JavaScript/Roadmap

Q3 2013

Firefox 26 (Beta)

August 6 - September 16

• [DONE] 547941 - ES6 WeakMaps
• [DONE] 666399 - ES6 Generator syntax
• All JS bugs fixed in Firefox 26

Full Query

ID	Summary	Whiteboard	Resolution	Assigned to
450320	Remove 'op' local variable from js_Interpret	[qa-]	FIXED	Dan Gohman [:sunfish]
609296	Number.toString() is slow		FIXED	Jan de Mooij [:jandem]
634417	Remove uses of vanilla malloc/calloc/realloc/free	[qa-]	FIXED	Nicholas Nethercote [inactive]
653438	Incorrect result with number.toExponential(undefined)		FIXED	Jan de Mooij [:jandem]
654820	Assertion failure: m_pools.empty(), at js/src/assembler/jit/ExecutableAllocator.h:180	[MemShrink:P3]	FIXED	Dan Gohman [:sunfish]
658800	Properties on an Error become enumerable after toSource is called?	[qa-]	FIXED	Jeff Walden [:Waldo]
724768	Object.getOwnPropertyNames does not see unresolved properties of Error objects	[qa-][DocArea=JS]	FIXED	Jeff Walden [:Waldo]
753203	[meta] GC: Exact Stack Rooting		FIXED	Terrence Cole [:terrence]
760460	Assertion failure: i < argc_, at ../dist/include/js/CallArgs.h:283 or Crash [@ ToPrimitive] with line2pc	[js:p3] [jsbugmon:testComment=4]	FIXED	Tom S. (please needinfo tschuster)
784295	Investigate activating ES5 strict mode for all self-hosted JS	[js:t][qa-]	FIXED	Chris Peterson [:cpeterson]
806522	"Assertion failure: getSlot(EVAL).isObject()," or Assertion failure: getSlotRefForCompilation(EVAL).isObject(), at js/src/vm/GlobalObject.h	[jsbugmon:update]	FIXED	Jason Orendorff [:jorendorff]
811264	Signed integer overflows in js::Int32ToString and IntToCString	[js:t] [-fsanitize=signed-integer-overflow][qa-]	FIXED	Jeff Walden [:Waldo]
822425	Expose assertSameCompartment outside the JS engine	[qa-]	FIXED	Bobby Holley (:bholley)
837566	Remove js_RemoveRoot.	[qa-]	FIXED	Nicholas Nethercote [inactive]
852175	Assertion failure: cur_ == frame_.fun()->environment(), at vm/ScopeObject.cpp:1046	[jsbugmon:update,testComment=8,origRev=59ff3a2a708a]	FIXED	Kannan Vijayan [:djvj]
852791	IonMonkey: Improve constant propagation on string concatenation.	[lang=c++][qa-]	FIXED	Masaya Iseki[:isk](UTC+9)
861785	Odinmonkey (ARM): use the hard-float ABI for inter-asm.js calls, even when the system is using the soft-float ABI.		FIXED	Douglas Crosher [:dougc]
869473	Optimize DivI with a power of two divisor when the numerator is positive.		FIXED	Douglas Crosher [:dougc]
880512	ARM: Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp with "use asm"		FIXED	Dan Gohman [:sunfish]
884617	Explicitly --disable-threadsafe for the SM(r) build on TBPL	[qa-]	FIXED	Steve Fink [:sfink] [:s:]
884676	Use mozilla::Atomic instead of JS_ATOMIC_*	[qa-]	FIXED	Joshua Cranmer [:jcranmer]
887077	JS::CompileOptions incorrectly roots 'element' member		FIXED	Jim Blandy :jimb
892643	SpiderMonkey needs a root type with unrestricted lifetime that can be copied and assigned		FIXED	Jim Blandy :jimb
894658	Implement ES6 Array.prototype.{keys, entries}	[DocArea=JS]	FIXED	Sankha Narayan Guria [:sankha]
894881	Accessing typed array properties like byteLength is very slow	[qa-]	FIXED	Jan de Mooij [:jandem]
895395	Support NameFunctions when compiling scripts off the main thread	[qa-]	FIXED	Bill McCloskey [inactive unless it's an emergency] (:billm)
897027	Missing ToNumber conversion for Math.pow()/Math.atan() when passing only one argument		FIXED	David Caabeiro [:dcaabeiro]
898359	[binary data] non-scalar types like any, object, and string		FIXED	Niko Matsakis [:nmatsakis]
900998	Static analysis is missing WorkerPrivate::Create	[qa-]	FIXED	general
901274	Reduce branching in testObjectTruthy and testValueTruthy	[qa-]	FIXED	Dan Gohman [:sunfish]
903332	document.watch() results in "TypeError: can't watch non-native objects of class Proxy"		FIXED	Jeff Walden [:Waldo]
906858	Assertion failure: v->toGCThing(), at gc/Marking.cpp with --ion-eager --ion-gvn=pessimistic --ion-inlining=off --ion-regalloc=backtracking		FIXED	Dan Gohman [:sunfish]
909490	Add ability to get and set per-Zone user data, and iterate over Zones	[qa-]	FIXED	Andrew McCreight [:mccr8]
909526	Suppress GetGlobalJSObject, which is virtual, but cannot GC	[qa-]	FIXED	Terrence Cole [:terrence]
909586	Assertion failure: frame->script->code <= pc && pc < frame->script->code + frame->script->length, at vm/SPSProfiler.h	[jsbugmon:][adv-main28+]	FIXED	Kannan Vijayan [:djvj]
909972	Fix the remaining hazards in AsmJS	[qa-]	FIXED	Terrence Cole [:terrence]
909997	Allow changing more JS compiler options at runtime		FIXED
910782	indirect-goto-based interpreter	[qa-]	FIXED	Dan Gohman [:sunfish]
911578	introduce self-hosting intrinsic IsPackedArray and use it for implementing optimized loops in array extras	[qa-]	FIXED	Till Schneidereit [:till]
912168	startup precompilation cache broken on sparc64		FIXED	Gabriele Svelto [:gsvelto]
912303	Differential Testing: Different output message involving __noSuchMethod__		FIXED	Kannan Vijayan [:djvj]
914141	Crash [@ js::Shape::isNative] with backtracking register allocation		FIXED	Dan Gohman [:sunfish]
916255	Allow script loaders to have multiple in flight off thread parses	[qa-]	FIXED	Brian Hackett [Laid off!]
917454	[typed objs] Add objectType function	[qa-]	FIXED	Niko Matsakis [:nmatsakis]
921224	Minimize GCMark buffer when incremental GC is disabled.	[MemShrink:P2]	FIXED	Nicholas Nethercote [inactive]
921561	JS_DECLARE_NEW_METHODS should use "perfect" forwarding	[qa-]	FIXED	Jeff Walden [:Waldo]
921586	'may be used uninitialized' warnings in StructuredClone.cpp	[qa-]	FIXED	Jim Blandy :jimb
922048	Peacekeeper domJQueryBasicFilters slower than in Chrome		FIXED	Jan de Mooij [:jandem]
922070	Source note table in BytecodeEmitter.cpp should be generated by higher-order macro	[qa-]	FIXED	Andy Wingo [:wingo]
922115	Support unsized arrays in typed objects	[qa-]	FIXED	Niko Matsakis [:nmatsakis]
922172	Add redimension method for typed objects		FIXED	Niko Matsakis [:nmatsakis]
922216	Self-host equivalent type check		FIXED	Niko Matsakis [:nmatsakis]
924920	Crash with SIGTRAP with --ion-regalloc=backtracking combined with other flags	[fuzzblocker]	FIXED	general
925308	Assertion failure: *(int*)size_ >= 0, at vm/SPSProfiler.cpp:196	[fuzzblocker] [jsbugmon:update,ignore][adv-main27+]	FIXED	Kannan Vijayan [:djvj]
925309	Assertion failure: enable == !(bool)spsOn_, at jit/BaselineJIT.cpp:777	[jsbugmon:update]	FIXED	Kannan Vijayan [:djvj]
925470	JSIL game "Soulcaster" fails to parse XML level description		FIXED	Kannan Vijayan [:djvj]
925621	Let startProfiling take a pid so the content process can be profiled	[qa-]	FIXED	Drew Willcoxon :adw
925949	AWFY regressions: 12% Octane-Regexp on Sep 20		FIXED	Hannes Verschore [:h4writer]
926401	ASan heap-buffer-overflow with BinaryData	[asan][fixed in bug 898362; this bug has the test]	FIXED	Jeff Walden [:Waldo]
926431	Assertion failure: isObject(), at js/Value.h:1129 with ASM.js and clone	[jsbugmon:update]	FIXED	Benjamin Bouvier [:bbouvier] (inactive)
926678	JSRuntime::gcMallocBytes is ignored if it doesn't trigger a GC the first time		FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
926710	PJS: Unify --thread-count shell option and JS_THREADPOOL_SIZE env var	[qa-]	FIXED	Shu-yu Guo [:shu]
926779	"Assertion failure: thing" with schedulegc, crypto exception		FIXED	Terrence Cole [:terrence]
926837	Assertion failure: !instructions.empty(), at jit/RegisterAllocator.cpp:80	[jsbugmon:update,bisect,ignore]	FIXED	Jan de Mooij [:jandem]
926904	Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Modified registers between VM call and OsiPoint)), at jit/shared/CodeGenerator-shared.cpp:532 with --ion-regalloc=backtracking		FIXED	general
927116	Implement import declarations		FIXED	Eddy Bruel [:ejpbruel]
927516	Worker is slower than Main Thread	[Shumway:P1]	FIXED	Jan de Mooij [:jandem]
927763	AWFY: asmjs-apps-box2d-workload1 regression of 15% - 20% on x86 slave on October 15th, 2013	[qa-]	FIXED	Brian Hackett [Laid off!]
927939	GenerationalGC: Mochitest test_bug773962.xul crashes with assertion failure on IsBackgroundFinalized()		FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
928050	Remove worker pausing mechanism	[qa-]	FIXED	Brian Hackett [Laid off!]
928350	IonMonkey: call collectRangeInfo before removing the range analysis beta nodes	[qa-]	FIXED	Douglas Crosher [:dougc]
928616	Clean up JS_CopyPropert{ies,y}From Implementation	[qa-]	FIXED	Bobby Holley (:bholley)
928917	Array.prototype.slice on an array with holes is super slow	[qa-]	FIXED	Masaya Iseki[:isk](UTC+9)
929261	GetElementIC typed array stub doesn't property respect monitoredResult()	[adv-main26+][adv-esr24.2+][qa-]	FIXED	Eric Faust [:efaust]
929280	Assertion failure: efs->argCount == args.length() - 1, at vm/SelfHosting.cpp	[fuzzblocker] [jsbugmon:update]	FIXED	Felix S. Klock II [:pnkfelix, :fklock]
930048	Remove need to read objects directly when optimizing singleton accesses	[qa-]	FIXED	Brian Hackett [Laid off!]
930057	Incorrect return false in TypedObject JIT compilation	[qa-]	FIXED	Niko Matsakis [:nmatsakis]
930327	Assertion failure: [infer failure] Missing type in object [0xf7025480] value: bool, at jsinfer.cpp:292	[jsbugmon:update]	FIXED	Brian Hackett [Laid off!]
930378	Improve rooting in Debugger	[qa-]	FIXED	Steve Fink [:sfink] [:s:]
930411	Implement export declarations	[qa-]	FIXED	Eddy Bruel [:ejpbruel]
930526	Assertion failure: obj, at dist/include/js/Value.h:527 with OOM		FIXED	Terrence Cole [:terrence]
930543	Assertion failure: JSVAL_IS_DOUBLE_IMPL(l), at dist/include/js/Value.h:406 or Crash [@ js::LoadScalarfloat::Func] or Crash [@ js::jit::BaselineScript::nativeCodeForPC]	[jsbugmon:update][fuzzblocker]	FIXED	Niko Matsakis [:nmatsakis]
930708	Add DoubleEqualsInt32 which accepts negative zero	[qa-]	FIXED	Dan Gohman [:sunfish]
930714	implement extraName() for LUnbox	[qa-]	FIXED	Dan Gohman [:sunfish]
930974	Assertion failure: args[0].isObject(), at builtin/TypedObject.cpp:2401 or Crash [@ js::ObjectIsTypedHandle]	[jsbugmon:update]	FIXED	Niko Matsakis [:nmatsakis]
930993	(jit) Dangerous Crash on Heap with Typed Arrays and GC	[jsbugmon:update,ignore]	FIXED	Benjamin Bouvier [:bbouvier] (inactive)
931008	Assertion failure: table, at dist/include/js/HashTable.h:1353 or Crash [@ Range]	[jsbugmon:update]	FIXED	Steve Fink [:sfink] [:s:]
931151	Offer an alternative to NSPR when building the shell on POSIX platforms	[qa-]	FIXED	Bill McCloskey [inactive unless it's an emergency] (:billm)
931218	Handle an exact rooting hazard in stealContents	[qa-]	FIXED	Terrence Cole [:terrence]
931251	crash in SaveSharedScriptData		FIXED	Till Schneidereit [:till]
931328	IonMonkey: Optimize Math.hypot		FIXED	Sankha Narayan Guria [:sankha]
931414	Assertion failure: pcdepth >= nuses, at js/src/jsopcode.cpp:1682		FIXED	Andy Wingo [:wingo]
931446	Improve comment on JS::Heap	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
931486	x86 assembly spew fixes	[qa-]	FIXED	Dan Gohman [:sunfish]
931487	Backtracking allocator: avoid spilling two different register groups to the same argument slot	[qa-]	FIXED	Dan Gohman [:sunfish]
931488	basic range analysis for MBoundsCheck, MArrayLength, MRandom, MMathFunction	[qa-]	FIXED	Dan Gohman [:sunfish]
931489	use range analysis to eliminate NaN code	[qa-]	FIXED	Dan Gohman [:sunfish]
931496	Assertion failure: script->canBaselineCompile(), at jit/BaselineJIT.cpp	[jsbugmon:update][qa-]	FIXED	Brian Hackett [Laid off!]
931812	GenerationalGC: Browser build test jittest failures: js/src/jit-test/tests/gc/bug-913261.js		FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
931864	can we remove the activeGCInAtomsZone limitation in JS::CanCompileOffThread?	[games][qa-]	FIXED	Luke Wagner [:luke]
931882	Jit-test test basic/bug908915.js times out on Android		FIXED	Douglas Crosher [:dougc]
931984	Use baseline cache information for calling common getter/setters in Ion code	[qa-]	FIXED	Brian Hackett [Laid off!]
932025	'may be used uninitialized' warnings in OldDebugAPI.cpp	[qa-]	FIXED	Jim Blandy :jimb
932180	Rewrite decompiler's bytecode parser to not need SRC_HIDDEN annotations	[qa-]	FIXED	Andy Wingo [:wingo]
932216	Remove code conditional on JS_HAS_CONST, JS_HAS_BLOCK_SCOPE	[qa-]	FIXED	Andy Wingo [:wingo]
932276	Compute static scope extents at compile-time and store them in JSScript	[qa-]	FIXED	Andy Wingo [:wingo]
932312	Remove SRC_HIDDEN	[qa-]	FIXED	Andy Wingo [:wingo]
932364	Fix an exact rooting hazard across AddSizeOfTab	[qa-]	FIXED	Terrence Cole [:terrence]
932440	Bug 918207 reinstated bug 924608	[qa-]	FIXED	nnethercote
932530	Assertion failure: thing, at gc/Marking.cpp:126 or Crash [@ tenuredZone] with OOM		FIXED	Terrence Cole [:terrence]
932757	Remove JSOP_POPV and JSOP_STOP	[qa-]	FIXED	Hannes Verschore [:h4writer]
932768	Remove vestigial decompiler hacks from BytecodeEmitter	[qa-]	FIXED	Andy Wingo [:wingo]
932769	AWFY: octane-mandreel regression of 16% on x86 slave on October 29th, 2013	[qa-]	FIXED	Brian Hackett [Laid off!]
932796	Assertion failure: efs->argCount == args.length() - 1, at vm/SelfHosting.cpp:87 or Crash [@ __strlen_sse2_bsf]		FIXED	Felix S. Klock II [:pnkfelix, :fklock]
932800	IonMonkey always bails for string[string] GETELEM		FIXED	Jan de Mooij [:jandem]
932851	Use of uninitialized value created on stack: : js::Discard() (StructuredClone.cpp:351)		FIXED	Steve Fink [:sfink] [:s:]
932875	Page load fails on kunagi.org		FIXED	Brian Hackett [Laid off!]
932899	Remove TYPE_FLAG_STACK_SET, TYPE_FLAG_HEAP_SET	[qa-]	FIXED	Brian Hackett [Laid off!]
932940	Jit-test harness needs to set different remote --js-cache		FIXED	Dan Minor [:dminor]
932991	build broken on OpenBSD/sparc64 after header reordering in bug 898274		FIXED	Landry Breuil (:gaston)
933104	OdinMonkey: Assertion failure: max_exponent_ + canHaveFractionalPart_ >= mozilla::FloorLog2(mozilla::Abs(upper_)), at jit/RangeAnalysis.h		FIXED	Dan Gohman [:sunfish]
933269	Optimize array indices in typed objects	[qa-]	FIXED	Felix S. Klock II [:pnkfelix, :fklock]
933301	[].push.apply is very slow	[performance] [shumway]	FIXED	Jan de Mooij [:jandem]
933369	x86 emulator much slower than in Chrome	[good first verify]	FIXED	Jan de Mooij [:jandem]
933382	GenerationalGC: Fix the all-slots post barrier		FIXED	Terrence Cole [:terrence]
933475	Array.prototype.push on a non-array-object is slow	[qa-]	FIXED	Jan de Mooij [:jandem]
933557	[jsdbg2] Setting a Debugger.prototype.onEnterFrame hook imposes substantial overhead		FIXED	Shu-yu Guo [:shu]
933734	google drive crashes with 11/1 nightly js::ObjectImpl::nativeLookup js::jit::DoTypeMonitorFallback		FIXED	Brian Hackett [Laid off!]
933746	GMail crash in JSObject::getPropertyNoGC(JSContext*, JSObject*, JSObject*, js::PropertyName*, JS::Value*)	fixed by bug 933734	FIXED
933760	Have TI track a TypeRepresentation for each type descriptor	[qa-]	FIXED	Niko Matsakis [:nmatsakis]
933764	Change TypeRepresentationSet to disallow access to individual members	[qa-]	FIXED	Niko Matsakis [:nmatsakis]
933776	crash in memcpy | JSRope::flattenInternal<int>(js::ExclusiveContext*)	fixed by bug 933734	FIXED
933798	Don't inhibit name optimizations in try blocks		FIXED	Jan de Mooij [:jandem]
933807	Allow easily disabling TriggerOperationCallbackFor(Ion|AsmJS)Code	[qa-]	FIXED	Luke Wagner [:luke]
933810	Really remove JS_ValueToECMAUint32	[qa-]	FIXED	Tom S. (please needinfo tschuster)
933834	Rename and handlify JS_ValueToString	[qa-]	FIXED	Tom S. (please needinfo tschuster)
933882	Invalidate scripts and discard JIT code instead of doing AutoDebugModeGC	[qa-]	FIXED	Shu-yu Guo [:shu]
933932	OdinMonkey: bad asm.js warning with unsigned form		FIXED	Luke Wagner [:luke]
933946	Remove the rest of the old number conversion functions	[qa-]	FIXED	Tom S. (please needinfo tschuster)
933952	The NO_DELTA flag in CharacterInfo is unnecessary	[qa-]	FIXED	Eddy Bruel [:ejpbruel]
934173	Mark debugMode() as JS_UNLIKELY	[qa-]	FIXED	Dan Gohman [:sunfish]
934174	Optimize the interpreter's int32 add	[qa-]	FIXED	Dan Gohman [:sunfish]
934175	optimize x64's extended jump table entry	[qa-]	FIXED	Dan Gohman [:sunfish]
934262	Fix -Wtautological-constant-out-of-range-compare warnings in js/src/jit/	[qa-]	FIXED	Chris Peterson [:cpeterson]
934351	More annotations that have been in production	[qa-]	FIXED	Steve Fink [:sfink] [:s:]
934419	Split CompartmentOptions off from ContextOptions	[Shumway:m2][qa-]	FIXED	Eddy Bruel [:ejpbruel]
934427	Crash [@ ScriptFromCalleeToken]	[jsbugmon:update]	FIXED	Kannan Vijayan [:djvj]
934442	GenerationalGC: mochitest test_cpows.xul assertion failure		FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
934485	Remove unused ProxyOptions::forceForegroundFinalization()	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
934500	Don't eagerly create callsite clones in IonBuilder	[qa-]	FIXED	Brian Hackett [Laid off!]
934520	undefined behavior in SafeAdd and others	[qa-]	FIXED	Dan Gohman [:sunfish]
934526	Don't use context to get existing intrinsic values in IonBuilder	[qa-]	FIXED	Brian Hackett [Laid off!]
934557	Handlify JS::ToBoolean, remove JS_ValueToBoolean	[qa-]	FIXED	Tom S. (please needinfo tschuster)
934698	Analysis false positive with AddRef()	[qa-]	FIXED	Steve Fink [:sfink] [:s:]
934718	Simplify some HashTable internal maths, kill some JS_STATIC_ASSERT usage	[qa-]	FIXED	Jeff Walden [:Waldo]
934789	Assertion Failure: type() != NAMED_LAMBDA in ScopeCoordinateToStaticScopeShape		FIXED	Jan de Mooij [:jandem]
934799	Make turning on debug mode for all compartments not delazify all lazy scripts	[qa-]	FIXED	Shu-yu Guo [:shu]
934990	unresolved external symbol in debug builds when calling shadow::Zone::runtimeFromMainThread from browser	[qa-]	FIXED	Andrew McCreight [:mccr8]
934997	Assertion failure: !empty(), at ../vm/Shape.h:1030 or Crash [@ js::ScopeCoordinateName]	[jsbugmon:update]	FIXED	Jan de Mooij [:jandem]
935006	Assertion failure: slotInRange(slot), at ../vm/ObjectImpl.h:1339 or Crash [@ getSlotAddressUnchecked]	[fuzzblocker] [jsbugmon:update]	FIXED	Jan de Mooij [:jandem]
935016	IonMonkey: Specialize string.split(string)	[qa-]	FIXED	Jan de Mooij [:jandem]
935022	GenerationalGC: Assertion failure: currentEnd_ == chunk(currentChunk_).end(), at ../gc/Nursery.h:199	[jsbugmon:ignore]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
935027	Don't create 'rest' template objects in IonBuilder	[qa-]	FIXED	Brian Hackett [Laid off!]
935032	Remove remaining uses of JSContext in IonBuilder	[qa-]	FIXED	Brian Hackett [Laid off!]
935125	Whitelist PLDHashTableOps.hashKey		FIXED	Steve Fink [:sfink] [:s:]
935130	mem.log console message should say "Zones Collected" not "Compartments Collected"		FIXED	Andrew McCreight [:mccr8]
935136	GenerationalGC: Heap<Value> can cause use-after-free	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
935156	Fix the new exact rooting hazards in jsopcode.cpp	[qa-]	FIXED	Terrence Cole [:terrence]
935173	Fix JS_NeuterArrayBuffer and call it	[qa-]	FIXED	Steve Fink [:sfink] [:s:]
935228	JSD.pause and unPause can attempt to toggle debug traps on non-debug mode Baseline scripts	[adv-main27-] exploit requires Firebug plus a malicious addon that uses Firebug	FIXED	Shu-yu Guo [:shu]
935271	Fix OSX #ifdefs and remove OS/2 support from gc/Memory.cpp		FIXED	Terrence Cole [:terrence]
935322	(jit) Crash on Heap near [@ EnterBaseline]	[fuzzblocker] [jsbugmon:update]	FIXED	Jan de Mooij [:jandem]
935324	Clean up adding of type properties to objects	[qa-]	FIXED	Brian Hackett [Laid off!]
935331	Assertion failure: is<CallObject>() || is<ClonedBlockObject>(), at ../vm/ScopeObject.h:771 or Assertion failure: type() != NAMED_LAMBDA, at vm/ScopeObject.cpp:74 or Crash on Heap	[fuzzblocker] [jsbugmon:update]	FIXED	Jan de Mooij [:jandem]
935338	Get NSPR emulation working on Macs	[qa-]	FIXED	Bill McCloskey [inactive unless it's an emergency] (:billm)
935348	crash in Interpret		FIXED	Jan de Mooij [:jandem]
935586	Fix an exact rooting hazard in getIntrinsicValue		FIXED	Terrence Cole [:terrence]
935791	Add an option to disable SSE3 and SSE4 code generation on the JS shell	[qa-]	FIXED	Benjamin Bouvier [:bbouvier] (inactive)
935800	Fix an exact rooting false positive in ForkJoinSlice		FIXED	Terrence Cole [:terrence]
935903	GC: SharedScriptData is not unmarked if a collection is reset	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
935952	Assertion failure: !unknownProperties(), at c:\work\mozilla\builds\aurora\mozilla\js\src\jsinferinlines.h:1396		FIXED	Brian Hackett [Laid off!]
935999	IonMonkey: add-property stub: support type checks	[qa-]	FIXED	Jan de Mooij [:jandem]
936004	Assertion failure: is<CallObject>() || is<ClonedBlockObject>(), at ../vm/ScopeObject.h:771 Crash [@ slotSpan] or Crash [@ js::jit::MacroAssembler::initGCThing]	[fuzzblocker] [jsbugmon:update]	FIXED	Brian Hackett [Laid off!]
936013	Assertion failure: is<T>(), at ../jsobj.h:1156 or Crash [@ getClass] with neuter	[jsbugmon:update]	FIXED	Steve Fink [:sfink] [:s:]
936040	Fix an exact rooting false positive in nsWindowSH::PostCreate	[qa-]	FIXED	Terrence Cole [:terrence]
936143	Fix js_GetScriptLineExtent. (r=?)	[qa-]	FIXED	Shu-yu Guo [:shu]
936232	js_InitTypedObjectClass is not APPLICATION_SLOTS-aware, and clobbers the DataView constructor	[qa-]	FIXED	Bobby Holley (:bholley)
936234	Inline n-Ary Math.min and Math.max	[Shumway][qa-]	FIXED	Sean Stangl [:sstangl]
936341	Get NSPR emulation working on BSD		FIXED	Feiko Koopman
936361	Assertion failure: (!property.isOwnProperty(constraints())), at jit/IonBuilder.cpp	[jsbugmon:update]	FIXED	Brian Hackett [Laid off!]
936403	Crash [@ operator] or [@ JSObject::nativeSetSlotWithType] or Assertion failure: obj, at dist/include/js/Value.h	[jsbugmon:]	FIXED	Brian Hackett [Laid off!]
936431	Fix tracelogger after CompileOptions changes	[qa-]	FIXED	Hannes Verschore [:h4writer]
936455	GetElementIC::update should call GetObjectElementOperation instead of GetElementOperation	[qa-]	FIXED	Jan de Mooij [:jandem]
936501	Only give IonBuilder a context during definite properties analysis	[qa-]	FIXED	Brian Hackett [Laid off!]
936514	GC: In source documentation on the collector needs updating		FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
936583	Move common fields of the chunk footer to a common struct	[qa-]	FIXED	Terrence Cole [:terrence]
936681	jit-test error output doesn't print stderr like it's supposed to		FIXED	Bill McCloskey [inactive unless it's an emergency] (:billm)
936698	The testIntTypesABI header list is woefully out of date	[qa-]	FIXED	Andrew McCreight [:mccr8]
936710	Add an option to propagate flags to nested shells	[qa-]	FIXED	Benjamin Bouvier [:bbouvier] (inactive)
936737	Crash with SIGTRAP involving --ion-check-range-analysis	[qa-]	FIXED	Dan Gohman [:sunfish]
936854	Assertion failure: !isOwned() && !unowned_, at vm/Shape.h	[jsbugmon:update]	FIXED	Brian Hackett [Laid off!]
936891	Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Modified registers between VM call and OsiPoint)), at jit/shared/CodeGenerator-shared.cpp:532		FIXED	Dan Gohman [:sunfish]
936966	Assertion failure: !aheader->hasFreeThings(), at jsgc.h:528 Assertion failure: !(addr & ArenaMask), at ../gc/Heap.h:847 or Crash [@ GetGCThingMarkBitmap]	[jsbugmon:update]	FIXED	Brian Hackett [Laid off!]
936993	reduce register pressure around MCheckOverRecursed	[qa-]	FIXED	Dan Gohman [:sunfish]
937012	Improve vanilla allocation/free checking in SpiderMonkey		FIXED	Nicholas Nethercote [inactive]
937058	Paper over debug-mode checks of stack depth for unreachable bytecode		FIXED	Andy Wingo [:wingo]
937083	Assertion failure: !cx->isExceptionPending(), at ../jscntxtinlines.h:223 with OOM in js::CallJSNative		FIXED	Christian Holler (:decoder)
937121	Register allocation debugging aids	[qa-]	FIXED	Dan Gohman [:sunfish]
937124	Refactor some backtracking allocator code to use isRegisterUse	[qa-]	FIXED	Dan Gohman [:sunfish]
937128	Backtracking allocator: minor code cleanups	[qa-]	FIXED	Dan Gohman [:sunfish]
937391	Refactor typed object element / property access	[qa-]	FIXED	Niko Matsakis [:nmatsakis]
937404	Possible buffer size miscalculation in JS::NotableStringInfo	[qa-]	FIXED	Jim Blandy :jimb
937540	Use placement new syntax for JIT temporary memory allocations	[qa-]	FIXED	Jan de Mooij [:jandem]
937550	Report OOM to stderr in JS_MORE_DETERMINISTIC builds		FIXED	Jan de Mooij [:jandem]
937605	Firefox fails to build on PPC64: GCInternals.h:29:5: error: ‘ZoneSelector’ does not name a type		FIXED	Gregor Wagner [:gwagner]
937674	Don't instantiate types when adding type object guards around type write barriers	[qa-]	FIXED	Brian Hackett [Laid off!]
937763	getPropTryCommonGetter is emitting unnecessary moves		FIXED	Shu-yu Guo [:shu]
937772	Should emit an infallible unbox in pushTypeBarrier when we can		FIXED	Boris Zbarsky [:bzbarsky]
937916	Implement TrueValue() and FalseValue()	[qa-]	FIXED	Michael
937944	Make ARM's scratch float register different from its argument registers		FIXED	Dan Gohman [:sunfish]
938130	Assertion failure: returnAddr < method_->raw() + method_->instructionsSize(), at jit/BaselineJIT.cpp:573 or Crash [@ GetBytecodeLength] with parallel compilation		FIXED	Kannan Vijayan [:djvj]
938211	GenerationalGC: Heap<T> does not supply copy assignment operator	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
938212	GenerationalGC: Iterator prototype objects should be tenured	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
938390	don't create a string to hold chars in ScriptSource::chars	[qa-]	FIXED	Luke Wagner [:luke]
938431	Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp	[jsbugmon:update][adv-main27+]	FIXED	Benjamin Bouvier [:bbouvier] (inactive)
938468	Backtracking allocator: miscompile on ss-aes on ARM		FIXED	Douglas Crosher [:dougc]
938615	avoid GC hazard in ScriptSource::substring	[adv-main28+]	FIXED	Luke Wagner [:luke]
938728	Implement basic support for float32x4 as a typed object constructor	[qa-][DocArea=JS]	FIXED	Niko Matsakis [:nmatsakis]
938907	Get rid of the compileAndGo flag in ContextOptions		FIXED	Eddy Bruel [:ejpbruel]
938950	Don't provide full access to compartment/zone/runtime when compiling off thread	[qa-]	FIXED
939015	"Assertion failure: !parent->inDictionary()" looping over huge string		FIXED	Shu-yu Guo [:shu]
939088	massive regression in testClosureAssign		FIXED	Brian Hackett [Laid off!]
939206	GenerationalGC: Postbarriers are broken for nsTArrays of JS::Values	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
939274	Change jit-tests remote harness to push tests/* to remote device		FIXED	Dan Minor [:dminor]
939410	JSON.parse() return incorrect error position		FIXED	Masaya Iseki[:isk](UTC+9)
939420	neuter() returns itself	[qa-]	FIXED	Jan de Mooij [:jandem]
939464	warning: ‘*((void*)(& c)+16).js::CompartmentsInZoneIter::it’ may be used uninitialized in this function [-Wmaybe-uninitialized]	[qa-]	FIXED	:Benjamin Peterson
939471	Typo in gcparam() error message	[qa-]	FIXED	Michael
939472	"Assertion failure: view" with gcslice and neuter	[fuzzblocker:neuter][adv-main27+]	FIXED	Steve Fink [:sfink] [:s:]
939475	gcparam() help and error message do not mention markStackLimit	[qa-]	FIXED	Michael
939476	"Assertion failure: phases[phase].parent == parent" with gcparam('markStackLimit')		FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
939504	Leftover <CanGC> Template on AtomizeChars in BIG ENDIAN case breaking the build		FIXED	Landry Breuil (:gaston)
939546	zone iterators should have explicit constructors	[qa-]	FIXED	:Benjamin Peterson
939816	IonMonkey: Support inlining JSOP_THROW	[qa-]	FIXED	Jan de Mooij [:jandem]
939820	LNop and LLabel are not needed for backtracking register allocator	[qa-]	FIXED	Dan Gohman [:sunfish]
939824	Factor out the backtracking allocator's splitting logic	[qa-]	FIXED	Dan Gohman [:sunfish]
939835	tcanvasmark regression detected on osx and windows platforms	[talos_regression][qa-]	FIXED	Boris Zbarsky [:bzbarsky]
939868	IonMonkey: Incorrect result for (x || Math.fround(y))		FIXED	Benjamin Bouvier [:bbouvier] (inactive)
939893	"Assertion failure: !minimalInterval(interval)" in backtracking allocator		FIXED	Dan Gohman [:sunfish]
939993	GenerationalGC: HashMap AddPtr API abuse misplaces hash table entries		FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
940033	js::HashMapEntry::key should be non-const, but private, with read-only accessor	[qa-]	FIXED	Jeff Walden [:Waldo]
940088	Assertion failure: jit::IsIonEnabled(cx), at jit/Ion.cpp	[jsbugmon:]	FIXED	Shu-yu Guo [:shu]
940131	Crash with SIGTRAP involving ArrayType	[jsbugmon:]	FIXED	Niko Matsakis [:nmatsakis]
940246	Cross-compiling 32-bit shell in Mac OS X 10.9 no longer seems to work	[fuzzblocker]	FIXED	Makoto Kato [:m_kato]
940285	Build failed with JS_ION off	[qa-]	FIXED	Kan-Ru Chen [:kanru] (UTC+9)
940441	js/src/tests/ecma_6/TypedObject/Bug914137.js causes OOM failures on Android x86 emulator		FIXED	Geoff Brown [:gbrown]
940525	Fix Baseline typed array stubs to handle double indexes		FIXED	Jan de Mooij [:jandem]
940558	Fix an exact rooting false positive in replaceLastProperty	[qa-]	FIXED	Terrence Cole [:terrence]
940591	Build parts of js/src in unified mode	[qa-]	FIXED	(no longer active)
940629	Root StackShape across getChildPropertyOnDictionary calls	[qa-]	FIXED	Steve Fink [:sfink] [:s:]
940635	IonMonkey: (false == null) incorrectly evaluates to true	[qa-]	FIXED	Brian Hackett [Laid off!]
940642	IonMonkey: Incorrect result for multiplication when also calling imul		FIXED	Tom S. (please needinfo tschuster)
940686	When eliminating barriers in TryEliminateTypeBarrierFromTest, also make the input unbox (if any) infallible		FIXED	Boris Zbarsky [:bzbarsky]
940718	Mark AutoJSContext as not GCing (and make this true)	[qa-]	FIXED	Terrence Cole [:terrence]
940755	Suppress AutoAssertNoGC scopes	[qa-]	FIXED	Terrence Cole [:terrence]
940846	Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp	[jsbugmon:update]	FIXED	Benjamin Bouvier [:bbouvier] (inactive)
940852	Record baseline frame information before Ion compilation	[qa-]	FIXED	Brian Hackett [Laid off!]
940864	OdinMonkey: Incorrect result with >>> % >>		FIXED	Dan Gohman [:sunfish]
940925	IonMonkey: Don't inspect baseline binary arithmetic IC if it had unoptimizable operands	[qa-]	FIXED	Jan de Mooij [:jandem]
940972	Uint8ClampedArray doesn't clamp correctly in baseline	[qa-]	FIXED	Nicolas B. Pierron [:nbp]
941028	IonMonkey: Don't inline in big functions	[qa-]	FIXED	Hannes Verschore [:h4writer]
941247	Zone::CompartmentGCState should be named Zone::GCState	[qa-]	FIXED	Jim Blandy :jimb
941262	AutoAssertNoGC with no runtime	[qa-]	FIXED	Steve Fink [:sfink] [:s:]
941311	Improve GGC pretenuring heuristics	[qa-]	FIXED	Brian Hackett [Laid off!]
941381	IonMonkey: Incorrect fround(asin())	[qa-]	FIXED	Benjamin Bouvier [:bbouvier] (inactive)
941424	Build more of the JS engine in unified mode	[qa-]	FIXED	(no longer active)
941590	Build jsapi-tests in unified mode	[qa-]	FIXED	Jan de Mooij [:jandem]
941617	Backtracking allocator: Fix an Osi point clobber in ComputeThis	[qa-]	FIXED	Dan Gohman [:sunfish]
941649	Multiple jit-tests fail on single core ARM target. (mostly parallel tests)		FIXED	Felix S. Klock II [:pnkfelix, :fklock]
941652	Fix quadradic algorithm in backtracking allocator	[qa-]	FIXED	Dan Gohman [:sunfish]
941672	Fix jit-tests on linux ec2 test machines		FIXED	Felix S. Klock II [:pnkfelix, :fklock]
941779	Fix an opt no-debug build error in ggc builds		FIXED	Terrence Cole [:terrence]
941792	Make sure decommitting actually works on B2G	[MemShrink:P1]	FIXED	Ting-Yuan Huang
941793	GenerationalGC: Store buffer entries are not always removed on relocation		FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
941803	SpiderMonkey --enable-perf builds broken by C++ rvalue reference patch		FIXED	Jim Blandy :jimb
941821	Fix an exact rooting hazard false positive across ForkJoin invocation		FIXED	Terrence Cole [:terrence]
941827	Use off-main-thread parsing even if GetCPUCount() == 1		FIXED	Luke Wagner [:luke]
941837	js::gc::MapAlignedPages causes virtual address space fragmentation on Windows	[MemShrink]	FIXED	Terrence Cole [:terrence]
941877	OdinMonkey: Crash [@ js::jit::CodeGeneratorX86Shared::bailout] or Assertion failure: isDiv(), at jit/MIR.h	[jsbugmon:update][qa-]	FIXED	Dan Gohman [:sunfish]
941905	OdinMonkey: Crash [@ js::jit::SplitCriticalEdges] or Assertion failure: GetARMFlags() <= ((4294967295U) >> ARCH_BITS), at jit/AsmJSModule.cpp	[fuzzblocker]	FIXED	Douglas Crosher [:dougc]
942027	Assertion failure: isObject(), at dist/include/js/Value.h or Assertion failure: JSVAL_IS_DOUBLE_IMPL(l), at dist/include/js/Value.h or Assertion failure: v.isUndefined(), at jsnum.cpp	[fuzzblocker]	FIXED	Douglas Crosher [:dougc]
942105	IonMonkey: Remove bogus inlineUseCountRatio	[qa-]	FIXED	Hannes Verschore [:h4writer]
942116	Stop using the register keyword in the JS engine	[qa-]	FIXED	(no longer active)
942122	Build the JS gdb tests in unified mode	[qa-]	FIXED	(no longer active)
942124	Build the js shell in unified mode	[qa-]	FIXED	(no longer active)
942127	Build the JS editline library in unified mode	[qa-]	FIXED	(no longer active)
942205	Initialize ParallelArray class in GlobalObject::initStandardClasses.	[qa-]	FIXED	Till Schneidereit [:till]
942211	Remove usages of NewObjectWithClassProto	[qa-]	FIXED	Till Schneidereit [:till]
942236	Optimize unsigned div, mod, and ursh	[qa-]	FIXED	Dan Gohman [:sunfish]
942258	Assertion failure: mir->canBeDivideByZero(), at jit/shared/CodeGenerator-x86-shared.cpp	[jsbugmon:update]	FIXED	Dan Gohman [:sunfish]
942304	Avoid rooting hazard in ArrayBufferObject::neuterViews	[qa-]	FIXED	Steve Fink [:sfink] [:s:]
942346	Bug 933882 broke non-ion builds		FIXED	Shu-yu Guo [:shu]
942354	GC: Remove NAME_ALL_GC_ROOTS #define	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
942376	Make "quit" and "terminate" print a message indicating they were called, in more-deterministic builds		FIXED	Jan de Mooij [:jandem]
942390	Differential Testing: Different output message involving __iterator__		FIXED	Jan de Mooij [:jandem]
942421	Since bugfix for 941424, xpcshell built with gcc 4.8.2 is broken in packaging process	[qa-]	FIXED	(no longer active)
942480	Crash [@ js::gc::Cell::runtimeFromAnyThread] or Assertion failure: table, at dist/include/js/HashTable.h or Assertion failure: object->runtimeFromMainThread()->isHeapBusy(), at vm/Debugger.cpp	[MemShrink]	FIXED	Shu-yu Guo [:shu]
942549	Differential Testing: Different output message involving eval, -0		FIXED	Shu-yu Guo [:shu]
942552	Unified sources causing build issues in SpiderMonkey with --disable-threadsafe	[fuzzblocker]	FIXED	(no longer active)
942604	Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp	[jsbugmon:update]	FIXED	Kannan Vijayan [:djvj]
942871	Convert trySplitAtLastRegisterUse to use splitAt	[qa-]	FIXED	Dan Gohman [:sunfish]
942903	BitAndAndBranch can use its operands AtStart	[qa-]	FIXED	Dan Gohman [:sunfish]
942928	GenerationalGC: Browser opt builds fail with undefined reference to `JS::HeapCellRelocate(js::gc::Cell**)'	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
942984	Emscripten web page hard-crashes the browser.		FIXED	Brian Hackett [Laid off!]
943126	Fast-path for String.split("")	[qa-]	FIXED	Sean Stangl [:sstangl]
943327	Octane-mandreel spends a lot of time in ValueNumberer::lookupValue		FIXED	Jan de Mooij [:jandem]
943347	Build js/jsd in unified mode	[qa-]	FIXED	(no longer active)
943425	Avoid creating empty MoveGroups	[qa-]	FIXED	Dan Gohman [:sunfish]
943429	Misc register allocation cleanups	[qa-]	FIXED	Dan Gohman [:sunfish]
943436	Refactor BacktrackingAllocator::processInterval	[qa-]	FIXED	Dan Gohman [:sunfish]
943449	Consistent dump() methods for Ion objects	[qa-]	FIXED	Dan Gohman [:sunfish]
943667	AsmJSModule can try to remove dependencies which were never successfully added in the first place	[qa-]	FIXED	Hannes Verschore [:h4writer]
943723	Nightly hangs with this test case (typed objects)	[qa-]	FIXED	Niko Matsakis [:nmatsakis]
943744	Minimize memory consumed while dumping memory reports to file	[MemShrink][qa-]	FIXED	Nicholas Nethercote [inactive]
943827	GC: Out of memory memory handling for buffering gray roots is broken	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
943839	JS_AnchorPtr doesn't, due to compiler optimizations (inlining or removing call without side effects)	[qa-]	FIXED	Jeff Walden [:Waldo]
943924	tp5o private bytes -regression on windows xp and windows 7	[talos_regression][qa-]	FIXED	Brian Hackett [Laid off!]
943989	Incorrect generation guard done in GenerateDOMProxyChecks in the baseline compiler	[qa-]	FIXED	Boris Zbarsky [:bzbarsky]
944040	Do not fire post-barriers during moving GC	[mem][qa-]	FIXED	Terrence Cole [:terrence]
944080	Assertion failure: false, at ../vm/SelfHosting.cpp:136 with "non-canonical BestAvailableLocale locale"	[jsbugmon:update][qa-]	FIXED	Brian Hackett [Laid off!]
944196	Rest arguments JIT code doesn't set ObjectElements::length	[qa-]	FIXED	Jeff Walden [:Waldo]
944266	Differential Testing: Different output message involving __iterator__, arguments	[qa-]	FIXED
944278	OdinMonkey: Crash [@ js::Invoke]	[fuzzblocker][qa-][adv-main27+]	FIXED	Hannes Verschore [:h4writer]
944379	Build js/ipc in unified mode	[qa-]	FIXED	(no longer active)
944438	Get rid of InstallSignalHandlersMutex	[qa-]	FIXED	Catalin Iacob
944444	Fix js/ compilation on mingw.	[qa-]	FIXED	Jacek Caban
944491	Add null-checking asserts to GetGCThingRuntime and GetGCThingMarkBitmap	[qa-]	FIXED	Andrew McCreight [:mccr8]
944930	Remove blockIndex from aliasedvar ops	[qa-]	FIXED	Brian Hackett [Laid off!]
944946	Use accessor methods for script->code and script->length	[qa-]	FIXED	Brian Hackett [Laid off!]
944963	Assertion failure: !minimalInterval(interval), at jit/BacktrackingAllocator.cpp	[qa-]	FIXED	Dan Gohman [:sunfish]
945077	js/src/jit/AsmJSSignalHandlers.cpp:931:13: warning: unused variable 'sHandlersInstalled' [-Wunused-variable]	[qa-]	FIXED	Chris Peterson [:cpeterson]
945294	Assertion failure: is<T>(), at ../jsobj.h:1169		FIXED	Jan de Mooij [:jandem]
945360	Fix three recently added hazards in spidermonkey	[qa-]	FIXED	Terrence Cole [:terrence]
945406	Move maybeAddOsrTypeBarriers calls from traverseBytecode to IonBuilder::build	[qa-]	FIXED	Jan de Mooij [:jandem]
945437	Fix Compile usecount check	[qa-]	FIXED	Jan de Mooij [:jandem]
945564	Move DataAlignment static const to function scope for unified build.	[qa-]	FIXED	Shu-yu Guo [:shu]
945568	Crash [@ ensureLinear] due to OOM in ReadFile	[jsbugmon:update]	FIXED	Christian Holler (:decoder)
945651	Comparison of 0 and null returns true		FIXED
945754	Assertion failure: !cx->isExceptionPending(), at ../vm/Interpreter.cpp:3468 due to OOM		FIXED	Christian Holler (:decoder)
945811	Assertion failure: !analysisContext->isExceptionPending(), at jit/IonBuilder.cpp:3868		FIXED	Jan de Mooij [:jandem]
945826	Every proxy trap |foo| must either use AutoEnterPolicy in Proxy::foo or be overridden in SecurityWrapper<Base>	[qa-]	FIXED	Bobby Holley (:bholley)
945844	GenerationalGC: Fix a couple of problems in browser builds	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
945846	GenerationalGC: Store buffer reentrancy assertion fails in browser builds	[qa-]	FIXED	Jon Coppeard (:jonco) (PTO until Friday 13th June)
945860	Assertion failure: mir->canBeDivideByZero() || (!mir->isUnsigned() && mir->canBeNegativeDividend()), at jit/shared/CodeGenerator-x86-shared.cpp		FIXED	Dan Gohman [:sunfish]
945939	Use-after-free or worse in ValueNumberer::lookupValue	[qa-][adv-main27+][adv-esr24.3+]	FIXED	Terrence Cole [:terrence]
946234	Crash [@ js::jit::CodeGeneratorX86Shared::bailout<js::jit::BailoutJump>]	[jsbugmon:update]	FIXED	Dan Gohman [:sunfish]
946284	Kraken stanford-crypto-ccm fails with --ion-eager	[qa-]	FIXED	Dan Gohman [:sunfish]
946405	js/src/jsinfer.cpp:581:14: warning: ‘js::types::CompilerConstraintList’ has a field ‘js::types::CompilerConstraintList::constraints’ whose type uses the anonymous namespace [enabled by default], and similar in jsopcode.cpp	[qa-]	FIXED	Daniel Holbert [:dholbert]
946662	Add MOZ_FINAL to MResumePoint	[qa-]	FIXED	Jan de Mooij [:jandem]
946883	Some timeout related jit-tests fail on OS X with NSPR emulation	[qa-]	FIXED	Jan de Mooij [:jandem]
946885	intermittent "TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/parallel/bailout-executed.js", with "bailout-executed.js:17:0 Error: ForkJoin: compilation required in par or bailout mode"	[qa-]	FIXED
946969	Differential Testing: Different output message involving Math.abs and Math.tan	[fuzzblocker]	FIXED	Douglas Crosher [:dougc]
947188	Jit: Add a way to bake MOZ_ASSUME_UNREACHABLE in generated code.	[qa-]	FIXED	Hannes Verschore [:h4writer]
947400	Make the analysis consider whether a virtual call can GC when all targets are known	[qa-]	FIXED	Steve Fink [:sfink] [:s:]
947603	IonMonkey: preparation for optimization levels	[qa-]	FIXED	Hannes Verschore [:h4writer]
947661	Crash at a weird memory address with [@ EnterBaseline] or [@ js::jit::EnterBaselineMethod] on the stack	[jsbugmon:update]	FIXED	Brian Hackett [Laid off!]
947703	crash in EnterBaseline at startup	[fixed by bug 947661]	FIXED	Brian Hackett [Laid off!]

367 Total; 367 Open (100%); 0 Resolved (0%); 0 Verified (0%);

Q4 2013

Firefox 27 (Aurora)

September 17 - October 28

• [PROPOSED] 903332 - document.watch() Proxies
• [PROPOSED] 933882 - Firebug perf: Invalidate JIT code instead of doing full GC on debug mode toggle
• All JS bugs fixed in Firefox 27

Firefox 28 (Nightly)

October 29 - December 9

• [DONE] 903332 - document.watch() Proxies
• [DONE] 929797 - Implement memory reporting of child processes
• [DONE] 933882 - Invalidate JIT code instead of doing full GC on debug mode toggle (Firebug perf)
• [DONE] 934799 - Lazify delazifying lazy scripts (Debugger perf)
• [ON TRACK] 499198 - WBGP: Optimize Peacekeeper benchmark
• [ON TRACK] 637572 - 935203 Implement Debugger.Source (for Firebug)
• [ON TRACK] 332176 - Fix line numbers in eval()'d code
• [ON TRACK] 716647 - Debug Ion code on stack
• [ON TRACK] 924839 - Update ICU (for i18n)
• [ON TRACK] 837963 - ECMA-402 i18n API
• [AT RISK] 753203 - Exact Rooting for GGC
• [AT RISK] 934257 - Run Valgrind on TBPL, not just Nightly
• [AT RISK] 934669 - Warn on Object.prototype.{,un}watch()
• [PROPOSED] 932402 - Shumway: create multiple globals
• [PROPOSED] 933467 - Shumway: implement iterable weak maps
• [PROPOSED] ? - Ion: Add optimization levels
• All JS bugs fixed in Firefox 28

Q1 2014

Firefox 29

December 10 - January 20

• [ON TRACK] 619558 - GGC
• [AT RISK] 930908 - Implement synchronous channel for Shumway workers
• [PROPOSED] 630464 - Pass exception info to window.onerror()
• [PROPOSED] 851699 - WBGP: Optimize Browsermark benchmark
• [PROPOSED] 856533 - Implement Ion escape analysis
• [PROPOSED] 800200 - Remove legacy JSD1 debugging API
• [PROPOSED] ? - Debugger: Implement low-level heap analysis (without UI)

Firefox 30+

January 21 -

• [PROPOSED] 785905 - OMT MIR construction?
• [PROPOSED] ? - Debugger: Implement UI for low-level heap analysis?

Q2 2014

• [PROPOSED] 854061 - Implement asm.js parser?
• [PROPOSED] 861963 - Integrate test262 test suite?
• [PROPOSED] 900784 - Add JS start-up cache (for Firefox OS and Shumway)?
• [PROPOSED] 792439 - ES6 WeakSets?
• [PROPOSED] 578700 - ES7 Typed Objects?
• [PROPOSED] ? - Implement Visual Studio plugin for JS debugger?

H2 2014

• [PROPOSED] 902174 - G1: The Good Parts?
• [PROPOSED] 568953 - ES6 Modules?
• [PROPOSED] 837314 - ES6 Classes?
• [PROPOSED] 645416 - ES6 Symbols?
• December: ES6 to be standardized?