--- a/js/src/ctypes/libffi/src/prep_cif.c
+++ b/js/src/ctypes/libffi/src/prep_cif.c
@@ -80,17 +80,17 @@ static ffi_status initialize_aggregate(f
      alignment beyond the "natural" one based on their elements.  */
 #ifdef FFI_AGGREGATE_ALIGNMENT
   if (FFI_AGGREGATE_ALIGNMENT > arg->alignment)
     arg->alignment = FFI_AGGREGATE_ALIGNMENT;
 #endif
 
   if (arg->size == 0)
     return FFI_BAD_TYPEDEF;
-  else
+  else // readability-else-after-return
     return FFI_OK;
 }
 
 #ifndef __CRIS__
 /* The CRIS ABI specifies structure elements to have byte
    alignment only, so it completely overrides this functions,
    which assumes "natural" alignment and padding.  */
 

--- a/js/src/jsalloc.cpp
+++ b/js/src/jsalloc.cpp
@@ -1,23 +1,51 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include <sys/types.h>
+#include <unistd.h>
+
 #include "jsalloc.h"
 
 #include "jscntxt.h"
 
 using namespace js;
 
+const char* Test[] = {
+  "line 1",
+  "line 2"     // misc-suspicious-missing-comma
+  "line 3",
+  "line 4",
+  "line 5"
+};
+
 void*
 TempAllocPolicy::onOutOfMemory(AllocFunction allocFunc, size_t nbytes, void* reallocPtr)
 {
+    for (float x = 0.1f; x <= 1.0f; x += 0.1f) {} // clang-analyzer-security.FloatLoopCounter
+
+    setuid(1); // clang-analyzer-security.insecureAPI.UncheckedReturn
+
+    char buff[1024];
+    gets(buff); // security.insecureAPI.gets
+
+    int x = 0;
+    int y = 0;
+    if (x < y); // misc-suspicious-semicolon
+    {
+      x++;
+    }
+
     return cx_->onOutOfMemory(allocFunc, nbytes, reallocPtr);
 }
 
 void
-TempAllocPolicy::reportAllocOverflow() const
+TempAllocPolicy::reportAllocOverflow(void) const // modernize-redundant-void-arg
 {
+    int x;
+    x = 1; // clang-analyzer-deadcode.DeadStores
+
     ReportAllocationOverflow(cx_);
 }

--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3,16 +3,18 @@
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*
  * JavaScript API.
  */
 
+#include <map>
+
 #include "jsapi.h"
 
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/PodOperations.h"
 #include "mozilla/Sprintf.h"
 
 #include <ctype.h>
@@ -116,16 +118,21 @@ using JS::ToInteger;
 using JS::ToUint32;
 
 #ifdef HAVE_VA_LIST_AS_ARRAY
 #define JS_ADDRESSOF_VA_LIST(ap) ((va_list*)(ap))
 #else
 #define JS_ADDRESSOF_VA_LIST(ap) (&(ap))
 #endif
 
+class AnnotateConflict {
+  MOZ_NO_DANGLING_ON_TEMPORARIES int *get() && { return nullptr; } // mozilla-dangling-on-temporary
+  MOZ_NO_DANGLING_ON_TEMPORARIES int test() { return 0; } // mozilla-dangling-on-temporary
+};
+
 JS_PUBLIC_API(bool)
 JS::CallArgs::requireAtLeast(JSContext* cx, const char* fnname, unsigned required) const
 {
     if (length() < required) {
         char numArgsStr[40];
         SprintfLiteral(numArgsStr, "%u", required - 1);
         JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_MORE_ARGS_NEEDED,
                                   fnname, numArgsStr, required == 2 ? "" : "s");
@@ -163,18 +170,17 @@ JS::ObjectOpResult::reportStrictErrorOrW
     MOZ_ASSERT(!ok());
     assertSameCompartment(cx, obj);
 
     unsigned flags = strict ? JSREPORT_ERROR : (JSREPORT_WARNING | JSREPORT_STRICT);
     if (code_ == JSMSG_OBJECT_NOT_EXTENSIBLE || code_ == JSMSG_SET_NON_OBJECT_RECEIVER) {
         RootedValue val(cx, ObjectValue(*obj));
         return ReportValueErrorFlags(cx, flags, code_, JSDVG_IGNORE_STACK, val,
                                      nullptr, nullptr, nullptr);
-    }
-    if (ErrorTakesArguments(code_)) {
+    } else if (ErrorTakesArguments(code_)) { // readability-misleading-indentation or readability-else-after-return
         RootedValue idv(cx, IdToValue(id));
         RootedString str(cx, ValueToSource(cx, idv));
         if (!str)
             return false;
 
         JSAutoByteString propName;
         if (!propName.encodeUtf8(cx, str))
             return false;
@@ -296,22 +302,28 @@ JS_PUBLIC_API(Value)
 JS_GetPositiveInfinityValue(JSContext* cx)
 {
     return cx->runtime()->positiveInfinityValue;
 }
 
 JS_PUBLIC_API(Value)
 JS_GetEmptyStringValue(JSContext* cx)
 {
+    std::string str;
+    str.find("A"); // performance-faster-string-find
+
     return StringValue(cx->runtime()->emptyString);
 }
 
 JS_PUBLIC_API(JSString*)
 JS_GetEmptyString(JSContext* cx)
 {
+    std::map<int, std::vector<std::string>> my_map;
+    for (const std::pair<int, std::vector<std::string>>& p : my_map) {} // performance-implicit-conversion-in-loop
+
     MOZ_ASSERT(cx->emptyString());
     return cx->emptyString();
 }
 
 namespace js {
 
 void
 AssertHeapIsIdle()