--- a/js/xpconnect/loader/ScriptPreloader.cpp
+++ b/js/xpconnect/loader/ScriptPreloader.cpp
@@ -993,17 +993,17 @@ ScriptPreloader::DecodeNextBatch(size_t 
     if (size == 0 && mPendingScripts.isEmpty()) {
         return;
     }
 
     AutoJSAPI jsapi;
     MOZ_RELEASE_ASSERT(jsapi.Init(xpc::CompilationScope()));
     JSContext* cx = jsapi.cx();
 
-    JS::CompileOptions options(cx, JSVERSION_LATEST);
+    JS::CompileOptions options(cx, JSVERSION_DEFAULT);
     options.setNoScriptRval(true)
            .setSourceIsLazy(true);
 
     if (!JS::CanCompileOffThread(cx, options, size) ||
         !JS::DecodeMultiOffThreadScripts(cx, options, mParsingSources,
                                          OffThreadDecodeCallback,
                                          static_cast<void*>(this))) {
         // If we fail here, we don't move on to process the next batch, so make

--- a/js/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -467,17 +467,17 @@ mozJSComponentLoader::CreateLoaderGlobal
     NS_ENSURE_SUCCESS_VOID(rv);
 
     CompartmentOptions options;
 
     options.creationOptions()
            .setSystemZone()
            .setAddonId(aAddonID);
 
-    options.behaviors().setVersion(JSVERSION_LATEST);
+    options.behaviors().setVersion(JSVERSION_DEFAULT);
 
     if (xpc::SharedMemoryEnabled())
         options.creationOptions().setSharedMemoryAndAtomicsEnabled(true);
 
     // Defer firing OnNewGlobalObject until after the __URI__ property has
     // been defined so the JS debugger can tell what module the global is
     // for
     nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
@@ -645,17 +645,17 @@ mozJSComponentLoader::ObjectForLocation(
         // Use lazy source if we're using the startup cache. Non-lazy source +
         // startup cache regresses installer size (due to source code stored in
         // XDR encoded modules in omni.ja). Also, XDR decoding is relatively
         // fast. When we're not using the startup cache, we want to use non-lazy
         // source code so that we can use lazy parsing.
         // See bug 1303754.
         CompileOptions options(cx);
         options.setNoScriptRval(true)
-               .setVersion(JSVERSION_LATEST)
+               .setVersion(JSVERSION_DEFAULT)
                .setFileAndLine(nativePath.get(), 1)
                .setSourceIsLazy(cache || ScriptPreloader::GetSingleton().Active());
 
         if (realFile) {
             AutoMemMap map;
             MOZ_TRY(map.init(aComponentFile));
 
             // Note: exceptions will get handled further down;

--- a/js/xpconnect/loader/mozJSSubScriptLoader.cpp
+++ b/js/xpconnect/loader/mozJSSubScriptLoader.cpp
@@ -133,17 +133,17 @@ PrepareScript(nsIURI* uri,
               const nsAString& charset,
               const char* buf,
               int64_t len,
               bool wantReturnValue,
               MutableHandleScript script)
 {
     JS::CompileOptions options(cx);
     options.setFileAndLine(uriStr, 1)
-           .setVersion(JSVERSION_LATEST)
+           .setVersion(JSVERSION_DEFAULT)
            .setNoScriptRval(!wantReturnValue);
     if (!charset.IsVoid()) {
         char16_t* scriptBuf = nullptr;
         size_t scriptLength = 0;
 
         nsresult rv =
             ScriptLoader::ConvertToUTF16(nullptr, reinterpret_cast<const uint8_t*>(buf), len,
                                          charset, nullptr, scriptBuf, scriptLength);

--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -2397,26 +2397,22 @@ nsXPCComponents_Utils::EvalInSandbox(con
         JSString* jsVersionStr = ToString(cx, version);
         if (!jsVersionStr)
             return NS_ERROR_INVALID_ARG;
 
         JSAutoByteString bytes(cx, jsVersionStr);
         if (!bytes)
             return NS_ERROR_INVALID_ARG;
 
-        jsVersion = JS_StringToVersion(bytes.ptr());
-        // Explicitly check for "latest", which we support for sandboxes but
-        // isn't in the set of web-exposed version strings.
-        if (jsVersion == JSVERSION_UNKNOWN &&
-            !strcmp(bytes.ptr(), "latest"))
+        // Treat non-default version designation as default.
+        if (JS_StringToVersion(bytes.ptr()) == JSVERSION_UNKNOWN &&
+            strcmp(bytes.ptr(), "latest"))
         {
-            jsVersion = JSVERSION_LATEST;
+            return NS_ERROR_INVALID_ARG;
         }
-        if (jsVersion == JSVERSION_UNKNOWN)
-            return NS_ERROR_INVALID_ARG;
     }
 
     // Optional fourth and fifth arguments: filename and line number.
     int32_t lineNo = (optionalArgc >= 3) ? lineNumber : 1;
     nsCString filename;
     if (!filenameArg.IsVoid()) {
         filename.Assign(filenameArg);
     } else {

--- a/js/xpconnect/src/XPCShellImpl.cpp
+++ b/js/xpconnect/src/XPCShellImpl.cpp
@@ -1428,17 +1428,17 @@ XRE_XPCShellMain(int argc, char** argv, 
         }
 
         // Make the default XPCShell global use a fresh zone (rather than the
         // System Zone) to improve cross-zone test coverage.
         JS::CompartmentOptions options;
         options.creationOptions().setNewZoneInSystemZoneGroup();
         if (xpc::SharedMemoryEnabled())
             options.creationOptions().setSharedMemoryAndAtomicsEnabled(true);
-        options.behaviors().setVersion(JSVERSION_LATEST);
+        options.behaviors().setVersion(JSVERSION_DEFAULT);
         nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
         rv = nsXPConnect::XPConnect()->
             InitClassesWithNewWrappedGlobal(cx,
                                             static_cast<nsIGlobalObject*>(backstagePass),
                                             systemprincipal,
                                             0,
                                             options,
                                             getter_AddRefs(holder));

--- a/js/xpconnect/tests/chrome/test_bug596580.xul
+++ b/js/xpconnect/tests/chrome/test_bug596580.xul
@@ -9,17 +9,17 @@
 
   <!-- test results are displayed in the html:body -->
   <body xmlns="http://www.w3.org/1999/xhtml">
   <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=596580"
      target="_blank">Mozilla Bug 596580</a>
   </body>
 
   <!-- test code goes here -->
-  <script type="application/x-javascript;version=1.8"><![CDATA[
+  <script type="application/javascript"><![CDATA[
     function init() {
       var f = new Function("let test = 'let is ok'; return test;");
       is(f(), 'let is ok', 'let should be ok');
       SimpleTest.finish();
     }
 
     Test = {
       include: function(p) {

--- a/js/xpconnect/tests/unit/test_xrayed_iterator.js
+++ b/js/xpconnect/tests/unit/test_xrayed_iterator.js
@@ -1,25 +1,25 @@
 const Cu = Components.utils;
 function run_test() {
 
   var toEval = [
     "var customIterator = {",
-    "  _array: [6, 7, 8, 9],",
-    "  __iterator__: function() {",
+    "  _array: [6, 7, 8, 9]",
+    "};",
+    "customIterator[Symbol.iterator] = function* () {",
     "    for (var i = 0; i < this._array.length; ++i)",
     "      yield this._array[i];",
-    "  }",
-    "}"
+    "};"
   ].join('\n');
 
   function checkIterator(iterator) {
     var control = [6, 7, 8, 9];
     var i = 0;
-    for (var item in iterator) {
+    for (var item of iterator) {
       do_check_eq(item, control[i]);
       ++i;
     }
   }
 
   // First, try in our own scope.
   eval(toEval);
   checkIterator(customIterator);