SERVER-21506 Upgrade to mozjs-38.4.0-esr

40 files changed, 243 insertions, 122 deletions

diff --git a/src/third_party/mozjs-38/extract/js/public/Utility.h b/src/third_party/mozjs-38/extract/js/public/Utility.h
index 40b5d90ba6d..6b750c3fedf 100644
--- a/src/third_party/mozjs-38/extract/js/public/Utility.h
+++ b/src/third_party/mozjs-38/extract/js/public/Utility.h
@@ -217,6 +217,36 @@ static inline char* js_strdup(const char* s)
 
 JS_DECLARE_NEW_METHODS(js_new, js_malloc, static MOZ_ALWAYS_INLINE)
 
+namespace js {
+
+/*
+ * Calculate the number of bytes needed to allocate |numElems| contiguous
+ * instances of type |T|.  Return false if the calculation overflowed.
+ */
+template <typename T>
+MOZ_WARN_UNUSED_RESULT inline bool
+CalculateAllocSize(size_t numElems, size_t* bytesOut)
+{
+    *bytesOut = numElems * sizeof(T);
+    return (numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value) == 0;
+}
+
+/*
+ * Calculate the number of bytes needed to allocate a single instance of type
+ * |T| followed by |numExtra| contiguous instances of type |Extra|.  Return
+ * false if the calculation overflowed.
+ */
+template <typename T, typename Extra>
+MOZ_WARN_UNUSED_RESULT inline bool
+CalculateAllocSizeWithExtra(size_t numExtra, size_t* bytesOut)
+{
+    *bytesOut = sizeof(T) + numExtra * sizeof(Extra);
+    return (numExtra & mozilla::tl::MulOverflowMask<sizeof(Extra)>::value) == 0 &&
+           *bytesOut >= sizeof(T);
+}
+
+} /* namespace js */
+
 template <class T>
 static MOZ_ALWAYS_INLINE void
 js_delete(T* p)
@@ -242,32 +272,34 @@ template <class T>
 static MOZ_ALWAYS_INLINE T*
 js_pod_malloc()
 {
-    return (T*)js_malloc(sizeof(T));
+    return static_cast<T*>(js_malloc(sizeof(T)));
 }
 
 template <class T>
 static MOZ_ALWAYS_INLINE T*
 js_pod_calloc()
 {
-    return (T*)js_calloc(sizeof(T));
+    return static_cast<T*>(js_calloc(sizeof(T)));
 }
 
 template <class T>
 static MOZ_ALWAYS_INLINE T*
 js_pod_malloc(size_t numElems)
 {
-    if (MOZ_UNLIKELY(numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+    size_t bytes;
+    if (MOZ_UNLIKELY(!js::CalculateAllocSize<T>(numElems, &bytes)))
         return nullptr;
-    return (T*)js_malloc(numElems * sizeof(T));
+    return static_cast<T*>(js_malloc(bytes));
 }
 
 template <class T>
 static MOZ_ALWAYS_INLINE T*
 js_pod_calloc(size_t numElems)
 {
-    if (MOZ_UNLIKELY(numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+    size_t bytes;
+    if (MOZ_UNLIKELY(!js::CalculateAllocSize<T>(numElems, &bytes)))
         return nullptr;
-    return (T*)js_calloc(numElems * sizeof(T));
+    return static_cast<T*>(js_calloc(bytes));
 }
 
 template <class T>
@@ -275,9 +307,10 @@ static MOZ_ALWAYS_INLINE T*
 js_pod_realloc(T* prior, size_t oldSize, size_t newSize)
 {
     MOZ_ASSERT(!(oldSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value));
-    if (MOZ_UNLIKELY(newSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+    size_t bytes;
+    if (MOZ_UNLIKELY(!js::CalculateAllocSize<T>(newSize, &bytes)))
         return nullptr;
-    return (T*)js_realloc(prior, newSize * sizeof(T));
+    return static_cast<T*>(js_realloc(prior, bytes));
 }
 
 namespace js {
diff --git a/src/third_party/mozjs-38/extract/js/src/ds/LifoAlloc.h b/src/third_party/mozjs-38/extract/js/src/ds/LifoAlloc.h
index 9dc68c1d37a..35cdc72b4af 100644
--- a/src/third_party/mozjs-38/extract/js/src/ds/LifoAlloc.h
+++ b/src/third_party/mozjs-38/extract/js/src/ds/LifoAlloc.h
@@ -310,9 +310,10 @@ class LifoAlloc
     // The caller is responsible for initialization.
     template <typename T>
     T* newArrayUninitialized(size_t count) {
-        if (MOZ_UNLIKELY(count & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(count, &bytes)))
             return nullptr;
-        return static_cast<T*>(alloc(sizeof(T) * count));
+        return static_cast<T*>(alloc(bytes));
     }
 
     class Mark {
@@ -527,16 +528,16 @@ class LifoAllocPolicy
     {}
     template <typename T>
     T* pod_malloc(size_t numElems) {
-        if (MOZ_UNLIKELY(numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(numElems, &bytes)))
             return nullptr;
-        size_t bytes = numElems * sizeof(T);
         void* p = fb == Fallible ? alloc_.alloc(bytes) : alloc_.allocInfallible(bytes);
         return static_cast<T*>(p);
     }
     template <typename T>
     T* pod_calloc(size_t numElems) {
         T* p = pod_malloc<T>(numElems);
-        if (fb == Fallible && !p)
+        if (MOZ_UNLIKELY(!p))
             return nullptr;
         memset(p, 0, numElems * sizeof(T));
         return p;
@@ -544,7 +545,7 @@ class LifoAllocPolicy
     template <typename T>
     T* pod_realloc(T* p, size_t oldSize, size_t newSize) {
         T* n = pod_malloc<T>(newSize);
-        if (fb == Fallible && !n)
+        if (MOZ_UNLIKELY(!n))
             return nullptr;
         MOZ_ASSERT(!(oldSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value));
         memcpy(n, p, Min(oldSize * sizeof(T), newSize * sizeof(T)));
diff --git a/src/third_party/mozjs-38/extract/js/src/jit/FixedList.h b/src/third_party/mozjs-38/extract/js/src/jit/FixedList.h
index 9cea3a80755..b6b37bbebe6 100644
--- a/src/third_party/mozjs-38/extract/js/src/jit/FixedList.h
+++ b/src/third_party/mozjs-38/extract/js/src/jit/FixedList.h
@@ -37,9 +37,10 @@ class FixedList
         if (length == 0)
             return true;
 
-        if (MOZ_UNLIKELY(length & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(length, &bytes)))
             return false;
-        list_ = (T*)alloc.allocate(length * sizeof(T));
+        list_ = (T*)alloc.allocate(bytes);
         return list_ != nullptr;
     }
 
@@ -60,9 +61,10 @@ class FixedList
         size_t newlength = length_ + num;
         if (newlength < length_)
             return false;
-        if (MOZ_UNLIKELY(newlength & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(newlength, &bytes)))
             return false;
-        T* list = (T*)alloc.allocate((length_ + num) * sizeof(T));
+        T* list = (T*)alloc.allocate(bytes);
         if (MOZ_UNLIKELY(!list))
             return false;
 
diff --git a/src/third_party/mozjs-38/extract/js/src/jit/JitAllocPolicy.h b/src/third_party/mozjs-38/extract/js/src/jit/JitAllocPolicy.h
index 4bbd1a35361..fca4b3f4120 100644
--- a/src/third_party/mozjs-38/extract/js/src/jit/JitAllocPolicy.h
+++ b/src/third_party/mozjs-38/extract/js/src/jit/JitAllocPolicy.h
@@ -48,12 +48,13 @@ class TempAllocator
         return p;
     }
 
-    template <size_t ElemSize>
-    void* allocateArray(size_t n)
+    template <typename T>
+    T* allocateArray(size_t n)
     {
-        if (MOZ_UNLIKELY(n & mozilla::tl::MulOverflowMask<ElemSize>::value))
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(n, &bytes)))
             return nullptr;
-        void* p = lifoScope_.alloc().alloc(n * ElemSize);
+        T* p = static_cast<T*>(lifoScope_.alloc().alloc(bytes));
         if (MOZ_UNLIKELY(!ensureBallast()))
             return nullptr;
         return p;
@@ -79,9 +80,10 @@ class JitAllocPolicy
     {}
     template <typename T>
     T* pod_malloc(size_t numElems) {
-        if (MOZ_UNLIKELY(numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(numElems, &bytes)))
             return nullptr;
-        return static_cast<T*>(alloc_.allocate(numElems * sizeof(T)));
+        return static_cast<T*>(alloc_.allocate(bytes));
     }
     template <typename T>
     T* pod_calloc(size_t numElems) {
@@ -112,9 +114,10 @@ class OldJitAllocPolicy
     {}
     template <typename T>
     T* pod_malloc(size_t numElems) {
-        if (MOZ_UNLIKELY(numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(numElems, &bytes)))
             return nullptr;
-        return static_cast<T*>(GetJitContext()->temp->allocate(numElems * sizeof(T)));
+        return static_cast<T*>(GetJitContext()->temp->allocate(bytes));
     }
     void free_(void* p) {
     }
diff --git a/src/third_party/mozjs-38/extract/js/src/jit/LIR.cpp b/src/third_party/mozjs-38/extract/js/src/jit/LIR.cpp
index 70a3fc05430..a76e7422332 100644
--- a/src/third_party/mozjs-38/extract/js/src/jit/LIR.cpp
+++ b/src/third_party/mozjs-38/extract/js/src/jit/LIR.cpp
@@ -105,8 +105,7 @@ LBlock::init(TempAllocator& alloc)
 
         int numPhis = (phi->type() == MIRType_Value) ? BOX_PIECES : 1;
         for (int i = 0; i < numPhis; i++) {
-            void* array = alloc.allocateArray<sizeof(LAllocation)>(numPreds);
-            LAllocation* inputs = static_cast<LAllocation*>(array);
+            LAllocation* inputs = alloc.allocateArray<LAllocation>(numPreds);
             if (!inputs)
                 return false;
 
diff --git a/src/third_party/mozjs-38/extract/js/src/jit/MCallOptimize.cpp b/src/third_party/mozjs-38/extract/js/src/jit/MCallOptimize.cpp
index 7fdede8167d..2c6a533c86d 100644
--- a/src/third_party/mozjs-38/extract/js/src/jit/MCallOptimize.cpp
+++ b/src/third_party/mozjs-38/extract/js/src/jit/MCallOptimize.cpp
@@ -2122,6 +2122,19 @@ IonBuilder::inlineIsTypedArray(CallInfo& callInfo)
     return InliningStatus_Inlined;
 }
 
+static bool
+IsTypedArrayObject(CompilerConstraintList* constraints, MDefinition* def)
+{
+    MOZ_ASSERT(def->type() == MIRType_Object);
+
+    TemporaryTypeSet* types = def->resultTypeSet();
+    if (!types)
+        return false;
+
+    return types->forAllClasses(constraints, IsTypedArrayClass) ==
+           TemporaryTypeSet::ForAllResult::ALL_TRUE;
+}
+
 IonBuilder::InliningStatus
 IonBuilder::inlineTypedArrayLength(CallInfo& callInfo)
 {
@@ -2132,8 +2145,10 @@ IonBuilder::inlineTypedArrayLength(CallInfo& callInfo)
     if (getInlineReturnType() != MIRType_Int32)
         return InliningStatus_NotInlined;
 
-    // We assume that when calling this function we always
-    // have a TypedArray. The native asserts that as well.
+    // Note that the argument we see here is not necessarily a typed array.
+    // If it's not, this call should be unreachable though.
+    if (!IsTypedArrayObject(constraints(), callInfo.getArg(0)))
+        return InliningStatus_NotInlined;
 
     MInstruction* length = addTypedArrayLength(callInfo.getArg(0));
     current->push(length);
diff --git a/src/third_party/mozjs-38/extract/js/src/jit/MIRGenerator.h b/src/third_party/mozjs-38/extract/js/src/jit/MIRGenerator.h
index 01de27d32af..5e6b9efb78f 100644
--- a/src/third_party/mozjs-38/extract/js/src/jit/MIRGenerator.h
+++ b/src/third_party/mozjs-38/extract/js/src/jit/MIRGenerator.h
@@ -60,10 +60,11 @@ class MIRGenerator
     }
 
     template <typename T>
-    T * allocate(size_t count = 1) {
-        if (count & mozilla::tl::MulOverflowMask<sizeof(T)>::value)
+    T* allocate(size_t count = 1) {
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(count, &bytes)))
             return nullptr;
-        return reinterpret_cast<T*>(alloc().allocate(sizeof(T) * count));
+        return static_cast<T*>(alloc().allocate(bytes));
     }
 
     // Set an error state and prints a message. Returns false so errors can be
diff --git a/src/third_party/mozjs-38/extract/js/src/jit/MIRGraph.cpp b/src/third_party/mozjs-38/extract/js/src/jit/MIRGraph.cpp
index 5d000dca52a..4c5cf8e372f 100644
--- a/src/third_party/mozjs-38/extract/js/src/jit/MIRGraph.cpp
+++ b/src/third_party/mozjs-38/extract/js/src/jit/MIRGraph.cpp
@@ -297,7 +297,7 @@ MBasicBlock::NewAsmJS(MIRGraph& graph, CompileInfo& info, MBasicBlock* pred, Kin
             size_t nphis = block->stackPosition_;
 
             TempAllocator& alloc = graph.alloc();
-            MPhi* phis = (MPhi*)alloc.allocateArray<sizeof(MPhi)>(nphis);
+            MPhi* phis = alloc.allocateArray<MPhi>(nphis);
             if (!phis)
                 return nullptr;
 
diff --git a/src/third_party/mozjs-38/extract/js/src/jit/TypePolicy.cpp b/src/third_party/mozjs-38/extract/js/src/jit/TypePolicy.cpp
index 4cea6386bc1..2510d507e62 100644
--- a/src/third_party/mozjs-38/extract/js/src/jit/TypePolicy.cpp
+++ b/src/third_party/mozjs-38/extract/js/src/jit/TypePolicy.cpp
@@ -22,6 +22,8 @@ EnsureOperandNotFloat32(TempAllocator& alloc, MInstruction* def, unsigned op)
     if (in->type() == MIRType_Float32) {
         MToDouble* replace = MToDouble::New(alloc, in);
         def->block()->insertBefore(def, replace);
+        if (def->isRecoveredOnBailout())
+            replace->setRecoveredOnBailout();
         def->replaceOperand(op, replace);
     }
 }
diff --git a/src/third_party/mozjs-38/extract/js/src/jit/ValueNumbering.cpp b/src/third_party/mozjs-38/extract/js/src/jit/ValueNumbering.cpp
index da3e692c7a3..eb367e132ef 100644
--- a/src/third_party/mozjs-38/extract/js/src/jit/ValueNumbering.cpp
+++ b/src/third_party/mozjs-38/extract/js/src/jit/ValueNumbering.cpp
@@ -726,6 +726,12 @@ ValueNumberer::visitDefinition(MDefinition* def)
         return true;
     }
 
+    // Skip optimizations on instructions which are recovered on bailout, to
+    // avoid mixing instructions which are recovered on bailouts with
+    // instructions which are not.
+    if (def->isRecoveredOnBailout())
+        return true;
+
     // If this instruction has a dependency() into an unreachable block, we'll
     // need to update AliasAnalysis.
     MInstruction* dep = def->dependency();
diff --git a/src/third_party/mozjs-38/extract/js/src/jit/arm/MacroAssembler-arm.cpp b/src/third_party/mozjs-38/extract/js/src/jit/arm/MacroAssembler-arm.cpp
index 7b8c06eddce..c8030bb654e 100644
--- a/src/third_party/mozjs-38/extract/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/src/third_party/mozjs-38/extract/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -2487,8 +2487,8 @@ MacroAssemblerARMCompat::store32(Imm32 src, const Address& address)
 void
 MacroAssemblerARMCompat::store32(Imm32 imm, const BaseIndex& dest)
 {
-    ma_mov(imm, secondScratchReg_);
-    store32(secondScratchReg_, dest);
+    ma_mov(imm, ScratchRegister);
+    store32(ScratchRegister, dest);
 }
 
 void
@@ -2498,8 +2498,8 @@ MacroAssemblerARMCompat::store32(Register src, const BaseIndex& dest)
     uint32_t scale = Imm32::ShiftOf(dest.scale).value;
 
     if (dest.offset != 0) {
-        ma_add(base, Imm32(dest.offset), ScratchRegister);
-        base = ScratchRegister;
+        ma_add(base, Imm32(dest.offset), secondScratchReg_);
+        base = secondScratchReg_;
     }
     ma_str(src, DTRAddr(base, DtrRegImmShift(dest.index, LSL, scale)));
 }
diff --git a/src/third_party/mozjs-38/extract/js/src/jsalloc.h b/src/third_party/mozjs-38/extract/js/src/jsalloc.h
index ce11ade9085..e20fa5f269f 100644
--- a/src/third_party/mozjs-38/extract/js/src/jsalloc.h
+++ b/src/third_party/mozjs-38/extract/js/src/jsalloc.h
@@ -53,6 +53,14 @@ class TempAllocPolicy
      */
     JS_FRIEND_API(void*) onOutOfMemory(void* p, size_t nbytes);
 
+    template <typename T>
+    T* onOutOfMemoryTyped(void* p, size_t numElems) {
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(numElems, &bytes)))
+            return nullptr;
+        return static_cast<T*>(onOutOfMemory(p, bytes));
+    }
+
   public:
     MOZ_IMPLICIT TempAllocPolicy(JSContext* cx) : cx_((ContextFriendFields*) cx) {} // :(
     MOZ_IMPLICIT TempAllocPolicy(ContextFriendFields* cx) : cx_(cx) {}
@@ -61,7 +69,7 @@ class TempAllocPolicy
     T* pod_malloc(size_t numElems) {
         T* p = js_pod_malloc<T>(numElems);
         if (MOZ_UNLIKELY(!p))
-            p = static_cast<T*>(onOutOfMemory(nullptr, numElems * sizeof(T)));
+            p = onOutOfMemoryTyped<T>(nullptr, numElems);
         return p;
     }
 
@@ -69,7 +77,7 @@ class TempAllocPolicy
     T* pod_calloc(size_t numElems) {
         T* p = js_pod_calloc<T>(numElems);
         if (MOZ_UNLIKELY(!p))
-            p = static_cast<T*>(onOutOfMemory(reinterpret_cast<void*>(1), numElems * sizeof(T)));
+            p = onOutOfMemoryTyped<T>(reinterpret_cast<void*>(1), numElems);
         return p;
     }
 
@@ -77,7 +85,7 @@ class TempAllocPolicy
     T* pod_realloc(T* prior, size_t oldSize, size_t newSize) {
         T* p2 = js_pod_realloc<T>(prior, oldSize, newSize);
         if (MOZ_UNLIKELY(!p2))
-            p2 = static_cast<T*>(onOutOfMemory(p2, newSize * sizeof(T)));
+            p2 = onOutOfMemoryTyped<T>(p2, newSize);
         return p2;
     }
 
diff --git a/src/third_party/mozjs-38/extract/js/src/jsarray.cpp b/src/third_party/mozjs-38/extract/js/src/jsarray.cpp
index 3d574d5d00c..b4ff057b933 100644
--- a/src/third_party/mozjs-38/extract/js/src/jsarray.cpp
+++ b/src/third_party/mozjs-38/extract/js/src/jsarray.cpp
@@ -2661,6 +2661,7 @@ js::array_concat(JSContext* cx, unsigned argc, Value* vp)
         narr = NewDenseEmptyArray(cx);
         if (!narr)
             return false;
+        TryReuseArrayGroup(aobj, narr);
         args.rval().setObject(*narr);
         length = 0;
     }
diff --git a/src/third_party/mozjs-38/extract/js/src/vm/MallocProvider.h b/src/third_party/mozjs-38/extract/js/src/vm/MallocProvider.h
index 1ea4ce2f37b..f334eb13f72 100644
--- a/src/third_party/mozjs-38/extract/js/src/vm/MallocProvider.h
+++ b/src/third_party/mozjs-38/extract/js/src/vm/MallocProvider.h
@@ -64,30 +64,27 @@ struct MallocProvider
             client()->updateMallocCounter(numElems * sizeof(T));
             return p;
         }
-        if (numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value) {
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(numElems, &bytes))) {
             client()->reportAllocationOverflow();
             return nullptr;
         }
-        return (T*)client()->onOutOfMemory(nullptr, numElems * sizeof(T));
+        return static_cast<T*>(client()->onOutOfMemory(nullptr, bytes));
     }
 
     template <class T, class U>
     T* pod_malloc_with_extra(size_t numExtra) {
-        if (MOZ_UNLIKELY(numExtra & mozilla::tl::MulOverflowMask<sizeof(U)>::value)) {
+        size_t bytes;
+        if (MOZ_UNLIKELY((!CalculateAllocSizeWithExtra<T, U>(numExtra, &bytes)))) {
             client()->reportAllocationOverflow();
             return nullptr;
         }
-        size_t bytes = sizeof(T) + numExtra * sizeof(U);
-        if (MOZ_UNLIKELY(bytes < sizeof(T))) {
-            client()->reportAllocationOverflow();
-            return nullptr;
-        }
-        T* p = reinterpret_cast<T*>(js_pod_malloc<uint8_t>(bytes));
+        T* p = static_cast<T*>(js_malloc(bytes));
         if (MOZ_LIKELY(p)) {
             client()->updateMallocCounter(bytes);
             return p;
         }
-        return (T*)client()->onOutOfMemory(nullptr, bytes);
+        return static_cast<T*>(client()->onOutOfMemory(nullptr, bytes));
     }
 
     template <class T>
@@ -108,30 +105,27 @@ struct MallocProvider
             client()->updateMallocCounter(numElems * sizeof(T));
             return p;
         }
-        if (numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value) {
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(numElems, &bytes))) {
             client()->reportAllocationOverflow();
             return nullptr;
         }
-        return (T*)client()->onOutOfMemory(nullptr, numElems * sizeof(T));
+        return static_cast<T*>(client()->onOutOfMemory(nullptr, bytes));
     }
 
     template <class T, class U>
     T* pod_calloc_with_extra(size_t numExtra) {
-        if (MOZ_UNLIKELY(numExtra & mozilla::tl::MulOverflowMask<sizeof(U)>::value)) {
-            client()->reportAllocationOverflow();
-            return nullptr;
-        }
-        size_t bytes = sizeof(T) + numExtra * sizeof(U);
-        if (MOZ_UNLIKELY(bytes < sizeof(T))) {
+        size_t bytes;
+        if (MOZ_UNLIKELY((!CalculateAllocSizeWithExtra<T, U>(numExtra, &bytes)))) {
             client()->reportAllocationOverflow();
             return nullptr;
         }
-        T* p = reinterpret_cast<T*>(js_pod_calloc<uint8_t>(bytes));
+        T* p = static_cast<T*>(js_calloc(bytes));
         if (MOZ_LIKELY(p)) {
             client()->updateMallocCounter(bytes);
             return p;
         }
-        return (T*)client()->onOutOfMemory(nullptr, bytes);
+        return static_cast<T*>(client()->onOutOfMemory(nullptr, bytes));
     }
 
     template <class T>
@@ -151,11 +145,12 @@ struct MallocProvider
                 client()->updateMallocCounter((newSize - oldSize) * sizeof(T));
             return p;
         }
-        if (newSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value) {
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(newSize, &bytes))) {
             client()->reportAllocationOverflow();
             return nullptr;
         }
-        return (T*)client()->onOutOfMemory(prior, newSize * sizeof(T));
+        return static_cast<T*>(client()->onOutOfMemory(prior, bytes));
     }
 
     JS_DECLARE_NEW_METHODS(new_, pod_malloc<uint8_t>, MOZ_ALWAYS_INLINE)
diff --git a/src/third_party/mozjs-38/extract/js/src/vm/Runtime.h b/src/third_party/mozjs-38/extract/js/src/vm/Runtime.h
index 90771d6d867..24c34d3d62d 100644
--- a/src/third_party/mozjs-38/extract/js/src/vm/Runtime.h
+++ b/src/third_party/mozjs-38/extract/js/src/vm/Runtime.h
@@ -1354,11 +1354,12 @@ struct JSRuntime : public JS::shadow::Runtime,
         T* p = pod_calloc<T>(numElems);
         if (MOZ_LIKELY(!!p))
             return p;
-        if (numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value) {
+        size_t bytes;
+        if (MOZ_UNLIKELY(!js::CalculateAllocSize<T>(numElems, &bytes))) {
             reportAllocationOverflow();
             return nullptr;
         }
-        return (T*)onOutOfMemoryCanGC(reinterpret_cast<void*>(1), numElems * sizeof(T));
+        return static_cast<T*>(onOutOfMemoryCanGC(reinterpret_cast<void*>(1), bytes));
     }
 
     template <typename T>
@@ -1366,11 +1367,12 @@ struct JSRuntime : public JS::shadow::Runtime,
         T* p2 = pod_realloc<T>(p, oldSize, newSize);
         if (MOZ_LIKELY(!!p2))
             return p2;
-        if (newSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value) {
+        size_t bytes;
+        if (MOZ_UNLIKELY(!js::CalculateAllocSize<T>(newSize, &bytes))) {
             reportAllocationOverflow();
             return nullptr;
         }
-        return (T*)onOutOfMemoryCanGC(p, newSize * sizeof(T));
+        return static_cast<T*>(onOutOfMemoryCanGC(p, bytes));
     }
 
     /*
diff --git a/src/third_party/mozjs-38/extract/mfbt/WeakPtr.h b/src/third_party/mozjs-38/extract/mfbt/WeakPtr.h
index 6e5de43a529..22ba20e0652 100644
--- a/src/third_party/mozjs-38/extract/mfbt/WeakPtr.h
+++ b/src/third_party/mozjs-38/extract/mfbt/WeakPtr.h
@@ -172,7 +172,13 @@ public:
 
   WeakPtr& operator=(T* aOther)
   {
-    return *this = aOther->SelfReferencingWeakPtr();
+    if (aOther) {
+      *this = aOther->SelfReferencingWeakPtr();
+    } else if (!mRef || mRef->get()) {
+      // Ensure that mRef is dereferenceable in the uninitialized state.
+      mRef = new WeakReference(nullptr);
+    }
+    return *this;
   }
 
   MOZ_IMPLICIT WeakPtr(T* aOther)
diff --git a/src/third_party/mozjs-38/get_sources.sh b/src/third_party/mozjs-38/get_sources.sh
index 06a902c5d1e..6a367b02fa8 100755
--- a/src/third_party/mozjs-38/get_sources.sh
+++ b/src/third_party/mozjs-38/get_sources.sh
@@ -2,8 +2,8 @@
 
 # how we got the last firefox sources
 
-wget "https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/38.3.0esr/source/firefox-38.3.0esr.source.tar.bz2"
+wget "https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/38.4.0esr/source/firefox-38.4.0esr.source.tar.bz2"
 
-tar -jxf firefox-38.3.0esr.source.tar.bz2
+tar -jxf firefox-38.4.0esr.source.tar.bz2
 
 mv mozilla-esr38 mozilla-release
diff --git a/src/third_party/mozjs-38/include/js/Utility.h b/src/third_party/mozjs-38/include/js/Utility.h
index 40b5d90ba6d..6b750c3fedf 100644
--- a/src/third_party/mozjs-38/include/js/Utility.h
+++ b/src/third_party/mozjs-38/include/js/Utility.h
@@ -217,6 +217,36 @@ static inline char* js_strdup(const char* s)
 
 JS_DECLARE_NEW_METHODS(js_new, js_malloc, static MOZ_ALWAYS_INLINE)
 
+namespace js {
+
+/*
+ * Calculate the number of bytes needed to allocate |numElems| contiguous
+ * instances of type |T|.  Return false if the calculation overflowed.
+ */
+template <typename T>
+MOZ_WARN_UNUSED_RESULT inline bool
+CalculateAllocSize(size_t numElems, size_t* bytesOut)
+{
+    *bytesOut = numElems * sizeof(T);
+    return (numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value) == 0;
+}
+
+/*
+ * Calculate the number of bytes needed to allocate a single instance of type
+ * |T| followed by |numExtra| contiguous instances of type |Extra|.  Return
+ * false if the calculation overflowed.
+ */
+template <typename T, typename Extra>
+MOZ_WARN_UNUSED_RESULT inline bool
+CalculateAllocSizeWithExtra(size_t numExtra, size_t* bytesOut)
+{
+    *bytesOut = sizeof(T) + numExtra * sizeof(Extra);
+    return (numExtra & mozilla::tl::MulOverflowMask<sizeof(Extra)>::value) == 0 &&
+           *bytesOut >= sizeof(T);
+}
+
+} /* namespace js */
+
 template <class T>
 static MOZ_ALWAYS_INLINE void
 js_delete(T* p)
@@ -242,32 +272,34 @@ template <class T>
 static MOZ_ALWAYS_INLINE T*
 js_pod_malloc()
 {
-    return (T*)js_malloc(sizeof(T));
+    return static_cast<T*>(js_malloc(sizeof(T)));
 }
 
 template <class T>
 static MOZ_ALWAYS_INLINE T*
 js_pod_calloc()
 {
-    return (T*)js_calloc(sizeof(T));
+    return static_cast<T*>(js_calloc(sizeof(T)));
 }
 
 template <class T>
 static MOZ_ALWAYS_INLINE T*
 js_pod_malloc(size_t numElems)
 {
-    if (MOZ_UNLIKELY(numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+    size_t bytes;
+    if (MOZ_UNLIKELY(!js::CalculateAllocSize<T>(numElems, &bytes)))
         return nullptr;
-    return (T*)js_malloc(numElems * sizeof(T));
+    return static_cast<T*>(js_malloc(bytes));
 }
 
 template <class T>
 static MOZ_ALWAYS_INLINE T*
 js_pod_calloc(size_t numElems)
 {
-    if (MOZ_UNLIKELY(numElems & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+    size_t bytes;
+    if (MOZ_UNLIKELY(!js::CalculateAllocSize<T>(numElems, &bytes)))
         return nullptr;
-    return (T*)js_calloc(numElems * sizeof(T));
+    return static_cast<T*>(js_calloc(bytes));
 }
 
 template <class T>
@@ -275,9 +307,10 @@ static MOZ_ALWAYS_INLINE T*
 js_pod_realloc(T* prior, size_t oldSize, size_t newSize)
 {
     MOZ_ASSERT(!(oldSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value));
-    if (MOZ_UNLIKELY(newSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value))
+    size_t bytes;
+    if (MOZ_UNLIKELY(!js::CalculateAllocSize<T>(newSize, &bytes)))
         return nullptr;
-    return (T*)js_realloc(prior, newSize * sizeof(T));
+    return static_cast<T*>(js_realloc(prior, bytes));
 }
 
 namespace js {
diff --git a/src/third_party/mozjs-38/include/jsalloc.h b/src/third_party/mozjs-38/include/jsalloc.h
index ce11ade9085..e20fa5f269f 100644
--- a/src/third_party/mozjs-38/include/jsalloc.h
+++ b/src/third_party/mozjs-38/include/jsalloc.h
@@ -53,6 +53,14 @@ class TempAllocPolicy
      */
     JS_FRIEND_API(void*) onOutOfMemory(void* p, size_t nbytes);
 
+    template <typename T>
+    T* onOutOfMemoryTyped(void* p, size_t numElems) {
+        size_t bytes;
+        if (MOZ_UNLIKELY(!CalculateAllocSize<T>(numElems, &bytes)))
+            return nullptr;
+        return static_cast<T*>(onOutOfMemory(p, bytes));
+    }
+
   public:
     MOZ_IMPLICIT TempAllocPolicy(JSContext* cx) : cx_((ContextFriendFields*) cx) {} // :(
     MOZ_IMPLICIT TempAllocPolicy(ContextFriendFields* cx) : cx_(cx) {}
@@ -61,7 +69,7 @@ class TempAllocPolicy
     T* pod_malloc(size_t numElems) {
         T* p = js_pod_malloc<T>(numElems);
         if (MOZ_UNLIKELY(!p))
-            p = static_cast<T*>(onOutOfMemory(nullptr, numElems * sizeof(T)));
+            p = onOutOfMemoryTyped<T>(nullptr, numElems);
         return p;
     }
 
@@ -69,7 +77,7 @@ class TempAllocPolicy
     T* pod_calloc(size_t numElems) {
         T* p = js_pod_calloc<T>(numElems);
         if (MOZ_UNLIKELY(!p))
-            p = static_cast<T*>(onOutOfMemory(reinterpret_cast<void*>(1), numElems * sizeof(T)));
+            p = onOutOfMemoryTyped<T>(reinterpret_cast<void*>(1), numElems);
         return p;
     }
 
@@ -77,7 +85,7 @@ class TempAllocPolicy
     T* pod_realloc(T* prior, size_t oldSize, size_t newSize) {
         T* p2 = js_pod_realloc<T>(prior, oldSize, newSize);
         if (MOZ_UNLIKELY(!p2))
-            p2 = static_cast<T*>(onOutOfMemory(p2, newSize * sizeof(T)));
+            p2 = onOutOfMemoryTyped<T>(p2, newSize);
         return p2;
     }
 
diff --git a/src/third_party/mozjs-38/include/mozilla/WeakPtr.h b/src/third_party/mozjs-38/include/mozilla/WeakPtr.h
index 6e5de43a529..22ba20e0652 100644
--- a/src/third_party/mozjs-38/include/mozilla/WeakPtr.h
+++ b/src/third_party/mozjs-38/include/mozilla/WeakPtr.h
@@ -172,7 +172,13 @@ public:
 
   WeakPtr& operator=(T* aOther)
   {
-    return *this = aOther->SelfReferencingWeakPtr();
+    if (aOther) {
+      *this = aOther->SelfReferencingWeakPtr();
+    } else if (!mRef || mRef->get()) {
+      // Ensure that mRef is dereferenceable in the uninitialized state.
+      mRef = new WeakReference(nullptr);
+    }
+    return *this;
   }
 
   MOZ_IMPLICIT WeakPtr(T* aOther)
diff --git a/src/third_party/mozjs-38/platform/arm64/linux/build/js-confdefs.h b/src/third_party/mozjs-38/platform/arm64/linux/build/js-confdefs.h
index 86a57482478..9d53c2c82bd 100644
--- a/src/third_party/mozjs-38/platform/arm64/linux/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/arm64/linux/build/js-confdefs.h
@@ -67,10 +67,10 @@
 #define JS_STANDALONE 1
 #define MALLOC_H <malloc.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".so"
 #define MOZ_UPDATE_CHANNEL default
diff --git a/src/third_party/mozjs-38/platform/arm64/linux/include/js-config.h b/src/third_party/mozjs-38/platform/arm64/linux/include/js-config.h
index 2772354ab82..59e1bc3de7d 100644
--- a/src/third_party/mozjs-38/platform/arm64/linux/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/arm64/linux/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */
diff --git a/src/third_party/mozjs-38/platform/i386/linux/build/js-confdefs.h b/src/third_party/mozjs-38/platform/i386/linux/build/js-confdefs.h
index 048440cb9ac..a59f69f842c 100644
--- a/src/third_party/mozjs-38/platform/i386/linux/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/i386/linux/build/js-confdefs.h
@@ -70,10 +70,10 @@
 #define JS_STANDALONE 1
 #define MALLOC_H <malloc.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".so"
 #define MOZ_UPDATE_CHANNEL default
diff --git a/src/third_party/mozjs-38/platform/i386/linux/include/js-config.h b/src/third_party/mozjs-38/platform/i386/linux/include/js-config.h
index aa5fddd95f0..9ab842f8574 100644
--- a/src/third_party/mozjs-38/platform/i386/linux/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/i386/linux/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */
diff --git a/src/third_party/mozjs-38/platform/i386/openbsd/build/js-confdefs.h b/src/third_party/mozjs-38/platform/i386/openbsd/build/js-confdefs.h
index 6fdd2e4d0ab..08056e7654d 100644
--- a/src/third_party/mozjs-38/platform/i386/openbsd/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/i386/openbsd/build/js-confdefs.h
@@ -59,10 +59,10 @@
 #define JS_STANDALONE 1
 #define MALLOC_H <malloc.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".so.1.0"
 #define MOZ_UPDATE_CHANNEL default
diff --git a/src/third_party/mozjs-38/platform/i386/openbsd/include/js-config.h b/src/third_party/mozjs-38/platform/i386/openbsd/include/js-config.h
index 18050ebe22a..8548ee982ae 100644
--- a/src/third_party/mozjs-38/platform/i386/openbsd/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/i386/openbsd/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */
diff --git a/src/third_party/mozjs-38/platform/i386/windows/build/js-confdefs.h b/src/third_party/mozjs-38/platform/i386/windows/build/js-confdefs.h
index ff6956e38eb..c768d70e2c1 100644
--- a/src/third_party/mozjs-38/platform/i386/windows/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/i386/windows/build/js-confdefs.h
@@ -32,10 +32,10 @@
 #define MALLOC_H <malloc.h>
 #define MALLOC_H <malloc.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".dll"
 #define MOZ_MEMORY 1
diff --git a/src/third_party/mozjs-38/platform/i386/windows/include/js-config.h b/src/third_party/mozjs-38/platform/i386/windows/include/js-config.h
index db784aab45f..cf6a5a4b42b 100644
--- a/src/third_party/mozjs-38/platform/i386/windows/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/i386/windows/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */
diff --git a/src/third_party/mozjs-38/platform/x86_64/freebsd/build/js-confdefs.h b/src/third_party/mozjs-38/platform/x86_64/freebsd/build/js-confdefs.h
index 2212823874a..bd40885b84c 100644
--- a/src/third_party/mozjs-38/platform/x86_64/freebsd/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/x86_64/freebsd/build/js-confdefs.h
@@ -63,10 +63,10 @@
 #define JS_STANDALONE 1
 #define MALLOC_H <malloc_np.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".so"
 #define MOZ_UPDATE_CHANNEL default
diff --git a/src/third_party/mozjs-38/platform/x86_64/freebsd/include/js-config.h b/src/third_party/mozjs-38/platform/x86_64/freebsd/include/js-config.h
index 0b8a1a3ce5e..57a01836e0c 100644
--- a/src/third_party/mozjs-38/platform/x86_64/freebsd/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/x86_64/freebsd/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */
diff --git a/src/third_party/mozjs-38/platform/x86_64/linux/build/js-confdefs.h b/src/third_party/mozjs-38/platform/x86_64/linux/build/js-confdefs.h
index fa8b5a5c730..a178c9bf903 100644
--- a/src/third_party/mozjs-38/platform/x86_64/linux/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/x86_64/linux/build/js-confdefs.h
@@ -71,10 +71,10 @@
 #define JS_STANDALONE 1
 #define MALLOC_H <malloc.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".so"
 #define MOZ_UPDATE_CHANNEL default
diff --git a/src/third_party/mozjs-38/platform/x86_64/linux/include/js-config.h b/src/third_party/mozjs-38/platform/x86_64/linux/include/js-config.h
index 2772354ab82..59e1bc3de7d 100644
--- a/src/third_party/mozjs-38/platform/x86_64/linux/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/x86_64/linux/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */
diff --git a/src/third_party/mozjs-38/platform/x86_64/openbsd/build/js-confdefs.h b/src/third_party/mozjs-38/platform/x86_64/openbsd/build/js-confdefs.h
index 086ce83dab1..2f01fac113c 100644
--- a/src/third_party/mozjs-38/platform/x86_64/openbsd/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/x86_64/openbsd/build/js-confdefs.h
@@ -62,10 +62,10 @@
 #define JS_STANDALONE 1
 #define MALLOC_H <malloc.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".so.1.0"
 #define MOZ_UPDATE_CHANNEL default
diff --git a/src/third_party/mozjs-38/platform/x86_64/openbsd/include/js-config.h b/src/third_party/mozjs-38/platform/x86_64/openbsd/include/js-config.h
index 7f5d3068ecb..91ebe2b8581 100644
--- a/src/third_party/mozjs-38/platform/x86_64/openbsd/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/x86_64/openbsd/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */
diff --git a/src/third_party/mozjs-38/platform/x86_64/osx/build/js-confdefs.h b/src/third_party/mozjs-38/platform/x86_64/osx/build/js-confdefs.h
index 8abcde8718b..4325e782ae0 100644
--- a/src/third_party/mozjs-38/platform/x86_64/osx/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/x86_64/osx/build/js-confdefs.h
@@ -58,10 +58,10 @@
 #define JS_STANDALONE 1
 #define MALLOC_H <malloc/malloc.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".dylib"
 #define MOZ_UPDATE_CHANNEL default
diff --git a/src/third_party/mozjs-38/platform/x86_64/osx/include/js-config.h b/src/third_party/mozjs-38/platform/x86_64/osx/include/js-config.h
index 0b8a1a3ce5e..57a01836e0c 100644
--- a/src/third_party/mozjs-38/platform/x86_64/osx/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/x86_64/osx/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */
diff --git a/src/third_party/mozjs-38/platform/x86_64/solaris/build/js-confdefs.h b/src/third_party/mozjs-38/platform/x86_64/solaris/build/js-confdefs.h
index 7b55e7ea95b..8714317c29d 100644
--- a/src/third_party/mozjs-38/platform/x86_64/solaris/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/x86_64/solaris/build/js-confdefs.h
@@ -62,10 +62,10 @@
 #define JS_STANDALONE 1
 #define MALLOC_H <malloc.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".so"
 #define MOZ_UPDATE_CHANNEL default
diff --git a/src/third_party/mozjs-38/platform/x86_64/solaris/include/js-config.h b/src/third_party/mozjs-38/platform/x86_64/solaris/include/js-config.h
index 576b93560ed..7cae8617d83 100644
--- a/src/third_party/mozjs-38/platform/x86_64/solaris/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/x86_64/solaris/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */
diff --git a/src/third_party/mozjs-38/platform/x86_64/windows/build/js-confdefs.h b/src/third_party/mozjs-38/platform/x86_64/windows/build/js-confdefs.h
index bb7d7030342..b6453f92f94 100644
--- a/src/third_party/mozjs-38/platform/x86_64/windows/build/js-confdefs.h
+++ b/src/third_party/mozjs-38/platform/x86_64/windows/build/js-confdefs.h
@@ -33,10 +33,10 @@
 #define MALLOC_H <malloc.h>
 #define MALLOC_H <malloc.h>
 #define MOZILLA_UAVERSION "38.0"
-#define MOZILLA_VERSION "38.3.0"
-#define MOZILLA_VERSION_U 38.3.0
+#define MOZILLA_VERSION "38.4.0"
+#define MOZILLA_VERSION_U 38.4.0
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 #define MOZ_DEBUG_SYMBOLS 1
 #define MOZ_DLL_SUFFIX ".dll"
 #define MOZ_MEMORY 1
diff --git a/src/third_party/mozjs-38/platform/x86_64/windows/include/js-config.h b/src/third_party/mozjs-38/platform/x86_64/windows/include/js-config.h
index ff677ff3f92..ce67755eb09 100644
--- a/src/third_party/mozjs-38/platform/x86_64/windows/include/js-config.h
+++ b/src/third_party/mozjs-38/platform/x86_64/windows/include/js-config.h
@@ -54,6 +54,6 @@
 
 /* MOZILLA JSAPI version number components */
 #define MOZJS_MAJOR_VERSION 38
-#define MOZJS_MINOR_VERSION 3
+#define MOZJS_MINOR_VERSION 4
 
 #endif /* js_config_h */