Merging upstream version 125.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

16 files changed, 160 insertions, 222 deletions

diff --git a/js/public/ContextOptions.h b/js/public/ContextOptions.h
index 25744ce9ea..0ac79c0ec7 100644
--- a/js/public/ContextOptions.h
+++ b/js/public/ContextOptions.h
@@ -27,9 +27,6 @@ class JS_PUBLIC_API ContextOptions {
         wasmVerbose_(false),
         wasmBaseline_(true),
         wasmIon_(true),
-#define WASM_FEATURE(NAME, LOWER_NAME, STAGE, ...) wasm##NAME##_(STAGE == WasmFeatureStage::Default),
-        JS_FOR_WASM_FEATURES(WASM_FEATURE)
-#undef WASM_FEATURE
         testWasmAwaitTier2_(false),
         disableIon_(false),
         disableEvalSecurityChecks_(false),
@@ -98,15 +95,6 @@ class JS_PUBLIC_API ContextOptions {
     return *this;
   }
 
-#define WASM_FEATURE(NAME, ...)                     \
-  bool wasm##NAME() const { return wasm##NAME##_; } \
-  ContextOptions& setWasm##NAME(bool flag) {        \
-    wasm##NAME##_ = flag;                           \
-    return *this;                                   \
-  }
-  JS_FOR_WASM_FEATURES(WASM_FEATURE)
-#undef WASM_FEATURE
-
   bool throwOnAsmJSValidationFailure() const {
     return compileOptions_.throwOnAsmJSValidationFailure();
   }
@@ -224,9 +212,6 @@ class JS_PUBLIC_API ContextOptions {
   bool wasmVerbose_ : 1;
   bool wasmBaseline_ : 1;
   bool wasmIon_ : 1;
-#define WASM_FEATURE(NAME, ...) bool wasm##NAME##_ : 1;
-  JS_FOR_WASM_FEATURES(WASM_FEATURE)
-#undef WASM_FEATURE
   bool testWasmAwaitTier2_ : 1;
 
   // JIT options.
diff --git a/js/public/GCAPI.h b/js/public/GCAPI.h
index b0f1325a1e..9bdaca9661 100644
--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -308,22 +308,21 @@ typedef enum JSGCParamKey {
   JSGC_LARGE_HEAP_INCREMENTAL_LIMIT = 26,
 
   /**
-   * Attempt to run a minor GC in the idle time if the free space falls
-   * below this number of bytes.
+   * Free space bytes threshold for eager nursery collection.
    *
    * Default: NurseryChunkUsableSize / 4
-   * Pref: None
+   * Pref: javascript.options.mem.nursery_eager_collection_threshold_kb
    */
-  JSGC_NURSERY_FREE_THRESHOLD_FOR_IDLE_COLLECTION = 27,
+  JSGC_NURSERY_EAGER_COLLECTION_THRESHOLD_KB = 27,
 
   /**
-   * Attempt to run a minor GC in the idle time if the free space falls
-   * below this percentage (from 0 to 99).
+   * Free space fraction threshold for eager nursery collection. This is a
+   * percentage (from 0 to 99).
    *
    * Default: 25
-   * Pref: None
+   * Pref: javascript.options.mem.nursery_eager_collection_threshold_percent
    */
-  JSGC_NURSERY_FREE_THRESHOLD_FOR_IDLE_COLLECTION_PERCENT = 30,
+  JSGC_NURSERY_EAGER_COLLECTION_THRESHOLD_PERCENT = 30,
 
   /**
    * Minimum size of the generational GC nurseries.
@@ -418,9 +417,9 @@ typedef enum JSGCParamKey {
    * collected in this many milliseconds.
    *
    * Default: 5000
-   * Pref: None
+   * Pref: javascript.options.mem.nursery_eager_collection_timeout_ms
    */
-  JSGC_NURSERY_TIMEOUT_FOR_IDLE_COLLECTION_MS = 46,
+  JSGC_NURSERY_EAGER_COLLECTION_TIMEOUT_MS = 46,
 
   /**
    * The system page size in KB.
@@ -456,6 +455,7 @@ typedef enum JSGCParamKey {
   /**
    * The heap size above which to use parallel marking.
    *
+   * Pref: javascript.options.mem.gc_parallel_marking_threshold_mb
    * Default: ParallelMarkingThresholdMB
    */
   JSGC_PARALLEL_MARKING_THRESHOLD_MB = 50,
@@ -1287,10 +1287,26 @@ JS_GetExternalStringCallbacks(JSString* str);
 
 namespace JS {
 
+/**
+ * Check whether the nursery should be eagerly collected, this is before it is
+ * full.
+ *
+ * The idea is that this can be called when the host environment has some idle
+ * time which it can use to for GC activity.
+ *
+ * Returns GCReason::NO_REASON to indicate no collection is desired.
+ */
 extern JS_PUBLIC_API GCReason WantEagerMinorGC(JSRuntime* rt);
 
 extern JS_PUBLIC_API GCReason WantEagerMajorGC(JSRuntime* rt);
 
+/**
+ * Check whether the nursery should be eagerly collected as per WantEagerMajorGC
+ * above, and if so run a collection.
+ *
+ * The idea is that this can be called when the host environment has some idle
+ * time which it can use to for GC activity.
+ */
 extern JS_PUBLIC_API void MaybeRunNurseryCollection(JSRuntime* rt,
                                                     JS::GCReason reason);
 
diff --git a/js/public/HeapAPI.h b/js/public/HeapAPI.h
index 3dfe00bd0d..26cca9e1c3 100644
--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -535,9 +535,11 @@ static MOZ_ALWAYS_INLINE TenuredChunkBase* GetCellChunkBase(
   return chunk;
 }
 
-static MOZ_ALWAYS_INLINE JS::Zone* GetTenuredGCThingZone(const uintptr_t addr) {
-  MOZ_ASSERT(addr);
-  const uintptr_t zone_addr = (addr & ~ArenaMask) | ArenaZoneOffset;
+static MOZ_ALWAYS_INLINE JS::Zone* GetTenuredGCThingZone(const void* ptr) {
+  // This takes a void* because the compiler can't see type relationships in
+  // this header. |ptr| must be a pointer to a tenured GC thing.
+  MOZ_ASSERT(ptr);
+  const uintptr_t zone_addr = (uintptr_t(ptr) & ~ArenaMask) | ArenaZoneOffset;
   return *reinterpret_cast<JS::Zone**>(zone_addr);
 }
 
@@ -631,7 +633,7 @@ MOZ_ALWAYS_INLINE bool IsCellPointerValid(const void* ptr) {
 
   auto* cell = reinterpret_cast<const Cell*>(ptr);
   if (!IsInsideNursery(cell)) {
-    return detail::GetTenuredGCThingZone(addr) != nullptr;
+    return detail::GetTenuredGCThingZone(cell) != nullptr;
   }
 
   return true;
@@ -649,16 +651,13 @@ MOZ_ALWAYS_INLINE bool IsCellPointerValidOrNull(const void* cell) {
 
 namespace JS {
 
-static MOZ_ALWAYS_INLINE Zone* GetTenuredGCThingZone(GCCellPtr thing) {
-  MOZ_ASSERT(!js::gc::IsInsideNursery(thing.asCell()));
-  return js::gc::detail::GetTenuredGCThingZone(thing.unsafeAsUIntPtr());
-}
+extern JS_PUBLIC_API Zone* GetTenuredGCThingZone(GCCellPtr thing);
 
 extern JS_PUBLIC_API Zone* GetNurseryCellZone(js::gc::Cell* cell);
 
 static MOZ_ALWAYS_INLINE Zone* GetGCThingZone(GCCellPtr thing) {
   if (!js::gc::IsInsideNursery(thing.asCell())) {
-    return js::gc::detail::GetTenuredGCThingZone(thing.unsafeAsUIntPtr());
+    return js::gc::detail::GetTenuredGCThingZone(thing.asCell());
   }
 
   return GetNurseryCellZone(thing.asCell());
@@ -666,9 +665,9 @@ static MOZ_ALWAYS_INLINE Zone* GetGCThingZone(GCCellPtr thing) {
 
 static MOZ_ALWAYS_INLINE Zone* GetStringZone(JSString* str) {
   if (!js::gc::IsInsideNursery(str)) {
-    return js::gc::detail::GetTenuredGCThingZone(
-        reinterpret_cast<uintptr_t>(str));
+    return js::gc::detail::GetTenuredGCThingZone(str);
   }
+
   return GetNurseryCellZone(reinterpret_cast<js::gc::Cell*>(str));
 }
 
@@ -767,7 +766,7 @@ static MOZ_ALWAYS_INLINE void ExposeGCThingToActiveJS(JS::GCCellPtr thing) {
   // GC things owned by other runtimes are always black.
   MOZ_ASSERT(!thing.mayBeOwnedByOtherRuntime());
 
-  auto* zone = JS::shadow::Zone::from(JS::GetTenuredGCThingZone(thing));
+  auto* zone = JS::shadow::Zone::from(detail::GetTenuredGCThingZone(cell));
   if (zone->needsIncrementalBarrier()) {
     PerformIncrementalReadBarrier(thing);
   } else if (!zone->isGCPreparing() && detail::NonBlackCellIsMarkedGray(cell)) {
@@ -785,8 +784,8 @@ static MOZ_ALWAYS_INLINE void IncrementalReadBarrier(JS::GCCellPtr thing) {
     return;
   }
 
-  auto* zone = JS::shadow::Zone::from(JS::GetTenuredGCThingZone(thing));
   auto* cell = reinterpret_cast<TenuredCell*>(thing.asCell());
+  auto* zone = JS::shadow::Zone::from(detail::GetTenuredGCThingZone(cell));
   if (zone->needsIncrementalBarrier() &&
       !detail::TenuredCellIsMarkedBlack(cell)) {
     // GC things owned by other runtimes are always black.
@@ -807,8 +806,7 @@ static MOZ_ALWAYS_INLINE bool EdgeNeedsSweepUnbarriered(JSObject** objp) {
     return false;
   }
 
-  auto zone =
-      JS::shadow::Zone::from(detail::GetTenuredGCThingZone(uintptr_t(*objp)));
+  auto zone = JS::shadow::Zone::from(detail::GetTenuredGCThingZone(*objp));
   if (!zone->isGCSweepingOrCompacting()) {
     return false;
   }
diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index f30844d8aa..305ab1feb0 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -642,6 +642,7 @@ struct ZoneStats {
   MACRO(Other, MallocHeap, scopesMallocHeap)               \
   MACRO(Other, GCHeapUsed, regExpSharedsGCHeap)            \
   MACRO(Other, MallocHeap, regExpSharedsMallocHeap)        \
+  MACRO(Other, MallocHeap, zoneObject)                     \
   MACRO(Other, MallocHeap, regexpZone)                     \
   MACRO(Other, MallocHeap, jitZone)                        \
   MACRO(Other, MallocHeap, cacheIRStubs)                   \
diff --git a/js/public/Modules.h b/js/public/Modules.h
index 580962235f..2e7192e120 100644
--- a/js/public/Modules.h
+++ b/js/public/Modules.h
@@ -36,6 +36,8 @@ union Utf8Unit;
 
 namespace JS {
 
+enum class ModuleType : uint32_t { Unknown = 0, JavaScript, JSON };
+
 /**
  * The HostResolveImportedModule hook.
  *
@@ -170,6 +172,14 @@ extern JS_PUBLIC_API JSObject* CompileModule(
     SourceText<mozilla::Utf8Unit>& srcBuf);
 
 /**
+ * Parse the given source buffer as a JSON module in the scope of the current
+ * global of cx and return a synthetic module record.
+ */
+extern JS_PUBLIC_API JSObject* CompileJsonModule(
+    JSContext* cx, const ReadOnlyCompileOptions& options,
+    SourceText<char16_t>& srcBuf);
+
+/**
  * Set a private value associated with a source text module record.
  */
 extern JS_PUBLIC_API void SetModulePrivate(JSObject* module,
diff --git a/js/public/ProfilingFrameIterator.h b/js/public/ProfilingFrameIterator.h
index 886ed806e9..bbad2b1244 100644
--- a/js/public/ProfilingFrameIterator.h
+++ b/js/public/ProfilingFrameIterator.h
@@ -14,6 +14,7 @@
 #include "jstypes.h"
 
 #include "js/GCAnnotations.h"
+#include "js/ProfilingCategory.h"
 #include "js/TypeDecls.h"
 
 namespace js {
@@ -141,7 +142,9 @@ class MOZ_NON_PARAM JS_PUBLIC_API ProfilingFrameIterator {
     Frame_BaselineInterpreter,
     Frame_Baseline,
     Frame_Ion,
-    Frame_Wasm
+    Frame_WasmBaseline,
+    Frame_WasmIon,
+    Frame_WasmOther,
   };
 
   struct Frame {
@@ -166,6 +169,23 @@ class MOZ_NON_PARAM JS_PUBLIC_API ProfilingFrameIterator {
       MOZ_ASSERT(kind == Frame_BaselineInterpreter);
       return interpreterPC_;
     }
+    ProfilingCategoryPair profilingCategory() const {
+      switch (kind) {
+        case FrameKind::Frame_BaselineInterpreter:
+          return JS::ProfilingCategoryPair::JS_BaselineInterpret;
+        case FrameKind::Frame_Baseline:
+          return JS::ProfilingCategoryPair::JS_Baseline;
+        case FrameKind::Frame_Ion:
+          return JS::ProfilingCategoryPair::JS_IonMonkey;
+        case FrameKind::Frame_WasmBaseline:
+          return JS::ProfilingCategoryPair::JS_WasmBaseline;
+        case FrameKind::Frame_WasmIon:
+          return JS::ProfilingCategoryPair::JS_WasmIon;
+        case FrameKind::Frame_WasmOther:
+          return JS::ProfilingCategoryPair::JS_WasmOther;
+      }
+      MOZ_CRASH();
+    }
   } JS_HAZ_GC_INVALIDATED;
 
   bool isWasm() const;
diff --git a/js/public/RegExpFlags.h b/js/public/RegExpFlags.h
index 36a2e76c29..e4663786fc 100644
--- a/js/public/RegExpFlags.h
+++ b/js/public/RegExpFlags.h
@@ -12,6 +12,7 @@
 #include "mozilla/Assertions.h"  // MOZ_ASSERT
 #include "mozilla/Attributes.h"  // MOZ_IMPLICIT
 
+#include <ostream>   // ostream
 #include <stdint.h>  // uint8_t
 
 namespace JS {
@@ -129,6 +130,15 @@ class RegExpFlags {
   explicit operator bool() const { return flags_ != 0; }
 
   Flag value() const { return flags_; }
+  constexpr operator Flag() const { return flags_; }
+
+  void set(Flag flags, bool value) {
+    if (value) {
+      flags_ |= flags;
+    } else {
+      flags_ &= ~flags;
+    }
+  }
 };
 
 inline RegExpFlags& operator&=(RegExpFlags& flags, RegExpFlags::Flag flag) {
@@ -158,6 +168,39 @@ inline RegExpFlags operator|(const RegExpFlags& lhs, const RegExpFlags& rhs) {
   return result;
 }
 
+inline bool MaybeParseRegExpFlag(char c, RegExpFlags::Flag* flag) {
+  switch (c) {
+    case 'd':
+      *flag = RegExpFlag::HasIndices;
+      return true;
+    case 'g':
+      *flag = RegExpFlag::Global;
+      return true;
+    case 'i':
+      *flag = RegExpFlag::IgnoreCase;
+      return true;
+    case 'm':
+      *flag = RegExpFlag::Multiline;
+      return true;
+    case 's':
+      *flag = RegExpFlag::DotAll;
+      return true;
+    case 'u':
+      *flag = RegExpFlag::Unicode;
+      return true;
+    case 'v':
+      *flag = RegExpFlag::UnicodeSets;
+      return true;
+    case 'y':
+      *flag = RegExpFlag::Sticky;
+      return true;
+    default:
+      return false;
+  }
+}
+
+std::ostream& operator<<(std::ostream& os, RegExpFlags flags);
+
 }  // namespace JS
 
 #endif  // js_RegExpFlags_h
diff --git a/js/public/RootingAPI.h b/js/public/RootingAPI.h
index 471c72dc42..e35a2c5bc8 100644
--- a/js/public/RootingAPI.h
+++ b/js/public/RootingAPI.h
@@ -981,12 +981,12 @@ enum class AutoGCRooterKind : uint8_t {
   Limit
 };
 
-using RootedListHeads =
-    mozilla::EnumeratedArray<RootKind, RootKind::Limit, js::StackRootedBase*>;
+using RootedListHeads = mozilla::EnumeratedArray<RootKind, js::StackRootedBase*,
+                                                 size_t(RootKind::Limit)>;
 
 using AutoRooterListHeads =
-    mozilla::EnumeratedArray<AutoGCRooterKind, AutoGCRooterKind::Limit,
-                             AutoGCRooter*>;
+    mozilla::EnumeratedArray<AutoGCRooterKind, AutoGCRooter*,
+                             size_t(AutoGCRooterKind::Limit)>;
 
 // Superclass of JSContext which can be used for rooting data in use by the
 // current thread but that does not provide all the functions of a JSContext.
diff --git a/js/public/Stack.h b/js/public/Stack.h
index 6f01b2b728..7384e92d39 100644
--- a/js/public/Stack.h
+++ b/js/public/Stack.h
@@ -140,6 +140,7 @@ struct JS_PUBLIC_API FirstSubsumedFrame {
   // unnecessarily.
   FirstSubsumedFrame(const FirstSubsumedFrame&) = delete;
   FirstSubsumedFrame& operator=(const FirstSubsumedFrame&) = delete;
+  FirstSubsumedFrame& operator=(FirstSubsumedFrame&&) = delete;
 
   FirstSubsumedFrame(FirstSubsumedFrame&& rhs)
       : principals(rhs.principals), ignoreSelfHosted(rhs.ignoreSelfHosted) {
@@ -147,11 +148,6 @@ struct JS_PUBLIC_API FirstSubsumedFrame {
     rhs.principals = nullptr;
   }
 
-  FirstSubsumedFrame& operator=(FirstSubsumedFrame&& rhs) {
-    new (this) FirstSubsumedFrame(std::move(rhs));
-    return *this;
-  }
-
   ~FirstSubsumedFrame() {
     if (principals) {
       JS_DropPrincipals(cx, principals);
diff --git a/js/public/UbiNodeCensus.h b/js/public/UbiNodeCensus.h
index 4086300580..9ac470725c 100644
--- a/js/public/UbiNodeCensus.h
+++ b/js/public/UbiNodeCensus.h
@@ -7,6 +7,7 @@
 #ifndef js_UbiNodeCensus_h
 #define js_UbiNodeCensus_h
 
+#include "js/GCVector.h"
 #include "js/UbiNode.h"
 #include "js/UbiNodeBreadthFirst.h"
 
@@ -222,8 +223,9 @@ using CensusTraversal = BreadthFirst<CensusHandler>;
 // Parse the breakdown language (as described in
 // js/src/doc/Debugger/Debugger.Memory.md) into a CountTypePtr. A null pointer
 // is returned on error and is reported to the cx.
-JS_PUBLIC_API CountTypePtr ParseBreakdown(JSContext* cx,
-                                          HandleValue breakdownValue);
+JS_PUBLIC_API CountTypePtr
+ParseBreakdown(JSContext* cx, HandleValue breakdownValue,
+               MutableHandle<JS::GCVector<JSLinearString*>> seen);
 
 }  // namespace ubi
 }  // namespace JS
diff --git a/js/public/Value.h b/js/public/Value.h
index 59f71da4f1..98f0f9273b 100644
--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -383,6 +383,9 @@ enum JSWhyMagic {
   /** arguments object can't be created because environment is dead. */
   JS_MISSING_ARGUMENTS,
 
+  /** exception value thrown when interrupting irregexp */
+  JS_INTERRUPT_REGEXP,
+
   /** for local use */
   JS_GENERIC_MAGIC,
 
@@ -645,7 +648,20 @@ class alignas(8) Value {
   }
 #endif
 
+  void changeGCThingPayload(js::gc::Cell* cell) {
+    MOZ_ASSERT(js::gc::IsCellPointerValid(cell));
+#ifdef DEBUG
+    assertTraceKindMatches(cell);
+#endif
+    asBits_ = bitsFromTagAndPayload(toTag(), PayloadType(cell));
+    MOZ_ASSERT(toGCThing() == cell);
+  }
+
  private:
+#ifdef DEBUG
+  void assertTraceKindMatches(js::gc::Cell* cell) const;
+#endif
+
   void setObjectNoCheck(JSObject* obj) {
     asBits_ = bitsFromTagAndPayload(JSVAL_TAG_OBJECT, PayloadType(obj));
   }
diff --git a/js/public/WasmFeatures.h b/js/public/WasmFeatures.h
index f2089f7fba..7e30a748d2 100644
--- a/js/public/WasmFeatures.h
+++ b/js/public/WasmFeatures.h
@@ -13,22 +13,6 @@
 // generate most of the feature gating code in a centralized manner. See
 // 'Adding a feature' below for the exact steps needed to add a new feature.
 //
-// Each feature is either `DEFAULT`, `TENTATIVE`, or `EXPERIMENTAL`:
-//
-// Default features are enabled by default in ContextOptions and in the
-// JS-shell, and are given a `--no-wasm-FEATURE` shell flag to disable.  The
-// `--wasm-FEATURE` flag is rejected.
-//
-// Tentative features are like Default features, but the `--wasm-FEATURE` flag
-// is silently ignored.
-//
-// Experimental features are disabled by default in ContextOptions and in the
-// JS-shell, and are given a `--wasm-FEATURE` shell flag to enable.  The
-// `--no-wasm-FEATURE` flag is silently ignored.
-//
-// The browser pref is `javascript.options.wasm-FEATURE` for default, tentative,
-// and experimental features alike.
-//
 // # Adding a feature
 //
 // 1. Add a configure switch for the feature in js/moz.configure
@@ -44,12 +28,10 @@
 //   e. flag predicate: Expression used to predicate enablement of feature
 //      flag. Useful for disabling a feature when dependent feature is not
 //      enabled or if we are fuzzing.
-//   f. shell flag: The stem of the JS-shell flag. Will be expanded to
-//      --no-wasm-FEATURE or --wasm-FEATURE as explained above.
-//   g. preference name: The stem of the browser preference. Will be expanded
+//   f. preference name: The stem of the browser preference. Will be expanded
 //      to `javascript.options.wasm-FEATURE`.
 // 4. Add the preference to module/libpref/init/StaticPrefList.yaml
-//   a. Use conditionally compiled flag
+//   a. Set `set_spidermonkey_pref: startup`
 //   b. Set value to 'true' for default features, @IS_NIGHTLY_BUILD@ for
 //      tentative features, and 'false' for experimental features.
 // 5. [fuzzing] Add the feature to gluesmith/src/lib.rs, if wasm-smith has
@@ -60,16 +42,6 @@
 #else
 #  define WASM_RELAXED_SIMD_ENABLED 0
 #endif
-#ifdef ENABLE_WASM_EXTENDED_CONST
-#  define WASM_EXTENDED_CONST_ENABLED 1
-#else
-#  define WASM_EXTENDED_CONST_ENABLED 0
-#endif
-#ifdef ENABLE_WASM_FUNCTION_REFERENCES
-#  define WASM_FUNCTION_REFERENCES_ENABLED 1
-#else
-#  define WASM_FUNCTION_REFERENCES_ENABLED 0
-#endif
 #ifdef ENABLE_WASM_GC
 #  define WASM_GC_ENABLED 1
 #else
@@ -106,168 +78,98 @@
 #  define WASM_JS_STRING_BUILTINS_ENABLED 0
 #endif
 
-enum class WasmFeatureStage {
-  Experimental = 0,
-  Tentative,
-  Default,
-};
-
 // clang-format off
 #define JS_FOR_WASM_FEATURES(FEATURE)                                   \
   FEATURE(                                                              \
-    /* capitalized name   */ ExtendedConst,                             \
-    /* lower case name    */ extendedConst,                             \
-    /* stage              */ WasmFeatureStage::Tentative,               \
-    /* compile predicate  */ WASM_EXTENDED_CONST_ENABLED,               \
-    /* compiler predicate */ true,                                      \
-    /* flag predicate     */ true,                                      \
-    /* flag force enable  */ false,                                     \
-    /* flag fuzz enable   */ true,                                      \
-    /* shell flag         */ "extended-const",                          \
-    /* preference name    */ "extended_const")                          \
-  FEATURE(                                                              \
-    /* capitalized name   */ Exceptions,                                \
-    /* lower case name    */ exceptions,                                \
-    /* stage              */ WasmFeatureStage::Default,                 \
-    /* compile predicate  */ true,                                      \
-    /* compiler predicate */ AnyCompilerAvailable(cx),                  \
-    /* flag predicate     */ true,                                      \
-    /* flag force enable  */ WasmExnRefFlag(cx),                        \
-    /* flag fuzz enable   */ true,                                      \
-    /* shell flag         */ "exceptions",                              \
-    /* preference name    */ "exceptions")                              \
-  FEATURE(                                                              \
     /* capitalized name   */ ExnRef,                                    \
     /* lower case name    */ exnref,                                    \
-    /* stage              */ WasmFeatureStage::Experimental,            \
     /* compile predicate  */ true,                                      \
     /* compiler predicate */ AnyCompilerAvailable(cx),                  \
     /* flag predicate     */ true,                                      \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ true,                                      \
-    /* shell flag         */ "exnref",                                  \
-    /* preference name    */ "exnref ")                                 \
-  FEATURE(                                                              \
-    /* capitalized name   */ FunctionReferences,                        \
-    /* lower case name    */ functionReferences,                        \
-    /* stage              */ WasmFeatureStage::Tentative,               \
-    /* compile predicate  */ WASM_FUNCTION_REFERENCES_ENABLED,          \
-    /* compiler predicate */ AnyCompilerAvailable(cx),                  \
-    /* flag predicate     */ true,                                      \
-    /* flag force enable  */ WasmGcFlag(cx),                            \
-    /* flag fuzz enable   */ false,                                     \
-    /* shell flag         */ "function-references",                     \
-    /* preference name    */ "function_references")                     \
+    /* preference name    */ exnref)                                    \
   FEATURE(                                                              \
     /* capitalized name   */ Gc,                                        \
     /* lower case name    */ gc,                                        \
-    /* stage              */ WasmFeatureStage::Tentative,               \
     /* compile predicate  */ WASM_GC_ENABLED,                           \
     /* compiler predicate */ AnyCompilerAvailable(cx),                  \
     /* flag predicate     */ true,                                      \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ false,                                     \
-    /* shell flag         */ "gc",                                      \
-    /* preference name    */ "gc")                                      \
+    /* preference name    */ gc)                                        \
   FEATURE(                                                              \
     /* capitalized name   */ JSStringBuiltins,                          \
     /* lower case name    */ jsStringBuiltins,                          \
-    /* stage              */ WasmFeatureStage::Experimental,            \
     /* compile predicate  */ WASM_JS_STRING_BUILTINS_ENABLED,           \
     /* compiler predicate */ AnyCompilerAvailable(cx),                  \
     /* flag predicate     */ true,                                      \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ true,                                      \
-    /* shell flag         */ "js-string-builtins",                      \
-    /* preference name    */ "js_string_builtins")                      \
+    /* preference name    */ js_string_builtins)                        \
   FEATURE(                                                              \
     /* capitalized name   */ RelaxedSimd,                               \
     /* lower case name    */ v128Relaxed,                               \
-    /* stage              */ WasmFeatureStage::Tentative,               \
     /* compile predicate  */ WASM_RELAXED_SIMD_ENABLED,                 \
     /* compiler predicate */ AnyCompilerAvailable(cx),                  \
     /* flag predicate     */ js::jit::JitSupportsWasmSimd(),            \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ true,                                      \
-    /* shell flag         */ "relaxed-simd",                            \
-    /* preference name    */ "relaxed_simd")                            \
+    /* preference name    */ relaxed_simd)                              \
   FEATURE(                                                              \
     /* capitalized name   */ Memory64,                                  \
     /* lower case name    */ memory64,                                  \
-    /* stage              */ WasmFeatureStage::Tentative,               \
     /* compile predicate  */ WASM_MEMORY64_ENABLED,                     \
     /* compiler predicate */ AnyCompilerAvailable(cx),                  \
     /* flag predicate     */ true,                                      \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ true,                                      \
-    /* shell flag         */ "memory64",                                \
-    /* preference name    */ "memory64")                                \
+    /* preference name    */ memory64)                                  \
   FEATURE(                                                              \
     /* capitalized name   */ MemoryControl,                             \
     /* lower case name    */ memoryControl,                             \
-    /* stage              */ WasmFeatureStage::Experimental,            \
     /* compile predicate  */ WASM_MEMORY_CONTROL_ENABLED,               \
     /* compiler predicate */ AnyCompilerAvailable(cx),                  \
     /* flag predicate     */ true,                                      \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ false,                                     \
-    /* shell flag         */ "memory-control",                          \
-    /* preference name    */ "memory_control")                          \
+    /* preference name    */ memory_control)                            \
   FEATURE(                                                              \
     /* capitalized name   */ MultiMemory,                               \
     /* lower case name    */ multiMemory,                               \
-    /* stage              */ WasmFeatureStage::Experimental,            \
     /* compile predicate  */ WASM_MULTI_MEMORY_ENABLED,                 \
     /* compiler predicate */ AnyCompilerAvailable(cx),                  \
     /* flag predicate     */ true,                                      \
     /* flag force enable  */ false,                                     \
-    /* flag fuzz enable  */  false,                                     \
-    /* shell flag         */ "multi-memory",                            \
-    /* preference name    */ "multi_memory")                            \
+    /* flag fuzz enable   */ true,                                      \
+    /* preference name    */ multi_memory)                              \
   FEATURE(                                                              \
     /* capitalized name   */ TailCalls,                                 \
     /* lower case name    */ tailCalls,                                 \
-    /* stage              */ WasmFeatureStage::Tentative,            \
     /* compile predicate  */ WASM_TAIL_CALLS_ENABLED,                   \
     /* compiler predicate */ AnyCompilerAvailable(cx),                  \
     /* flag predicate     */ true,                                      \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ true,                                      \
-    /* shell flag         */ "tail-calls",                              \
-    /* preference name    */ "tail_calls")                              \
+    /* preference name    */ tail_calls)                                \
   FEATURE(                                                              \
     /* capitalized name   */ MozIntGemm,                                \
     /* lower case name    */ mozIntGemm,                                \
-    /* stage              */ WasmFeatureStage::Experimental,            \
     /* compile predicate  */ WASM_MOZ_INTGEMM_ENABLED,                  \
     /* compiler predicate */ AnyCompilerAvailable(cx),                  \
     /* flag predicate     */ IsSimdPrivilegedContext(cx),               \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ false,                                     \
-    /* shell flag         */ "moz-intgemm",                             \
-    /* preference name    */ "moz_intgemm")                             \
+    /* preference name    */ moz_intgemm)                               \
   FEATURE(                                                              \
     /* capitalized name   */ TestSerialization,                         \
     /* lower case name    */ testSerialization,                         \
-    /* stage              */ WasmFeatureStage::Experimental,            \
     /* compile predicate  */ 1,                                         \
     /* compiler predicate */ IonAvailable(cx),                          \
     /* flag predicate     */ true,                                      \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ false,                                     \
-    /* shell flag         */ "test-serialization",                      \
-    /* preference name    */ "test-serialization")                      \
-  FEATURE(                                                              \
-    /* capitalized name   */ TestMetadata,                              \
-    /* lower case name    */ testMetadata,                              \
-    /* stage              */ WasmFeatureStage::Experimental,            \
-    /* compile predicate  */ 1,                                         \
-    /* compiler predicate */ AnyCompilerAvailable(cx),                  \
-    /* flag predicate     */ true,                                      \
-    /* flag force enable  */ false,                                     \
-    /* flag fuzz enable   */ false,                                     \
-    /* shell flag         */ "test-metadata",                           \
-    /* preference name    */ "test_metadata")
+    /* preference name    */ test_serialization)
 
 // clang-format on
 
diff --git a/js/public/experimental/CompileScript.h b/js/public/experimental/CompileScript.h
index 308a5848d9..ebb87e6227 100644
--- a/js/public/experimental/CompileScript.h
+++ b/js/public/experimental/CompileScript.h
@@ -105,71 +105,21 @@ JS_PUBLIC_API const JSErrorReport* GetFrontendWarningAt(
     JS::FrontendContext* fc, size_t index,
     const JS::ReadOnlyCompileOptions& options);
 
-// Temporary storage used during compiling and preparing to instantiate a
-// Stencil.
-//
-// Off-thread consumers can allocate this instance off main thread, and pass it
-// back to the main thread, in order to reduce the main thread allocation.
-struct CompilationStorage {
- private:
-  // Owned CompilationInput.
-  //
-  // This uses raw pointer instead of UniquePtr because CompilationInput
-  // is opaque.
-  JS_HAZ_NON_GC_POINTER js::frontend::CompilationInput* input_ = nullptr;
-  bool isBorrowed_ = false;
-
- public:
-  CompilationStorage() = default;
-  explicit CompilationStorage(js::frontend::CompilationInput* input)
-      : input_(input), isBorrowed_(true) {}
-  CompilationStorage(CompilationStorage&& other)
-      : input_(other.input_), isBorrowed_(other.isBorrowed_) {
-    other.input_ = nullptr;
-  }
-
-  ~CompilationStorage();
-
- private:
-  CompilationStorage(const CompilationStorage& other) = delete;
-  void operator=(const CompilationStorage& aOther) = delete;
-
- public:
-  bool hasInput() { return !!input_; }
-
-  // Internal function that initializes the CompilationInput. It should only be
-  // called once.
-  bool allocateInput(FrontendContext* fc,
-                     const JS::ReadOnlyCompileOptions& options);
-
-  js::frontend::CompilationInput& getInput() {
-    MOZ_ASSERT(hasInput());
-    return *input_;
-  }
-
-  // Size of dynamic data. Note that GC data is counted by GC and not here.
-  size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
-
-  void trace(JSTracer* trc);
-};
-
 extern JS_PUBLIC_API already_AddRefed<JS::Stencil> CompileGlobalScriptToStencil(
     JS::FrontendContext* fc, const JS::ReadOnlyCompileOptions& options,
-    JS::SourceText<mozilla::Utf8Unit>& srcBuf,
-    JS::CompilationStorage& compileStorage);
+    JS::SourceText<mozilla::Utf8Unit>& srcBuf);
 
 extern JS_PUBLIC_API already_AddRefed<JS::Stencil> CompileGlobalScriptToStencil(
     JS::FrontendContext* fc, const JS::ReadOnlyCompileOptions& options,
-    JS::SourceText<char16_t>& srcBuf, JS::CompilationStorage& compileStorage);
+    JS::SourceText<char16_t>& srcBuf);
 
 extern JS_PUBLIC_API already_AddRefed<JS::Stencil> CompileModuleScriptToStencil(
     JS::FrontendContext* fc, const JS::ReadOnlyCompileOptions& options,
-    JS::SourceText<mozilla::Utf8Unit>& srcBuf,
-    JS::CompilationStorage& compileStorage);
+    JS::SourceText<mozilla::Utf8Unit>& srcBuf);
 
 extern JS_PUBLIC_API already_AddRefed<JS::Stencil> CompileModuleScriptToStencil(
     JS::FrontendContext* fc, const JS::ReadOnlyCompileOptions& options,
-    JS::SourceText<char16_t>& srcBuf, JS::CompilationStorage& compileStorage);
+    JS::SourceText<char16_t>& srcBuf);
 
 extern JS_PUBLIC_API bool PrepareForInstantiate(
     JS::FrontendContext* fc, JS::Stencil& stencil,
diff --git a/js/public/experimental/JSStencil.h b/js/public/experimental/JSStencil.h
index 8a79687898..780c3e1c62 100644
--- a/js/public/experimental/JSStencil.h
+++ b/js/public/experimental/JSStencil.h
@@ -47,8 +47,6 @@ struct PreallocatedCompilationGCOutput;
 
 namespace JS {
 
-struct CompilationStorage;
-
 using Stencil = js::frontend::CompilationStencil;
 using FrontendContext = js::FrontendContext;
 
@@ -56,7 +54,7 @@ using FrontendContext = js::FrontendContext;
 //
 // Off-thread APIs can allocate this instance off main thread, and pass it back
 // to the main thread, in order to reduce the main thread allocation.
-struct InstantiationStorage {
+struct JS_PUBLIC_API InstantiationStorage {
  private:
   // Owned CompilationGCOutput.
   //
diff --git a/js/public/friend/ErrorNumbers.msg b/js/public/friend/ErrorNumbers.msg
index 5daa625ff9..e75e7b973c 100644
--- a/js/public/friend/ErrorNumbers.msg
+++ b/js/public/friend/ErrorNumbers.msg
@@ -154,7 +154,6 @@ MSG_DEF(JSMSG_CANT_DECLARE_GLOBAL_BINDING, 2, JSEXN_TYPEERR, "cannot declare glo
 // Date
 MSG_DEF(JSMSG_INVALID_DATE,            0, JSEXN_RANGEERR, "invalid date")
 MSG_DEF(JSMSG_BAD_TOISOSTRING_PROP,    0, JSEXN_TYPEERR, "toISOString property is not callable")
-MSG_DEF(JSMSG_DEPRECATED_LATE_WEEKDAY, 0, JSEXN_WARN, "day of week after day of month in date format is deprecated")
 
 // String
 MSG_DEF(JSMSG_BAD_URI,                 0, JSEXN_URIERR, "malformed URI sequence")
@@ -580,6 +579,7 @@ MSG_DEF(JSMSG_QUERY_LINE_WITHOUT_URL, 0, JSEXN_TYPEERR, "findScripts query objec
 MSG_DEF(JSMSG_DEBUG_CANT_SET_OPT_ENV, 1, JSEXN_REFERENCEERR, "can't set '{0}' in an optimized-out environment")
 MSG_DEF(JSMSG_DEBUG_INVISIBLE_COMPARTMENT, 0, JSEXN_TYPEERR, "object in compartment marked as invisible to Debugger")
 MSG_DEF(JSMSG_DEBUG_CENSUS_BREAKDOWN,  1, JSEXN_TYPEERR, "unrecognized 'by' value in takeCensus breakdown: {0}")
+MSG_DEF(JSMSG_DEBUG_CENSUS_BREAKDOWN_NESTED,  1, JSEXN_TYPEERR, "takeCensus breakdown 'by' value nested within itself: {0}")
 MSG_DEF(JSMSG_DEBUG_PROMISE_NOT_RESOLVED, 0, JSEXN_TYPEERR, "Promise hasn't been resolved")
 MSG_DEF(JSMSG_DEBUG_PROMISE_NOT_FULFILLED, 0, JSEXN_TYPEERR, "Promise hasn't been fulfilled")
 MSG_DEF(JSMSG_DEBUG_PROMISE_NOT_REJECTED, 0, JSEXN_TYPEERR, "Promise hasn't been rejected")
@@ -722,6 +722,7 @@ MSG_DEF(JSMSG_MISSING_EXPORT,               1, JSEXN_SYNTAXERR, "local binding f
 MSG_DEF(JSMSG_BAD_MODULE_STATUS,            1, JSEXN_INTERNALERR, "module record has unexpected status: {0}")
 MSG_DEF(JSMSG_DYNAMIC_IMPORT_FAILED,        1, JSEXN_TYPEERR, "error loading dynamically imported module: {0}")
 MSG_DEF(JSMSG_DYNAMIC_IMPORT_NOT_SUPPORTED, 0, JSEXN_TYPEERR, "Dynamic import not supported in this context")
+MSG_DEF(JSMSG_BAD_MODULE_TYPE,              0, JSEXN_TYPEERR, "invalid module type")
 
 // Import maps
 MSG_DEF(JSMSG_IMPORT_MAPS_PARSE_FAILED, 1, JSEXN_SYNTAXERR, "Failed to parse import map: Invalid JSON format. {0}")
diff --git a/js/public/friend/UsageStatistics.h b/js/public/friend/UsageStatistics.h
index 27fea9b1a8..c098548ad9 100644
--- a/js/public/friend/UsageStatistics.h
+++ b/js/public/friend/UsageStatistics.h
@@ -91,7 +91,7 @@ extern JS_PUBLIC_API void JS_SetAccumulateTelemetryCallback(
  * fixed member of the mozilla::UseCounter enum by the callback.
  */
 
-enum class JSUseCounter { ASMJS, WASM, WASM_LEGACY_EXCEPTIONS, LATE_WEEKDAY };
+enum class JSUseCounter { ASMJS, WASM, WASM_LEGACY_EXCEPTIONS };
 
 using JSSetUseCounterCallback = void (*)(JSObject*, JSUseCounter);