if we don't know l and m's values. For
+  // example:
+  //
+  //   Label l, m;
+  //   m = l + 10;
+  //   l.IsKnownConstant();             // false
+  //   m.IsKnownConstant();             // false
+  //   uint64_t d;
+  //   l.IsKnownOffsetFrom(m, &d);      // true, and sets d to -10.
+  //   l-m                              // -10
+  //   m-l                              // 10
+  //   m.Value()                        // error: m's value is not known
+  bool IsKnownOffsetFrom(const Label& label, uint64_t* offset_p = NULL) const;
+
+ private:
+  // A label's value, or if that is not yet known, how the value is
+  // related to other labels' values. A binding may be:
+  // - a known constant,
+  // - constrained to be equal to some other binding plus a constant, or
+  // - unconstrained, and free to take on any value.
+  //
+  // Many labels may point to a single binding, and each binding may
+  // refer to another, so bindings and labels form trees whose leaves
+  // are labels, whose interior nodes (and roots) are bindings, and
+  // where links point from children to parents. Bindings are
+  // reference counted, allowing labels to be lightweight, copyable,
+  // assignable, placed in containers, and so on.
+  class Binding {
+   public:
+    Binding();
+    explicit Binding(uint64_t addend);
+    ~Binding();
+
+    // Increment our reference count.
+    void Acquire() { reference_count_++; };
+    // Decrement our reference count, and return true if it is zero.
+    bool Release() { return --reference_count_ == 0; }
+
+    // Set this binding to be equal to BINDING + ADDEND. If BINDING is
+    // NULL, then set this binding to the known constant ADDEND.
+    // Update every binding on this binding's chain to point directly
+    // to BINDING, or to be a constant, with addends adjusted
+    // appropriately.
+    void Set(Binding* binding, uint64_t value);
+
+    // Return what we know about the value of this binding.
+    // - If this binding's value is a known constant, set BASE to
+    //   NULL, and set ADDEND to its value.
+    // - If this binding is not a known constant but related to other
+    //   bindings, set BASE to the binding at the end of the relation
+    //   chain (which will always be unconstrained), and set ADDEND to the
+    //   value to add to that binding's value to get this binding's
+    //   value.
+    // - If this binding is unconstrained, set BASE to this, and leave
+    //   ADDEND unchanged.
+    void Get(Binding** base, uint64_t* addend);
+
+   private:
+    // There are three cases:
+    //
+    // - A binding representing a known constant value has base_ NULL,
+    //   and addend_ equal to the value.
+    //
+    // - A binding representing a completely unconstrained value has
+    //   base_ pointing to this; addend_ is unused.
+    //
+    // - A binding whose value is related to some other binding's
+    //   value has base_ pointing to that other binding, and addend_
+    //   set to the amount to add to that binding's value to get this
+    //   binding's value. We only represent relationships of the form
+    //   x = y+c.
+    //
+    // Thus, the bind_ links form a chain terminating in either a
+    // known constant value or a completely unconstrained value. Most
+    // operations on bindings do path compression: they change every
+    // binding on the chain to point directly to the final value,
+    // adjusting addends as appropriate.
+    Binding* base_;
+    uint64_t addend_;
+
+    // The number of Labels and Bindings pointing to this binding.
+    // (When a binding points to itself, indicating a completely
+    // unconstrained binding, that doesn't count as a reference.)
+    int reference_count_;
+  };
+
+  // This label's value.
+  Binding* value_;
+};
+
+// Conventions for representing larger numbers as sequences of bytes.
+enum Endianness {
+  kBigEndian,     // Big-endian: the most significant byte comes first.
+  kLittleEndian,  // Little-endian: the least significant byte comes first.
+  kUnsetEndian,   // used internally
+};
+
+// A section is a sequence of bytes, constructed by appending bytes
+// to the end. Sections have a convenient and flexible set of member
+// functions for appending data in various formats: big-endian and
+// little-endian signed and unsigned values of different sizes;
+// LEB128 and ULEB128 values (see below), and raw blocks of bytes.
+//
+// If you need to append a value to a section that is not convenient
+// to compute immediately, you can create a label, append the
+// label's value to the section, and then set the label's value
+// later, when it's convenient to do so. Once a label's value is
+// known, the section class takes care of updating all previously
+// appended references to it.
+//
+// Once all the labels to which a section refers have had their
+// values determined, you can get a copy of the section's contents
+// as a string.
+//
+// Note that there is no specified "start of section" label. This is
+// because there are typically several different meanings for "the
+// start of a section": the offset of the section within an object
+// file, the address in memory at which the section's content appear,
+// and so on. It's up to the code that uses the Section class to
+// keep track of these explicitly, as they depend on the application.
+class Section {
+ public:
+  explicit Section(Endianness endianness = kUnsetEndian)
+      : endianness_(endianness){};
+
+  // A base class destructor should be either public and virtual,
+  // or protected and nonvirtual.
+  virtual ~Section(){};
+
+  // Return the default endianness of this section.
+  Endianness endianness() const { return endianness_; }
+
+  // Append the SIZE bytes at DATA to the end of this section. Return
+  // a reference to this section.
+  Section& Append(const string& data) {
+    contents_.append(data);
+    return *this;
+  };
+
+  // Append SIZE copies of BYTE to the end of this section. Return a
+  // reference to this section.
+  Section& Append(size_t size, uint8_t byte) {
+    contents_.append(size, (char)byte);
+    return *this;
+  }
+
+  // Append NUMBER to this section. ENDIANNESS is the endianness to
+  // use to write the number. SIZE is the length of the number in
+  // bytes. Return a reference to this section.
+  Section& Append(Endianness endianness, size_t size, uint64_t number);
+  Section& Append(Endianness endianness, size_t size, const Label& label);
+
+  // Append SECTION to the end of this section. The labels SECTION
+  // refers to need not be defined yet.
+  //
+  // Note that this has no effect on any Labels' values, or on
+  // SECTION. If placing SECTION within 'this' provides new
+  // constraints on existing labels' values, then it's up to the
+  // caller to fiddle with those labels as needed.
+  Section& Append(const Section& section);
+
+  // Append the contents of DATA as a series of bytes terminated by
+  // a NULL character.
+  Section& AppendCString(const string& data) {
+    Append(data);
+    contents_ += '\0';
+    return *this;
+  }
+
+  // Append VALUE or LABEL to this section, with the given bit width and
+  // endianness. Return a reference to this section.
+  //
+  // The names of these functions have the form <ENDIANNESS><BITWIDTH>:
+  // <ENDIANNESS> is either 'L' (little-endian, least significant byte first),
+  //                        'B' (big-endian, most significant byte first), or
+  //                        'D' (default, the section's default endianness)
+  // <BITWIDTH> is 8, 16, 32, or 64.
+  //
+  // Since endianness doesn't matter for a single byte, all the
+  // <BITWIDTH>=8 functions are equivalent.
+  //
+  // These can be used to write both signed and unsigned values, as
+  // the compiler will properly sign-extend a signed value before
+  // passing it to the function, at which point the function's
+  // behavior is the same either way.
+  Section& L8(uint8_t value) {
+    contents_ += value;
+    return *this;
+  }
+  Section& B8(uint8_t value) {
+    contents_ += value;
+    return *this;
+  }
+  Section& D8(uint8_t value) {
+    contents_ += value;
+    return *this;
+  }
+  Section &L16(uint16_t), &L32(uint32_t), &L64(uint64_t), &B16(uint16_t),
+      &B32(uint32_t), &B64(uint64_t), &D16(uint16_t), &D32(uint32_t),
+      &D64(uint64_t);
+  Section &L8(const Label&label), &L16(const Label&label),
+      &L32(const Label&label), &L64(const Label&label), &B8(const Label&label),
+      &B16(const Label&label), &B32(const Label&label), &B64(const Label&label),
+      &D8(const Label&label), &D16(const Label&label), &D32(const Label&label),
+      &D64(const Label&label);
+
+  // Append VALUE in a signed LEB128 (Little-Endian Base 128) form.
+  //
+  // The signed LEB128 representation of an integer N is a variable
+  // number of bytes:
+  //
+  // - If N is between -0x40 and 0x3f, then its signed LEB128
+  //   representation is a single byte whose value is N.
+  //
+  // - Otherwise, its signed LEB128 representation is (N & 0x7f) |
+  //   0x80, followed by the signed LEB128 representation of N / 128,
+  //   rounded towards negative infinity.
+  //
+  // In other words, we break VALUE into groups of seven bits, put
+  // them in little-endian order, and then write them as eight-bit
+  // bytes with the high bit on all but the last.
+  //
+  // Note that VALUE cannot be a Label (we would have to implement
+  // relaxation).
+  Section& LEB128(long long value);
+
+  // Append VALUE in unsigned LEB128 (Little-Endian Base 128) form.
+  //
+  // The unsigned LEB128 representation of an integer N is a variable
+  // number of bytes:
+  //
+  // - If N is between 0 and 0x7f, then its unsigned LEB128
+  //   representation is a single byte whose value is N.
+  //
+  // - Otherwise, its unsigned LEB128 representation is (N & 0x7f) |
+  //   0x80, followed by the unsigned LEB128 representation of N /
+  //   128, rounded towards negative infinity.
+  //
+  // Note that VALUE cannot be a Label (we would have to implement
+  // relaxation).
+  Section& ULEB128(uint64_t value);
+
+  // Jump to the next location aligned on an ALIGNMENT-byte boundary,
+  // relative to the start of the section. Fill the gap with PAD_BYTE.
+  // ALIGNMENT must be a power of two. Return a reference to this
+  // section.
+  Section& Align(size_t alignment, uint8_t pad_byte = 0);
+
+  // Return the current size of the section.
+  size_t Size() const { return contents_.size(); }
+
+  // Return a label representing the start of the section.
+  //
+  // It is up to the user whether this label represents the section's
+  // position in an object file, the section's address in memory, or
+  // what have you; some applications may need both, in which case
+  // this simple-minded interface won't be enough. This class only
+  // provides a single start label, for use with the Here and Mark
+  // member functions.
+  //
+  // Ideally, we'd provide this in a subclass that actually knows more
+  // about the application at hand and can provide an appropriate
+  // collection of start labels. But then the appending member
+  // functions like Append and D32 would return a reference to the
+  // base class, not the derived class, and the chaining won't work.
+  // Since the only value here is in pretty notation, that's a fatal
+  // flaw.
+  Label start() const { return start_; }
+
+  // Return a label representing the point at which the next Appended
+  // item will appear in the section, relative to start().
+  Label Here() const { return start_ + Size(); }
+
+  // Set *LABEL to Here, and return a reference to this section.
+  Section& Mark(Label* label) {
+    *label = Here();
+    return *this;
+  }
+
+  // If there are no undefined label references left in this
+  // section, set CONTENTS to the contents of this section, as a
+  // string, and clear this section. Return true on success, or false
+  // if there were still undefined labels.
+  bool GetContents(string* contents);
+
+ private:
+  // Used internally. A reference to a label's value.
+  struct Reference {
+    Reference(size_t set_offset, Endianness set_endianness, size_t set_size,
+              const Label& set_label)
+        : offset(set_offset),
+          endianness(set_endianness),
+          size(set_size),
+          label(set_label) {}
+
+    // The offset of the reference within the section.
+    size_t offset;
+
+    // The endianness of the reference.
+    Endianness endianness;
+
+    // The size of the reference.
+    size_t size;
+
+    // The label to which this is a reference.
+    Label label;
+  };
+
+  // The default endianness of this section.
+  Endianness endianness_;
+
+  // The contents of the section.
+  string contents_;
+
+  // References to labels within those contents.
+  vector<Reference> references_;
+
+  // A label referring to the beginning of the section.
+  Label start_;
+};
+
+}  // namespace test_assembler
+}  // namespace lul_test
+
+namespace lul_test {
+
+using lul::DwarfPointerEncoding;
+using lul_test::test_assembler::Endianness;
+using lul_test::test_assembler::Label;
+using lul_test::test_assembler::Section;
+
+class CFISection : public Section {
+ public:
+  // CFI augmentation strings beginning with 'z', defined by the
+  // Linux/IA-64 C++ ABI, can specify interesting encodings for
+  // addresses appearing in FDE headers and call frame instructions (and
+  // for additional fields whose presence the augmentation string
+  // specifies). In particular, pointers can be specified to be relative
+  // to various base address: the start of the .text section, the
+  // location holding the address itself, and so on. These allow the
+  // frame data to be position-independent even when they live in
+  // write-protected pages. These variants are specified at the
+  // following two URLs:
+  //
+  // http://refspecs.linux-foundation.org/LSB_4.0.0/LSB-Core-generic/LSB-Core-generic/dwarfext.html
+  // http://refspecs.linux-foundation.org/LSB_4.0.0/LSB-Core-generic/LSB-Core-generic/ehframechpt.html
+  //
+  // CFISection leaves the production of well-formed 'z'-augmented CIEs and
+  // FDEs to the user, but does provide EncodedPointer, to emit
+  // properly-encoded addresses for a given pointer encoding.
+  // EncodedPointer uses an instance of this structure to find the base
+  // addresses it should use; you can establish a default for all encoded
+  // pointers appended to this section with SetEncodedPointerBases.
+  struct EncodedPointerBases {
+    EncodedPointerBases() : cfi(), text(), data() {}
+
+    // The starting address of this CFI section in memory, for
+    // DW_EH_PE_pcrel. DW_EH_PE_pcrel pointers may only be used in data
+    // that has is loaded into the program's address space.
+    uint64_t cfi;
+
+    // The starting address of this file's .text section, for DW_EH_PE_textrel.
+    uint64_t text;
+
+    // The starting address of this file's .got or .eh_frame_hdr section,
+    // for DW_EH_PE_datarel.
+    uint64_t data;
+  };
+
+  // Create a CFISection whose endianness is ENDIANNESS, and where
+  // machine addresses are ADDRESS_SIZE bytes long. If EH_FRAME is
+  // true, use the .eh_frame format, as described by the Linux
+  // Standards Base Core Specification, instead of the DWARF CFI
+  // format.
+  CFISection(Endianness endianness, size_t address_size, bool eh_frame = false)
+      : Section(endianness),
+        address_size_(address_size),
+        eh_frame_(eh_frame),
+        pointer_encoding_(lul::DW_EH_PE_absptr),
+        encoded_pointer_bases_(),
+        entry_length_(NULL),
+        in_fde_(false) {
+    // The 'start', 'Here', and 'Mark' members of a CFISection all refer
+    // to section offsets.
+    start() = 0;
+  }
+
+  // Return this CFISection's address size.
+  size_t AddressSize() const { return address_size_; }
+
+  // Return true if this CFISection uses the .eh_frame format, or
+  // false if it contains ordinary DWARF CFI data.
+  bool ContainsEHFrame() const { return eh_frame_; }
+
+  // Use ENCODING for pointers in calls to FDEHeader and EncodedPointer.
+  void SetPointerEncoding(DwarfPointerEncoding encoding) {
+    pointer_encoding_ = encoding;
+  }
+
+  // Use the addresses in BASES as the base addresses for encoded
+  // pointers in subsequent calls to FDEHeader or EncodedPointer.
+  // This function makes a copy of BASES.
+  void SetEncodedPointerBases(const EncodedPointerBases& bases) {
+    encoded_pointer_bases_ = bases;
+  }
+
+  // Append a Common Information Entry header to this section with the
+  // given values. If dwarf64 is true, use the 64-bit DWARF initial
+  // length format for the CIE's initial length. Return a reference to
+  // this section. You should call FinishEntry after writing the last
+  // instruction for the CIE.
+  //
+  // Before calling this function, you will typically want to use Mark
+  // or Here to make a label to pass to FDEHeader that refers to this
+  // CIE's position in the section.
+  CFISection& CIEHeader(uint64_t code_alignment_factor,
+                        int data_alignment_factor,
+                        unsigned return_address_register, uint8_t version = 3,
+                        const string& augmentation = "", bool dwarf64 = false);
+
+  // Append a Frame Description Entry header to this section with the
+  // given values. If dwarf64 is true, use the 64-bit DWARF initial
+  // length format for the CIE's initial length. Return a reference to
+  // this section. You should call FinishEntry after writing the last
+  // instruction for the CIE.
+  //
+  // This function doesn't support entries that are longer than
+  // 0xffffff00 bytes. (The "initial length" is always a 32-bit
+  // value.) Nor does it support .debug_frame sections longer than
+  // 0xffffff00 bytes.
+  CFISection& FDEHeader(Label cie_pointer, uint64_t initial_location,
+                        uint64_t address_range, bool dwarf64 = false);
+
+  // Note the current position as the end of the last CIE or FDE we
+  // started, after padding with DW_CFA_nops for alignment. This
+  // defines the label representing the entry's length, cited in the
+  // entry's header. Return a reference to this section.
+  CFISection& FinishEntry();
+
+  // Append the contents of BLOCK as a DW_FORM_block value: an
+  // unsigned LEB128 length, followed by that many bytes of data.
+  CFISection& Block(const string& block) {
+    ULEB128(block.size());
+    Append(block);
+    return *this;
+  }
+
+  // Append ADDRESS to this section, in the appropriate size and
+  // endianness. Return a reference to this section.
+  CFISection& Address(uint64_t address) {
+    Section::Append(endianness(), address_size_, address);
+    return *this;
+  }
+
+  // Append ADDRESS to this section, using ENCODING and BASES. ENCODING
+  // defaults to this section's default encoding, established by
+  // SetPointerEncoding. BASES defaults to this section's bases, set by
+  // SetEncodedPointerBases. If the DW_EH_PE_indirect bit is set in the
+  // encoding, assume that ADDRESS is where the true address is stored.
+  // Return a reference to this section.
+  //
+  // (C++ doesn't let me use default arguments here, because I want to
+  // refer to members of *this in the default argument expression.)
+  CFISection& EncodedPointer(uint64_t address) {
+    return EncodedPointer(address, pointer_encoding_, encoded_pointer_bases_);
+  }
+  CFISection& EncodedPointer(uint64_t address, DwarfPointerEncoding encoding) {
+    return EncodedPointer(address, encoding, encoded_pointer_bases_);
+  }
+  CFISection& EncodedPointer(uint64_t address, DwarfPointerEncoding encoding,
+                             const EncodedPointerBases& bases);
+
+  // Restate some member functions, to keep chaining working nicely.
+  CFISection& Mark(Label* label) {
+    Section::Mark(label);
+    return *this;
+  }
+  CFISection& D8(uint8_t v) {
+    Section::D8(v);
+    return *this;
+  }
+  CFISection& D16(uint16_t v) {
+    Section::D16(v);
+    return *this;
+  }
+  CFISection& D16(Label v) {
+    Section::D16(v);
+    return *this;
+  }
+  CFISection& D32(uint32_t v) {
+    Section::D32(v);
+    return *this;
+  }
+  CFISection& D32(const Label& v) {
+    Section::D32(v);
+    return *this;
+  }
+  CFISection& D64(uint64_t v) {
+    Section::D64(v);
+    return *this;
+  }
+  CFISection& D64(const Label& v) {
+    Section::D64(v);
+    return *this;
+  }
+  CFISection& LEB128(long long v) {
+    Section::LEB128(v);
+    return *this;
+  }
+  CFISection& ULEB128(uint64_t v) {
+    Section::ULEB128(v);
+    return *this;
+  }
+
+ private:
+  // A length value that we've appended to the section, but is not yet
+  // known. LENGTH is the appended value; START is a label referring
+  // to the start of the data whose length was cited.
+  struct PendingLength {
+    Label length;
+    Label start;
+  };
+
+  // Constants used in CFI/.eh_frame data:
+
+  // If the first four bytes of an "initial length" are this constant, then
+  // the data uses the 64-bit DWARF format, and the length itself is the
+  // subsequent eight bytes.
+  static const uint32_t kDwarf64InitialLengthMarker = 0xffffffffU;
+
+  // The CIE identifier for 32- and 64-bit DWARF CFI and .eh_frame data.
+  static const uint32_t kDwarf32CIEIdentifier = ~(uint32_t)0;
+  static const uint64_t kDwarf64CIEIdentifier = ~(uint64_t)0;
+  static const uint32_t kEHFrame32CIEIdentifier = 0;
+  static const uint64_t kEHFrame64CIEIdentifier = 0;
+
+  // The size of a machine address for the data in this section.
+  size_t address_size_;
+
+  // If true, we are generating a Linux .eh_frame section, instead of
+  // a standard DWARF .debug_frame section.
+  bool eh_frame_;
+
+  // The encoding to use for FDE pointers.
+  DwarfPointerEncoding pointer_encoding_;
+
+  // The base addresses to use when emitting encoded pointers.
+  EncodedPointerBases encoded_pointer_bases_;
+
+  // The length value for the current entry.
+  //
+  // Oddly, this must be dynamically allocated. Labels never get new
+  // values; they only acquire constraints on the value they already
+  // have, or assert if you assign them something incompatible. So
+  // each header needs truly fresh Label objects to cite in their
+  // headers and track their positions. The alternative is explicit
+  // destructor invocation and a placement new. Ick.
+  PendingLength* entry_length_;
+
+  // True if we are currently emitting an FDE --- that is, we have
+  // called FDEHeader but have not yet called FinishEntry.
+  bool in_fde_;
+
+  // If in_fde_ is true, this is its starting address. We use this for
+  // emitting DW_EH_PE_funcrel pointers.
+  uint64_t fde_start_address_;
+};
+
+}  // namespace lul_test
+
+#endif  // LUL_TEST_INFRASTRUCTURE_H
diff --git a/tools/profiler/tests/gtest/ThreadProfileTest.cpp b/tools/profiler/tests/gtest/ThreadProfileTest.cpp
new file mode 100644
index 0000000000..ef54de4940
--- /dev/null
+++ b/tools/profiler/tests/gtest/ThreadProfileTest.cpp
@@ -0,0 +1,57 @@
+
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProfileBuffer.h"
+#include "ThreadInfo.h"
+
+#include "mozilla/PowerOfTwo.h"
+#include "mozilla/ProfileBufferChunkManagerWithLocalLimit.h"
+#include "mozilla/ProfileChunkedBuffer.h"
+
+#include "gtest/gtest.h"
+
+// Make sure we can record one entry and read it
+TEST(ThreadProfile, InsertOneEntry)
+{
+  mozilla::ProfileBufferChunkManagerWithLocalLimit chunkManager(
+      2 * (1 + uint32_t(sizeof(ProfileBufferEntry))) * 4,
+      2 * (1 + uint32_t(sizeof(ProfileBufferEntry))));
+  mozilla::ProfileChunkedBuffer profileChunkedBuffer(
+      mozilla::ProfileChunkedBuffer::ThreadSafety::WithMutex, chunkManager);
+  auto pb = mozilla::MakeUnique<ProfileBuffer>(profileChunkedBuffer);
+  pb->AddEntry(ProfileBufferEntry::Time(123.1));
+  ProfileBufferEntry entry = pb->GetEntry(pb->BufferRangeStart());
+  ASSERT_TRUE(entry.IsTime());
+  ASSERT_EQ(123.1, entry.GetDouble());
+}
+
+// See if we can insert some entries
+TEST(ThreadProfile, InsertEntriesNoWrap)
+{
+  mozilla::ProfileBufferChunkManagerWithLocalLimit chunkManager(
+      100 * (1 + uint32_t(sizeof(ProfileBufferEntry))),
+      100 * (1 + uint32_t(sizeof(ProfileBufferEntry))) / 4);
+  mozilla::ProfileChunkedBuffer profileChunkedBuffer(
+      mozilla::ProfileChunkedBuffer::ThreadSafety::WithMutex, chunkManager);
+  auto pb = mozilla::MakeUnique<ProfileBuffer>(profileChunkedBuffer);
+  const int test_size = 50;
+  for (int i = 0; i < test_size; i++) {
+    pb->AddEntry(ProfileBufferEntry::Time(i));
+  }
+  int times = 0;
+  uint64_t readPos = pb->BufferRangeStart();
+  while (readPos != pb->BufferRangeEnd()) {
+    ProfileBufferEntry entry = pb->GetEntry(readPos);
+    readPos++;
+    if (entry.GetKind() == ProfileBufferEntry::Kind::INVALID) {
+      continue;
+    }
+    ASSERT_TRUE(entry.IsTime());
+    ASSERT_EQ(times, entry.GetDouble());
+    times++;
+  }
+  ASSERT_EQ(test_size, times);
+}
diff --git a/tools/profiler/tests/gtest/moz.build b/tools/profiler/tests/gtest/moz.build
new file mode 100644
index 0000000000..b8ea860514
--- /dev/null
+++ b/tools/profiler/tests/gtest/moz.build
@@ -0,0 +1,43 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at http://mozilla.org/MPL/2.0/.
+
+if CONFIG["OS_TARGET"] in ("Android", "Linux") and CONFIG["CPU_ARCH"] in (
+    "arm",
+    "aarch64",
+    "x86",
+    "x86_64",
+):
+    UNIFIED_SOURCES += [
+        "LulTest.cpp",
+        "LulTestDwarf.cpp",
+        "LulTestInfrastructure.cpp",
+    ]
+
+LOCAL_INCLUDES += [
+    "/netwerk/base",
+    "/netwerk/protocol/http",
+    "/toolkit/components/jsoncpp/include",
+    "/tools/profiler/core",
+    "/tools/profiler/gecko",
+    "/tools/profiler/lul",
+]
+
+if CONFIG["OS_TARGET"] != "Android":
+    UNIFIED_SOURCES += [
+        "GeckoProfiler.cpp",
+        "ThreadProfileTest.cpp",
+    ]
+
+USE_LIBS += [
+    "jsoncpp",
+]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+FINAL_LIBRARY = "xul-gtest"
+
+if CONFIG["CC_TYPE"] in ("clang", "gcc"):
+    CXXFLAGS += ["-Wno-error=shadow"]
diff --git a/tools/profiler/tests/shared-head.js b/tools/profiler/tests/shared-head.js
new file mode 100644
index 0000000000..ffcdc5d361
--- /dev/null
+++ b/tools/profiler/tests/shared-head.js
@@ -0,0 +1,216 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * This file contains utilities that can be shared between xpcshell tests and mochitests.
+ */
+
+// The marker phases.
+const INSTANT = 0;
+const INTERVAL = 1;
+const INTERVAL_START = 2;
+const INTERVAL_END = 3;
+
+// This Services declaration may shadow another from head.js, so define it as
+// a var rather than a const.
+var { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm");
+
+const defaultSettings = {
+  entries: 8 * 1024 * 1024, // 8M entries = 64MB
+  interval: 1, // ms
+  features: ["threads"],
+  threads: ["GeckoMain"],
+};
+
+function startProfiler(callersSettings) {
+  if (Services.profiler.IsActive()) {
+    throw new Error(
+      "The profiler must not be active before starting it in a test."
+    );
+  }
+  const settings = Object.assign({}, defaultSettings, callersSettings);
+  Services.profiler.StartProfiler(
+    settings.entries,
+    settings.interval,
+    settings.features,
+    settings.threads,
+    0,
+    settings.duration
+  );
+}
+
+/**
+ * This is a helper function be able to run `await wait(500)`. Unfortunately
+ * this is needed as the act of collecting functions relies on the periodic
+ * sampling of the threads. See:
+ * https://bugzilla.mozilla.org/show_bug.cgi?id=1529053
+ *
+ * @param {number} time
+ * @returns {Promise}
+ */
+function wait(time) {
+  return new Promise(resolve => {
+    // eslint-disable-next-line mozilla/no-arbitrary-setTimeout
+    setTimeout(resolve, time);
+  });
+}
+
+/**
+ * Get the payloads of a type recursively, including from all subprocesses.
+ *
+ * @param {Object} profile The gecko profile.
+ * @param {string} type The marker payload type, e.g. "DiskIO".
+ * @param {Array} payloadTarget The recursive list of payloads.
+ * @return {Array} The final payloads.
+ */
+function getPayloadsOfTypeFromAllThreads(profile, type, payloadTarget = []) {
+  for (const { markers } of profile.threads) {
+    for (const markerTuple of markers.data) {
+      const payload = markerTuple[markers.schema.data];
+      if (payload && payload.type === type) {
+        payloadTarget.push(payload);
+      }
+    }
+  }
+
+  for (const subProcess of profile.processes) {
+    getPayloadsOfTypeFromAllThreads(subProcess, type, payloadTarget);
+  }
+
+  return payloadTarget;
+}
+
+/**
+ * Get the payloads of a type from a single thread.
+ *
+ * @param {Object} thread The thread from a profile.
+ * @param {string} type The marker payload type, e.g. "DiskIO".
+ * @return {Array} The payloads.
+ */
+function getPayloadsOfType(thread, type) {
+  const { markers } = thread;
+  const results = [];
+  for (const markerTuple of markers.data) {
+    const payload = markerTuple[markers.schema.data];
+    if (payload && payload.type === type) {
+      results.push(payload);
+    }
+  }
+  return results;
+}
+
+/**
+ * Applies the marker schema to create individual objects for each marker
+ *
+ * @param {Object} thread The thread from a profile.
+ * @return {InflatedMarker[]} The markers.
+ */
+function getInflatedMarkerData(thread) {
+  const { markers, stringTable } = thread;
+  return markers.data.map(markerTuple => {
+    const marker = {};
+    for (const [key, tupleIndex] of Object.entries(markers.schema)) {
+      marker[key] = markerTuple[tupleIndex];
+      if (key === "name") {
+        // Use the string from the string table.
+        marker[key] = stringTable[marker[key]];
+      }
+    }
+    return marker;
+  });
+}
+
+/**
+ * It can be helpful to force the profiler to collect a JavaScript sample. This
+ * function spins on a while loop until at least one more sample is collected.
+ *
+ * @return {number} The index of the collected sample.
+ */
+function captureAtLeastOneJsSample() {
+  function getProfileSampleCount() {
+    const profile = Services.profiler.getProfileData();
+    return profile.threads[0].samples.data.length;
+  }
+
+  const sampleCount = getProfileSampleCount();
+  // Create an infinite loop until a sample has been collected.
+  while (true) {
+    if (sampleCount < getProfileSampleCount()) {
+      return sampleCount;
+    }
+  }
+}
+
+/**
+ * This function pauses the profiler before getting the profile. Then after the
+ * getting the data, the profiler is stopped, and all profiler data is removed.
+ * @returns {Promise<Profile>}
+ */
+async function stopAndGetProfile() {
+  Services.profiler.Pause();
+  const profile = await Services.profiler.getProfileDataAsync();
+  Services.profiler.StopProfiler();
+  return profile;
+}
+
+/**
+ * Verifies that a marker is an interval marker.
+ *
+ * @param {InflatedMarker} marker
+ * @returns {boolean}
+ */
+function isIntervalMarker(inflatedMarker) {
+  return (
+    inflatedMarker.phase === 1 &&
+    typeof inflatedMarker.startTime === "number" &&
+    typeof inflatedMarker.endTime === "number"
+  );
+}
+
+/**
+ * @param {Profile} profile
+ * @returns {Thread[]}
+ */
+function getThreads(profile) {
+  const threads = [];
+
+  function getThreadsRecursive(process) {
+    for (const thread of process.threads) {
+      threads.push(thread);
+    }
+    for (const subprocess of process.processes) {
+      getThreadsRecursive(subprocess);
+    }
+  }
+
+  getThreadsRecursive(profile);
+  return threads;
+}
+
+/**
+ * Find a specific marker schema from any process of a profile.
+ *
+ * @param {Profile} profile
+ * @param {string} name
+ * @returns {MarkerSchema}
+ */
+function getSchema(profile, name) {
+  {
+    const schema = profile.meta.markerSchema.find(s => s.name === name);
+    if (schema) {
+      return schema;
+    }
+  }
+  for (const subprocess of profile.processes) {
+    const schema = subprocess.meta.markerSchema.find(s => s.name === name);
+    if (schema) {
+      return schema;
+    }
+  }
+  console.error("Parent process schema", profile.meta.markerSchema);
+  for (const subprocess of profile.processes) {
+    console.error("Child process schema", subprocess.meta.markerSchema);
+  }
+  throw new Error(`Could not find a schema for "${name}".`);
+}
diff --git a/tools/profiler/tests/xpcshell/head.js b/tools/profiler/tests/xpcshell/head.js
new file mode 100644
index 0000000000..fd133d1607
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/head.js
@@ -0,0 +1,242 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* import-globals-from ../shared-head.js */
+
+// This Services declaration may shadow another from head.js, so define it as
+// a var rather than a const.
+var { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm");
+
+const { AppConstants } = ChromeUtils.import(
+  "resource://gre/modules/AppConstants.jsm"
+);
+const { setTimeout } = ChromeUtils.import("resource://gre/modules/Timer.jsm");
+
+// Load the shared head
+const sharedHead = do_get_file("shared-head.js", false);
+if (!sharedHead) {
+  throw new Error("Could not load the shared head.");
+}
+Services.scriptloader.loadSubScript(
+  Services.io.newFileURI(sharedHead).spec,
+  this
+);
+
+/**
+ * This function takes a thread, and a sample tuple from the "data" array, and
+ * inflates the frame to be an array of strings.
+ *
+ * @param {Object} thread - The thread from the profile.
+ * @param {Array} sample - The tuple from the thread.samples.data array.
+ * @returns {Array<string>} An array of function names.
+ */
+function getInflatedStackLocations(thread, sample) {
+  let stackTable = thread.stackTable;
+  let frameTable = thread.frameTable;
+  let stringTable = thread.stringTable;
+  let SAMPLE_STACK_SLOT = thread.samples.schema.stack;
+  let STACK_PREFIX_SLOT = stackTable.schema.prefix;
+  let STACK_FRAME_SLOT = stackTable.schema.frame;
+  let FRAME_LOCATION_SLOT = frameTable.schema.location;
+
+  // Build the stack from the raw data and accumulate the locations in
+  // an array.
+  let stackIndex = sample[SAMPLE_STACK_SLOT];
+  let locations = [];
+  while (stackIndex !== null) {
+    let stackEntry = stackTable.data[stackIndex];
+    let frame = frameTable.data[stackEntry[STACK_FRAME_SLOT]];
+    locations.push(stringTable[frame[FRAME_LOCATION_SLOT]]);
+    stackIndex = stackEntry[STACK_PREFIX_SLOT];
+  }
+
+  // The profiler tree is inverted, so reverse the array.
+  return locations.reverse();
+}
+
+/**
+ * This utility matches up stacks to see if they contain a certain sequence of
+ * stack frames. A correctly functioning profiler will have a certain sequence
+ * of stacks, but we can't always determine exactly which stacks will show up
+ * due to implementation changes, as well as memory addresses being arbitrary to
+ * that particular build.
+ *
+ * This function triggers a test failure with a nice debug message when it
+ * fails.
+ *
+ * @param {Array<string>} actualStackFrames - As generated by
+ *     inflatedStackFrames.
+ * @param {Array<string | RegExp>} expectedStackFrames - Matches a subset of
+ *     actualStackFrames
+ */
+function expectStackToContain(
+  actualStackFrames,
+  expectedStackFrames,
+  message = "The actual stack and expected stack do not match."
+) {
+  // Log the stacks that are being passed to this assertion, as it could be
+  // useful for when these tests fail.
+  console.log("Actual stack: ", actualStackFrames);
+  console.log(
+    "Expected to contain: ",
+    expectedStackFrames.map(s => s.toString())
+  );
+
+  let actualIndex = 0;
+
+  // Start walking the expected stack and look for matches.
+  for (
+    let expectedIndex = 0;
+    expectedIndex < expectedStackFrames.length;
+    expectedIndex++
+  ) {
+    const expectedStackFrame = expectedStackFrames[expectedIndex];
+
+    while (true) {
+      // Make sure that we haven't run out of actual stack frames.
+      if (actualIndex >= actualStackFrames.length) {
+        info(`Could not find a match for: "${expectedStackFrame.toString()}"`);
+        Assert.ok(false, message);
+      }
+
+      const actualStackFrame = actualStackFrames[actualIndex];
+      actualIndex++;
+
+      const itMatches =
+        typeof expectedStackFrame === "string"
+          ? expectedStackFrame === actualStackFrame
+          : actualStackFrame.match(expectedStackFrame);
+
+      if (itMatches) {
+        // We found a match, break out of this loop.
+        break;
+      }
+      // Keep on looping looking for a match.
+    }
+  }
+
+  Assert.ok(true, message);
+}
+
+/**
+ * @param {Thread} thread
+ * @param {string} filename - The filename used to trigger FileIO.
+ * @returns {InflatedMarkers[]}
+ */
+function getInflatedFileIOMarkers(thread, filename) {
+  const markers = getInflatedMarkerData(thread);
+  return markers.filter(
+    marker =>
+      marker.data?.type === "FileIO" && marker.data?.filename.endsWith(filename)
+  );
+}
+
+/**
+ * Checks properties common to all FileIO markers.
+ *
+ * @param {InflatedMarkers[]} markers
+ * @param {string} filename
+ */
+function checkInflatedFileIOMarkers(markers, filename) {
+  greater(markers.length, 0, "Found some markers");
+
+  // See IOInterposeObserver::Observation::ObservedOperationString
+  const validOperations = new Set([
+    "write",
+    "fsync",
+    "close",
+    "stat",
+    "create/open",
+    "read",
+  ]);
+  const validSources = new Set(["PoisonIOInterposer", "NSPRIOInterposer"]);
+
+  for (const marker of markers) {
+    try {
+      ok(
+        marker.name.startsWith("FileIO"),
+        "Has a marker.name that starts with FileIO"
+      );
+      equal(marker.data.type, "FileIO", "Has a marker.data.type");
+      ok(isIntervalMarker(marker), "All FileIO markers are interval markers");
+      ok(
+        validOperations.has(marker.data.operation),
+        `The markers have a known operation - "${marker.data.operation}"`
+      );
+      ok(
+        validSources.has(marker.data.source),
+        `The FileIO marker has a known source "${marker.data.source}"`
+      );
+      ok(marker.data.filename.endsWith(filename));
+      ok(Boolean(marker.data.stack), "A stack was collected");
+    } catch (error) {
+      console.error("Failing inflated FileIO marker:", marker);
+      throw error;
+    }
+  }
+}
+
+/**
+ * Do deep equality checks for schema, but then surface nice errors for a user to know
+ * what to do if the check fails.
+ */
+function checkSchema(actual, expected) {
+  const schemaName = expected.name;
+  info(`Checking marker schema for "${schemaName}"`);
+
+  try {
+    ok(
+      actual,
+      `Schema was found for "${schemaName}". See the test output for more information.`
+    );
+    // Check individual properties to surface easier to debug errors.
+    deepEqual(
+      expected.display,
+      actual.display,
+      `The "display" property for ${schemaName} schema matches. See the test output for more information.`
+    );
+    if (expected.data) {
+      ok(actual.data, `Schema was found for "${schemaName}"`);
+      for (const expectedDatum of expected.data) {
+        const actualDatum = actual.data.find(d => d.key === expectedDatum.key);
+        deepEqual(
+          expectedDatum,
+          actualDatum,
+          `The "${schemaName}" field "${expectedDatum.key}" matches expectations. See the test output for more information.`
+        );
+      }
+      equal(
+        expected.data.length,
+        actual.data.length,
+        "The expected and actual data have the same number of items"
+      );
+    }
+
+    // Finally do a true deep equal.
+    deepEqual(expected, actual, "The entire schema is deepEqual");
+  } catch (error) {
+    // The test results are not very human readable. This is a bit of a hacky
+    // solution to make it more readable.
+    dump("-----------------------------------------------------\n");
+    dump("The expected marker schema:\n");
+    dump("-----------------------------------------------------\n");
+    dump(JSON.stringify(expected, null, 2));
+    dump("\n");
+    dump("-----------------------------------------------------\n");
+    dump("The actual marker schema:\n");
+    dump("-----------------------------------------------------\n");
+    dump(JSON.stringify(actual, null, 2));
+    dump("\n");
+    dump("-----------------------------------------------------\n");
+    dump("A marker schema was not equal to expectations. If you\n");
+    dump("are modifying the schema, then please copy and paste\n");
+    dump("the new schema into this test.\n");
+    dump("-----------------------------------------------------\n");
+    dump("Copy this: " + JSON.stringify(actual));
+    dump("\n");
+    dump("-----------------------------------------------------\n");
+
+    throw error;
+  }
+}
diff --git a/tools/profiler/tests/xpcshell/test_active_configuration.js b/tools/profiler/tests/xpcshell/test_active_configuration.js
new file mode 100644
index 0000000000..10c3ff6a0f
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_active_configuration.js
@@ -0,0 +1,118 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function run_test() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  info(
+    "Checking that the profiler can fetch the information about the active " +
+      "configuration that is being used to power the profiler."
+  );
+
+  equal(
+    Services.profiler.activeConfiguration,
+    null,
+    "When the profile is off, there is no active configuration."
+  );
+
+  {
+    info("Start the profiler.");
+    const entries = 10000;
+    const interval = 1;
+    const threads = ["GeckoMain"];
+    const features = ["js", "leaf", "threads"];
+    const activeBrowsingContextID = 123;
+    Services.profiler.StartProfiler(
+      entries,
+      interval,
+      features,
+      threads,
+      activeBrowsingContextID
+    );
+
+    info("Generate the activeConfiguration.");
+    const { activeConfiguration } = Services.profiler;
+    const expectedConfiguration = {
+      interval,
+      threads,
+      features,
+      activeBrowsingContextID,
+      // The buffer is created as a power of two that can fit all of the entires
+      // into it. If the ratio of entries to buffer size ever changes, this setting
+      // will need to be updated.
+      capacity: Math.pow(2, 14),
+    };
+
+    deepEqual(
+      activeConfiguration,
+      expectedConfiguration,
+      "The active configuration matches configuration given."
+    );
+
+    info("Get the profile.");
+    const profile = Services.profiler.getProfileData();
+    deepEqual(
+      profile.meta.configuration,
+      expectedConfiguration,
+      "The configuration also matches on the profile meta object."
+    );
+  }
+
+  {
+    const entries = 20000;
+    const interval = 0.5;
+    const threads = ["GeckoMain", "DOM Worker"];
+    const features = ["threads"];
+    const activeBrowsingContextID = 111;
+    const duration = 20;
+
+    info("Restart the profiler with a new configuration.");
+    Services.profiler.StartProfiler(
+      entries,
+      interval,
+      features,
+      threads,
+      activeBrowsingContextID,
+      // Also start it with duration, this property is optional.
+      duration
+    );
+
+    info("Generate the activeConfiguration.");
+    const { activeConfiguration } = Services.profiler;
+    const expectedConfiguration = {
+      interval,
+      threads,
+      features,
+      activeBrowsingContextID,
+      duration,
+      // The buffer is created as a power of two that can fit all of the entires
+      // into it. If the ratio of entries to buffer size ever changes, this setting
+      // will need to be updated.
+      capacity: Math.pow(2, 15),
+    };
+
+    deepEqual(
+      activeConfiguration,
+      expectedConfiguration,
+      "The active configuration matches the new configuration."
+    );
+
+    info("Get the profile.");
+    const profile = Services.profiler.getProfileData();
+    deepEqual(
+      profile.meta.configuration,
+      expectedConfiguration,
+      "The configuration also matches on the profile meta object."
+    );
+  }
+
+  Services.profiler.StopProfiler();
+
+  equal(
+    Services.profiler.activeConfiguration,
+    null,
+    "When the profile is off, there is no active configuration."
+  );
+}
diff --git a/tools/profiler/tests/xpcshell/test_addProfilerMarker.js b/tools/profiler/tests/xpcshell/test_addProfilerMarker.js
new file mode 100644
index 0000000000..f3cba5843d
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_addProfilerMarker.js
@@ -0,0 +1,184 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Test that ChromeUtils.addProfilerMarker is working correctly.
+ */
+
+const markerNamePrefix = "test_addProfilerMarker";
+const markerText = "Text payload";
+// The same startTime will be used for all markers with a duration,
+// and we store this value globally so that expectDuration and
+// expectNoDuration can access it. The value isn't set here as we
+// want a start time after the profiler has started
+var startTime;
+
+function expectNoDuration(marker) {
+  Assert.equal(
+    typeof marker.startTime,
+    "number",
+    "startTime should be a number"
+  );
+  Assert.greater(
+    marker.startTime,
+    startTime,
+    "startTime should be after the begining of the test"
+  );
+  Assert.equal(typeof marker.endTime, "number", "endTime should be a number");
+  Assert.equal(marker.endTime, 0, "endTime should be 0");
+}
+
+function expectDuration(marker) {
+  Assert.equal(
+    typeof marker.startTime,
+    "number",
+    "startTime should be a number"
+  );
+  Assert.equal(
+    Math.round(marker.startTime * 10 ** 6) / 10 ** 6,
+    startTime,
+    "startTime should be the expected time"
+  );
+  Assert.equal(typeof marker.endTime, "number", "endTime should be a number");
+  Assert.greater(
+    marker.endTime,
+    startTime,
+    "endTime should be after startTime"
+  );
+}
+
+function expectNoData(marker) {
+  Assert.equal(
+    typeof marker.data,
+    "undefined",
+    "The data property should be undefined"
+  );
+}
+
+function expectText(marker) {
+  Assert.equal(
+    typeof marker.data,
+    "object",
+    "The data property should be an object"
+  );
+  Assert.equal(marker.data.type, "Text", "Should be a Text marker");
+  Assert.equal(
+    marker.data.name,
+    markerText,
+    "The payload should contain the expected text"
+  );
+}
+
+function expectNoStack(marker) {
+  Assert.ok(!marker.data || !marker.data.stack, "There should be no stack");
+}
+
+function expectStack(marker) {
+  Assert.ok(marker.data.stack, "There should be a stack");
+}
+
+add_task(async () => {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  startProfiler();
+  startTime = Math.round(Cu.now() * 10 ** 6) / 10 ** 6;
+  info("startTime used for markers with durations: " + startTime);
+
+  /* Each call to testMarker will record a marker with a unique name.
+   * The testFunctions and testCases objects contain respectively test
+   * functions to verify that the marker found in the captured profile
+   * matches expectations, and a string that can be printed to describe
+   * in which way ChromeUtils.addProfilerMarker was called. */
+  let testFunctions = {};
+  let testCases = {};
+  let markerId = 0;
+  function testMarker(args, checks) {
+    let name = markerNamePrefix + markerId++;
+    ChromeUtils.addProfilerMarker(name, ...args);
+    testFunctions[name] = checks;
+    testCases[name] = `ChromeUtils.addProfilerMarker(${[name, ...args]
+      .toSource()
+      .slice(1, -1)})`;
+  }
+
+  info("Record markers without options object.");
+  testMarker([], m => {
+    expectNoDuration(m);
+    expectNoData(m);
+  });
+  testMarker([startTime], m => {
+    expectDuration(m);
+    expectNoData(m);
+  });
+  testMarker([undefined, markerText], m => {
+    expectNoDuration(m);
+    expectText(m);
+  });
+  testMarker([startTime, markerText], m => {
+    expectDuration(m);
+    expectText(m);
+  });
+
+  info("Record markers providing the duration as the startTime property.");
+  testMarker([{ startTime }], m => {
+    expectDuration(m);
+    expectNoData(m);
+  });
+  testMarker([{}, markerText], m => {
+    expectNoDuration(m);
+    expectText(m);
+  });
+  testMarker([{ startTime }, markerText], m => {
+    expectDuration(m);
+    expectText(m);
+  });
+
+  info("Record markers to test the captureStack property.");
+  const captureStack = true;
+  testMarker([], expectNoStack);
+  testMarker([startTime, markerText], expectNoStack);
+  testMarker([{ captureStack: false }], expectNoStack);
+  testMarker([{ captureStack }], expectStack);
+  testMarker([{ startTime, captureStack }], expectStack);
+  testMarker([{ captureStack }, markerText], expectStack);
+  testMarker([{ startTime, captureStack }, markerText], expectStack);
+
+  info("Record markers to test the category property");
+  function testCategory(args, expectedCategory) {
+    testMarker(args, marker => {
+      Assert.equal(marker.category, expectedCategory);
+    });
+  }
+  testCategory([], "JavaScript");
+  testCategory([{ category: "Test" }], "Test");
+  testCategory([{ category: "Test" }, markerText], "Test");
+  testCategory([{ category: "JavaScript" }], "JavaScript");
+  testCategory([{ category: "Other" }], "Other");
+  testCategory([{ category: "DOM" }], "DOM");
+  testCategory([{ category: "does not exist" }], "Other");
+
+  info("Capture the profile");
+  const profile = await stopAndGetProfile();
+  const mainThread = profile.threads.find(({ name }) => name === "GeckoMain");
+  const markers = getInflatedMarkerData(mainThread).filter(m =>
+    m.name.startsWith(markerNamePrefix)
+  );
+  Assert.equal(
+    markers.length,
+    Object.keys(testFunctions).length,
+    `Found ${markers.length} test markers in the captured profile`
+  );
+
+  for (let marker of markers) {
+    marker.category = profile.meta.categories[marker.category].name;
+    info(`${testCases[marker.name]} -> ${marker.toSource()}`);
+
+    testFunctions[marker.name](marker);
+    delete testFunctions[marker.name];
+  }
+
+  Assert.equal(0, Object.keys(testFunctions).length, "all markers were found");
+});
diff --git a/tools/profiler/tests/xpcshell/test_asm.js b/tools/profiler/tests/xpcshell/test_asm.js
new file mode 100644
index 0000000000..fe04782c0d
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_asm.js
@@ -0,0 +1,81 @@
+// Check that asm.js code shows up on the stack.
+function run_test() {
+  // Just skip the test if the profiler component isn't present.
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  // This test assumes that it's starting on an empty profiler stack.
+  // (Note that the other profiler tests also assume the profiler
+  // isn't already started.)
+  Assert.ok(!Services.profiler.IsActive());
+
+  let jsFuns = Cu.getJSTestingFunctions();
+  if (!jsFuns.isAsmJSCompilationAvailable()) {
+    return;
+  }
+
+  const ms = 10;
+  Services.profiler.StartProfiler(10000, ms, ["js"]);
+
+  let stack = null;
+  function ffi_function() {
+    var delayMS = 5;
+    while (1) {
+      let then = Date.now();
+      do {
+        // do nothing
+      } while (Date.now() - then < delayMS);
+
+      var thread0 = Services.profiler.getProfileData().threads[0];
+
+      if (delayMS > 30000) {
+        return;
+      }
+
+      delayMS *= 2;
+
+      if (thread0.samples.data.length == 0) {
+        continue;
+      }
+
+      var lastSample = thread0.samples.data[thread0.samples.data.length - 1];
+      stack = String(getInflatedStackLocations(thread0, lastSample));
+      if (stack.includes("trampoline")) {
+        return;
+      }
+    }
+  }
+
+  function asmjs_module(global, ffis) {
+    "use asm";
+    var ffi = ffis.ffi;
+    function asmjs_function() {
+      ffi();
+    }
+    return asmjs_function;
+  }
+
+  Assert.ok(jsFuns.isAsmJSModule(asmjs_module));
+
+  var asmjs_function = asmjs_module(null, { ffi: ffi_function });
+  Assert.ok(jsFuns.isAsmJSFunction(asmjs_function));
+
+  asmjs_function();
+
+  Assert.notEqual(stack, null);
+
+  var i1 = stack.indexOf("entry trampoline");
+  Assert.ok(i1 !== -1);
+  var i2 = stack.indexOf("asmjs_function");
+  Assert.ok(i2 !== -1);
+  var i3 = stack.indexOf("exit trampoline");
+  Assert.ok(i3 !== -1);
+  var i4 = stack.indexOf("ffi_function");
+  Assert.ok(i4 !== -1);
+  Assert.ok(i1 < i2);
+  Assert.ok(i2 < i3);
+  Assert.ok(i3 < i4);
+
+  Services.profiler.StopProfiler();
+}
diff --git a/tools/profiler/tests/xpcshell/test_enterjit_osr.js b/tools/profiler/tests/xpcshell/test_enterjit_osr.js
new file mode 100644
index 0000000000..87fc711138
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_enterjit_osr.js
@@ -0,0 +1,56 @@
+// Check that the EnterJIT frame, added by the JIT trampoline and
+// usable by a native unwinder to resume unwinding after encountering
+// JIT code, is pushed as expected.
+function run_test() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  // This test assumes that it's starting on an empty profiler stack.
+  // (Note that the other profiler tests also assume the profiler
+  // isn't already started.)
+  Assert.ok(!Services.profiler.IsActive());
+
+  const ms = 5;
+  Services.profiler.StartProfiler(10000, ms, ["js"]);
+
+  function has_arbitrary_name_in_stack() {
+    // A frame for |arbitrary_name| has been pushed.  Do a sequence of
+    // increasingly long spins until we get a sample.
+    var delayMS = 5;
+    while (1) {
+      info("loop: ms = " + delayMS);
+      const then = Date.now();
+      do {
+        let n = 10000;
+        // eslint-disable-next-line no-empty
+        while (--n) {} // OSR happens here
+        // Spin in the hope of getting a sample.
+      } while (Date.now() - then < delayMS);
+      let profile = Services.profiler.getProfileData().threads[0];
+
+      // Go through all of the stacks, and search for this function name.
+      for (const sample of profile.samples.data) {
+        const stack = getInflatedStackLocations(profile, sample);
+        info(`The following stack was found: ${stack}`);
+        for (var i = 0; i < stack.length; i++) {
+          if (stack[i].match(/arbitrary_name/)) {
+            // This JS sample was correctly found.
+            return true;
+          }
+        }
+      }
+
+      // Continue running this function with an increasingly long delay.
+      delayMS *= 2;
+      if (delayMS > 30000) {
+        return false;
+      }
+    }
+  }
+  Assert.ok(
+    has_arbitrary_name_in_stack(),
+    "A JS frame was found before the test timeout."
+  );
+  Services.profiler.StopProfiler();
+}
diff --git a/tools/profiler/tests/xpcshell/test_enterjit_osr_disabling.js b/tools/profiler/tests/xpcshell/test_enterjit_osr_disabling.js
new file mode 100644
index 0000000000..2d4ffe5a10
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_enterjit_osr_disabling.js
@@ -0,0 +1,19 @@
+function run_test() {
+  // Just skip the test if the profiler component isn't present.
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  Assert.ok(!Services.profiler.IsActive());
+
+  Services.profiler.StartProfiler(100, 10, ["js"]);
+  // The function is entered with the profiler enabled
+  (function() {
+    Services.profiler.StopProfiler();
+    let n = 10000;
+    // eslint-disable-next-line no-empty
+    while (--n) {} // OSR happens here with the profiler disabled.
+    // An assertion will fail when this function returns, if the
+    // profiler stack was misbalanced.
+  })();
+}
diff --git a/tools/profiler/tests/xpcshell/test_enterjit_osr_enabling.js b/tools/profiler/tests/xpcshell/test_enterjit_osr_enabling.js
new file mode 100644
index 0000000000..3084a00018
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_enterjit_osr_enabling.js
@@ -0,0 +1,18 @@
+function run_test() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  Assert.ok(!Services.profiler.IsActive());
+
+  // The function is entered with the profiler disabled.
+  (function() {
+    Services.profiler.StartProfiler(100, 10, ["js"]);
+    let n = 10000;
+    // eslint-disable-next-line no-empty
+    while (--n) {} // OSR happens here with the profiler enabled.
+    // An assertion will fail when this function returns, if the
+    // profiler stack was misbalanced.
+  })();
+  Services.profiler.StopProfiler();
+}
diff --git a/tools/profiler/tests/xpcshell/test_feature_fileioall.js b/tools/profiler/tests/xpcshell/test_feature_fileioall.js
new file mode 100644
index 0000000000..97d55988d6
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_feature_fileioall.js
@@ -0,0 +1,171 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// This is only needed for getting a temp file location, which IOUtils
+// cannot currently do.
+const { OS } = ChromeUtils.import("resource://gre/modules/osfile.jsm");
+
+add_task(async () => {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  info(
+    "Test that off-main thread fileio is captured for a profiled thread, " +
+      "and that it will be sent to the main thread."
+  );
+  const filename = "test_marker_fileio";
+  const profile = await startProfilerAndTriggerFileIO({
+    features: ["fileioall"],
+    threadsFilter: ["GeckoMain", "BackgroundThreadPool"],
+    filename,
+  });
+
+  const threads = getThreads(profile);
+  const mainThread = threads.find(thread => thread.name === "GeckoMain");
+  const mainThreadFileIO = getInflatedFileIOMarkers(mainThread, filename);
+  let backgroundThread;
+  let backgroundThreadFileIO;
+  for (const thread of threads) {
+    // Check for FileIO in any of the background threads.
+    if (thread.name.startsWith("BackgroundThreadPool")) {
+      const markers = getInflatedFileIOMarkers(thread, filename);
+      if (markers.length > 0) {
+        backgroundThread = thread;
+        backgroundThreadFileIO = markers;
+        break;
+      }
+    }
+  }
+
+  info("Check all of the main thread FileIO markers.");
+  checkInflatedFileIOMarkers(mainThreadFileIO, filename);
+  for (const { data, name } of mainThreadFileIO) {
+    equal(
+      name,
+      "FileIO (non-main thread)",
+      "The markers from off main thread are labeled as such."
+    );
+    equal(
+      data.threadId,
+      backgroundThread.tid,
+      "The main thread FileIO markers were all sent from the background thread."
+    );
+  }
+
+  info("Check all of the background thread FileIO markers.");
+  checkInflatedFileIOMarkers(backgroundThreadFileIO, filename);
+  for (const { data, name } of backgroundThreadFileIO) {
+    equal(
+      name,
+      "FileIO",
+      "The markers on the thread where they were generated just say FileIO"
+    );
+    equal(
+      data.threadId,
+      undefined,
+      "The background thread FileIO correctly excludes the threadId."
+    );
+  }
+});
+
+add_task(async () => {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  info(
+    "Test that off-main thread fileio is captured for a thread that is not profiled, " +
+      "and that it will be sent to the main thread."
+  );
+  const filename = "test_marker_fileio";
+  const profile = await startProfilerAndTriggerFileIO({
+    features: ["fileioall"],
+    threadsFilter: ["GeckoMain"],
+    filename,
+  });
+
+  const threads = getThreads(profile);
+  const mainThread = threads.find(thread => thread.name === "GeckoMain");
+  const mainThreadFileIO = getInflatedFileIOMarkers(mainThread, filename);
+
+  info("Check all of the main thread FileIO markers.");
+  checkInflatedFileIOMarkers(mainThreadFileIO, filename);
+  for (const { data, name } of mainThreadFileIO) {
+    equal(
+      name,
+      "FileIO (non-profiled thread)",
+      "The markers from off main thread are labeled as such."
+    );
+    equal(typeof data.threadId, "number", "A thread ID is captured.");
+  }
+});
+
+/**
+ * @typedef {Object} TestConfig
+ * @prop {Array} features The list of profiler features
+ * @prop {string[]} threadsFilter The list of threads to profile
+ * @prop {string} filename A filename to trigger a write operation
+ */
+
+/**
+ * Start the profiler and get FileIO markers.
+ * @param {TestConfig}
+ * @returns {Profile}
+ */
+async function startProfilerAndTriggerFileIO({
+  features,
+  threadsFilter,
+  filename,
+}) {
+  const entries = 10000;
+  const interval = 10;
+  Services.profiler.StartProfiler(entries, interval, features, threadsFilter);
+
+  const tmpDir = OS.Constants.Path.tmpDir;
+  const path = OS.Path.join(tmpDir, filename);
+
+  info(`Using a temporary file to test FileIO: ${path}`);
+
+  if (fileExists(path)) {
+    console.warn(
+      "This test is triggering FileIO by writing to a file. However, the test found an " +
+        "existing file at the location it was trying to write to. This could happen " +
+        "because a previous run of the test failed to clean up after itself. This test " +
+        " will now clean up that file before running the test again."
+    );
+    await removeFile(path);
+  }
+
+  info("Write to the file, but do so using a background thread.");
+
+  // IOUtils handles file operations using a background thread.
+  await IOUtils.write(path, new TextEncoder().encode("Test data."));
+  const exists = await fileExists(path);
+  ok(exists, `Created temporary file at: ${path}`);
+
+  info("Remove the file");
+  await removeFile(path);
+
+  // Pause the profiler as we don't need to collect more samples as we retrieve
+  // and serialize the profile.
+  Services.profiler.Pause();
+
+  const profile = await Services.profiler.getProfileDataAsync();
+  Services.profiler.StopProfiler();
+  return profile;
+}
+
+async function fileExists(file) {
+  try {
+    let { type } = await IOUtils.stat(file);
+    return type === "regular";
+  } catch (_error) {
+    return false;
+  }
+}
+
+async function removeFile(file) {
+  await IOUtils.remove(file);
+  const exists = await fileExists(file);
+  ok(!exists, `Removed temporary file: ${file}`);
+}
diff --git a/tools/profiler/tests/xpcshell/test_feature_js.js b/tools/profiler/tests/xpcshell/test_feature_js.js
new file mode 100644
index 0000000000..a2c328c051
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_feature_js.js
@@ -0,0 +1,63 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Test that JS capturing works as expected.
+ */
+add_task(async () => {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  const entries = 10000;
+  const interval = 1;
+  const threads = [];
+  const features = ["js"];
+
+  Services.profiler.StartProfiler(entries, interval, features, threads);
+
+  // Call the following to get a nice stack in the profiler:
+  // functionA -> functionB -> functionC -> captureAtLeastOneJsSample
+  const sampleIndex = await functionA();
+
+  const profile = await Services.profiler.getProfileDataAsync();
+  const [thread] = profile.threads;
+  const { samples } = thread;
+
+  const inflatedStackFrames = getInflatedStackLocations(
+    thread,
+    samples.data[sampleIndex]
+  );
+
+  expectStackToContain(
+    inflatedStackFrames,
+    [
+      "(root)",
+      "js::RunScript",
+      // The following regexes match a string similar to:
+      //
+      // "functionA (/gecko/obj/_tests/xpcshell/tools/profiler/tests/xpcshell/test_feature_js.js:47:0)"
+      //
+      //          this matches the script location
+      //          |                       match the line number
+      //          |                       |   match the column number
+      //          v                       v   v
+      /^functionA \(.+test_feature_js\.js:\d+:\d+\)$/,
+      /^functionB \(.+test_feature_js\.js:\d+:\d+\)$/,
+      /^functionC \(.+test_feature_js\.js:\d+:\d+\)$/,
+    ],
+    "The stack contains a few frame labels, as well as the JS functions that we called."
+  );
+});
+
+function functionA() {
+  return functionB();
+}
+
+function functionB() {
+  return functionC();
+}
+
+async function functionC() {
+  return captureAtLeastOneJsSample();
+}
diff --git a/tools/profiler/tests/xpcshell/test_feature_mainthreadio.js b/tools/profiler/tests/xpcshell/test_feature_mainthreadio.js
new file mode 100644
index 0000000000..d3fed91f83
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_feature_mainthreadio.js
@@ -0,0 +1,125 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const { FileUtils } = ChromeUtils.import(
+  "resource://gre/modules/FileUtils.jsm"
+);
+
+/**
+ * Test that the IOInterposer is working correctly to capture main thread IO.
+ *
+ * This test should not run on release or beta, as the IOInterposer is wrapped in
+ * an ifdef.
+ */
+add_task(async () => {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  {
+    const filename = "profiler-mainthreadio-test-firstrun";
+    const { markers, schema } = await runProfilerWithFileIO(
+      ["mainthreadio"],
+      filename
+    );
+    info("Check the FileIO markers when using the mainthreadio feature");
+    checkInflatedFileIOMarkers(markers, filename);
+
+    checkSchema(schema, {
+      name: "FileIO",
+      display: ["marker-chart", "marker-table", "timeline-fileio"],
+      data: [
+        {
+          key: "operation",
+          label: "Operation",
+          format: "string",
+          searchable: true,
+        },
+        { key: "source", label: "Source", format: "string", searchable: true },
+        {
+          key: "filename",
+          label: "Filename",
+          format: "file-path",
+          searchable: true,
+        },
+      ],
+    });
+  }
+
+  {
+    const filename = "profiler-mainthreadio-test-no-instrumentation";
+    const { markers } = await runProfilerWithFileIO([], filename);
+    equal(
+      markers.length,
+      0,
+      "No FileIO markers are found when the mainthreadio feature is not turned on " +
+        "in the profiler."
+    );
+  }
+
+  {
+    const filename = "profiler-mainthreadio-test-secondrun";
+    const { markers } = await runProfilerWithFileIO(["mainthreadio"], filename);
+    info("Check the FileIO markers when re-starting the mainthreadio feature");
+    checkInflatedFileIOMarkers(markers, filename);
+  }
+});
+
+/**
+ * Start the profiler and get FileIO markers and schema.
+ *
+ * @param {Array} features The list of profiler features
+ * @param {string} filename A filename to trigger a write operation
+ * @returns {{
+ *   markers: InflatedMarkers[];
+ *   schema: MarkerSchema;
+ * }}
+ */
+async function runProfilerWithFileIO(features, filename) {
+  const entries = 10000;
+  const interval = 10;
+  const threads = [];
+  Services.profiler.StartProfiler(entries, interval, features, threads);
+
+  info("Get the file");
+  const file = FileUtils.getFile("TmpD", [filename]);
+  if (file.exists()) {
+    console.warn(
+      "This test is triggering FileIO by writing to a file. However, the test found an " +
+        "existing file at the location it was trying to write to. This could happen " +
+        "because a previous run of the test failed to clean up after itself. This test " +
+        " will now clean up that file before running the test again."
+    );
+    file.remove(false);
+  }
+
+  info(
+    "Generate file IO on the main thread using FileUtils.openSafeFileOutputStream."
+  );
+  const outputStream = FileUtils.openSafeFileOutputStream(file);
+
+  const data = "Test data.";
+  info("Write to the file");
+  outputStream.write(data, data.length);
+
+  info("Close the file");
+  FileUtils.closeSafeFileOutputStream(outputStream);
+
+  info("Remove the file");
+  file.remove(false);
+
+  // Pause the profiler as we don't need to collect more samples as we retrieve
+  // and serialize the profile.
+  Services.profiler.Pause();
+
+  const profile = await Services.profiler.getProfileDataAsync();
+  Services.profiler.StopProfiler();
+  const mainThread = profile.threads.find(({ name }) => name === "GeckoMain");
+
+  const schema = getSchema(profile, "FileIO");
+
+  const markers = getInflatedFileIOMarkers(mainThread, filename);
+
+  return { schema, markers };
+}
diff --git a/tools/profiler/tests/xpcshell/test_feature_nativeallocations.js b/tools/profiler/tests/xpcshell/test_feature_nativeallocations.js
new file mode 100644
index 0000000000..9893315417
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_feature_nativeallocations.js
@@ -0,0 +1,164 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+add_task(async () => {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  if (!Services.profiler.GetFeatures().includes("nativeallocations")) {
+    Assert.ok(
+      true,
+      "Native allocations are not supported by this build, " +
+        "skip run the rest of the test."
+    );
+    return;
+  }
+
+  Assert.ok(
+    !Services.profiler.IsActive(),
+    "The profiler is not currently active"
+  );
+
+  info(
+    "Test that the profiler can install memory hooks and collect native allocation " +
+      "information in the marker payloads."
+  );
+  {
+    info("Start the profiler.");
+    startProfiler({
+      // Only instrument the main thread.
+      threads: ["GeckoMain"],
+      features: ["threads", "leaf", "nativeallocations"],
+    });
+
+    info(
+      "Do some JS work for a little bit. This will increase the amount of allocations " +
+        "that take place."
+    );
+    doWork();
+
+    info("Get the profile data and analyze it.");
+    const profile = await stopAndGetProfile();
+
+    const {
+      allocationPayloads,
+      unmatchedAllocations,
+      logAllocationsAndDeallocations,
+    } = getAllocationInformation(profile);
+
+    Assert.greater(
+      allocationPayloads.length,
+      0,
+      "Native allocation payloads were recorded for the parent process' main thread when " +
+        "the Native Allocation feature was turned on."
+    );
+
+    if (unmatchedAllocations.length !== 0) {
+      info(
+        "There were unmatched allocations. Log all of the allocations and " +
+          "deallocations in order to aid debugging."
+      );
+      logAllocationsAndDeallocations();
+      ok(
+        false,
+        "Found a deallocation that did not have a matching allocation site. " +
+          "This could happen if balanced allocations is broken, or if the the " +
+          "buffer size of this test was too small, and some markers ended up " +
+          "rolling off."
+      );
+    }
+
+    ok(true, "All deallocation sites had matching allocations.");
+  }
+
+  info("Restart the profiler, to ensure that we get no more allocations.");
+  {
+    startProfiler({ features: ["threads", "leaf"] });
+    info("Do some work again.");
+    doWork();
+    info("Wait for the periodic sampling.");
+    await Services.profiler.waitOnePeriodicSampling();
+
+    const profile = await stopAndGetProfile();
+    const allocationPayloads = getPayloadsOfType(
+      profile.threads[0],
+      "Native allocation"
+    );
+
+    Assert.equal(
+      allocationPayloads.length,
+      0,
+      "No native allocations were collected when the feature was disabled."
+    );
+  }
+});
+
+function doWork() {
+  this.n = 0;
+  for (let i = 0; i < 1e5; i++) {
+    this.n += Math.random();
+  }
+}
+
+/**
+ * Extract the allocation payloads, and find the unmatched allocations.
+ */
+function getAllocationInformation(profile) {
+  // Get all of the allocation payloads.
+  const allocationPayloads = getPayloadsOfType(
+    profile.threads[0],
+    "Native allocation"
+  );
+
+  // Decide what is an allocation and deallocation.
+  const allocations = allocationPayloads.filter(
+    payload => ensureIsNumber(payload.size) >= 0
+  );
+  const deallocations = allocationPayloads.filter(
+    payload => ensureIsNumber(payload.size) < 0
+  );
+
+  // Now determine the unmatched allocations by building a set
+  const allocationSites = new Set(
+    allocations.map(({ memoryAddress }) => memoryAddress)
+  );
+
+  const unmatchedAllocations = deallocations.filter(
+    ({ memoryAddress }) => !allocationSites.has(memoryAddress)
+  );
+
+  // Provide a helper to log out the allocations and deallocations on failure.
+  function logAllocationsAndDeallocations() {
+    for (const { memoryAddress } of allocations) {
+      console.log("Allocations", formatHex(memoryAddress));
+      allocationSites.add(memoryAddress);
+    }
+
+    for (const { memoryAddress } of deallocations) {
+      console.log("Deallocations", formatHex(memoryAddress));
+    }
+
+    for (const { memoryAddress } of unmatchedAllocations) {
+      console.log("Deallocation with no allocation", formatHex(memoryAddress));
+    }
+  }
+
+  return {
+    allocationPayloads,
+    unmatchedAllocations,
+    logAllocationsAndDeallocations,
+  };
+}
+
+function ensureIsNumber(value) {
+  if (typeof value !== "number") {
+    throw new Error(`Expected a number: ${value}`);
+  }
+  return value;
+}
+
+function formatHex(number) {
+  return `0x${number.toString(16)}`;
+}
diff --git a/tools/profiler/tests/xpcshell/test_feature_stackwalking.js b/tools/profiler/tests/xpcshell/test_feature_stackwalking.js
new file mode 100644
index 0000000000..628f46f417
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_feature_stackwalking.js
@@ -0,0 +1,51 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Do a basic test to see if native frames are being collected for stackwalking. This
+ * test is fairly naive, as it does not attempt to check that these are valid symbols,
+ * only that some kind of stack walking is happening. It does this by making sure at
+ * least two native frames are collected.
+ */
+add_task(async () => {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  const entries = 10000;
+  const interval = 1;
+  const threads = [];
+  const features = ["stackwalk"];
+
+  Services.profiler.StartProfiler(entries, interval, features, threads);
+  const sampleIndex = await captureAtLeastOneJsSample();
+
+  const profile = await Services.profiler.getProfileDataAsync();
+  const [thread] = profile.threads;
+  const { samples } = thread;
+
+  const inflatedStackFrames = getInflatedStackLocations(
+    thread,
+    samples.data[sampleIndex]
+  );
+  const nativeStack = /^0x[0-9a-f]+$/;
+
+  expectStackToContain(
+    inflatedStackFrames,
+    [
+      "(root)",
+      // There are probably more native stacks here.
+      nativeStack,
+      nativeStack,
+      // Since this is an xpcshell test we know that JavaScript will run:
+      "js::RunScript",
+      // There are probably more native stacks here.
+      nativeStack,
+      nativeStack,
+    ],
+    "Expected native stacks to be interleaved between some frame labels. There should" +
+      "be more than one native stack if stack walking is working correctly. There " +
+      "is no attempt here to determine if the memory addresses point to the correct " +
+      "symbols"
+  );
+});
diff --git a/tools/profiler/tests/xpcshell/test_get_features.js b/tools/profiler/tests/xpcshell/test_get_features.js
new file mode 100644
index 0000000000..23aee089a3
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_get_features.js
@@ -0,0 +1,12 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function run_test() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  var profilerFeatures = Services.profiler.GetFeatures();
+  Assert.ok(profilerFeatures != null);
+}
diff --git a/tools/profiler/tests/xpcshell/test_merged_stacks.js b/tools/profiler/tests/xpcshell/test_merged_stacks.js
new file mode 100644
index 0000000000..526807d80b
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_merged_stacks.js
@@ -0,0 +1,75 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Test that we correctly merge the three stack types, JS, native, and frame labels.
+ */
+add_task(async () => {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  const entries = 10000;
+  const interval = 1;
+  const threads = [];
+  const features = ["js", "stackwalk"];
+
+  Services.profiler.StartProfiler(entries, interval, features, threads);
+
+  // Call the following to get a nice stack in the profiler:
+  // functionA -> functionB -> functionC
+  const sampleIndex = await functionA();
+
+  const profile = await Services.profiler.getProfileDataAsync();
+  const [thread] = profile.threads;
+  const { samples } = thread;
+
+  const inflatedStackFrames = getInflatedStackLocations(
+    thread,
+    samples.data[sampleIndex]
+  );
+
+  const nativeStack = /^0x[0-9a-f]+$/;
+
+  expectStackToContain(
+    inflatedStackFrames,
+    [
+      "(root)",
+      nativeStack,
+      nativeStack,
+      // There are more native stacks and frame labels here, but we know some execute
+      // and then the "js::RunScript" frame label runs.
+      "js::RunScript",
+      nativeStack,
+      nativeStack,
+      // The following regexes match a string similar to:
+      //
+      // "functionA (/gecko/obj/_tests/xpcshell/tools/profiler/tests/xpcshell/test_merged_stacks.js:47:0)"
+      //
+      //          this matches the script location
+      //          |                          match the line number
+      //          |                          |   match the column number
+      //          v                          v   v
+      /^functionA \(.+test_merged_stacks\.js:\d+:\d+\)$/,
+      /^functionB \(.+test_merged_stacks\.js:\d+:\d+\)$/,
+      /^functionC \(.+test_merged_stacks\.js:\d+:\d+\)$/,
+      // After the JS frames, then there are a bunch of arbitrary native stack frames
+      // that run.
+      nativeStack,
+      nativeStack,
+    ],
+    "The stack contains a few frame labels, as well as the JS functions that we called."
+  );
+});
+
+function functionA() {
+  return functionB();
+}
+
+function functionB() {
+  return functionC();
+}
+
+async function functionC() {
+  return captureAtLeastOneJsSample();
+}
diff --git a/tools/profiler/tests/xpcshell/test_pause.js b/tools/profiler/tests/xpcshell/test_pause.js
new file mode 100644
index 0000000000..394a805715
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_pause.js
@@ -0,0 +1,82 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function run_test() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  Assert.ok(!Services.profiler.IsActive());
+  Assert.ok(!Services.profiler.IsPaused());
+
+  Services.profiler.StartProfiler(1000, 10, []);
+
+  // Default: Active and not paused.
+  Assert.ok(Services.profiler.IsActive());
+  Assert.ok(!Services.profiler.IsPaused());
+  Assert.ok(!Services.profiler.IsSamplingPaused());
+
+  // Pause everything, implicitly pauses sampling.
+  Services.profiler.Pause();
+
+  Assert.ok(Services.profiler.IsActive());
+  Assert.ok(Services.profiler.IsPaused());
+  Assert.ok(Services.profiler.IsSamplingPaused());
+
+  // While fully paused, pause and resume sampling only, no expected changes.
+  Services.profiler.PauseSampling();
+
+  Assert.ok(Services.profiler.IsActive());
+  Assert.ok(Services.profiler.IsPaused());
+  Assert.ok(Services.profiler.IsSamplingPaused());
+
+  Services.profiler.ResumeSampling();
+
+  Assert.ok(Services.profiler.IsActive());
+  Assert.ok(Services.profiler.IsPaused());
+  Assert.ok(Services.profiler.IsSamplingPaused());
+
+  // Resume everything.
+  Services.profiler.Resume();
+
+  Assert.ok(Services.profiler.IsActive());
+  Assert.ok(!Services.profiler.IsPaused());
+  Assert.ok(!Services.profiler.IsSamplingPaused());
+
+  // Pause sampling only.
+  Services.profiler.PauseSampling();
+
+  Assert.ok(Services.profiler.IsActive());
+  Assert.ok(!Services.profiler.IsPaused());
+  Assert.ok(Services.profiler.IsSamplingPaused());
+
+  // While sampling is paused, pause everything.
+  Services.profiler.Pause();
+
+  Assert.ok(Services.profiler.IsActive());
+  Assert.ok(Services.profiler.IsPaused());
+  Assert.ok(Services.profiler.IsSamplingPaused());
+
+  // Resume, but sampling is still paused separately.
+  Services.profiler.Resume();
+
+  Assert.ok(Services.profiler.IsActive());
+  Assert.ok(!Services.profiler.IsPaused());
+  Assert.ok(Services.profiler.IsSamplingPaused());
+
+  // Resume sampling only.
+  Services.profiler.ResumeSampling();
+
+  Assert.ok(Services.profiler.IsActive());
+  Assert.ok(!Services.profiler.IsPaused());
+  Assert.ok(!Services.profiler.IsSamplingPaused());
+
+  Services.profiler.StopProfiler();
+  Assert.ok(!Services.profiler.IsActive());
+  // Stopping is not pausing.
+  Assert.ok(!Services.profiler.IsPaused());
+  Assert.ok(!Services.profiler.IsSamplingPaused());
+
+  do_test_finished();
+}
diff --git a/tools/profiler/tests/xpcshell/test_responsiveness.js b/tools/profiler/tests/xpcshell/test_responsiveness.js
new file mode 100644
index 0000000000..48d2eccff9
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_responsiveness.js
@@ -0,0 +1,53 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Test that we can measure non-zero event delays
+ */
+
+add_task(async () => {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+  const entries = 10000;
+  const interval = 1;
+  const threads = [];
+  const features = [];
+
+  Services.profiler.StartProfiler(entries, interval, features, threads);
+
+  await functionA();
+
+  const profile = await Services.profiler.getProfileDataAsync();
+  const [thread] = profile.threads;
+  const { samples } = thread;
+  const message = "eventDelay > 0 not found.";
+  let SAMPLE_STACK_SLOT = thread.samples.schema.eventDelay;
+
+  for (let i = 0; i < samples.data.length; i++) {
+    if (samples.data[i][SAMPLE_STACK_SLOT] > 0) {
+      Assert.ok(true, message);
+      return;
+    }
+  }
+  Assert.ok(false, message);
+});
+
+function doSyncWork(milliseconds) {
+  const start = Date.now();
+  while (true) {
+    this.n = 0;
+    for (let i = 0; i < 1e5; i++) {
+      this.n += Math.random();
+    }
+    if (Date.now() - start > milliseconds) {
+      return;
+    }
+  }
+}
+
+function functionA() {
+  doSyncWork(100);
+  captureAtLeastOneJsSample();
+}
diff --git a/tools/profiler/tests/xpcshell/test_run.js b/tools/profiler/tests/xpcshell/test_run.js
new file mode 100644
index 0000000000..607c828677
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_run.js
@@ -0,0 +1,41 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function run_test() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  Assert.ok(!Services.profiler.IsActive());
+
+  Services.profiler.StartProfiler(1000, 10, []);
+
+  Assert.ok(Services.profiler.IsActive());
+
+  do_test_pending();
+
+  do_timeout(1000, function wait() {
+    // Check text profile format
+    var profileStr = Services.profiler.GetProfile();
+    Assert.ok(profileStr.length > 10);
+
+    // check json profile format
+    var profileObj = Services.profiler.getProfileData();
+    Assert.notEqual(profileObj, null);
+    Assert.notEqual(profileObj.threads, null);
+    // We capture memory counters by default only when jemalloc is turned
+    // on (and it isn't for ASAN), so unless we can conditionalize for ASAN
+    // here we can't check that we're capturing memory counter data.
+    Assert.notEqual(profileObj.counters, null);
+    Assert.notEqual(profileObj.memory, null);
+    Assert.ok(profileObj.threads.length >= 1);
+    Assert.notEqual(profileObj.threads[0].samples, null);
+    // NOTE: The number of samples will be empty since we
+    //       don't have any labels in the xpcshell code
+
+    Services.profiler.StopProfiler();
+    Assert.ok(!Services.profiler.IsActive());
+    do_test_finished();
+  });
+}
diff --git a/tools/profiler/tests/xpcshell/test_shared_library.js b/tools/profiler/tests/xpcshell/test_shared_library.js
new file mode 100644
index 0000000000..805047c363
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_shared_library.js
@@ -0,0 +1,25 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function run_test() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  var libs = Services.profiler.sharedLibraries;
+
+  Assert.equal(typeof libs, "object");
+  Assert.ok(Array.isArray(libs));
+  Assert.equal(typeof libs, "object");
+  Assert.ok(libs.length >= 1);
+  Assert.equal(typeof libs[0], "object");
+  Assert.equal(typeof libs[0].name, "string");
+  Assert.equal(typeof libs[0].path, "string");
+  Assert.equal(typeof libs[0].debugName, "string");
+  Assert.equal(typeof libs[0].debugPath, "string");
+  Assert.equal(typeof libs[0].arch, "string");
+  Assert.equal(typeof libs[0].start, "number");
+  Assert.equal(typeof libs[0].end, "number");
+  Assert.ok(libs[0].start <= libs[0].end);
+}
diff --git a/tools/profiler/tests/xpcshell/test_start.js b/tools/profiler/tests/xpcshell/test_start.js
new file mode 100644
index 0000000000..c220ba22eb
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/test_start.js
@@ -0,0 +1,19 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function run_test() {
+  if (!AppConstants.MOZ_GECKO_PROFILER) {
+    return;
+  }
+
+  Assert.ok(!Services.profiler.IsActive());
+
+  Services.profiler.StartProfiler(10, 100, []);
+
+  Assert.ok(Services.profiler.IsActive());
+
+  Services.profiler.StopProfiler();
+
+  Assert.ok(!Services.profiler.IsActive());
+}
diff --git a/tools/profiler/tests/xpcshell/xpcshell.ini b/tools/profiler/tests/xpcshell/xpcshell.ini
new file mode 100644
index 0000000000..02b3f57640
--- /dev/null
+++ b/tools/profiler/tests/xpcshell/xpcshell.ini
@@ -0,0 +1,53 @@
+[DEFAULT]
+head = head.js
+support-files =
+  ../shared-head.js
+skip-if = toolkit == 'android'
+
+[test_active_configuration.js]
+[test_addProfilerMarker.js]
+[test_start.js]
+skip-if = true
+[test_get_features.js]
+[test_responsiveness.js]
+skip-if = tsan # Times out on TSan, bug 1612707
+[test_shared_library.js]
+[test_run.js]
+skip-if = true
+[test_pause.js]
+[test_enterjit_osr.js]
+skip-if = (os == "win" && processor == "aarch64") # aarch64 due to 1536652
+[test_enterjit_osr_disabling.js]
+skip-if = !debug
+[test_enterjit_osr_enabling.js]
+skip-if = !debug
+[test_asm.js]
+[test_feature_mainthreadio.js]
+skip-if = release_or_beta || (os == "win" && processor == "aarch64") # The IOInterposer is in an ifdef, aarch64 due to 1536657
+[test_feature_fileioall.js]
+skip-if = release_or_beta || (os == "win" && processor == "aarch64") # The IOInterposer is in an ifdef, aarch64 due to 1536657
+
+# The sanitizer checks appears to overwrite our own memory hooks in xpcshell tests,
+# and no allocation markers are gathered. Skip this test in that configuration.
+[test_feature_nativeallocations.js]
+skip-if = asan || tsan
+
+# Native stackwalking is somewhat unreliable depending on the platform.
+#
+# We don't have frame pointers on macOS release and beta, so stack walking does not
+# work. See Bug 1571216 for more details.
+#
+# Linux can be very unreliable when native stackwalking through JavaScript code.
+# See Bug 1434402 for more details.
+#
+# For sanitizer builds, there were many intermittents, and we're not getting much
+# additional coverage there, so it's better to be a bit more reliable.
+[test_feature_stackwalking.js]
+skip-if = (os == "mac" && release_or_beta) || (os == "linux" && release_or_beta && !debug) || asan || tsan
+
+[test_feature_js.js]
+skip-if = tsan # Times out on TSan, bug 1612707
+
+# See the comment on test_feature_stackwalking.js
+[test_merged_stacks.js]
+skip-if = (os == "mac" && release_or_beta) || (os == "linux" && release_or_beta && !debug) || asan || tsan