Update SpiderMonkey to m-c bcf4ff0c3eef.

This currently breaks Servo on Android, because there are a number of
interdependent changes that cannot easily land serially in a way that
keeps it working throughout. We expect to fix this in the near future.

components/script/dom/bindings/proxyhandler.rs

@@ -12,7 +12,9 @@ use js::glue::GetProxyExtra;
 use js::glue::InvokeGetOwnPropertyDescriptor;
 use js::glue::{GetProxyHandler, SetProxyExtra};
 use js::jsapi::GetObjectProto;
+use js::jsapi::GetStaticPrototype;
 use js::jsapi::JS_GetPropertyDescriptorById;
+use js::jsapi::MutableHandleObject;
 use js::jsapi::{Handle, HandleId, HandleObject, MutableHandle, ObjectOpResult};
 use js::jsapi::{JSContext, JSObject, JSPROP_GETTER, PropertyDescriptor};
 use js::jsapi::{JSErrNum, JS_StrictPropertyStub};
@@ -103,6 +105,25 @@ pub unsafe extern "C" fn is_extensible(_cx: *mut JSContext,
     true
 }
 
+/// If `proxy` (underneath any functionally-transparent wrapper proxies) has as
+/// its `[[GetPrototypeOf]]` trap the ordinary `[[GetPrototypeOf]]` behavior
+/// defined for ordinary objects, set `*is_ordinary` to true and store `obj`'s
+/// prototype in `proto`.  Otherwise set `*isOrdinary` to false. In case of
+/// error, both outparams have unspecified value.
+///
+/// This implementation always handles the case of the ordinary
+/// `[[GetPrototypeOf]]` behavior. An alternative implementation will be
+/// necessary for the Location object.
+pub unsafe extern "C" fn get_prototype_if_ordinary(_: *mut JSContext,
+                                                   proxy: HandleObject,
+                                                   is_ordinary: *mut bool,
+                                                   proto: MutableHandleObject)
+                                                   -> bool {
+    *is_ordinary = true;
+    proto.set(GetStaticPrototype(proxy.get()));
+    true
+}
+
 /// Get the expando object, or null if there is none.
 pub fn get_expando_object(obj: HandleObject) -> *mut JSObject {
     unsafe {