Adding upstream version 127.0.upstream/127.0

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

14 files changed, 173 insertions, 20 deletions

diff --git a/js/public/Class.h b/js/public/Class.h
index 5664198584..0c9833cbcf 100644
--- a/js/public/Class.h
+++ b/js/public/Class.h
@@ -272,6 +272,9 @@ typedef JSString* (*JSFunToStringOp)(JSContext* cx, JS::HandleObject obj,
  * JS looks for a property in an object, and if not found, tries to resolve
  * the given id. *resolvedp should be set to true iff the property was defined
  * on |obj|.
+ *
+ * See JS::dbg::ShouldAvoidSideEffects in Debug.h if this function has any
+ * other side-effect than just resolving the property.
  */
 typedef bool (*JSResolveOp)(JSContext* cx, JS::HandleObject obj,
                             JS::HandleId id, bool* resolvedp);
@@ -606,6 +609,10 @@ struct MOZ_STATIC_CLASS JSClassOps {
 
 static constexpr const JSClassOps* JS_NULL_CLASS_OPS = nullptr;
 
+// Note: This is a MOZ_STATIC_CLASS, as having a non-static JSClass
+// can lead to bizarre behaviour, however the annotation
+// is at the bottom to handle some incompatibility with GCC
+// annotation processing.
 struct alignas(js::gc::JSClassAlignBytes) JSClass {
   const char* name;
   uint32_t flags;
@@ -763,7 +770,7 @@ struct alignas(js::gc::JSClassAlignBytes) JSClass {
   JSFunToStringOp getOpsFunToString() const {
     return oOps ? oOps->funToString : nullptr;
   }
-};
+} MOZ_STATIC_CLASS;
 
 static constexpr uint32_t JSCLASS_RESERVED_SLOTS(const JSClass* clasp) {
   return (clasp->flags >> JSCLASS_RESERVED_SLOTS_SHIFT) &
diff --git a/js/public/Context.h b/js/public/Context.h
index 13a18e3e05..b7f9921042 100644
--- a/js/public/Context.h
+++ b/js/public/Context.h
@@ -102,6 +102,25 @@ using EnsureCanAddPrivateElementOp = bool (*)(JSContext* cx, HandleValue val);
 JS_PUBLIC_API void SetHostEnsureCanAddPrivateElementHook(
     JSContext* cx, EnsureCanAddPrivateElementOp op);
 
+/**
+ * Transition the cx to a mode where failures that would normally cause a false
+ * return value will instead crash with a diagnostic assertion.
+ *
+ * Return value: the former brittle mode setting.
+ */
+JS_PUBLIC_API bool SetBrittleMode(JSContext* cx, bool setting);
+
+class AutoBrittleMode {
+  bool wasBrittle;
+  JSContext* cx;
+
+ public:
+  explicit AutoBrittleMode(JSContext* cx) : cx(cx) {
+    wasBrittle = SetBrittleMode(cx, true);
+  }
+  ~AutoBrittleMode() { MOZ_ALWAYS_TRUE(SetBrittleMode(cx, wasBrittle)); }
+};
+
 } /* namespace JS */
 
 #endif  // js_Context_h
diff --git a/js/public/Debug.h b/js/public/Debug.h
index 6d7fd8a4be..837ae2a181 100644
--- a/js/public/Debug.h
+++ b/js/public/Debug.h
@@ -348,6 +348,36 @@ class MOZ_STACK_CLASS JS_PUBLIC_API AutoEntryMonitor {
   virtual void Exit(JSContext* cx) {}
 };
 
+// Returns true if there's any debugger attached to the given context where
+// the debugger's "shouldAvoidSideEffects" property is true.
+//
+// This is supposed to be used by native code that performs side-effectful
+// operations where the debugger cannot hook it.
+//
+// If this function returns true, the native function should throw an
+// uncatchable exception by returning `false` without setting any pending
+// exception. The debugger will handle this exception by aborting the eager
+// evaluation.
+//
+// The native code can opt into this behavior to help the debugger performing
+// the side-effect-free evaluation.
+//
+// Expected consumers of this API include JSClassOps.resolve hooks which have
+// any side-effect other than just resolving the property.
+//
+// Example:
+//   static bool ResolveHook(JSContext* cx, HandleObject obj, HandleId id,
+//                           bool* resolvedp) {
+//     *resolvedp = false;
+//     if (JS::dbg::ShouldAvoidSideEffects()) {
+//       return false;
+//     }
+//     // Resolve the property with the side-effect.
+//     ...
+//     return true;
+//   }
+bool ShouldAvoidSideEffects(JSContext* cx);
+
 }  // namespace dbg
 }  // namespace JS
 
diff --git a/js/public/GCAPI.h b/js/public/GCAPI.h
index 5773838e46..a7fcee3d42 100644
--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -440,15 +440,9 @@ typedef enum JSGCParamKey {
   JSGC_URGENT_THRESHOLD_MB = 48,
 
   /**
-   * Set the number of threads to use for parallel marking, or zero to use the
-   * default.
-   *
-   * The actual number used is capped to the number of available helper threads.
-   *
-   * This is provided for testing purposes.
+   * Get the number of threads used for parallel marking.
    *
    * Pref: None.
-   * Default: 0 (no effect).
    */
   JSGC_MARKING_THREAD_COUNT = 49,
 
@@ -468,6 +462,18 @@ typedef enum JSGCParamKey {
    */
   JSGC_SEMISPACE_NURSERY_ENABLED = 51,
 
+  /**
+   * Set the maximum number of threads to use for parallel marking, if enabled.
+   *
+   * The actual number used is calculated based on the number of available
+   * helper threads and can be found by getting the JSGC_MARKING_THREAD_COUNT
+   * parameter.
+   *
+   * Pref: javascript.options.mem.gc_max_parallel_marking_threads
+   * Default: 2.
+   */
+  JSGC_MAX_MARKING_THREADS = 52,
+
 } JSGCParamKey;
 
 /*
diff --git a/js/public/GCVector.h b/js/public/GCVector.h
index 424f689a91..897acb71e7 100644
--- a/js/public/GCVector.h
+++ b/js/public/GCVector.h
@@ -46,6 +46,7 @@ class GCVector {
 
  public:
   using ElementType = T;
+  static constexpr size_t InlineLength = decltype(vector)::InlineLength;
 
   explicit GCVector(AllocPolicy alloc) : vector(std::move(alloc)) {}
   GCVector() : GCVector(AllocPolicy()) {}
diff --git a/js/public/HeapAPI.h b/js/public/HeapAPI.h
index cabadeb75d..cda803cf80 100644
--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -380,7 +380,7 @@ enum StackKind {
  * initial value. In the browser this configured by the
  * javascript.options.mem.nursery.max_kb pref.
  */
-const uint32_t DefaultNurseryMaxBytes = 16 * js::gc::ChunkSize;
+const uint32_t DefaultNurseryMaxBytes = 64 * js::gc::ChunkSize;
 
 /* Default maximum heap size in bytes to pass to JS_NewContext(). */
 const uint32_t DefaultHeapMaxBytes = 32 * 1024 * 1024;
diff --git a/js/public/ProtoKey.h b/js/public/ProtoKey.h
index 31dfae927c..fe8a191f06 100644
--- a/js/public/ProtoKey.h
+++ b/js/public/ProtoKey.h
@@ -53,8 +53,21 @@
 #  define IF_WASM_TYPE(REAL, IMAGINARY) IMAGINARY
 #endif
 
+#ifdef ENABLE_WASM_JSPI
+#  define IF_WASM_JSPI(REAL, IMAGINARY) REAL
+#else
+#  define IF_WASM_JSPI(REAL, IMAGINARY) IMAGINARY
+#endif
+
+#ifdef NIGHTLY_BUILD
+#  define IF_NIGHTLY(REAL, IMAGINARY) REAL
+#else
+#  define IF_NIGHTLY(REAL, IMAGINARY) IMAGINARY
+#endif
+
 #define JS_FOR_PROTOTYPES_(REAL, IMAGINARY, REAL_IF_INTL, REAL_IF_TEMPORAL, \
-                           REAL_IF_WASM_TYPE)                               \
+                           REAL_IF_WASM_TYPE, REAL_IF_WASM_JSPI,            \
+                           REAL_IF_NIGHTLY)                                 \
   IMAGINARY(Null, dummy)                                                    \
   REAL(Object, OCLASP(Plain))                                               \
   REAL(Function, &FunctionClass)                                            \
@@ -92,6 +105,7 @@
   REAL(Uint8ClampedArray, TYPED_ARRAY_CLASP(Uint8Clamped))                  \
   REAL(BigInt64Array, TYPED_ARRAY_CLASP(BigInt64))                          \
   REAL(BigUint64Array, TYPED_ARRAY_CLASP(BigUint64))                        \
+  REAL_IF_NIGHTLY(Float16Array, TYPED_ARRAY_CLASP(Float16))                 \
   REAL(BigInt, OCLASP(BigInt))                                              \
   REAL(Proxy, CLASP(Proxy))                                                 \
   REAL(WeakMap, OCLASP(WeakMap))                                            \
@@ -128,6 +142,7 @@
   REAL(WasmGlobal, OCLASP(WasmGlobal))                                      \
   REAL(WasmTag, OCLASP(WasmTag))                                            \
   REAL_IF_WASM_TYPE(WasmFunction, CLASP(WasmFunction))                      \
+  REAL_IF_WASM_JSPI(WasmSuspending, OCLASP(WasmSuspending))                 \
   REAL(WasmException, OCLASP(WasmException))                                \
   REAL(FinalizationRegistry, OCLASP(FinalizationRegistry))                  \
   REAL(WeakRef, OCLASP(WeakRef))                                            \
@@ -148,10 +163,11 @@
   IF_RECORD_TUPLE(REAL(Record, (&RecordType::class_)))                      \
   IF_RECORD_TUPLE(REAL(Tuple, (&TupleType::class_)))
 
-#define JS_FOR_PROTOTYPES(REAL, IMAGINARY)                      \
-  JS_FOR_PROTOTYPES_(REAL, IMAGINARY, IF_INTL(REAL, IMAGINARY), \
-                     IF_TEMPORAL(REAL, IMAGINARY),              \
-                     IF_WASM_TYPE(REAL, IMAGINARY))
+#define JS_FOR_PROTOTYPES(REAL, IMAGINARY)                                     \
+  JS_FOR_PROTOTYPES_(                                                          \
+      REAL, IMAGINARY, IF_INTL(REAL, IMAGINARY), IF_TEMPORAL(REAL, IMAGINARY), \
+      IF_WASM_TYPE(REAL, IMAGINARY), IF_WASM_JSPI(REAL, IMAGINARY),            \
+      IF_NIGHTLY(REAL, IMAGINARY))
 
 #define JS_FOR_EACH_PROTOTYPE(MACRO) JS_FOR_PROTOTYPES(MACRO, MACRO)
 
diff --git a/js/public/ScalarType.h b/js/public/ScalarType.h
index 3c98fa204c..ab410dc7c8 100644
--- a/js/public/ScalarType.h
+++ b/js/public/ScalarType.h
@@ -51,6 +51,8 @@ enum Type {
   BigInt64,
   BigUint64,
 
+  Float16,
+
   /**
    * Types that don't have their own TypedArray equivalent, for now.
    * E.g. DataView
@@ -69,6 +71,7 @@ static inline size_t byteSize(Type atype) {
       return 1;
     case Int16:
     case Uint16:
+    case Float16:
       return 2;
     case Int32:
     case Uint32:
@@ -99,6 +102,7 @@ static inline bool isSignedIntType(Type atype) {
     case Uint8Clamped:
     case Uint16:
     case Uint32:
+    case Float16:
     case Float32:
     case Float64:
     case BigUint64:
@@ -123,6 +127,7 @@ static inline bool isBigIntType(Type atype) {
     case Uint8Clamped:
     case Uint16:
     case Uint32:
+    case Float16:
     case Float32:
     case Float64:
     case Simd128:
@@ -146,6 +151,7 @@ static inline bool isFloatingType(Type atype) {
     case BigInt64:
     case BigUint64:
       return false;
+    case Float16:
     case Float32:
     case Float64:
     case Simd128:
@@ -170,6 +176,8 @@ static inline const char* name(Type atype) {
       return "Int32";
     case Uint32:
       return "Uint32";
+    case Float16:
+      return "Float16";
     case Float32:
       return "Float32";
     case Float64:
@@ -198,6 +206,7 @@ static inline const char* byteSizeString(Type atype) {
       return "1";
     case Int16:
     case Uint16:
+    case Float16:
       return "2";
     case Int32:
     case Uint32:
diff --git a/js/public/StableStringChars.h b/js/public/StableStringChars.h
index 5c50df18cb..84429041da 100644
--- a/js/public/StableStringChars.h
+++ b/js/public/StableStringChars.h
@@ -53,10 +53,15 @@ class MOZ_STACK_CLASS JS_PUBLIC_API AutoStableStringChars final {
     const char16_t* twoByteChars_;
     const Latin1Char* latin1Chars_;
   };
+  MOZ_INIT_OUTSIDE_CTOR uint32_t length_;
   mozilla::Maybe<js::Vector<uint8_t, InlineCapacity>> ownChars_;
   enum State { Uninitialized, Latin1, TwoByte };
   State state_;
 
+  // Prevent the string that owns s's chars from being collected (by storing it
+  // in s_) or deduplicated.
+  void holdStableChars(JSLinearString* s);
+
  public:
   explicit AutoStableStringChars(JSContext* cx)
       : s_(cx), state_(Uninitialized) {}
@@ -99,7 +104,10 @@ class MOZ_STACK_CLASS JS_PUBLIC_API AutoStableStringChars final {
     return true;
   }
 
-  size_t length() const { return GetStringLength(s_); }
+  size_t length() const {
+    MOZ_ASSERT(state_ != Uninitialized);
+    return length_;
+  }
 
  private:
   AutoStableStringChars(const AutoStableStringChars& other) = delete;
diff --git a/js/public/WasmFeatures.h b/js/public/WasmFeatures.h
index 7e30a748d2..30c1bcca26 100644
--- a/js/public/WasmFeatures.h
+++ b/js/public/WasmFeatures.h
@@ -62,6 +62,11 @@
 #else
 #  define WASM_TAIL_CALLS_ENABLED 0
 #endif
+#ifdef ENABLE_WASM_JSPI
+#  define WASM_JSPI_ENABLED 1
+#else
+#  define WASM_JSPI_ENABLED 0
+#endif
 #ifdef ENABLE_WASM_MOZ_INTGEMM
 #  define WASM_MOZ_INTGEMM_ENABLED 1
 #else
@@ -72,6 +77,11 @@
 #else
 #  define WASM_MULTI_MEMORY_ENABLED 0
 #endif
+#ifdef ENABLE_WASM_BRANCH_HINTING
+#  define WASM_BRANCH_HINTING_ENABLED 1
+#else
+#  define WASM_BRANCH_HINTING_ENABLED 0
+#endif
 #ifdef ENABLE_WASM_JS_STRING_BUILTINS
 #  define WASM_JS_STRING_BUILTINS_ENABLED 1
 #else
@@ -153,6 +163,15 @@
     /* flag fuzz enable   */ true,                                      \
     /* preference name    */ tail_calls)                                \
   FEATURE(                                                              \
+    /* capitalized name   */ JSPromiseIntegration,                      \
+    /* lower case name    */ jsPromiseIntegration,                      \
+    /* compile predicate  */ WASM_JSPI_ENABLED,                         \
+    /* compiler predicate */ IonAvailable(cx),                          \
+    /* flag predicate     */ true,                                      \
+    /* flag force enable  */ false,                                     \
+    /* flag fuzz enable   */ false,                                     \
+    /* preference name    */ js_promise_integration)                    \
+  FEATURE(                                                              \
     /* capitalized name   */ MozIntGemm,                                \
     /* lower case name    */ mozIntGemm,                                \
     /* compile predicate  */ WASM_MOZ_INTGEMM_ENABLED,                  \
@@ -169,7 +188,16 @@
     /* flag predicate     */ true,                                      \
     /* flag force enable  */ false,                                     \
     /* flag fuzz enable   */ false,                                     \
-    /* preference name    */ test_serialization)
+    /* preference name    */ test_serialization)                        \
+  FEATURE(                                                              \
+    /* capitalized name   */ BranchHinting,                             \
+    /* lower case name    */ branchHinting,                             \
+    /* compile predicate  */ WASM_BRANCH_HINTING_ENABLED,               \
+    /* compiler predicate */ IonAvailable(cx),                          \
+    /* flag predicate     */ true,                                      \
+    /* flag force enable  */ false,                                     \
+    /* flag fuzz enable   */ false,                                     \
+    /* preference name    */ branch_hinting)
 
 // clang-format on
 
diff --git a/js/public/experimental/TypedData.h b/js/public/experimental/TypedData.h
index abb6bf81f4..39d691b039 100644
--- a/js/public/experimental/TypedData.h
+++ b/js/public/experimental/TypedData.h
@@ -60,7 +60,8 @@ class JS_PUBLIC_API AutoRequireNoGC;
   MACRO(double, double, Float64)                  \
   MACRO(uint8_t, js::uint8_clamped, Uint8Clamped) \
   MACRO(int64_t, int64_t, BigInt64)               \
-  MACRO(uint64_t, uint64_t, BigUint64)
+  MACRO(uint64_t, uint64_t, BigUint64)            \
+  MACRO(uint16_t, js::float16, Float16)
 
 /*
  * JS_New(type)Array:
diff --git a/js/public/friend/ErrorNumbers.msg b/js/public/friend/ErrorNumbers.msg
index 42f9a6615d..b064c2d464 100644
--- a/js/public/friend/ErrorNumbers.msg
+++ b/js/public/friend/ErrorNumbers.msg
@@ -58,6 +58,7 @@ MSG_DEF(JSMSG_INCOMPATIBLE_PROTO2,     3, JSEXN_TYPEERR, "{0}.prototype[{1}] cal
 MSG_DEF(JSMSG_NO_CONSTRUCTOR,          1, JSEXN_TYPEERR, "{0} has no constructor")
 MSG_DEF(JSMSG_BAD_SORT_ARG,            0, JSEXN_TYPEERR, "invalid Array.prototype.sort argument")
 MSG_DEF(JSMSG_BAD_TOSORTED_ARG,      0, JSEXN_TYPEERR, "non-function passed to Array.prototype.toSorted")
+MSG_DEF(JSMSG_BAD_TYPEDARRAY_SORT_ARG, 0, JSEXN_TYPEERR, "invalid %TypedArray%.prototype.sort argument")
 MSG_DEF(JSMSG_READ_ONLY,               1, JSEXN_TYPEERR, "{0} is read-only")
 MSG_DEF(JSMSG_CANT_DELETE,             1, JSEXN_TYPEERR, "property {0} is non-configurable and can't be deleted")
 MSG_DEF(JSMSG_CANT_TRUNCATE_ARRAY,     0, JSEXN_TYPEERR, "can't delete non-configurable array element")
@@ -469,6 +470,7 @@ MSG_DEF(JSMSG_WASM_BAD_IMPORT_ARG,     0, JSEXN_TYPEERR,     "second argument mu
 MSG_DEF(JSMSG_WASM_BAD_IMPORT_FIELD,   1, JSEXN_TYPEERR,     "import object field '{0}' is not an Object")
 MSG_DEF(JSMSG_WASM_BAD_REF_NONNULLABLE_VALUE,  0, JSEXN_TYPEERR,     "cannot pass null to non-nullable WebAssembly reference")
 MSG_DEF(JSMSG_WASM_BAD_FUNCREF_VALUE,  0, JSEXN_TYPEERR,     "can only pass WebAssembly exported functions to funcref")
+MSG_DEF(JSMSG_WASM_BAD_NULL_EXNREF_VALUE,  0, JSEXN_TYPEERR,     "can only pass null to nullexnref")
 MSG_DEF(JSMSG_WASM_BAD_NULL_EXTERNREF_VALUE,  0, JSEXN_TYPEERR,     "can only pass null to nullexternref")
 MSG_DEF(JSMSG_WASM_BAD_NULL_FUNCREF_VALUE,  0, JSEXN_TYPEERR,     "can only pass null to nullfuncref")
 MSG_DEF(JSMSG_WASM_BAD_NULL_ANYREF_VALUE,  0, JSEXN_TYPEERR,     "can only pass null to nullref")
@@ -500,6 +502,15 @@ MSG_DEF(JSMSG_WASM_SUPPLY_ONLY_ONE,    2, JSEXN_TYPEERR,     "exactly one of {0}
 MSG_DEF(JSMSG_WASM_MISSING_REQUIRED,   1, JSEXN_TYPEERR,     "Missing required argument {0}")
 MSG_DEF(JSMSG_WASM_MODIFIED_GC_OBJECT,   0, JSEXN_TYPEERR,     "can't modify WebAssembly GC objects")
 
+// JSPI
+MSG_DEF(JSMSG_JSPI_ARG_POSITION,       0, JSEXN_TYPEERR,              "Invalid argument position value")
+MSG_DEF(JSMSG_JSPI_INVALID_SUSPENDER,  0, JSEXN_WASMRUNTIMEERROR,     "Invalid suspender")
+MSG_DEF(JSMSG_JSPI_INVALID_STATE,      0, JSEXN_WASMRUNTIMEERROR,     "Invalid state")
+MSG_DEF(JSMSG_JSPI_EXPECTED_SUSPENDER, 0, JSEXN_TYPEERR,              "Expected externref for suspender")
+MSG_DEF(JSMSG_JSPI_EXPECTED_PROMISE,   0, JSEXN_TYPEERR,              "Expected externref for returned promise")
+MSG_DEF(JSMSG_JSPI_SIGNATURE_MISMATCH, 0, JSEXN_TYPEERR,              "Signature mismatch")
+MSG_DEF(JSMSG_JSPI_SUSPENDER_LIMIT,    0, JSEXN_WASMRUNTIMEERROR,     "Too many suspenders")
+
 // Proxy
 MSG_DEF(JSMSG_BAD_GETPROTOTYPEOF_TRAP_RETURN,0,JSEXN_TYPEERR,"proxy getPrototypeOf handler returned a non-object, non-null value")
 MSG_DEF(JSMSG_INCONSISTENT_GETPROTOTYPEOF_TRAP,0,JSEXN_TYPEERR,"proxy getPrototypeOf handler didn't return the target object's prototype")
@@ -744,6 +755,9 @@ MSG_DEF(JSMSG_IMPORT_MAPS_IMPORTS_NOT_A_MAP, 0, JSEXN_TYPEERR, "the imports top-
 MSG_DEF(JSMSG_IMPORT_MAPS_SCOPES_NOT_A_MAP, 0, JSEXN_TYPEERR, "the scopes top-level key needs to be a JSON object")
 MSG_DEF(JSMSG_IMPORT_MAPS_SCOPE_VALUE_NOT_A_MAP, 1, JSEXN_TYPEERR, "the value of the scope with prefix '{0}' needs to be a JSON object")
 
+// Import Attributes
+MSG_DEF(JSMSG_IMPORT_ATTRIBUTES_UNSUPPORTED_ATTRIBUTE, 1, JSEXN_TYPEERR, "Unsupported import attribute: {0}")
+
 // Promise
 MSG_DEF(JSMSG_CANNOT_RESOLVE_PROMISE_WITH_ITSELF,       0, JSEXN_TYPEERR, "A promise cannot be resolved with itself.")
 MSG_DEF(JSMSG_PROMISE_CAPABILITY_HAS_SOMETHING_ALREADY, 0, JSEXN_TYPEERR, "GetCapabilitiesExecutor function already invoked with non-undefined values.")
@@ -866,12 +880,15 @@ MSG_DEF(JSMSG_TEMPORAL_TIMEZONE_INVALID_IDENTIFIER, 1, JSEXN_RANGEERR, "invalid
 MSG_DEF(JSMSG_TEMPORAL_TIMEZONE_NANOS_RANGE,        1, JSEXN_RANGEERR, "nanoseconds out of range: {0}")
 MSG_DEF(JSMSG_TEMPORAL_TIMEZONE_INCOMPATIBLE,       2, JSEXN_RANGEERR, "time zones \"{0}\" and \"{1}\" aren't compatible")
 MSG_DEF(JSMSG_TEMPORAL_TIMEZONE_INSTANT_AMBIGUOUS,  0, JSEXN_RANGEERR, "instant is ambiguous")
+MSG_DEF(JSMSG_TEMPORAL_TIMEZONE_OFFSET_SHIFT_ONE_DAY, 0, JSEXN_RANGEERR, "time zone offset shift must not exceed a 24-hour span")
 MSG_DEF(JSMSG_TEMPORAL_DURATION_INVALID_SIGN,       2, JSEXN_RANGEERR, "duration value \"{0}\" has a mismatched sign: {1}")
 MSG_DEF(JSMSG_TEMPORAL_DURATION_INVALID_NON_FINITE, 2, JSEXN_RANGEERR, "duration value \"{0}\" is {1}")
+MSG_DEF(JSMSG_TEMPORAL_DURATION_INVALID_NORMALIZED_TIME, 0, JSEXN_RANGEERR, "time duration values must be lower than 2**53 seconds")
 MSG_DEF(JSMSG_TEMPORAL_DURATION_MISSING_UNIT,       0, JSEXN_TYPEERR, "Duration-like objects must have at least one duration unit")
 MSG_DEF(JSMSG_TEMPORAL_DURATION_NOT_INTEGER,        2, JSEXN_RANGEERR, "{0} isn't a valid {1} duration because it isn't an integer")
 MSG_DEF(JSMSG_TEMPORAL_DURATION_MISSING_UNIT_SPECIFIER, 0, JSEXN_RANGEERR, "at least one of \"smallestUnit\" and \"largestUnit\" must be present")
 MSG_DEF(JSMSG_TEMPORAL_DURATION_UNCOMPARABLE,       1, JSEXN_RANGEERR, "can't compare durations when \"{0}\" is undefined")
+MSG_DEF(JSMSG_TEMPORAL_DURATION_COMBINE_INVALID_SIGN, 0, JSEXN_RANGEERR, "can't combine date- and time-durations with different signs")
 MSG_DEF(JSMSG_TEMPORAL_CALENDAR_INVALID_ID,         1, JSEXN_RANGEERR, "invalid calendar: {0}")
 MSG_DEF(JSMSG_TEMPORAL_CALENDAR_MISSING_FIELD,      1, JSEXN_TYPEERR, "missing \"{0}\" calendar field")
 MSG_DEF(JSMSG_TEMPORAL_CALENDAR_INVALID_FIELD,      1, JSEXN_RANGEERR, "invalid calendar field name \"{0}\"")
@@ -888,8 +905,8 @@ MSG_DEF(JSMSG_TEMPORAL_PLAIN_TIME_CALENDAR_NOT_ISO8601, 1, JSEXN_RANGEERR, "Plai
 MSG_DEF(JSMSG_TEMPORAL_PLAIN_MONTH_DAY_INVALID,     0, JSEXN_RANGEERR, "year-month-day must be valid iso dates")
 MSG_DEF(JSMSG_TEMPORAL_PLAIN_YEAR_MONTH_INVALID,    0, JSEXN_RANGEERR, "year-month-day must be valid iso dates")
 MSG_DEF(JSMSG_TEMPORAL_ZONED_DATE_TIME_NO_TIME_FOUND, 0, JSEXN_RANGEERR, "date-time can't be represented in the given time zone")
-MSG_DEF(JSMSG_TEMPORAL_ZONED_DATE_TIME_NON_POSITIVE_DAY_LENGTH, 0, JSEXN_RANGEERR, "day length must be positive number")
 MSG_DEF(JSMSG_TEMPORAL_ZONED_DATE_TIME_INCORRECT_SIGN,  1, JSEXN_RANGEERR, "computed {0} has an incorrect sign")
+MSG_DEF(JSMSG_TEMPORAL_ZONED_DATE_TIME_INCONSISTENT_INSTANT, 0, JSEXN_RANGEERR, "time zone computed inconsistent instant values")
 MSG_DEF(JSMSG_TEMPORAL_PARSER_NEGATIVE_ZERO_YEAR,       0, JSEXN_RANGEERR, "year 0 must not start with \"-\"")
 MSG_DEF(JSMSG_TEMPORAL_PARSER_MISSING_EXTENDED_YEAR,    0, JSEXN_RANGEERR, "signed year must be followed by six digits")
 MSG_DEF(JSMSG_TEMPORAL_PARSER_MISSING_YEAR,             0, JSEXN_RANGEERR, "missing four digit year")
diff --git a/js/public/friend/StackLimits.h b/js/public/friend/StackLimits.h
index b4f1e010a8..231ab3219d 100644
--- a/js/public/friend/StackLimits.h
+++ b/js/public/friend/StackLimits.h
@@ -199,9 +199,20 @@ MOZ_ALWAYS_INLINE bool AutoCheckRecursionLimit::checkLimitImpl(
 #endif
 }
 
+#ifdef ENABLE_WASM_JSPI
+bool IsSuspendableStackActive(JSContext* cx);
+JS::NativeStackLimit GetSuspendableStackLimit(JSContext* cx);
+#endif
+
 MOZ_ALWAYS_INLINE JS::NativeStackLimit
 AutoCheckRecursionLimit::getStackLimitSlow(JSContext* cx) const {
   JS::StackKind kind = stackKindForCurrentPrincipal(cx);
+#ifdef ENABLE_WASM_JSPI
+  if (IsSuspendableStackActive(cx)) {
+    MOZ_RELEASE_ASSERT(kind == JS::StackForUntrustedScript);
+    return GetSuspendableStackLimit(cx);
+  }
+#endif
   return getStackLimitHelper(cx, kind, 0);
 }
 
diff --git a/js/public/shadow/String.h b/js/public/shadow/String.h
index 570c9f189b..cae853cc5d 100644
--- a/js/public/shadow/String.h
+++ b/js/public/shadow/String.h
@@ -34,9 +34,9 @@ struct String {
   static constexpr uint32_t ATOM_BIT = js::Bit(3);
   static constexpr uint32_t LINEAR_BIT = js::Bit(4);
   static constexpr uint32_t INLINE_CHARS_BIT = js::Bit(6);
-  static constexpr uint32_t LATIN1_CHARS_BIT = js::Bit(9);
+  static constexpr uint32_t LATIN1_CHARS_BIT = js::Bit(10);
   static constexpr uint32_t EXTERNAL_FLAGS = LINEAR_BIT | js::Bit(8);
-  static constexpr uint32_t TYPE_FLAGS_MASK = js::BitMask(9) - js::BitMask(3);
+  static constexpr uint32_t TYPE_FLAGS_MASK = js::BitMask(10) - js::BitMask(3);
   static constexpr uint32_t PERMANENT_ATOM_MASK = ATOM_BIT | js::Bit(8);
 
   uintptr_t flags_;