diff -r 000000000000 -r 6474c204b198 js/src/vm/StructuredClone.cpp
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/vm/StructuredClone.cpp	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,1906 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * This file implements the structured clone algorithm of
+ * http://www.whatwg.org/specs/web-apps/current-work/multipage/common-dom-interfaces.html#safe-passing-of-structured-data
+ *
+ * The implementation differs slightly in that it uses an explicit stack, and
+ * the "memory" maps source objects to sequential integer indexes rather than
+ * directly pointing to destination objects. As a result, the order in which
+ * things are added to the memory must exactly match the order in which they
+ * are placed into 'allObjs', an analogous array of back-referenceable
+ * destination objects constructed while reading.
+ *
+ * For the most part, this is easy: simply add objects to the memory when first
+ * encountering them. But reading in a typed array requires an ArrayBuffer for
+ * construction, so objects cannot just be added to 'allObjs' in the order they
+ * are created. If they were, ArrayBuffers would come before typed arrays when
+ * in fact the typed array was added to 'memory' first.
+ *
+ * So during writing, we add objects to the memory when first encountering
+ * them. When reading a typed array, a placeholder is pushed onto allObjs until
+ * the ArrayBuffer has been read, then it is updated with the actual typed
+ * array object.
+ */
+
+#include "js/StructuredClone.h"
+
+#include "mozilla/Endian.h"
+#include "mozilla/FloatingPoint.h"
+
+#include <algorithm>
+
+#include "jsapi.h"
+#include "jscntxt.h"
+#include "jsdate.h"
+#include "jswrapper.h"
+
+#include "vm/SharedArrayObject.h"
+#include "vm/TypedArrayObject.h"
+#include "vm/WrapperObject.h"
+
+#include "jscntxtinlines.h"
+#include "jsobjinlines.h"
+
+using namespace js;
+
+using mozilla::IsNaN;
+using mozilla::LittleEndian;
+using mozilla::NativeEndian;
+using JS::CanonicalizeNaN;
+
+enum StructuredDataType {
+    /* Structured data types provided by the engine */
+    SCTAG_FLOAT_MAX = 0xFFF00000,
+    SCTAG_NULL = 0xFFFF0000,
+    SCTAG_UNDEFINED,
+    SCTAG_BOOLEAN,
+    SCTAG_INDEX,
+    SCTAG_STRING,
+    SCTAG_DATE_OBJECT,
+    SCTAG_REGEXP_OBJECT,
+    SCTAG_ARRAY_OBJECT,
+    SCTAG_OBJECT_OBJECT,
+    SCTAG_ARRAY_BUFFER_OBJECT,
+    SCTAG_BOOLEAN_OBJECT,
+    SCTAG_STRING_OBJECT,
+    SCTAG_NUMBER_OBJECT,
+    SCTAG_BACK_REFERENCE_OBJECT,
+    SCTAG_DO_NOT_USE_1, // Required for backwards compatibility
+    SCTAG_DO_NOT_USE_2, // Required for backwards compatibility
+    SCTAG_TYPED_ARRAY_OBJECT,
+    SCTAG_TYPED_ARRAY_V1_MIN = 0xFFFF0100,
+    SCTAG_TYPED_ARRAY_V1_INT8 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_INT8,
+    SCTAG_TYPED_ARRAY_V1_UINT8 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_UINT8,
+    SCTAG_TYPED_ARRAY_V1_INT16 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_INT16,
+    SCTAG_TYPED_ARRAY_V1_UINT16 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_UINT16,
+    SCTAG_TYPED_ARRAY_V1_INT32 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_INT32,
+    SCTAG_TYPED_ARRAY_V1_UINT32 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_UINT32,
+    SCTAG_TYPED_ARRAY_V1_FLOAT32 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_FLOAT32,
+    SCTAG_TYPED_ARRAY_V1_FLOAT64 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_FLOAT64,
+    SCTAG_TYPED_ARRAY_V1_UINT8_CLAMPED = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_UINT8_CLAMPED,
+    SCTAG_TYPED_ARRAY_V1_MAX = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_MAX - 1,
+
+    /*
+     * Define a separate range of numbers for Transferable-only tags, since
+     * they are not used for persistent clone buffers and therefore do not
+     * require bumping JS_STRUCTURED_CLONE_VERSION.
+     */
+    SCTAG_TRANSFER_MAP_HEADER = 0xFFFF0200,
+    SCTAG_TRANSFER_MAP_PENDING_ENTRY,
+    SCTAG_TRANSFER_MAP_ARRAY_BUFFER,
+    SCTAG_TRANSFER_MAP_SHARED_BUFFER,
+    SCTAG_TRANSFER_MAP_END_OF_BUILTIN_TYPES,
+
+    SCTAG_END_OF_BUILTIN_TYPES
+};
+
+/*
+ * Format of transfer map:
+ *   <SCTAG_TRANSFER_MAP_HEADER, TransferableMapHeader(UNREAD|TRANSFERRED)>
+ *   numTransferables (64 bits)
+ *   array of:
+ *     <SCTAG_TRANSFER_MAP_*, TransferableOwnership>
+ *     pointer (64 bits)
+ *     extraData (64 bits), eg byte length for ArrayBuffers
+ */
+
+// Data associated with an SCTAG_TRANSFER_MAP_HEADER that tells whether the
+// contents have been read out yet or not.
+enum TransferableMapHeader {
+    SCTAG_TM_UNREAD = 0,
+    SCTAG_TM_TRANSFERRED
+};
+
+static inline uint64_t
+PairToUInt64(uint32_t tag, uint32_t data)
+{
+    return uint64_t(data) | (uint64_t(tag) << 32);
+}
+
+namespace js {
+
+struct SCOutput {
+  public:
+    explicit SCOutput(JSContext *cx);
+
+    JSContext *context() const { return cx; }
+
+    bool write(uint64_t u);
+    bool writePair(uint32_t tag, uint32_t data);
+    bool writeDouble(double d);
+    bool writeBytes(const void *p, size_t nbytes);
+    bool writeChars(const jschar *p, size_t nchars);
+    bool writePtr(const void *);
+
+    template <class T>
+    bool writeArray(const T *p, size_t nbytes);
+
+    bool extractBuffer(uint64_t **datap, size_t *sizep);
+
+    uint64_t count() const { return buf.length(); }
+    uint64_t *rawBuffer() { return buf.begin(); }
+
+  private:
+    JSContext *cx;
+    Vector<uint64_t> buf;
+};
+
+class SCInput {
+  public:
+    SCInput(JSContext *cx, uint64_t *data, size_t nbytes);
+
+    JSContext *context() const { return cx; }
+
+    static void getPtr(const uint64_t *buffer, void **ptr);
+    static void getPair(const uint64_t *buffer, uint32_t *tagp, uint32_t *datap);
+
+    bool read(uint64_t *p);
+    bool readNativeEndian(uint64_t *p);
+    bool readPair(uint32_t *tagp, uint32_t *datap);
+    bool readDouble(double *p);
+    bool readBytes(void *p, size_t nbytes);
+    bool readChars(jschar *p, size_t nchars);
+    bool readPtr(void **);
+
+    bool get(uint64_t *p);
+    bool getPair(uint32_t *tagp, uint32_t *datap);
+
+    uint64_t *tell() const { return point; }
+    uint64_t *end() const { return bufEnd; }
+
+    template <class T>
+    bool readArray(T *p, size_t nelems);
+
+    bool reportTruncated() {
+         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
+                              JSMSG_SC_BAD_SERIALIZED_DATA, "truncated");
+         return false;
+     }
+
+  private:
+    void staticAssertions() {
+        JS_STATIC_ASSERT(sizeof(jschar) == 2);
+        JS_STATIC_ASSERT(sizeof(uint32_t) == 4);
+        JS_STATIC_ASSERT(sizeof(double) == 8);
+    }
+
+    JSContext *cx;
+    uint64_t *point;
+    uint64_t *bufEnd;
+};
+
+} /* namespace js */
+
+struct JSStructuredCloneReader {
+  public:
+    explicit JSStructuredCloneReader(SCInput &in, const JSStructuredCloneCallbacks *cb,
+                                     void *cbClosure)
+        : in(in), objs(in.context()), allObjs(in.context()),
+          callbacks(cb), closure(cbClosure) { }
+
+    SCInput &input() { return in; }
+    bool read(Value *vp);
+
+  private:
+    JSContext *context() { return in.context(); }
+
+    bool readTransferMap();
+
+    bool checkDouble(double d);
+    JSString *readString(uint32_t nchars);
+    bool readTypedArray(uint32_t arrayType, uint32_t nelems, Value *vp, bool v1Read = false);
+    bool readArrayBuffer(uint32_t nbytes, Value *vp);
+    bool readV1ArrayBuffer(uint32_t arrayType, uint32_t nelems, Value *vp);
+    bool readId(jsid *idp);
+    bool startRead(Value *vp);
+
+    SCInput &in;
+
+    // Stack of objects with properties remaining to be read.
+    AutoValueVector objs;
+
+    // Stack of all objects read during this deserialization
+    AutoValueVector allObjs;
+
+    // The user defined callbacks that will be used for cloning.
+    const JSStructuredCloneCallbacks *callbacks;
+
+    // Any value passed to JS_ReadStructuredClone.
+    void *closure;
+
+    friend bool JS_ReadTypedArray(JSStructuredCloneReader *r, MutableHandleValue vp);
+};
+
+struct JSStructuredCloneWriter {
+  public:
+    explicit JSStructuredCloneWriter(JSContext *cx,
+                                     const JSStructuredCloneCallbacks *cb,
+                                     void *cbClosure,
+                                     jsval tVal)
+        : out(cx), objs(out.context()),
+          counts(out.context()), ids(out.context()),
+          memory(out.context()), callbacks(cb), closure(cbClosure),
+          transferable(out.context(), tVal), transferableObjects(out.context()) { }
+
+    ~JSStructuredCloneWriter();
+
+    bool init() { return memory.init() && parseTransferable() && writeTransferMap(); }
+
+    bool write(const Value &v);
+
+    SCOutput &output() { return out; }
+
+    bool extractBuffer(uint64_t **datap, size_t *sizep) {
+        return out.extractBuffer(datap, sizep);
+    }
+
+  private:
+    JSContext *context() { return out.context(); }
+
+    bool writeTransferMap();
+
+    bool writeString(uint32_t tag, JSString *str);
+    bool writeId(jsid id);
+    bool writeArrayBuffer(HandleObject obj);
+    bool writeTypedArray(HandleObject obj);
+    bool startObject(HandleObject obj, bool *backref);
+    bool startWrite(const Value &v);
+    bool traverseObject(HandleObject obj);
+
+    bool parseTransferable();
+    bool reportErrorTransferable();
+    bool transferOwnership();
+
+    inline void checkStack();
+
+    SCOutput out;
+
+    // Vector of objects with properties remaining to be written.
+    //
+    // NB: These can span multiple compartments, so the compartment must be
+    // entered before any manipulation is performed.
+    AutoValueVector objs;
+
+    // counts[i] is the number of properties of objs[i] remaining to be written.
+    // counts.length() == objs.length() and sum(counts) == ids.length().
+    Vector<size_t> counts;
+
+    // Ids of properties remaining to be written.
+    AutoIdVector ids;
+
+    // The "memory" list described in the HTML5 internal structured cloning algorithm.
+    // memory is a superset of objs; items are never removed from Memory
+    // until a serialization operation is finished
+    typedef AutoObjectUnsigned32HashMap CloneMemory;
+    CloneMemory memory;
+
+    // The user defined callbacks that will be used for cloning.
+    const JSStructuredCloneCallbacks *callbacks;
+
+    // Any value passed to JS_WriteStructuredClone.
+    void *closure;
+
+    // List of transferable objects
+    RootedValue transferable;
+    AutoObjectVector transferableObjects;
+
+    friend bool JS_WriteTypedArray(JSStructuredCloneWriter *w, HandleValue v);
+};
+
+JS_FRIEND_API(uint64_t)
+js_GetSCOffset(JSStructuredCloneWriter* writer)
+{
+    JS_ASSERT(writer);
+    return writer->output().count() * sizeof(uint64_t);
+}
+
+JS_STATIC_ASSERT(SCTAG_END_OF_BUILTIN_TYPES <= JS_SCTAG_USER_MIN);
+JS_STATIC_ASSERT(JS_SCTAG_USER_MIN <= JS_SCTAG_USER_MAX);
+JS_STATIC_ASSERT(ScalarTypeDescr::TYPE_INT8 == 0);
+
+static void
+ReportErrorTransferable(JSContext *cx, const JSStructuredCloneCallbacks *callbacks)
+{
+    if (callbacks && callbacks->reportError)
+        callbacks->reportError(cx, JS_SCERR_TRANSFERABLE);
+    else
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_SC_NOT_TRANSFERABLE);
+}
+
+bool
+WriteStructuredClone(JSContext *cx, HandleValue v, uint64_t **bufp, size_t *nbytesp,
+                     const JSStructuredCloneCallbacks *cb, void *cbClosure,
+                     jsval transferable)
+{
+    JSStructuredCloneWriter w(cx, cb, cbClosure, transferable);
+    return w.init() && w.write(v) && w.extractBuffer(bufp, nbytesp);
+}
+
+bool
+ReadStructuredClone(JSContext *cx, uint64_t *data, size_t nbytes, MutableHandleValue vp,
+                    const JSStructuredCloneCallbacks *cb, void *cbClosure)
+{
+    SCInput in(cx, data, nbytes);
+    JSStructuredCloneReader r(in, cb, cbClosure);
+    return r.read(vp.address());
+}
+
+// If the given buffer contains Transferables, free them. Note that custom
+// Transferables will use the JSStructuredCloneCallbacks::freeTransfer() to
+// delete their transferables.
+static void
+Discard(uint64_t *buffer, size_t nbytes, const JSStructuredCloneCallbacks *cb, void *cbClosure)
+{
+    JS_ASSERT(nbytes % sizeof(uint64_t) == 0);
+    if (nbytes < sizeof(uint64_t))
+        return; // Empty buffer
+
+    uint64_t *point = buffer;
+    uint32_t tag, data;
+    SCInput::getPair(point++, &tag, &data);
+    if (tag != SCTAG_TRANSFER_MAP_HEADER)
+        return;
+
+    if (TransferableMapHeader(data) == SCTAG_TM_TRANSFERRED)
+        return;
+
+    // freeTransfer should not GC
+    JS::AutoAssertNoGC nogc;
+
+    uint64_t numTransferables = LittleEndian::readUint64(point++);
+    while (numTransferables--) {
+        uint32_t ownership;
+        SCInput::getPair(point++, &tag, &ownership);
+        JS_ASSERT(tag >= SCTAG_TRANSFER_MAP_PENDING_ENTRY);
+
+        void *content;
+        SCInput::getPtr(point++, &content);
+
+        uint64_t extraData = LittleEndian::readUint64(point++);
+
+        if (ownership < JS::SCTAG_TMO_FIRST_OWNED)
+            continue;
+
+        if (ownership == JS::SCTAG_TMO_ALLOC_DATA) {
+            js_free(content);
+        } else if (ownership == JS::SCTAG_TMO_MAPPED_DATA) {
+            JS_ReleaseMappedArrayBufferContents(content, extraData);
+        } else if (ownership == JS::SCTAG_TMO_SHARED_BUFFER) {
+            SharedArrayRawBuffer *raw = static_cast<SharedArrayRawBuffer*>(content);
+            if (raw)
+                raw->dropReference();
+        } else if (cb && cb->freeTransfer) {
+            cb->freeTransfer(tag, JS::TransferableOwnership(ownership), content, extraData, cbClosure);
+        } else {
+            MOZ_ASSERT(false, "unknown ownership");
+        }
+    }
+}
+
+static void
+ClearStructuredClone(uint64_t *data, size_t nbytes,
+                     const JSStructuredCloneCallbacks *cb, void *cbClosure)
+{
+    Discard(data, nbytes, cb, cbClosure);
+    js_free(data);
+}
+
+bool
+StructuredCloneHasTransferObjects(const uint64_t *data, size_t nbytes, bool *hasTransferable)
+{
+    *hasTransferable = false;
+
+    if (data) {
+        uint64_t u = LittleEndian::readUint64(data);
+        uint32_t tag = uint32_t(u >> 32);
+        if (tag == SCTAG_TRANSFER_MAP_HEADER)
+            *hasTransferable = true;
+    }
+
+    return true;
+}
+
+namespace js {
+
+SCInput::SCInput(JSContext *cx, uint64_t *data, size_t nbytes)
+    : cx(cx), point(data), bufEnd(data + nbytes / 8)
+{
+    // On 32-bit, we sometimes construct an SCInput from an SCOutput buffer,
+    // which is not guaranteed to be 8-byte aligned
+    JS_ASSERT((uintptr_t(data) & (sizeof(int) - 1)) == 0);
+    JS_ASSERT((nbytes & 7) == 0);
+}
+
+bool
+SCInput::read(uint64_t *p)
+{
+    if (point == bufEnd) {
+        *p = 0;  /* initialize to shut GCC up */
+        return reportTruncated();
+    }
+    *p = LittleEndian::readUint64(point++);
+    return true;
+}
+
+bool
+SCInput::readNativeEndian(uint64_t *p)
+{
+    if (point == bufEnd) {
+        *p = 0;  /* initialize to shut GCC up */
+        return reportTruncated();
+    }
+    *p = *(point++);
+    return true;
+}
+
+bool
+SCInput::readPair(uint32_t *tagp, uint32_t *datap)
+{
+    uint64_t u;
+    bool ok = read(&u);
+    if (ok) {
+        *tagp = uint32_t(u >> 32);
+        *datap = uint32_t(u);
+    }
+    return ok;
+}
+
+bool
+SCInput::get(uint64_t *p)
+{
+    if (point == bufEnd)
+        return reportTruncated();
+    *p = LittleEndian::readUint64(point);
+    return true;
+}
+
+bool
+SCInput::getPair(uint32_t *tagp, uint32_t *datap)
+{
+    uint64_t u = 0;
+    if (!get(&u))
+        return false;
+
+    *tagp = uint32_t(u >> 32);
+    *datap = uint32_t(u);
+    return true;
+}
+
+void
+SCInput::getPair(const uint64_t *p, uint32_t *tagp, uint32_t *datap)
+{
+    uint64_t u = LittleEndian::readUint64(p);
+    *tagp = uint32_t(u >> 32);
+    *datap = uint32_t(u);
+}
+
+bool
+SCInput::readDouble(double *p)
+{
+    union {
+        uint64_t u;
+        double d;
+    } pun;
+    if (!read(&pun.u))
+        return false;
+    *p = CanonicalizeNaN(pun.d);
+    return true;
+}
+
+template <typename T>
+static void
+copyAndSwapFromLittleEndian(T *dest, const void *src, size_t nelems)
+{
+    if (nelems > 0)
+        NativeEndian::copyAndSwapFromLittleEndian(dest, src, nelems);
+}
+
+template <>
+void
+copyAndSwapFromLittleEndian(uint8_t *dest, const void *src, size_t nelems)
+{
+    memcpy(dest, src, nelems);
+}
+
+template <class T>
+bool
+SCInput::readArray(T *p, size_t nelems)
+{
+    JS_STATIC_ASSERT(sizeof(uint64_t) % sizeof(T) == 0);
+
+    /*
+     * Fail if nelems is so huge as to make JS_HOWMANY overflow or if nwords is
+     * larger than the remaining data.
+     */
+    size_t nwords = JS_HOWMANY(nelems, sizeof(uint64_t) / sizeof(T));
+    if (nelems + sizeof(uint64_t) / sizeof(T) - 1 < nelems || nwords > size_t(bufEnd - point))
+        return reportTruncated();
+
+    copyAndSwapFromLittleEndian(p, point, nelems);
+    point += nwords;
+    return true;
+}
+
+bool
+SCInput::readBytes(void *p, size_t nbytes)
+{
+    return readArray((uint8_t *) p, nbytes);
+}
+
+bool
+SCInput::readChars(jschar *p, size_t nchars)
+{
+    JS_ASSERT(sizeof(jschar) == sizeof(uint16_t));
+    return readArray((uint16_t *) p, nchars);
+}
+
+void
+SCInput::getPtr(const uint64_t *p, void **ptr)
+{
+    // No endianness conversion is used for pointers, since they are not sent
+    // across address spaces anyway.
+    *ptr = reinterpret_cast<void*>(*p);
+}
+
+bool
+SCInput::readPtr(void **p)
+{
+    uint64_t u;
+    if (!readNativeEndian(&u))
+        return false;
+    *p = reinterpret_cast<void*>(u);
+    return true;
+}
+
+SCOutput::SCOutput(JSContext *cx) : cx(cx), buf(cx) {}
+
+bool
+SCOutput::write(uint64_t u)
+{
+    return buf.append(NativeEndian::swapToLittleEndian(u));
+}
+
+bool
+SCOutput::writePair(uint32_t tag, uint32_t data)
+{
+    /*
+     * As it happens, the tag word appears after the data word in the output.
+     * This is because exponents occupy the last 2 bytes of doubles on the
+     * little-endian platforms we care most about.
+     *
+     * For example, JSVAL_TRUE is written using writePair(SCTAG_BOOLEAN, 1).
+     * PairToUInt64 produces the number 0xFFFF000200000001.
+     * That is written out as the bytes 01 00 00 00 02 00 FF FF.
+     */
+    return write(PairToUInt64(tag, data));
+}
+
+static inline uint64_t
+ReinterpretDoubleAsUInt64(double d)
+{
+    union {
+        double d;
+        uint64_t u;
+    } pun;
+    pun.d = d;
+    return pun.u;
+}
+
+static inline double
+ReinterpretUInt64AsDouble(uint64_t u)
+{
+    union {
+        uint64_t u;
+        double d;
+    } pun;
+    pun.u = u;
+    return pun.d;
+}
+
+static inline double
+ReinterpretPairAsDouble(uint32_t tag, uint32_t data)
+{
+    return ReinterpretUInt64AsDouble(PairToUInt64(tag, data));
+}
+
+bool
+SCOutput::writeDouble(double d)
+{
+    return write(ReinterpretDoubleAsUInt64(CanonicalizeNaN(d)));
+}
+
+template <typename T>
+static void
+copyAndSwapToLittleEndian(void *dest, const T *src, size_t nelems)
+{
+    if (nelems > 0)
+        NativeEndian::copyAndSwapToLittleEndian(dest, src, nelems);
+}
+
+template <>
+void
+copyAndSwapToLittleEndian(void *dest, const uint8_t *src, size_t nelems)
+{
+    memcpy(dest, src, nelems);
+}
+
+template <class T>
+bool
+SCOutput::writeArray(const T *p, size_t nelems)
+{
+    JS_ASSERT(8 % sizeof(T) == 0);
+    JS_ASSERT(sizeof(uint64_t) % sizeof(T) == 0);
+
+    if (nelems == 0)
+        return true;
+
+    if (nelems + sizeof(uint64_t) / sizeof(T) - 1 < nelems) {
+        js_ReportAllocationOverflow(context());
+        return false;
+    }
+    size_t nwords = JS_HOWMANY(nelems, sizeof(uint64_t) / sizeof(T));
+    size_t start = buf.length();
+    if (!buf.growByUninitialized(nwords))
+        return false;
+
+    buf.back() = 0;  /* zero-pad to an 8-byte boundary */
+
+    T *q = (T *) &buf[start];
+    copyAndSwapToLittleEndian(q, p, nelems);
+    return true;
+}
+
+bool
+SCOutput::writeBytes(const void *p, size_t nbytes)
+{
+    return writeArray((const uint8_t *) p, nbytes);
+}
+
+bool
+SCOutput::writeChars(const jschar *p, size_t nchars)
+{
+    JS_ASSERT(sizeof(jschar) == sizeof(uint16_t));
+    return writeArray((const uint16_t *) p, nchars);
+}
+
+bool
+SCOutput::writePtr(const void *p)
+{
+    return write(reinterpret_cast<uint64_t>(p));
+}
+
+bool
+SCOutput::extractBuffer(uint64_t **datap, size_t *sizep)
+{
+    *sizep = buf.length() * sizeof(uint64_t);
+    return (*datap = buf.extractRawBuffer()) != nullptr;
+}
+
+} /* namespace js */
+
+JS_STATIC_ASSERT(JSString::MAX_LENGTH < UINT32_MAX);
+
+JSStructuredCloneWriter::~JSStructuredCloneWriter()
+{
+    // Free any transferable data left lying around in the buffer
+    uint64_t *data;
+    size_t size;
+    MOZ_ALWAYS_TRUE(extractBuffer(&data, &size));
+    ClearStructuredClone(data, size, callbacks, closure);
+}
+
+bool
+JSStructuredCloneWriter::parseTransferable()
+{
+    MOZ_ASSERT(transferableObjects.empty(), "parseTransferable called with stale data");
+
+    if (JSVAL_IS_NULL(transferable) || JSVAL_IS_VOID(transferable))
+        return true;
+
+    if (!transferable.isObject())
+        return reportErrorTransferable();
+
+    JSContext *cx = context();
+    RootedObject array(cx, &transferable.toObject());
+    if (!JS_IsArrayObject(cx, array))
+        return reportErrorTransferable();
+
+    uint32_t length;
+    if (!JS_GetArrayLength(cx, array, &length)) {
+        return false;
+    }
+
+    RootedValue v(context());
+
+    for (uint32_t i = 0; i < length; ++i) {
+        if (!JS_GetElement(cx, array, i, &v))
+            return false;
+
+        if (!v.isObject())
+            return reportErrorTransferable();
+
+        RootedObject tObj(context(), CheckedUnwrap(&v.toObject()));
+
+        if (!tObj) {
+            JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr, JSMSG_UNWRAP_DENIED);
+            return false;
+        }
+
+        // No duplicates allowed
+        if (std::find(transferableObjects.begin(), transferableObjects.end(), tObj) != transferableObjects.end()) {
+            JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr, JSMSG_SC_DUP_TRANSFERABLE);
+            return false;
+        }
+
+        if (!transferableObjects.append(tObj))
+            return false;
+    }
+
+    return true;
+}
+
+bool
+JSStructuredCloneWriter::reportErrorTransferable()
+{
+    ReportErrorTransferable(context(), callbacks);
+    return false;
+}
+
+bool
+JSStructuredCloneWriter::writeString(uint32_t tag, JSString *str)
+{
+    size_t length = str->length();
+    const jschar *chars = str->getChars(context());
+    if (!chars)
+        return false;
+    return out.writePair(tag, uint32_t(length)) && out.writeChars(chars, length);
+}
+
+bool
+JSStructuredCloneWriter::writeId(jsid id)
+{
+    if (JSID_IS_INT(id))
+        return out.writePair(SCTAG_INDEX, uint32_t(JSID_TO_INT(id)));
+    JS_ASSERT(JSID_IS_STRING(id));
+    return writeString(SCTAG_STRING, JSID_TO_STRING(id));
+}
+
+inline void
+JSStructuredCloneWriter::checkStack()
+{
+#ifdef DEBUG
+    /* To avoid making serialization O(n^2), limit stack-checking at 10. */
+    const size_t MAX = 10;
+
+    size_t limit = Min(counts.length(), MAX);
+    JS_ASSERT(objs.length() == counts.length());
+    size_t total = 0;
+    for (size_t i = 0; i < limit; i++) {
+        JS_ASSERT(total + counts[i] >= total);
+        total += counts[i];
+    }
+    if (counts.length() <= MAX)
+        JS_ASSERT(total == ids.length());
+    else
+        JS_ASSERT(total <= ids.length());
+
+    size_t j = objs.length();
+    for (size_t i = 0; i < limit; i++)
+        JS_ASSERT(memory.has(&objs[--j].toObject()));
+#endif
+}
+
+/*
+ * Write out a typed array. Note that post-v1 structured clone buffers do not
+ * perform endianness conversion on stored data, so multibyte typed arrays
+ * cannot be deserialized into a different endianness machine. Endianness
+ * conversion would prevent sharing ArrayBuffers: if you have Int8Array and
+ * Int16Array views of the same ArrayBuffer, should the data bytes be
+ * byte-swapped when writing or not? The Int8Array requires them to not be
+ * swapped; the Int16Array requires that they are.
+ */
+bool
+JSStructuredCloneWriter::writeTypedArray(HandleObject obj)
+{
+    Rooted<TypedArrayObject*> tarr(context(), &obj->as<TypedArrayObject>());
+
+    if (!TypedArrayObject::ensureHasBuffer(context(), tarr))
+        return false;
+
+    if (!out.writePair(SCTAG_TYPED_ARRAY_OBJECT, tarr->length()))
+        return false;
+    uint64_t type = tarr->type();
+    if (!out.write(type))
+        return false;
+
+    // Write out the ArrayBuffer tag and contents
+    RootedValue val(context(), TypedArrayObject::bufferValue(tarr));
+    if (!startWrite(val))
+        return false;
+
+    return out.write(tarr->byteOffset());
+}
+
+bool
+JSStructuredCloneWriter::writeArrayBuffer(HandleObject obj)
+{
+    ArrayBufferObject &buffer = obj->as<ArrayBufferObject>();
+
+    return out.writePair(SCTAG_ARRAY_BUFFER_OBJECT, buffer.byteLength()) &&
+           out.writeBytes(buffer.dataPointer(), buffer.byteLength());
+}
+
+bool
+JSStructuredCloneWriter::startObject(HandleObject obj, bool *backref)
+{
+    /* Handle cycles in the object graph. */
+    CloneMemory::AddPtr p = memory.lookupForAdd(obj);
+    if ((*backref = p))
+        return out.writePair(SCTAG_BACK_REFERENCE_OBJECT, p->value());
+    if (!memory.add(p, obj, memory.count()))
+        return false;
+
+    if (memory.count() == UINT32_MAX) {
+        JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
+                             JSMSG_NEED_DIET, "object graph to serialize");
+        return false;
+    }
+
+    return true;
+}
+
+bool
+JSStructuredCloneWriter::traverseObject(HandleObject obj)
+{
+    /*
+     * Get enumerable property ids and put them in reverse order so that they
+     * will come off the stack in forward order.
+     */
+    size_t initialLength = ids.length();
+    if (!GetPropertyNames(context(), obj, JSITER_OWNONLY, &ids))
+        return false;
+    jsid *begin = ids.begin() + initialLength, *end = ids.end();
+    size_t count = size_t(end - begin);
+    Reverse(begin, end);
+
+    /* Push obj and count to the stack. */
+    if (!objs.append(ObjectValue(*obj)) || !counts.append(count))
+        return false;
+    checkStack();
+
+    /* Write the header for obj. */
+    return out.writePair(obj->is<ArrayObject>() ? SCTAG_ARRAY_OBJECT : SCTAG_OBJECT_OBJECT, 0);
+}
+
+static bool
+PrimitiveToObject(JSContext *cx, Value *vp)
+{
+    JSObject *obj = PrimitiveToObject(cx, *vp);
+    if (!obj)
+        return false;
+
+    vp->setObject(*obj);
+    return true;
+}
+
+bool
+JSStructuredCloneWriter::startWrite(const Value &v)
+{
+    assertSameCompartment(context(), v);
+
+    if (v.isString()) {
+        return writeString(SCTAG_STRING, v.toString());
+    } else if (v.isNumber()) {
+        return out.writeDouble(v.toNumber());
+    } else if (v.isBoolean()) {
+        return out.writePair(SCTAG_BOOLEAN, v.toBoolean());
+    } else if (v.isNull()) {
+        return out.writePair(SCTAG_NULL, 0);
+    } else if (v.isUndefined()) {
+        return out.writePair(SCTAG_UNDEFINED, 0);
+    } else if (v.isObject()) {
+        RootedObject obj(context(), &v.toObject());
+
+        // The object might be a security wrapper. See if we can clone what's
+        // behind it. If we can, unwrap the object.
+        obj = CheckedUnwrap(obj);
+        if (!obj) {
+            JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr, JSMSG_UNWRAP_DENIED);
+            return false;
+        }
+
+        AutoCompartment ac(context(), obj);
+
+        bool backref;
+        if (!startObject(obj, &backref))
+            return false;
+        if (backref)
+            return true;
+
+        if (obj->is<RegExpObject>()) {
+            RegExpObject &reobj = obj->as<RegExpObject>();
+            return out.writePair(SCTAG_REGEXP_OBJECT, reobj.getFlags()) &&
+                   writeString(SCTAG_STRING, reobj.getSource());
+        } else if (obj->is<DateObject>()) {
+            double d = js_DateGetMsecSinceEpoch(obj);
+            return out.writePair(SCTAG_DATE_OBJECT, 0) && out.writeDouble(d);
+        } else if (obj->is<TypedArrayObject>()) {
+            return writeTypedArray(obj);
+        } else if (obj->is<ArrayBufferObject>() && obj->as<ArrayBufferObject>().hasData()) {
+            return writeArrayBuffer(obj);
+        } else if (obj->is<JSObject>() || obj->is<ArrayObject>()) {
+            return traverseObject(obj);
+        } else if (obj->is<BooleanObject>()) {
+            return out.writePair(SCTAG_BOOLEAN_OBJECT, obj->as<BooleanObject>().unbox());
+        } else if (obj->is<NumberObject>()) {
+            return out.writePair(SCTAG_NUMBER_OBJECT, 0) &&
+                   out.writeDouble(obj->as<NumberObject>().unbox());
+        } else if (obj->is<StringObject>()) {
+            return writeString(SCTAG_STRING_OBJECT, obj->as<StringObject>().unbox());
+        }
+
+        if (callbacks && callbacks->write)
+            return callbacks->write(context(), this, obj, closure);
+        /* else fall through */
+    }
+
+    JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr, JSMSG_SC_UNSUPPORTED_TYPE);
+    return false;
+}
+
+bool
+JSStructuredCloneWriter::writeTransferMap()
+{
+    if (transferableObjects.empty())
+        return true;
+
+    if (!out.writePair(SCTAG_TRANSFER_MAP_HEADER, (uint32_t)SCTAG_TM_UNREAD))
+        return false;
+
+    if (!out.write(transferableObjects.length()))
+        return false;
+
+    for (JS::AutoObjectVector::Range tr = transferableObjects.all(); !tr.empty(); tr.popFront()) {
+        JSObject *obj = tr.front();
+
+        if (!memory.put(obj, memory.count()))
+            return false;
+
+        // Emit a placeholder pointer. We will steal the data and neuter the
+        // transferable later, in the case of ArrayBufferObject.
+        if (!out.writePair(SCTAG_TRANSFER_MAP_PENDING_ENTRY, JS::SCTAG_TMO_UNFILLED))
+            return false;
+        if (!out.writePtr(nullptr)) // Pointer to ArrayBuffer contents or to SharedArrayRawBuffer.
+            return false;
+        if (!out.write(0)) // extraData
+            return false;
+    }
+
+    return true;
+}
+
+bool
+JSStructuredCloneWriter::transferOwnership()
+{
+    if (transferableObjects.empty())
+        return true;
+
+    // Walk along the transferables and the transfer map at the same time,
+    // grabbing out pointers from the transferables and stuffing them into the
+    // transfer map.
+    uint64_t *point = out.rawBuffer();
+    JS_ASSERT(uint32_t(LittleEndian::readUint64(point) >> 32) == SCTAG_TRANSFER_MAP_HEADER);
+    point++;
+    JS_ASSERT(LittleEndian::readUint64(point) == transferableObjects.length());
+    point++;
+
+    for (JS::AutoObjectVector::Range tr = transferableObjects.all(); !tr.empty(); tr.popFront()) {
+        RootedObject obj(context(), tr.front());
+
+        uint32_t tag;
+        JS::TransferableOwnership ownership;
+        void *content;
+        uint64_t extraData;
+
+#if DEBUG
+        SCInput::getPair(point, &tag, (uint32_t*) &ownership);
+        MOZ_ASSERT(tag == SCTAG_TRANSFER_MAP_PENDING_ENTRY);
+        MOZ_ASSERT(ownership == JS::SCTAG_TMO_UNFILLED);
+#endif
+
+        if (obj->is<ArrayBufferObject>()) {
+            size_t nbytes = obj->as<ArrayBufferObject>().byteLength();
+            content = JS_StealArrayBufferContents(context(), obj);
+            if (!content)
+                return false; // Destructor will clean up the already-transferred data
+            tag = SCTAG_TRANSFER_MAP_ARRAY_BUFFER;
+            if (obj->as<ArrayBufferObject>().isMappedArrayBuffer())
+                ownership = JS::SCTAG_TMO_MAPPED_DATA;
+            else
+                ownership = JS::SCTAG_TMO_ALLOC_DATA;
+            extraData = nbytes;
+        } else if (obj->is<SharedArrayBufferObject>()) {
+            SharedArrayRawBuffer *rawbuf = obj->as<SharedArrayBufferObject>().rawBufferObject();
+
+            // Avoids a race condition where the parent thread frees the buffer
+            // before the child has accepted the transferable.
+            rawbuf->addReference();
+
+            tag = SCTAG_TRANSFER_MAP_SHARED_BUFFER;
+            ownership = JS::SCTAG_TMO_SHARED_BUFFER;
+            content = rawbuf;
+            extraData = 0;
+        } else {
+            if (!callbacks || !callbacks->writeTransfer)
+                return reportErrorTransferable();
+            if (!callbacks->writeTransfer(context(), obj, closure, &tag, &ownership, &content, &extraData))
+                return false;
+            JS_ASSERT(tag > SCTAG_TRANSFER_MAP_PENDING_ENTRY);
+        }
+
+        LittleEndian::writeUint64(point++, PairToUInt64(tag, ownership));
+        LittleEndian::writeUint64(point++, reinterpret_cast<uint64_t>(content));
+        LittleEndian::writeUint64(point++, extraData);
+    }
+
+    JS_ASSERT(point <= out.rawBuffer() + out.count());
+    JS_ASSERT_IF(point < out.rawBuffer() + out.count(),
+                 uint32_t(LittleEndian::readUint64(point) >> 32) < SCTAG_TRANSFER_MAP_HEADER);
+
+    return true;
+}
+
+bool
+JSStructuredCloneWriter::write(const Value &v)
+{
+    if (!startWrite(v))
+        return false;
+
+    while (!counts.empty()) {
+        RootedObject obj(context(), &objs.back().toObject());
+        AutoCompartment ac(context(), obj);
+        if (counts.back()) {
+            counts.back()--;
+            RootedId id(context(), ids.back());
+            ids.popBack();
+            checkStack();
+            if (JSID_IS_STRING(id) || JSID_IS_INT(id)) {
+                /*
+                 * If obj still has an own property named id, write it out.
+                 * The cost of re-checking could be avoided by using
+                 * NativeIterators.
+                 */
+                bool found;
+                if (!HasOwnProperty(context(), obj, id, &found))
+                    return false;
+
+                if (found) {
+                    RootedValue val(context());
+                    if (!writeId(id) ||
+                        !JSObject::getGeneric(context(), obj, obj, id, &val) ||
+                        !startWrite(val))
+                        return false;
+                }
+            }
+        } else {
+            out.writePair(SCTAG_NULL, 0);
+            objs.popBack();
+            counts.popBack();
+        }
+    }
+
+    memory.clear();
+    return transferOwnership();
+}
+
+bool
+JSStructuredCloneReader::checkDouble(double d)
+{
+    jsval_layout l;
+    l.asDouble = d;
+    if (!JSVAL_IS_DOUBLE_IMPL(l)) {
+        JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
+                             JSMSG_SC_BAD_SERIALIZED_DATA, "unrecognized NaN");
+        return false;
+    }
+    return true;
+}
+
+namespace {
+
+class Chars {
+    JSContext *cx;
+    jschar *p;
+  public:
+    Chars(JSContext *cx) : cx(cx), p(nullptr) {}
+    ~Chars() { js_free(p); }
+
+    bool allocate(size_t len) {
+        JS_ASSERT(!p);
+        // We're going to null-terminate!
+        p = cx->pod_malloc<jschar>(len + 1);
+        if (p) {
+            p[len] = jschar(0);
+            return true;
+        }
+        return false;
+    }
+    jschar *get() { return p; }
+    void forget() { p = nullptr; }
+};
+
+} /* anonymous namespace */
+
+JSString *
+JSStructuredCloneReader::readString(uint32_t nchars)
+{
+    if (nchars > JSString::MAX_LENGTH) {
+        JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
+                             JSMSG_SC_BAD_SERIALIZED_DATA, "string length");
+        return nullptr;
+    }
+    Chars chars(context());
+    if (!chars.allocate(nchars) || !in.readChars(chars.get(), nchars))
+        return nullptr;
+    JSString *str = js_NewString<CanGC>(context(), chars.get(), nchars);
+    if (str)
+        chars.forget();
+    return str;
+}
+
+static uint32_t
+TagToV1ArrayType(uint32_t tag)
+{
+    JS_ASSERT(tag >= SCTAG_TYPED_ARRAY_V1_MIN && tag <= SCTAG_TYPED_ARRAY_V1_MAX);
+    return tag - SCTAG_TYPED_ARRAY_V1_MIN;
+}
+
+bool
+JSStructuredCloneReader::readTypedArray(uint32_t arrayType, uint32_t nelems, Value *vp,
+                                        bool v1Read)
+{
+    if (arrayType > ScalarTypeDescr::TYPE_UINT8_CLAMPED) {
+        JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
+                             JSMSG_SC_BAD_SERIALIZED_DATA, "unhandled typed array element type");
+        return false;
+    }
+
+    // Push a placeholder onto the allObjs list to stand in for the typed array
+    uint32_t placeholderIndex = allObjs.length();
+    Value dummy = JSVAL_NULL;
+    if (!allObjs.append(dummy))
+        return false;
+
+    // Read the ArrayBuffer object and its contents (but no properties)
+    RootedValue v(context());
+    uint32_t byteOffset;
+    if (v1Read) {
+        if (!readV1ArrayBuffer(arrayType, nelems, v.address()))
+            return false;
+        byteOffset = 0;
+    } else {
+        if (!startRead(v.address()))
+            return false;
+        uint64_t n;
+        if (!in.read(&n))
+            return false;
+        byteOffset = n;
+    }
+    RootedObject buffer(context(), &v.toObject());
+    RootedObject obj(context(), nullptr);
+
+    switch (arrayType) {
+      case ScalarTypeDescr::TYPE_INT8:
+        obj = JS_NewInt8ArrayWithBuffer(context(), buffer, byteOffset, nelems);
+        break;
+      case ScalarTypeDescr::TYPE_UINT8:
+        obj = JS_NewUint8ArrayWithBuffer(context(), buffer, byteOffset, nelems);
+        break;
+      case ScalarTypeDescr::TYPE_INT16:
+        obj = JS_NewInt16ArrayWithBuffer(context(), buffer, byteOffset, nelems);
+        break;
+      case ScalarTypeDescr::TYPE_UINT16:
+        obj = JS_NewUint16ArrayWithBuffer(context(), buffer, byteOffset, nelems);
+        break;
+      case ScalarTypeDescr::TYPE_INT32:
+        obj = JS_NewInt32ArrayWithBuffer(context(), buffer, byteOffset, nelems);
+        break;
+      case ScalarTypeDescr::TYPE_UINT32:
+        obj = JS_NewUint32ArrayWithBuffer(context(), buffer, byteOffset, nelems);
+        break;
+      case ScalarTypeDescr::TYPE_FLOAT32:
+        obj = JS_NewFloat32ArrayWithBuffer(context(), buffer, byteOffset, nelems);
+        break;
+      case ScalarTypeDescr::TYPE_FLOAT64:
+        obj = JS_NewFloat64ArrayWithBuffer(context(), buffer, byteOffset, nelems);
+        break;
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
+        obj = JS_NewUint8ClampedArrayWithBuffer(context(), buffer, byteOffset, nelems);
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("unknown TypedArrayObject type");
+    }
+
+    if (!obj)
+        return false;
+    vp->setObject(*obj);
+
+    allObjs[placeholderIndex] = *vp;
+
+    return true;
+}
+
+bool
+JSStructuredCloneReader::readArrayBuffer(uint32_t nbytes, Value *vp)
+{
+    JSObject *obj = ArrayBufferObject::create(context(), nbytes);
+    if (!obj)
+        return false;
+    vp->setObject(*obj);
+    ArrayBufferObject &buffer = obj->as<ArrayBufferObject>();
+    JS_ASSERT(buffer.byteLength() == nbytes);
+    return in.readArray(buffer.dataPointer(), nbytes);
+}
+
+static size_t
+bytesPerTypedArrayElement(uint32_t arrayType)
+{
+    switch (arrayType) {
+      case ScalarTypeDescr::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
+        return sizeof(uint8_t);
+      case ScalarTypeDescr::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_UINT16:
+        return sizeof(uint16_t);
+      case ScalarTypeDescr::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
+        return sizeof(uint32_t);
+      case ScalarTypeDescr::TYPE_FLOAT64:
+        return sizeof(uint64_t);
+      default:
+        MOZ_ASSUME_UNREACHABLE("unknown TypedArrayObject type");
+    }
+}
+
+/*
+ * Read in the data for a structured clone version 1 ArrayBuffer, performing
+ * endianness-conversion while reading.
+ */
+bool
+JSStructuredCloneReader::readV1ArrayBuffer(uint32_t arrayType, uint32_t nelems, Value *vp)
+{
+    JS_ASSERT(arrayType <= ScalarTypeDescr::TYPE_UINT8_CLAMPED);
+
+    uint32_t nbytes = nelems * bytesPerTypedArrayElement(arrayType);
+    JSObject *obj = ArrayBufferObject::create(context(), nbytes);
+    if (!obj)
+        return false;
+    vp->setObject(*obj);
+    ArrayBufferObject &buffer = obj->as<ArrayBufferObject>();
+    JS_ASSERT(buffer.byteLength() == nbytes);
+
+    switch (arrayType) {
+      case ScalarTypeDescr::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
+        return in.readArray((uint8_t*) buffer.dataPointer(), nelems);
+      case ScalarTypeDescr::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_UINT16:
+        return in.readArray((uint16_t*) buffer.dataPointer(), nelems);
+      case ScalarTypeDescr::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
+        return in.readArray((uint32_t*) buffer.dataPointer(), nelems);
+      case ScalarTypeDescr::TYPE_FLOAT64:
+        return in.readArray((uint64_t*) buffer.dataPointer(), nelems);
+      default:
+        MOZ_ASSUME_UNREACHABLE("unknown TypedArrayObject type");
+    }
+}
+
+bool
+JSStructuredCloneReader::startRead(Value *vp)
+{
+    uint32_t tag, data;
+
+    if (!in.readPair(&tag, &data))
+        return false;
+    switch (tag) {
+      case SCTAG_NULL:
+        vp->setNull();
+        break;
+
+      case SCTAG_UNDEFINED:
+        vp->setUndefined();
+        break;
+
+      case SCTAG_BOOLEAN:
+      case SCTAG_BOOLEAN_OBJECT:
+        vp->setBoolean(!!data);
+        if (tag == SCTAG_BOOLEAN_OBJECT && !PrimitiveToObject(context(), vp))
+            return false;
+        break;
+
+      case SCTAG_STRING:
+      case SCTAG_STRING_OBJECT: {
+        JSString *str = readString(data);
+        if (!str)
+            return false;
+        vp->setString(str);
+        if (tag == SCTAG_STRING_OBJECT && !PrimitiveToObject(context(), vp))
+            return false;
+        break;
+      }
+
+      case SCTAG_NUMBER_OBJECT: {
+        double d;
+        if (!in.readDouble(&d) || !checkDouble(d))
+            return false;
+        vp->setDouble(d);
+        if (!PrimitiveToObject(context(), vp))
+            return false;
+        break;
+      }
+
+      case SCTAG_DATE_OBJECT: {
+        double d;
+        if (!in.readDouble(&d) || !checkDouble(d))
+            return false;
+        if (!IsNaN(d) && d != TimeClip(d)) {
+            JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
+                                 JSMSG_SC_BAD_SERIALIZED_DATA, "date");
+            return false;
+        }
+        JSObject *obj = js_NewDateObjectMsec(context(), d);
+        if (!obj)
+            return false;
+        vp->setObject(*obj);
+        break;
+      }
+
+      case SCTAG_REGEXP_OBJECT: {
+        RegExpFlag flags = RegExpFlag(data);
+        uint32_t tag2, nchars;
+        if (!in.readPair(&tag2, &nchars))
+            return false;
+        if (tag2 != SCTAG_STRING) {
+            JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
+                                 JSMSG_SC_BAD_SERIALIZED_DATA, "regexp");
+            return false;
+        }
+        JSString *str = readString(nchars);
+        if (!str)
+            return false;
+        JSFlatString *flat = str->ensureFlat(context());
+        if (!flat)
+            return false;
+
+        RegExpObject *reobj = RegExpObject::createNoStatics(context(), flat->chars(),
+                                                            flat->length(), flags, nullptr);
+        if (!reobj)
+            return false;
+        vp->setObject(*reobj);
+        break;
+      }
+
+      case SCTAG_ARRAY_OBJECT:
+      case SCTAG_OBJECT_OBJECT: {
+        JSObject *obj = (tag == SCTAG_ARRAY_OBJECT)
+                        ? NewDenseEmptyArray(context())
+                        : NewBuiltinClassInstance(context(), &JSObject::class_);
+        if (!obj || !objs.append(ObjectValue(*obj)))
+            return false;
+        vp->setObject(*obj);
+        break;
+      }
+
+      case SCTAG_BACK_REFERENCE_OBJECT: {
+        if (data >= allObjs.length()) {
+            JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
+                                 JSMSG_SC_BAD_SERIALIZED_DATA,
+                                 "invalid back reference in input");
+            return false;
+        }
+        *vp = allObjs[data];
+        return true;
+      }
+
+      case SCTAG_TRANSFER_MAP_HEADER:
+      case SCTAG_TRANSFER_MAP_PENDING_ENTRY:
+        // We should be past all the transfer map tags.
+        JS_ReportErrorNumber(context(), js_GetErrorMessage, NULL,
+                             JSMSG_SC_BAD_SERIALIZED_DATA,
+                             "invalid input");
+        return false;
+
+      case SCTAG_ARRAY_BUFFER_OBJECT:
+        if (!readArrayBuffer(data, vp))
+            return false;
+        break;
+
+      case SCTAG_TYPED_ARRAY_OBJECT:
+        // readTypedArray adds the array to allObjs
+        uint64_t arrayType;
+        if (!in.read(&arrayType))
+            return false;
+        return readTypedArray(arrayType, data, vp);
+        break;
+
+      default: {
+        if (tag <= SCTAG_FLOAT_MAX) {
+            double d = ReinterpretPairAsDouble(tag, data);
+            if (!checkDouble(d))
+                return false;
+            vp->setNumber(d);
+            break;
+        }
+
+        if (SCTAG_TYPED_ARRAY_V1_MIN <= tag && tag <= SCTAG_TYPED_ARRAY_V1_MAX) {
+            // A v1-format typed array
+            // readTypedArray adds the array to allObjs
+            return readTypedArray(TagToV1ArrayType(tag), data, vp, true);
+        }
+
+        if (!callbacks || !callbacks->read) {
+            JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
+                                 JSMSG_SC_BAD_SERIALIZED_DATA, "unsupported type");
+            return false;
+        }
+        JSObject *obj = callbacks->read(context(), this, tag, data, closure);
+        if (!obj)
+            return false;
+        vp->setObject(*obj);
+      }
+    }
+
+    if (vp->isObject() && !allObjs.append(*vp))
+        return false;
+
+    return true;
+}
+
+bool
+JSStructuredCloneReader::readId(jsid *idp)
+{
+    uint32_t tag, data;
+    if (!in.readPair(&tag, &data))
+        return false;
+
+    if (tag == SCTAG_INDEX) {
+        *idp = INT_TO_JSID(int32_t(data));
+        return true;
+    }
+    if (tag == SCTAG_STRING) {
+        JSString *str = readString(data);
+        if (!str)
+            return false;
+        JSAtom *atom = AtomizeString(context(), str);
+        if (!atom)
+            return false;
+        *idp = NON_INTEGER_ATOM_TO_JSID(atom);
+        return true;
+    }
+    if (tag == SCTAG_NULL) {
+        *idp = JSID_VOID;
+        return true;
+    }
+    JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
+                         JSMSG_SC_BAD_SERIALIZED_DATA, "id");
+    return false;
+}
+
+bool
+JSStructuredCloneReader::readTransferMap()
+{
+    JSContext *cx = context();
+    uint64_t *headerPos = in.tell();
+
+    uint32_t tag, data;
+    if (!in.getPair(&tag, &data))
+        return in.reportTruncated();
+
+    if (tag != SCTAG_TRANSFER_MAP_HEADER || TransferableMapHeader(data) == SCTAG_TM_TRANSFERRED)
+        return true;
+
+    uint64_t numTransferables;
+    MOZ_ALWAYS_TRUE(in.readPair(&tag, &data));
+    if (!in.read(&numTransferables))
+        return false;
+
+    for (uint64_t i = 0; i < numTransferables; i++) {
+        uint64_t *pos = in.tell();
+
+        if (!in.readPair(&tag, &data))
+            return false;
+
+        JS_ASSERT(tag != SCTAG_TRANSFER_MAP_PENDING_ENTRY);
+        RootedObject obj(cx);
+
+        void *content;
+        if (!in.readPtr(&content))
+            return false;
+
+        uint64_t extraData;
+        if (!in.read(&extraData))
+            return false;
+
+        if (tag == SCTAG_TRANSFER_MAP_ARRAY_BUFFER) {
+            size_t nbytes = extraData;
+            JS_ASSERT(data == JS::SCTAG_TMO_ALLOC_DATA ||
+                      data == JS::SCTAG_TMO_MAPPED_DATA);
+            if (data == JS::SCTAG_TMO_ALLOC_DATA)
+                obj = JS_NewArrayBufferWithContents(cx, nbytes, content);
+            else if (data == JS::SCTAG_TMO_MAPPED_DATA)
+                obj = JS_NewMappedArrayBufferWithContents(cx, nbytes, content);
+        } else if (tag == SCTAG_TRANSFER_MAP_SHARED_BUFFER) {
+            JS_ASSERT(data == JS::SCTAG_TMO_SHARED_BUFFER);
+            obj = SharedArrayBufferObject::New(context(), (SharedArrayRawBuffer *)content);
+        } else {
+            if (!callbacks || !callbacks->readTransfer) {
+                ReportErrorTransferable(cx, callbacks);
+                return false;
+            }
+            if (!callbacks->readTransfer(cx, this, tag, content, extraData, closure, &obj))
+                return false;
+            MOZ_ASSERT(obj);
+            MOZ_ASSERT(!cx->isExceptionPending());
+        }
+        
+        // On failure, the buffer will still own the data (since its ownership will not get set to SCTAG_TMO_UNOWNED),
+        // so the data will be freed by ClearStructuredClone
+        if (!obj)
+            return false;
+
+        // Mark the SCTAG_TRANSFER_MAP_* entry as no longer owned by the input
+        // buffer.
+        *pos = PairToUInt64(tag, JS::SCTAG_TMO_UNOWNED);
+        MOZ_ASSERT(headerPos < pos && pos < in.end());
+
+        if (!allObjs.append(ObjectValue(*obj)))
+            return false;
+    }
+
+    // Mark the whole transfer map as consumed.
+    MOZ_ASSERT(headerPos <= in.tell());
+#ifdef DEBUG
+    SCInput::getPair(headerPos, &tag, &data);
+    MOZ_ASSERT(tag == SCTAG_TRANSFER_MAP_HEADER);
+    MOZ_ASSERT(TransferableMapHeader(data) != SCTAG_TM_TRANSFERRED);
+#endif
+    *headerPos = PairToUInt64(SCTAG_TRANSFER_MAP_HEADER, SCTAG_TM_TRANSFERRED);
+
+    return true;
+}
+
+bool
+JSStructuredCloneReader::read(Value *vp)
+{
+    if (!readTransferMap())
+        return false;
+
+    if (!startRead(vp))
+        return false;
+
+    while (objs.length() != 0) {
+        RootedObject obj(context(), &objs.back().toObject());
+
+        RootedId id(context());
+        if (!readId(id.address()))
+            return false;
+
+        if (JSID_IS_VOID(id)) {
+            objs.popBack();
+        } else {
+            RootedValue v(context());
+            if (!startRead(v.address()) || !JSObject::defineGeneric(context(), obj, id, v))
+                return false;
+        }
+    }
+
+    allObjs.clear();
+
+    return true;
+}
+
+using namespace js;
+
+JS_PUBLIC_API(bool)
+JS_ReadStructuredClone(JSContext *cx, uint64_t *buf, size_t nbytes,
+                       uint32_t version, MutableHandleValue vp,
+                       const JSStructuredCloneCallbacks *optionalCallbacks,
+                       void *closure)
+{
+    AssertHeapIsIdle(cx);
+    CHECK_REQUEST(cx);
+
+    if (version > JS_STRUCTURED_CLONE_VERSION) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_CLONE_VERSION);
+        return false;
+    }
+    const JSStructuredCloneCallbacks *callbacks =
+        optionalCallbacks ?
+        optionalCallbacks :
+        cx->runtime()->structuredCloneCallbacks;
+    return ReadStructuredClone(cx, buf, nbytes, vp, callbacks, closure);
+}
+
+JS_PUBLIC_API(bool)
+JS_WriteStructuredClone(JSContext *cx, HandleValue value, uint64_t **bufp, size_t *nbytesp,
+                        const JSStructuredCloneCallbacks *optionalCallbacks,
+                        void *closure, HandleValue transferable)
+{
+    AssertHeapIsIdle(cx);
+    CHECK_REQUEST(cx);
+    assertSameCompartment(cx, value);
+
+    const JSStructuredCloneCallbacks *callbacks =
+        optionalCallbacks ?
+        optionalCallbacks :
+        cx->runtime()->structuredCloneCallbacks;
+    return WriteStructuredClone(cx, value, bufp, nbytesp, callbacks, closure, transferable);
+}
+
+JS_PUBLIC_API(bool)
+JS_ClearStructuredClone(uint64_t *data, size_t nbytes,
+                        const JSStructuredCloneCallbacks *optionalCallbacks,
+                        void *closure)
+{
+    ClearStructuredClone(data, nbytes, optionalCallbacks, closure);
+    return true;
+}
+
+JS_PUBLIC_API(bool)
+JS_StructuredCloneHasTransferables(const uint64_t *data, size_t nbytes,
+                                   bool *hasTransferable)
+{
+    bool transferable;
+    if (!StructuredCloneHasTransferObjects(data, nbytes, &transferable))
+        return false;
+
+    *hasTransferable = transferable;
+    return true;
+}
+
+JS_PUBLIC_API(bool)
+JS_StructuredClone(JSContext *cx, HandleValue value, MutableHandleValue vp,
+                   const JSStructuredCloneCallbacks *optionalCallbacks,
+                   void *closure)
+{
+    AssertHeapIsIdle(cx);
+    CHECK_REQUEST(cx);
+
+    // Strings are associated with zones, not compartments,
+    // so we copy the string by wrapping it.
+    if (value.isString()) {
+      RootedString strValue(cx, value.toString());
+      if (!cx->compartment()->wrap(cx, strValue.address())) {
+        return false;
+      }
+      vp.setString(strValue);
+      return true;
+    }
+
+    const JSStructuredCloneCallbacks *callbacks =
+        optionalCallbacks ?
+        optionalCallbacks :
+        cx->runtime()->structuredCloneCallbacks;
+
+    JSAutoStructuredCloneBuffer buf;
+    {
+        // If we use Maybe<AutoCompartment> here, G++ can't tell that the
+        // destructor is only called when Maybe::construct was called, and
+        // we get warnings about using uninitialized variables.
+        if (value.isObject()) {
+            AutoCompartment ac(cx, &value.toObject());
+            if (!buf.write(cx, value, callbacks, closure))
+                return false;
+        } else {
+            if (!buf.write(cx, value, callbacks, closure))
+                return false;
+        }
+    }
+
+    return buf.read(cx, vp, callbacks, closure);
+}
+
+JSAutoStructuredCloneBuffer::JSAutoStructuredCloneBuffer(JSAutoStructuredCloneBuffer &&other)
+{
+    other.steal(&data_, &nbytes_, &version_);
+}
+
+JSAutoStructuredCloneBuffer&
+JSAutoStructuredCloneBuffer::operator=(JSAutoStructuredCloneBuffer &&other)
+{
+    JS_ASSERT(&other != this);
+    clear();
+    other.steal(&data_, &nbytes_, &version_);
+    return *this;
+}
+
+void
+JSAutoStructuredCloneBuffer::clear()
+{
+    if (data_) {
+        ClearStructuredClone(data_, nbytes_, callbacks_, closure_);
+        data_ = nullptr;
+        nbytes_ = 0;
+        version_ = 0;
+    }
+}
+
+bool
+JSAutoStructuredCloneBuffer::copy(const uint64_t *srcData, size_t nbytes, uint32_t version)
+{
+    // transferable objects cannot be copied
+    bool hasTransferable;
+    if (!StructuredCloneHasTransferObjects(data_, nbytes_, &hasTransferable) ||
+        hasTransferable)
+        return false;
+
+    uint64_t *newData = static_cast<uint64_t *>(js_malloc(nbytes));
+    if (!newData)
+        return false;
+
+    js_memcpy(newData, srcData, nbytes);
+
+    clear();
+    data_ = newData;
+    nbytes_ = nbytes;
+    version_ = version;
+    return true;
+}
+
+void
+JSAutoStructuredCloneBuffer::adopt(uint64_t *data, size_t nbytes, uint32_t version)
+{
+    clear();
+    data_ = data;
+    nbytes_ = nbytes;
+    version_ = version;
+}
+
+void
+JSAutoStructuredCloneBuffer::steal(uint64_t **datap, size_t *nbytesp, uint32_t *versionp)
+{
+    *datap = data_;
+    *nbytesp = nbytes_;
+    if (versionp)
+        *versionp = version_;
+
+    data_ = nullptr;
+    nbytes_ = 0;
+    version_ = 0;
+}
+
+bool
+JSAutoStructuredCloneBuffer::read(JSContext *cx, MutableHandleValue vp,
+                                  const JSStructuredCloneCallbacks *optionalCallbacks,
+                                  void *closure)
+{
+    JS_ASSERT(cx);
+    JS_ASSERT(data_);
+    return !!JS_ReadStructuredClone(cx, data_, nbytes_, version_, vp,
+                                    optionalCallbacks, closure);
+}
+
+bool
+JSAutoStructuredCloneBuffer::write(JSContext *cx, HandleValue value,
+                                   const JSStructuredCloneCallbacks *optionalCallbacks,
+                                   void *closure)
+{
+    HandleValue transferable = UndefinedHandleValue;
+    return write(cx, value, transferable, optionalCallbacks, closure);
+}
+
+bool
+JSAutoStructuredCloneBuffer::write(JSContext *cx, HandleValue value,
+                                   HandleValue transferable,
+                                   const JSStructuredCloneCallbacks *optionalCallbacks,
+                                   void *closure)
+{
+    clear();
+    bool ok = !!JS_WriteStructuredClone(cx, value, &data_, &nbytes_,
+                                        optionalCallbacks, closure,
+                                        transferable);
+    if (!ok) {
+        data_ = nullptr;
+        nbytes_ = 0;
+        version_ = JS_STRUCTURED_CLONE_VERSION;
+    }
+    return ok;
+}
+
+JS_PUBLIC_API(void)
+JS_SetStructuredCloneCallbacks(JSRuntime *rt, const JSStructuredCloneCallbacks *callbacks)
+{
+    rt->structuredCloneCallbacks = callbacks;
+}
+
+JS_PUBLIC_API(bool)
+JS_ReadUint32Pair(JSStructuredCloneReader *r, uint32_t *p1, uint32_t *p2)
+{
+    return r->input().readPair((uint32_t *) p1, (uint32_t *) p2);
+}
+
+JS_PUBLIC_API(bool)
+JS_ReadBytes(JSStructuredCloneReader *r, void *p, size_t len)
+{
+    return r->input().readBytes(p, len);
+}
+
+JS_PUBLIC_API(bool)
+JS_ReadTypedArray(JSStructuredCloneReader *r, MutableHandleValue vp)
+{
+    uint32_t tag, nelems;
+    if (!r->input().readPair(&tag, &nelems))
+        return false;
+    if (tag >= SCTAG_TYPED_ARRAY_V1_MIN && tag <= SCTAG_TYPED_ARRAY_V1_MAX) {
+        return r->readTypedArray(TagToV1ArrayType(tag), nelems, vp.address(), true);
+    } else if (tag == SCTAG_TYPED_ARRAY_OBJECT) {
+        uint64_t arrayType;
+        if (!r->input().read(&arrayType))
+            return false;
+        return r->readTypedArray(arrayType, nelems, vp.address());
+    } else {
+        JS_ReportErrorNumber(r->context(), js_GetErrorMessage, nullptr,
+                             JSMSG_SC_BAD_SERIALIZED_DATA, "expected type array");
+        return false;
+    }
+}
+
+JS_PUBLIC_API(bool)
+JS_WriteUint32Pair(JSStructuredCloneWriter *w, uint32_t tag, uint32_t data)
+{
+    return w->output().writePair(tag, data);
+}
+
+JS_PUBLIC_API(bool)
+JS_WriteBytes(JSStructuredCloneWriter *w, const void *p, size_t len)
+{
+    return w->output().writeBytes(p, len);
+}
+
+JS_PUBLIC_API(bool)
+JS_WriteTypedArray(JSStructuredCloneWriter *w, HandleValue v)
+{
+    JS_ASSERT(v.isObject());
+    assertSameCompartment(w->context(), v);
+    RootedObject obj(w->context(), &v.toObject());
+
+    // If the object is a security wrapper, see if we're allowed to unwrap it.
+    // If we aren't, throw.
+    if (obj->is<WrapperObject>())
+        obj = CheckedUnwrap(obj);
+    if (!obj) {
+        JS_ReportErrorNumber(w->context(), js_GetErrorMessage, nullptr, JSMSG_UNWRAP_DENIED);
+        return false;
+    }
+    return w->writeTypedArray(obj);
+}