- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser][tor-browser-115.24.0esr-13.5-1] 8 commits: Bug 1889130 - block http requests on 0.0.0.0 address. r=necko-reviewers,valentin,kershaw
by ma1 (＠ma1) 26 May '25

26 May '25

ma1 pushed to branch tor-browser-115.24.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 0a4acb71 by smayya at 2025-05-22T17:18:56+02:00 Bug 1889130 - block http requests on 0.0.0.0 address. r=necko-reviewers,valentin,kershaw Differential Revision: https://phabricator.services.mozilla.com/D219041 - - - - - 02ee510f by hackademix at 2025-05-22T17:34:56+02:00 fixup! Firefox preference overrides. BB 43811: Block 0.0.0.0 - - - - - 6186c1fe by Oskar Mansfeld at 2025-05-26T17:25:28+02:00 Bug 1914583 - Block IPAddrAny on H3 code path. r=necko-reviewers,kershaw Note: removed glean references on Tor Browser esr115 backport Differential Revision: https://phabricator.services.mozilla.com/D239514 - - - - - dc06e11d by Daniel Holbert at 2025-05-26T17:25:48+02:00 Bug 1742738 part 1: Tighten up tearoff-table removal for DOMSVGPointList and DOMSVGStringList. r=firefox-svg-reviewers,longsonr Differential Revision: https://phabricator.services.mozilla.com/D246062 - - - - - 4f3e5d70 by Daniel Holbert at 2025-05-26T17:25:49+02:00 Bug 1742738 part 2: Tighten up tearoff-table removal for DOMSVGLength. r=firefox-svg-reviewers,longsonr I'm doing this one in its own patch since it's slightly more subtle than the others, due to the existence of multiple instance-creation codepaths, some of which generate instances that never end up in the tearoff table. Differential Revision: https://phabricator.services.mozilla.com/D246063 - - - - - d5a152e4 by Daniel Holbert at 2025-05-26T17:25:50+02:00 Bug 1742738 part 3: Tighten up tearoff-table removal for DOMSVGPoint. r=firefox-svg-reviewers,longsonr I'm doing this one in its own patch since it's slightly more subtle than the others, due to the existence of multiple instance-creation codepaths, some of which generate instances that never end up in the tearoff table. Differential Revision: https://phabricator.services.mozilla.com/D246065 - - - - - 73753ce8 by Jonathan Kew at 2025-05-26T17:25:50+02:00 Bug 1958121 - Use exchange to update the SpaceFeatures flags. a=RyanVM Original Revision: https://phabricator.services.mozilla.com/D245913 Differential Revision: https://phabricator.services.mozilla.com/D247887 - - - - - d3e4fff1 by Gijs Kruitbosch at 2025-05-26T17:25:51+02:00 Bug 1959298 - use search params in about:memory, r=mccr8 Differential Revision: https://phabricator.services.mozilla.com/D245049 - - - - - 16 changed files: - browser/app/profile/001-base-profile.js - dom/svg/DOMSVGLength.cpp - dom/svg/DOMSVGLength.h - dom/svg/DOMSVGPoint.cpp - dom/svg/DOMSVGPoint.h - dom/svg/DOMSVGPointList.cpp - dom/svg/DOMSVGPointList.h - dom/svg/DOMSVGStringList.cpp - dom/svg/DOMSVGStringList.h - gfx/thebes/gfxFont.cpp - modules/libpref/init/StaticPrefList.yaml - netwerk/base/nsIOService.cpp - netwerk/base/nsSocketTransport2.cpp - netwerk/protocol/http/HttpConnectionUDP.cpp - netwerk/test/unit/trr_common.js - toolkit/components/aboutmemory/content/aboutMemory.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -482,6 +482,11 @@ pref("network.http.http2.default-hpack-buffer", 65536, locked); pref("network.http.http2.websockets", true, locked); pref("network.http.http2.enable-hpack-dump", false, locked); +// Block 0.0.0.0 +// https://bugzilla.mozilla.org/show_bug.cgi?id=1889130 +// tor-browser#43811 +pref("network.socket.ip_addr_any.disabled", true); + // tor-browser#23044: Make sure we don't have any GIO supported protocols // (defense in depth measure) pref("network.gio.supported-protocols", ""); ===================================== dom/svg/DOMSVGLength.cpp ===================================== @@ -51,6 +51,7 @@ DOMSVGLength::DOMSVGLength(DOMSVGLengthList* aList, uint8_t aAttrEnum, mListIndex(aListIndex), mAttrEnum(aAttrEnum), mIsAnimValItem(aIsAnimValItem), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) { MOZ_ASSERT(aList, "bad arg"); MOZ_ASSERT(mAttrEnum == aAttrEnum, "bitfield too small"); @@ -63,6 +64,7 @@ DOMSVGLength::DOMSVGLength() mListIndex(0), mAttrEnum(0), mIsAnimValItem(false), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) {} DOMSVGLength::DOMSVGLength(SVGAnimatedLength* aVal, SVGElement* aSVGElement, @@ -71,6 +73,7 @@ DOMSVGLength::DOMSVGLength(SVGAnimatedLength* aVal, SVGElement* aSVGElement, mListIndex(0), mAttrEnum(aVal->mAttrEnum), mIsAnimValItem(aAnimVal), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) { MOZ_ASSERT(aVal, "bad arg"); MOZ_ASSERT(mAttrEnum == aVal->mAttrEnum, "bitfield too small"); @@ -88,22 +91,33 @@ void DOMSVGLength::CleanupWeakRefs() { // Similarly, we must update the tearoff table to remove its (non-owning) // pointer to mVal. - if (nsCOMPtr<SVGElement> svg = do_QueryInterface(mOwner)) { - auto& table = mIsAnimValItem ? sAnimSVGLengthTearOffTable - : sBaseSVGLengthTearOffTable; - table.RemoveTearoff(svg->GetAnimatedLength(mAttrEnum)); + if (mIsInTearoffTable) { + nsCOMPtr<SVGElement> svg = do_QueryInterface(mOwner); + MOZ_ASSERT(svg, + "We need our svgElement reference in order to remove " + "ourselves from tearoff table..."); + if (MOZ_LIKELY(svg)) { + auto& table = mIsAnimValItem ? sAnimSVGLengthTearOffTable + : sBaseSVGLengthTearOffTable; + table.RemoveTearoff(svg->GetAnimatedLength(mAttrEnum)); + mIsInTearoffTable = false; + } } } already_AddRefed<DOMSVGLength> DOMSVGLength::GetTearOff(SVGAnimatedLength* aVal, SVGElement* aSVGElement, bool aAnimVal) { + MOZ_ASSERT(aVal && aSVGElement, "Expecting non-null aVal and aSVGElement"); + MOZ_ASSERT(aVal == aSVGElement->GetAnimatedLength(aVal->mAttrEnum), + "Mismatched aVal/SVGElement?"); auto& table = aAnimVal ? sAnimSVGLengthTearOffTable : sBaseSVGLengthTearOffTable; RefPtr<DOMSVGLength> domLength = table.GetTearoff(aVal); if (!domLength) { domLength = new DOMSVGLength(aVal, aSVGElement, aAnimVal); table.AddTearoff(aVal, domLength); + domLength->mIsInTearoffTable = true; } return domLength.forget(); ===================================== dom/svg/DOMSVGLength.h ===================================== @@ -15,7 +15,7 @@ #include "mozilla/Attributes.h" #include "nsWrapperCache.h" -#define MOZ_SVG_LIST_INDEX_BIT_COUNT 22 // supports > 4 million list items +#define MOZ_SVG_LIST_INDEX_BIT_COUNT 21 // supports > 2 million list items namespace mozilla { @@ -198,6 +198,13 @@ class DOMSVGLength final : public nsWrapperCache { uint32_t mAttrEnum : 4; // supports up to 16 attributes uint32_t mIsAnimValItem : 1; + // Tracks whether we're in the tearoff table. Initialized to false in the + // ctor, but then immediately set to true after we're added to the table + // (unless we're an instance created via 'Copy()'; those never get added to + // the table). Updated to false when we're removed from the table (at which + // point we're being destructed or soon-to-be destructed). + uint32_t mIsInTearoffTable : 1; + // The following members are only used when we're not in a list: uint32_t mUnit : 5; // can handle 31 units (the 10 SVG 1.1 units + rem, vw, // vh, wm, calc + future additions) ===================================== dom/svg/DOMSVGPoint.cpp ===================================== @@ -168,6 +168,7 @@ already_AddRefed<DOMSVGPoint> DOMSVGPoint::GetTranslateTearOff( if (!domPoint) { domPoint = new DOMSVGPoint(aVal, aSVGSVGElement); sSVGTranslateTearOffTable.AddTearoff(aVal, domPoint); + domPoint->mIsInTearoffTable = true; } return domPoint.forget(); @@ -204,12 +205,18 @@ void DOMSVGPoint::CleanupWeakRefs() { pointList->mItems[mListIndex] = nullptr; } + if (mIsInTearoffTable) { + // Similarly, we must update the tearoff table to remove its (non-owning) + // pointer to mVal. + MOZ_ASSERT(mVal && mIsTranslatePoint, + "Tearoff table should only be used for translate-point objects " + "with non-null mVal (see GetTranslateTearOff and its callers)"); + sSVGTranslateTearOffTable.RemoveTearoff(mVal); + mIsInTearoffTable = false; + } + if (mVal) { - if (mIsTranslatePoint) { - // Similarly, we must update the tearoff table to remove its (non-owning) - // pointer to mVal. - sSVGTranslateTearOffTable.RemoveTearoff(mVal); - } else { + if (!mIsTranslatePoint) { // In this case we own mVal delete mVal; } ===================================== dom/svg/DOMSVGPoint.h ===================================== @@ -17,7 +17,7 @@ #include "mozilla/dom/SVGSVGElement.h" #include "mozilla/gfx/2D.h" -#define MOZ_SVG_LIST_INDEX_BIT_COUNT 30 +#define MOZ_SVG_LIST_INDEX_BIT_COUNT 29 namespace mozilla::dom { struct DOMMatrix2DInit; @@ -51,7 +51,8 @@ class DOMSVGPoint final : public nsWrapperCache { mOwner(aList), mListIndex(aListIndex), mIsAnimValItem(aIsAnimValItem), - mIsTranslatePoint(false) { + mIsTranslatePoint(false), + mIsInTearoffTable(false) { // These shifts are in sync with the members. MOZ_ASSERT(aList && aListIndex <= MaxListIndex(), "bad arg"); @@ -60,7 +61,10 @@ class DOMSVGPoint final : public nsWrapperCache { // Constructor for unowned points and SVGSVGElement.createSVGPoint explicit DOMSVGPoint(const Point& aPt) - : mListIndex(0), mIsAnimValItem(false), mIsTranslatePoint(false) { + : mListIndex(0), + mIsAnimValItem(false), + mIsTranslatePoint(false), + mIsInTearoffTable(false) { // In this case we own mVal mVal = new SVGPoint(aPt.x, aPt.y); } @@ -72,7 +76,8 @@ class DOMSVGPoint final : public nsWrapperCache { mOwner(ToSupports(aSVGSVGElement)), mListIndex(0), mIsAnimValItem(false), - mIsTranslatePoint(true) {} + mIsTranslatePoint(true), + mIsInTearoffTable(false) {} virtual ~DOMSVGPoint() { CleanupWeakRefs(); } @@ -178,6 +183,12 @@ class DOMSVGPoint final : public nsWrapperCache { uint32_t mListIndex : MOZ_SVG_LIST_INDEX_BIT_COUNT; uint32_t mIsAnimValItem : 1; // True if We're the animated value of a list uint32_t mIsTranslatePoint : 1; // true iff our owner is a SVGSVGElement + + // Tracks whether we're in the tearoff table. Initialized to false in the + // ctor, but then immediately set to true if/when we're added to the table + // (not all instances are). Updated to false when we're removed from the + // table (at which point we're being destructed or soon-to-be destructed). + uint32_t mIsInTearoffTable : 1; }; } // namespace mozilla::dom ===================================== dom/svg/DOMSVGPointList.cpp ===================================== @@ -88,9 +88,12 @@ void DOMSVGPointList::RemoveFromTearoffTable() { // // There are now no longer any references to us held by script or list items. // Note we must use GetAnimValKey/GetBaseValKey here, NOT InternalList()! - void* key = mIsAnimValList ? InternalAList().GetAnimValKey() - : InternalAList().GetBaseValKey(); - SVGPointListTearoffTable().RemoveTearoff(key); + if (mIsInTearoffTable) { + void* key = mIsAnimValList ? InternalAList().GetAnimValKey() + : InternalAList().GetBaseValKey(); + SVGPointListTearoffTable().RemoveTearoff(key); + mIsInTearoffTable = false; + } } DOMSVGPointList::~DOMSVGPointList() { RemoveFromTearoffTable(); } ===================================== dom/svg/DOMSVGPointList.h ===================================== @@ -250,6 +250,12 @@ class DOMSVGPointList final : public nsISupports, public nsWrapperCache { RefPtr<dom::SVGElement> mElement; bool mIsAnimValList; + + // Tracks whether we're in the tearoff table. Initialized to true, since all + // new instances are added to the table right after construction. Updated to + // false when we're removed from the table (at which point we're being + // destructed or soon-to-be destructed). + bool mIsInTearoffTable = true; }; NS_DEFINE_STATIC_IID_ACCESSOR(DOMSVGPointList, MOZILLA_DOMSVGPOINTLIST_IID) ===================================== dom/svg/DOMSVGStringList.cpp ===================================== @@ -91,7 +91,10 @@ already_AddRefed<DOMSVGStringList> DOMSVGStringList::GetDOMWrapper( void DOMSVGStringList::RemoveFromTearoffTable() { // Script no longer has any references to us. - SVGStringListTearoffTable().RemoveTearoff(&InternalList()); + if (mIsInTearoffTable) { + SVGStringListTearoffTable().RemoveTearoff(&InternalList()); + mIsInTearoffTable = false; + } } DOMSVGStringList::~DOMSVGStringList() { RemoveFromTearoffTable(); } ===================================== dom/svg/DOMSVGStringList.h ===================================== @@ -108,6 +108,12 @@ class DOMSVGStringList final : public nsISupports, public nsWrapperCache { uint8_t mAttrEnum; bool mIsConditionalProcessingAttribute; + + // Tracks whether we're in the tearoff table. Initialized to true, since all + // new instances are added to the table right after construction. Updated to + // false when we're removed from the table (at which point we're being + // destructed or soon-to-be destructed). + bool mIsInTearoffTable = true; }; } // namespace dom ===================================== gfx/thebes/gfxFont.cpp ===================================== @@ -1293,8 +1293,12 @@ static const hb_tag_t defaultFeatures[] = { void gfxFont::CheckForFeaturesInvolvingSpace() const { gfxFontEntry::SpaceFeatures flags = gfxFontEntry::SpaceFeatures::None; + // mFontEntry->mHasSpaceFeatures is a std::atomic<>, so we set it with + // `exchange` to avoid a potential data race. It's ok if two threads both + // try to set it; they'll end up with the same value, so it doesn't matter + // that one will overwrite the other. auto setFlags = - MakeScopeExit([&]() { mFontEntry->mHasSpaceFeatures = flags; }); + MakeScopeExit([&]() { mFontEntry->mHasSpaceFeatures.exchange(flags); }); bool log = LOG_FONTINIT_ENABLED(); TimeStamp start; ===================================== modules/libpref/init/StaticPrefList.yaml ===================================== @@ -11735,6 +11735,13 @@ value: true mirror: always +# Disable requests to 0.0.0.0 +# See Bug 1889130 +- name: network.socket.ip_addr_any.disabled + type: RelaxedAtomicBool + value: @IS_EARLY_BETA_OR_EARLIER@ + mirror: always + # Set true to allow resolving proxy for localhost - name: network.proxy.allow_hijacking_localhost type: RelaxedAtomicBool ===================================== netwerk/base/nsIOService.cpp ===================================== @@ -230,6 +230,7 @@ static const char* gCallbackPrefsForSocketProcess[] = { "network.proxy.allow_hijacking_localhost", "network.connectivity-service.", "network.captive-portal-service.testMode", + "network.socket.ip_addr_any.disabled", nullptr, }; ===================================== netwerk/base/nsSocketTransport2.cpp ===================================== @@ -1245,6 +1245,15 @@ nsresult nsSocketTransport::InitiateSocket() { if (gIOService->IsNetTearingDown()) { return NS_ERROR_ABORT; } + + // Since https://github.com/whatwg/fetch/pull/1763, + // we need to disable access to 0.0.0.0 for non-test purposes + if (StaticPrefs::network_socket_ip_addr_any_disabled() && + mNetAddr.IsIPAddrAny() && !mProxyTransparentResolvesHost) { + SOCKET_LOG(("connection refused NS_ERROR_CONNECTION_REFUSED\n")); + return NS_ERROR_CONNECTION_REFUSED; + } + if (gIOService->IsOffline()) { if (StaticPrefs::network_disable_localhost_when_offline() || !isLocal) { return NS_ERROR_OFFLINE; ===================================== netwerk/protocol/http/HttpConnectionUDP.cpp ===================================== @@ -86,6 +86,15 @@ nsresult HttpConnectionUDP::Init(nsHttpConnectionInfo* info, return rv; } + // We are disabling 0.0.0.0 for non-test purposes. + // See https://github.com/whatwg/fetch/pull/1763 for context. + if (peerAddr.IsIPAddrAny()) { + if (StaticPrefs::network_socket_ip_addr_any_disabled()) { + LOG(("Connection refused because of 0.0.0.0 IP address\n")); + return NS_ERROR_CONNECTION_REFUSED; + } + } + mSocket = do_CreateInstance("@mozilla.org/network/udp-socket;1", &rv); if (NS_FAILED(rv)) { return rv; ===================================== netwerk/test/unit/trr_common.js ===================================== @@ -1025,6 +1025,7 @@ async function test_ipv4_trr_fallback() { async function test_no_retry_without_doh() { info("Bug 1648147 - if the TRR returns 0.0.0.0 we should not retry with DNS"); Services.prefs.setBoolPref("network.trr.fallback-on-zero-response", false); + Services.prefs.setBoolPref("network.socket.ip_addr_any.disabled", false); async function test(url, ip) { setModeAndURI(2, `doh?responseIP=${ip}`); @@ -1071,6 +1072,8 @@ async function test_no_retry_without_doh() { await test(`http://unknown.ipv4.stuff:666/path`, "0.0.0.0"); await test(`http://unknown.ipv6.stuff:666/path`, "::"); } + + Services.prefs.clearUserPref("network.socket.ip_addr_any.disabled"); } async function test_connection_reuse_and_cycling() { ===================================== toolkit/components/aboutmemory/content/aboutMemory.js ===================================== @@ -506,19 +506,11 @@ window.onload = function () { appendElementWithText(gFooter, "div", "legend", legendText1); appendElementWithText(gFooter, "div", "legend hiddenOnMobile", legendText2); - // See if we're loading from a file. (Because about:memory is a non-standard - // URL, location.search is undefined, so we have to use location.href - // instead.) - let search = location.href.split("?")[1]; - if (search) { - let searchSplit = search.split("&"); - for (let s of searchSplit) { - if (s.toLowerCase().startsWith("file=")) { - let filename = s.substring("file=".length); - updateAboutMemoryFromFile(decodeURIComponent(filename)); - return; - } - } + // See if we're loading from a file. + let { searchParams } = URL.fromURI(document.documentURIObject); + let fileParam = searchParams.get("file"); + if (fileParam) { + updateAboutMemoryFromFile(fileParam); } }; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/be8b37… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/be8b37… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.11.0esr-14.5-1] 7 commits: Bug 1889130 - block http requests on 0.0.0.0 address. r=necko-reviewers,valentin,kershaw
by morgan (＠morgan) 26 May '25

26 May '25

morgan pushed to branch base-browser-128.11.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 67609f51 by smayya at 2025-05-26T20:22:49+00:00 Bug 1889130 - block http requests on 0.0.0.0 address. r=necko-reviewers,valentin,kershaw Differential Revision: https://phabricator.services.mozilla.com/D219041 - - - - - 9135b49b by hackademix at 2025-05-26T20:22:49+00:00 fixup! Firefox preference overrides. BB 43811: Block 0.0.0.0 - - - - - 3863a3bb by Oskar Mansfeld at 2025-05-26T20:22:49+00:00 Bug 1914583 - Block IPAddrAny on H3 code path. r=necko-reviewers,kershaw Differential Revision: https://phabricator.services.mozilla.com/D239514 - - - - - 23aa8fbb by Daniel Holbert at 2025-05-26T20:22:50+00:00 Bug 1742738 part 1: Tighten up tearoff-table removal for DOMSVGPointList and DOMSVGStringList. r=firefox-svg-reviewers,longsonr Differential Revision: https://phabricator.services.mozilla.com/D246062 - - - - - a75f2376 by Daniel Holbert at 2025-05-26T20:22:50+00:00 Bug 1742738 part 2: Tighten up tearoff-table removal for DOMSVGLength. r=firefox-svg-reviewers,longsonr I'm doing this one in its own patch since it's slightly more subtle than the others, due to the existence of multiple instance-creation codepaths, some of which generate instances that never end up in the tearoff table. Differential Revision: https://phabricator.services.mozilla.com/D246063 - - - - - ab86560a by Daniel Holbert at 2025-05-26T20:22:50+00:00 Bug 1742738 part 3: Tighten up tearoff-table removal for DOMSVGPoint. r=firefox-svg-reviewers,longsonr I'm doing this one in its own patch since it's slightly more subtle than the others, due to the existence of multiple instance-creation codepaths, some of which generate instances that never end up in the tearoff table. Differential Revision: https://phabricator.services.mozilla.com/D246065 - - - - - 5ae92208 by Gijs Kruitbosch at 2025-05-26T20:22:51+00:00 Bug 1959298 - use search params in about:memory, r=mccr8 Differential Revision: https://phabricator.services.mozilla.com/D245049 - - - - - 15 changed files: - browser/app/profile/001-base-profile.js - dom/svg/DOMSVGLength.cpp - dom/svg/DOMSVGLength.h - dom/svg/DOMSVGPoint.cpp - dom/svg/DOMSVGPoint.h - dom/svg/DOMSVGPointList.cpp - dom/svg/DOMSVGPointList.h - dom/svg/DOMSVGStringList.cpp - dom/svg/DOMSVGStringList.h - modules/libpref/init/StaticPrefList.yaml - netwerk/base/nsIOService.cpp - netwerk/base/nsSocketTransport2.cpp - netwerk/protocol/http/HttpConnectionUDP.cpp - netwerk/test/unit/trr_common.js - toolkit/components/aboutmemory/content/aboutMemory.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -536,6 +536,11 @@ pref("network.proxy.failover_direct", false, locked); // alters content load order in a page. See tor-browser#24686 pref("network.http.tailing.enabled", true, locked); +// Block 0.0.0.0 +// https://bugzilla.mozilla.org/show_bug.cgi?id=1889130 +// tor-browser#43811 +pref("network.socket.ip_addr_any.disabled", true); + // tor-browser#23044: Make sure we don't have any GIO supported protocols // (defense in depth measure). // As of Firefox 118 (Bug 1843763), upstream does not add any protocol by ===================================== dom/svg/DOMSVGLength.cpp ===================================== @@ -51,6 +51,7 @@ DOMSVGLength::DOMSVGLength(DOMSVGLengthList* aList, uint8_t aAttrEnum, mListIndex(aListIndex), mAttrEnum(aAttrEnum), mIsAnimValItem(aIsAnimValItem), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) { MOZ_ASSERT(aList, "bad arg"); MOZ_ASSERT(mAttrEnum == aAttrEnum, "bitfield too small"); @@ -63,6 +64,7 @@ DOMSVGLength::DOMSVGLength() mListIndex(0), mAttrEnum(0), mIsAnimValItem(false), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) {} DOMSVGLength::DOMSVGLength(SVGAnimatedLength* aVal, SVGElement* aSVGElement, @@ -71,6 +73,7 @@ DOMSVGLength::DOMSVGLength(SVGAnimatedLength* aVal, SVGElement* aSVGElement, mListIndex(0), mAttrEnum(aVal->mAttrEnum), mIsAnimValItem(aAnimVal), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) { MOZ_ASSERT(aVal, "bad arg"); MOZ_ASSERT(mAttrEnum == aVal->mAttrEnum, "bitfield too small"); @@ -88,22 +91,33 @@ void DOMSVGLength::CleanupWeakRefs() { // Similarly, we must update the tearoff table to remove its (non-owning) // pointer to mVal. - if (nsCOMPtr<SVGElement> svg = do_QueryInterface(mOwner)) { - auto& table = mIsAnimValItem ? sAnimSVGLengthTearOffTable - : sBaseSVGLengthTearOffTable; - table.RemoveTearoff(svg->GetAnimatedLength(mAttrEnum)); + if (mIsInTearoffTable) { + nsCOMPtr<SVGElement> svg = do_QueryInterface(mOwner); + MOZ_ASSERT(svg, + "We need our svgElement reference in order to remove " + "ourselves from tearoff table..."); + if (MOZ_LIKELY(svg)) { + auto& table = mIsAnimValItem ? sAnimSVGLengthTearOffTable + : sBaseSVGLengthTearOffTable; + table.RemoveTearoff(svg->GetAnimatedLength(mAttrEnum)); + mIsInTearoffTable = false; + } } } already_AddRefed<DOMSVGLength> DOMSVGLength::GetTearOff(SVGAnimatedLength* aVal, SVGElement* aSVGElement, bool aAnimVal) { + MOZ_ASSERT(aVal && aSVGElement, "Expecting non-null aVal and aSVGElement"); + MOZ_ASSERT(aVal == aSVGElement->GetAnimatedLength(aVal->mAttrEnum), + "Mismatched aVal/SVGElement?"); auto& table = aAnimVal ? sAnimSVGLengthTearOffTable : sBaseSVGLengthTearOffTable; RefPtr<DOMSVGLength> domLength = table.GetTearoff(aVal); if (!domLength) { domLength = new DOMSVGLength(aVal, aSVGElement, aAnimVal); table.AddTearoff(aVal, domLength); + domLength->mIsInTearoffTable = true; } return domLength.forget(); ===================================== dom/svg/DOMSVGLength.h ===================================== @@ -15,7 +15,7 @@ #include "mozilla/Attributes.h" #include "nsWrapperCache.h" -#define MOZ_SVG_LIST_INDEX_BIT_COUNT 22 // supports > 4 million list items +#define MOZ_SVG_LIST_INDEX_BIT_COUNT 21 // supports > 2 million list items namespace mozilla { @@ -204,6 +204,13 @@ class DOMSVGLength final : public nsWrapperCache { uint32_t mAttrEnum : 4; // supports up to 16 attributes uint32_t mIsAnimValItem : 1; + // Tracks whether we're in the tearoff table. Initialized to false in the + // ctor, but then immediately set to true after we're added to the table + // (unless we're an instance created via 'Copy()'; those never get added to + // the table). Updated to false when we're removed from the table (at which + // point we're being destructed or soon-to-be destructed). + uint32_t mIsInTearoffTable : 1; + // The following members are only used when we're not in a list: uint32_t mUnit : 5; // can handle 31 units (the 10 SVG 1.1 units + rem, vw, // vh, wm, calc + future additions) ===================================== dom/svg/DOMSVGPoint.cpp ===================================== @@ -167,6 +167,7 @@ already_AddRefed<DOMSVGPoint> DOMSVGPoint::GetTranslateTearOff( if (!domPoint) { domPoint = new DOMSVGPoint(aVal, aSVGSVGElement); sSVGTranslateTearOffTable.AddTearoff(aVal, domPoint); + domPoint->mIsInTearoffTable = true; } return domPoint.forget(); @@ -203,12 +204,18 @@ void DOMSVGPoint::CleanupWeakRefs() { pointList->mItems[mListIndex] = nullptr; } + if (mIsInTearoffTable) { + // Similarly, we must update the tearoff table to remove its (non-owning) + // pointer to mVal. + MOZ_ASSERT(mVal && mIsTranslatePoint, + "Tearoff table should only be used for translate-point objects " + "with non-null mVal (see GetTranslateTearOff and its callers)"); + sSVGTranslateTearOffTable.RemoveTearoff(mVal); + mIsInTearoffTable = false; + } + if (mVal) { - if (mIsTranslatePoint) { - // Similarly, we must update the tearoff table to remove its (non-owning) - // pointer to mVal. - sSVGTranslateTearOffTable.RemoveTearoff(mVal); - } else { + if (!mIsTranslatePoint) { // In this case we own mVal delete mVal; } ===================================== dom/svg/DOMSVGPoint.h ===================================== @@ -17,7 +17,7 @@ #include "mozilla/dom/SVGSVGElement.h" #include "mozilla/gfx/2D.h" -#define MOZ_SVG_LIST_INDEX_BIT_COUNT 30 +#define MOZ_SVG_LIST_INDEX_BIT_COUNT 29 namespace mozilla::dom { struct DOMMatrix2DInit; @@ -51,7 +51,8 @@ class DOMSVGPoint final : public nsWrapperCache { mOwner(aList), mListIndex(aListIndex), mIsAnimValItem(aIsAnimValItem), - mIsTranslatePoint(false) { + mIsTranslatePoint(false), + mIsInTearoffTable(false) { // These shifts are in sync with the members. MOZ_ASSERT(aList && aListIndex <= MaxListIndex(), "bad arg"); @@ -60,7 +61,10 @@ class DOMSVGPoint final : public nsWrapperCache { // Constructor for unowned points and SVGSVGElement.createSVGPoint explicit DOMSVGPoint(const Point& aPt) - : mListIndex(0), mIsAnimValItem(false), mIsTranslatePoint(false) { + : mListIndex(0), + mIsAnimValItem(false), + mIsTranslatePoint(false), + mIsInTearoffTable(false) { // In this case we own mVal mVal = new SVGPoint(aPt.x, aPt.y); } @@ -72,7 +76,8 @@ class DOMSVGPoint final : public nsWrapperCache { mOwner(ToSupports(aSVGSVGElement)), mListIndex(0), mIsAnimValItem(false), - mIsTranslatePoint(true) {} + mIsTranslatePoint(true), + mIsInTearoffTable(false) {} virtual ~DOMSVGPoint() { CleanupWeakRefs(); } @@ -178,6 +183,12 @@ class DOMSVGPoint final : public nsWrapperCache { uint32_t mListIndex : MOZ_SVG_LIST_INDEX_BIT_COUNT; uint32_t mIsAnimValItem : 1; // True if We're the animated value of a list uint32_t mIsTranslatePoint : 1; // true iff our owner is a SVGSVGElement + + // Tracks whether we're in the tearoff table. Initialized to false in the + // ctor, but then immediately set to true if/when we're added to the table + // (not all instances are). Updated to false when we're removed from the + // table (at which point we're being destructed or soon-to-be destructed). + uint32_t mIsInTearoffTable : 1; }; } // namespace mozilla::dom ===================================== dom/svg/DOMSVGPointList.cpp ===================================== @@ -90,9 +90,12 @@ void DOMSVGPointList::RemoveFromTearoffTable() { // // There are now no longer any references to us held by script or list items. // Note we must use GetAnimValKey/GetBaseValKey here, NOT InternalList()! - void* key = mIsAnimValList ? InternalAList().GetAnimValKey() - : InternalAList().GetBaseValKey(); - SVGPointListTearoffTable().RemoveTearoff(key); + if (mIsInTearoffTable) { + void* key = mIsAnimValList ? InternalAList().GetAnimValKey() + : InternalAList().GetBaseValKey(); + SVGPointListTearoffTable().RemoveTearoff(key); + mIsInTearoffTable = false; + } } DOMSVGPointList::~DOMSVGPointList() { RemoveFromTearoffTable(); } ===================================== dom/svg/DOMSVGPointList.h ===================================== @@ -251,6 +251,12 @@ class DOMSVGPointList final : public nsISupports, public nsWrapperCache { RefPtr<dom::SVGElement> mElement; bool mIsAnimValList; + + // Tracks whether we're in the tearoff table. Initialized to true, since all + // new instances are added to the table right after construction. Updated to + // false when we're removed from the table (at which point we're being + // destructed or soon-to-be destructed). + bool mIsInTearoffTable = true; }; NS_DEFINE_STATIC_IID_ACCESSOR(DOMSVGPointList, MOZILLA_DOMSVGPOINTLIST_IID) ===================================== dom/svg/DOMSVGStringList.cpp ===================================== @@ -91,7 +91,10 @@ already_AddRefed<DOMSVGStringList> DOMSVGStringList::GetDOMWrapper( void DOMSVGStringList::RemoveFromTearoffTable() { // Script no longer has any references to us. - SVGStringListTearoffTable().RemoveTearoff(&InternalList()); + if (mIsInTearoffTable) { + SVGStringListTearoffTable().RemoveTearoff(&InternalList()); + mIsInTearoffTable = false; + } } DOMSVGStringList::~DOMSVGStringList() { RemoveFromTearoffTable(); } ===================================== dom/svg/DOMSVGStringList.h ===================================== @@ -108,6 +108,12 @@ class DOMSVGStringList final : public nsISupports, public nsWrapperCache { uint8_t mAttrEnum; bool mIsConditionalProcessingAttribute; + + // Tracks whether we're in the tearoff table. Initialized to true, since all + // new instances are added to the table right after construction. Updated to + // false when we're removed from the table (at which point we're being + // destructed or soon-to-be destructed). + bool mIsInTearoffTable = true; }; } // namespace dom ===================================== modules/libpref/init/StaticPrefList.yaml ===================================== @@ -12175,6 +12175,13 @@ value: true mirror: always +# Disable requests to 0.0.0.0 +# See Bug 1889130 +- name: network.socket.ip_addr_any.disabled + type: RelaxedAtomicBool + value: @IS_EARLY_BETA_OR_EARLIER@ + mirror: always + # Set true to allow resolving proxy for localhost - name: network.proxy.allow_hijacking_localhost type: RelaxedAtomicBool ===================================== netwerk/base/nsIOService.cpp ===================================== @@ -239,6 +239,7 @@ static const char* gCallbackPrefsForSocketProcess[] = { "network.proxy.allow_hijacking_localhost", "network.connectivity-service.", "network.captive-portal-service.testMode", + "network.socket.ip_addr_any.disabled", nullptr, }; ===================================== netwerk/base/nsSocketTransport2.cpp ===================================== @@ -1241,6 +1241,15 @@ nsresult nsSocketTransport::InitiateSocket() { if (gIOService->IsNetTearingDown()) { return NS_ERROR_ABORT; } + + // Since https://github.com/whatwg/fetch/pull/1763, + // we need to disable access to 0.0.0.0 for non-test purposes + if (StaticPrefs::network_socket_ip_addr_any_disabled() && + mNetAddr.IsIPAddrAny() && !mProxyTransparentResolvesHost) { + SOCKET_LOG(("connection refused NS_ERROR_CONNECTION_REFUSED\n")); + return NS_ERROR_CONNECTION_REFUSED; + } + if (gIOService->IsOffline()) { if (StaticPrefs::network_disable_localhost_when_offline() || !isLocal) { return NS_ERROR_OFFLINE; ===================================== netwerk/protocol/http/HttpConnectionUDP.cpp ===================================== @@ -19,6 +19,7 @@ #include "ASpdySession.h" #include "mozilla/StaticPrefs_network.h" +#include "mozilla/glean/NetwerkMetrics.h" #include "mozilla/Telemetry.h" #include "HttpConnectionUDP.h" #include "nsHttpHandler.h" @@ -88,6 +89,22 @@ nsresult HttpConnectionUDP::Init(nsHttpConnectionInfo* info, return rv; } + // We are disabling 0.0.0.0 for non-test purposes. + // See https://github.com/whatwg/fetch/pull/1763 for context. + if (peerAddr.IsIPAddrAny()) { + if (StaticPrefs::network_socket_ip_addr_any_disabled()) { + mozilla::glean::networking::http_ip_addr_any_count + .Get("blocked_requests"_ns) + .Add(1); + LOG(("Connection refused because of 0.0.0.0 IP address\n")); + return NS_ERROR_CONNECTION_REFUSED; + } + + mozilla::glean::networking::http_ip_addr_any_count + .Get("not_blocked_requests"_ns) + .Add(1); + } + mSocket = do_CreateInstance("@mozilla.org/network/udp-socket;1", &rv); if (NS_FAILED(rv)) { return rv; ===================================== netwerk/test/unit/trr_common.js ===================================== @@ -1027,6 +1027,7 @@ async function test_ipv4_trr_fallback() { async function test_no_retry_without_doh() { info("Bug 1648147 - if the TRR returns 0.0.0.0 we should not retry with DNS"); Services.prefs.setBoolPref("network.trr.fallback-on-zero-response", false); + Services.prefs.setBoolPref("network.socket.ip_addr_any.disabled", false); async function test(url, ip) { setModeAndURI(2, `doh?responseIP=${ip}`); @@ -1073,6 +1074,8 @@ async function test_no_retry_without_doh() { await test(`http://unknown.ipv4.stuff:666/path`, "0.0.0.0"); await test(`http://unknown.ipv6.stuff:666/path`, "::"); } + + Services.prefs.clearUserPref("network.socket.ip_addr_any.disabled"); } async function test_connection_reuse_and_cycling() { ===================================== toolkit/components/aboutmemory/content/aboutMemory.js ===================================== @@ -508,19 +508,11 @@ window.onload = function () { appendElementWithText(gFooter, "div", "legend", legendText1); appendElementWithText(gFooter, "div", "legend hiddenOnMobile", legendText2); - // See if we're loading from a file. (Because about:memory is a non-standard - // URL, location.search is undefined, so we have to use location.href - // instead.) - let search = location.href.split("?")[1]; - if (search) { - let searchSplit = search.split("&"); - for (let s of searchSplit) { - if (s.toLowerCase().startsWith("file=")) { - let filename = s.substring("file=".length); - updateAboutMemoryFromFile(decodeURIComponent(filename)); - return; - } - } + // See if we're loading from a file. + let { searchParams } = URL.fromURI(document.documentURIObject); + let fileParam = searchParams.get("file"); + if (fileParam) { + updateAboutMemoryFromFile(fileParam); } }; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/6a2fa0… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/6a2fa0… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-128.11.0esr-14.5-1-build2
by morgan (＠morgan) 26 May '25

26 May '25

morgan pushed new tag mullvad-browser-128.11.0esr-14.5-1-build2 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.11.0esr-14.5-1] 7 commits: Bug 1889130 - block http requests on 0.0.0.0 address. r=necko-reviewers,valentin,kershaw
by morgan (＠morgan) 26 May '25

26 May '25

morgan pushed to branch mullvad-browser-128.11.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser Commits: d3f83daa by smayya at 2025-05-26T20:03:31+00:00 Bug 1889130 - block http requests on 0.0.0.0 address. r=necko-reviewers,valentin,kershaw Differential Revision: https://phabricator.services.mozilla.com/D219041 - - - - - f13fc799 by hackademix at 2025-05-26T20:03:31+00:00 fixup! Firefox preference overrides. BB 43811: Block 0.0.0.0 - - - - - 557f124b by Oskar Mansfeld at 2025-05-26T20:03:32+00:00 Bug 1914583 - Block IPAddrAny on H3 code path. r=necko-reviewers,kershaw Differential Revision: https://phabricator.services.mozilla.com/D239514 - - - - - 493492d2 by Daniel Holbert at 2025-05-26T20:03:32+00:00 Bug 1742738 part 1: Tighten up tearoff-table removal for DOMSVGPointList and DOMSVGStringList. r=firefox-svg-reviewers,longsonr Differential Revision: https://phabricator.services.mozilla.com/D246062 - - - - - e486547a by Daniel Holbert at 2025-05-26T20:03:32+00:00 Bug 1742738 part 2: Tighten up tearoff-table removal for DOMSVGLength. r=firefox-svg-reviewers,longsonr I'm doing this one in its own patch since it's slightly more subtle than the others, due to the existence of multiple instance-creation codepaths, some of which generate instances that never end up in the tearoff table. Differential Revision: https://phabricator.services.mozilla.com/D246063 - - - - - c1566bd8 by Daniel Holbert at 2025-05-26T20:03:32+00:00 Bug 1742738 part 3: Tighten up tearoff-table removal for DOMSVGPoint. r=firefox-svg-reviewers,longsonr I'm doing this one in its own patch since it's slightly more subtle than the others, due to the existence of multiple instance-creation codepaths, some of which generate instances that never end up in the tearoff table. Differential Revision: https://phabricator.services.mozilla.com/D246065 - - - - - d686ade4 by Gijs Kruitbosch at 2025-05-26T20:03:33+00:00 Bug 1959298 - use search params in about:memory, r=mccr8 Differential Revision: https://phabricator.services.mozilla.com/D245049 - - - - - 15 changed files: - browser/app/profile/001-base-profile.js - dom/svg/DOMSVGLength.cpp - dom/svg/DOMSVGLength.h - dom/svg/DOMSVGPoint.cpp - dom/svg/DOMSVGPoint.h - dom/svg/DOMSVGPointList.cpp - dom/svg/DOMSVGPointList.h - dom/svg/DOMSVGStringList.cpp - dom/svg/DOMSVGStringList.h - modules/libpref/init/StaticPrefList.yaml - netwerk/base/nsIOService.cpp - netwerk/base/nsSocketTransport2.cpp - netwerk/protocol/http/HttpConnectionUDP.cpp - netwerk/test/unit/trr_common.js - toolkit/components/aboutmemory/content/aboutMemory.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -536,6 +536,11 @@ pref("network.proxy.failover_direct", false, locked); // alters content load order in a page. See tor-browser#24686 pref("network.http.tailing.enabled", true, locked); +// Block 0.0.0.0 +// https://bugzilla.mozilla.org/show_bug.cgi?id=1889130 +// tor-browser#43811 +pref("network.socket.ip_addr_any.disabled", true); + // tor-browser#23044: Make sure we don't have any GIO supported protocols // (defense in depth measure). // As of Firefox 118 (Bug 1843763), upstream does not add any protocol by ===================================== dom/svg/DOMSVGLength.cpp ===================================== @@ -51,6 +51,7 @@ DOMSVGLength::DOMSVGLength(DOMSVGLengthList* aList, uint8_t aAttrEnum, mListIndex(aListIndex), mAttrEnum(aAttrEnum), mIsAnimValItem(aIsAnimValItem), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) { MOZ_ASSERT(aList, "bad arg"); MOZ_ASSERT(mAttrEnum == aAttrEnum, "bitfield too small"); @@ -63,6 +64,7 @@ DOMSVGLength::DOMSVGLength() mListIndex(0), mAttrEnum(0), mIsAnimValItem(false), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) {} DOMSVGLength::DOMSVGLength(SVGAnimatedLength* aVal, SVGElement* aSVGElement, @@ -71,6 +73,7 @@ DOMSVGLength::DOMSVGLength(SVGAnimatedLength* aVal, SVGElement* aSVGElement, mListIndex(0), mAttrEnum(aVal->mAttrEnum), mIsAnimValItem(aAnimVal), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) { MOZ_ASSERT(aVal, "bad arg"); MOZ_ASSERT(mAttrEnum == aVal->mAttrEnum, "bitfield too small"); @@ -88,22 +91,33 @@ void DOMSVGLength::CleanupWeakRefs() { // Similarly, we must update the tearoff table to remove its (non-owning) // pointer to mVal. - if (nsCOMPtr<SVGElement> svg = do_QueryInterface(mOwner)) { - auto& table = mIsAnimValItem ? sAnimSVGLengthTearOffTable - : sBaseSVGLengthTearOffTable; - table.RemoveTearoff(svg->GetAnimatedLength(mAttrEnum)); + if (mIsInTearoffTable) { + nsCOMPtr<SVGElement> svg = do_QueryInterface(mOwner); + MOZ_ASSERT(svg, + "We need our svgElement reference in order to remove " + "ourselves from tearoff table..."); + if (MOZ_LIKELY(svg)) { + auto& table = mIsAnimValItem ? sAnimSVGLengthTearOffTable + : sBaseSVGLengthTearOffTable; + table.RemoveTearoff(svg->GetAnimatedLength(mAttrEnum)); + mIsInTearoffTable = false; + } } } already_AddRefed<DOMSVGLength> DOMSVGLength::GetTearOff(SVGAnimatedLength* aVal, SVGElement* aSVGElement, bool aAnimVal) { + MOZ_ASSERT(aVal && aSVGElement, "Expecting non-null aVal and aSVGElement"); + MOZ_ASSERT(aVal == aSVGElement->GetAnimatedLength(aVal->mAttrEnum), + "Mismatched aVal/SVGElement?"); auto& table = aAnimVal ? sAnimSVGLengthTearOffTable : sBaseSVGLengthTearOffTable; RefPtr<DOMSVGLength> domLength = table.GetTearoff(aVal); if (!domLength) { domLength = new DOMSVGLength(aVal, aSVGElement, aAnimVal); table.AddTearoff(aVal, domLength); + domLength->mIsInTearoffTable = true; } return domLength.forget(); ===================================== dom/svg/DOMSVGLength.h ===================================== @@ -15,7 +15,7 @@ #include "mozilla/Attributes.h" #include "nsWrapperCache.h" -#define MOZ_SVG_LIST_INDEX_BIT_COUNT 22 // supports > 4 million list items +#define MOZ_SVG_LIST_INDEX_BIT_COUNT 21 // supports > 2 million list items namespace mozilla { @@ -204,6 +204,13 @@ class DOMSVGLength final : public nsWrapperCache { uint32_t mAttrEnum : 4; // supports up to 16 attributes uint32_t mIsAnimValItem : 1; + // Tracks whether we're in the tearoff table. Initialized to false in the + // ctor, but then immediately set to true after we're added to the table + // (unless we're an instance created via 'Copy()'; those never get added to + // the table). Updated to false when we're removed from the table (at which + // point we're being destructed or soon-to-be destructed). + uint32_t mIsInTearoffTable : 1; + // The following members are only used when we're not in a list: uint32_t mUnit : 5; // can handle 31 units (the 10 SVG 1.1 units + rem, vw, // vh, wm, calc + future additions) ===================================== dom/svg/DOMSVGPoint.cpp ===================================== @@ -167,6 +167,7 @@ already_AddRefed<DOMSVGPoint> DOMSVGPoint::GetTranslateTearOff( if (!domPoint) { domPoint = new DOMSVGPoint(aVal, aSVGSVGElement); sSVGTranslateTearOffTable.AddTearoff(aVal, domPoint); + domPoint->mIsInTearoffTable = true; } return domPoint.forget(); @@ -203,12 +204,18 @@ void DOMSVGPoint::CleanupWeakRefs() { pointList->mItems[mListIndex] = nullptr; } + if (mIsInTearoffTable) { + // Similarly, we must update the tearoff table to remove its (non-owning) + // pointer to mVal. + MOZ_ASSERT(mVal && mIsTranslatePoint, + "Tearoff table should only be used for translate-point objects " + "with non-null mVal (see GetTranslateTearOff and its callers)"); + sSVGTranslateTearOffTable.RemoveTearoff(mVal); + mIsInTearoffTable = false; + } + if (mVal) { - if (mIsTranslatePoint) { - // Similarly, we must update the tearoff table to remove its (non-owning) - // pointer to mVal. - sSVGTranslateTearOffTable.RemoveTearoff(mVal); - } else { + if (!mIsTranslatePoint) { // In this case we own mVal delete mVal; } ===================================== dom/svg/DOMSVGPoint.h ===================================== @@ -17,7 +17,7 @@ #include "mozilla/dom/SVGSVGElement.h" #include "mozilla/gfx/2D.h" -#define MOZ_SVG_LIST_INDEX_BIT_COUNT 30 +#define MOZ_SVG_LIST_INDEX_BIT_COUNT 29 namespace mozilla::dom { struct DOMMatrix2DInit; @@ -51,7 +51,8 @@ class DOMSVGPoint final : public nsWrapperCache { mOwner(aList), mListIndex(aListIndex), mIsAnimValItem(aIsAnimValItem), - mIsTranslatePoint(false) { + mIsTranslatePoint(false), + mIsInTearoffTable(false) { // These shifts are in sync with the members. MOZ_ASSERT(aList && aListIndex <= MaxListIndex(), "bad arg"); @@ -60,7 +61,10 @@ class DOMSVGPoint final : public nsWrapperCache { // Constructor for unowned points and SVGSVGElement.createSVGPoint explicit DOMSVGPoint(const Point& aPt) - : mListIndex(0), mIsAnimValItem(false), mIsTranslatePoint(false) { + : mListIndex(0), + mIsAnimValItem(false), + mIsTranslatePoint(false), + mIsInTearoffTable(false) { // In this case we own mVal mVal = new SVGPoint(aPt.x, aPt.y); } @@ -72,7 +76,8 @@ class DOMSVGPoint final : public nsWrapperCache { mOwner(ToSupports(aSVGSVGElement)), mListIndex(0), mIsAnimValItem(false), - mIsTranslatePoint(true) {} + mIsTranslatePoint(true), + mIsInTearoffTable(false) {} virtual ~DOMSVGPoint() { CleanupWeakRefs(); } @@ -178,6 +183,12 @@ class DOMSVGPoint final : public nsWrapperCache { uint32_t mListIndex : MOZ_SVG_LIST_INDEX_BIT_COUNT; uint32_t mIsAnimValItem : 1; // True if We're the animated value of a list uint32_t mIsTranslatePoint : 1; // true iff our owner is a SVGSVGElement + + // Tracks whether we're in the tearoff table. Initialized to false in the + // ctor, but then immediately set to true if/when we're added to the table + // (not all instances are). Updated to false when we're removed from the + // table (at which point we're being destructed or soon-to-be destructed). + uint32_t mIsInTearoffTable : 1; }; } // namespace mozilla::dom ===================================== dom/svg/DOMSVGPointList.cpp ===================================== @@ -90,9 +90,12 @@ void DOMSVGPointList::RemoveFromTearoffTable() { // // There are now no longer any references to us held by script or list items. // Note we must use GetAnimValKey/GetBaseValKey here, NOT InternalList()! - void* key = mIsAnimValList ? InternalAList().GetAnimValKey() - : InternalAList().GetBaseValKey(); - SVGPointListTearoffTable().RemoveTearoff(key); + if (mIsInTearoffTable) { + void* key = mIsAnimValList ? InternalAList().GetAnimValKey() + : InternalAList().GetBaseValKey(); + SVGPointListTearoffTable().RemoveTearoff(key); + mIsInTearoffTable = false; + } } DOMSVGPointList::~DOMSVGPointList() { RemoveFromTearoffTable(); } ===================================== dom/svg/DOMSVGPointList.h ===================================== @@ -251,6 +251,12 @@ class DOMSVGPointList final : public nsISupports, public nsWrapperCache { RefPtr<dom::SVGElement> mElement; bool mIsAnimValList; + + // Tracks whether we're in the tearoff table. Initialized to true, since all + // new instances are added to the table right after construction. Updated to + // false when we're removed from the table (at which point we're being + // destructed or soon-to-be destructed). + bool mIsInTearoffTable = true; }; NS_DEFINE_STATIC_IID_ACCESSOR(DOMSVGPointList, MOZILLA_DOMSVGPOINTLIST_IID) ===================================== dom/svg/DOMSVGStringList.cpp ===================================== @@ -91,7 +91,10 @@ already_AddRefed<DOMSVGStringList> DOMSVGStringList::GetDOMWrapper( void DOMSVGStringList::RemoveFromTearoffTable() { // Script no longer has any references to us. - SVGStringListTearoffTable().RemoveTearoff(&InternalList()); + if (mIsInTearoffTable) { + SVGStringListTearoffTable().RemoveTearoff(&InternalList()); + mIsInTearoffTable = false; + } } DOMSVGStringList::~DOMSVGStringList() { RemoveFromTearoffTable(); } ===================================== dom/svg/DOMSVGStringList.h ===================================== @@ -108,6 +108,12 @@ class DOMSVGStringList final : public nsISupports, public nsWrapperCache { uint8_t mAttrEnum; bool mIsConditionalProcessingAttribute; + + // Tracks whether we're in the tearoff table. Initialized to true, since all + // new instances are added to the table right after construction. Updated to + // false when we're removed from the table (at which point we're being + // destructed or soon-to-be destructed). + bool mIsInTearoffTable = true; }; } // namespace dom ===================================== modules/libpref/init/StaticPrefList.yaml ===================================== @@ -12175,6 +12175,13 @@ value: true mirror: always +# Disable requests to 0.0.0.0 +# See Bug 1889130 +- name: network.socket.ip_addr_any.disabled + type: RelaxedAtomicBool + value: @IS_EARLY_BETA_OR_EARLIER@ + mirror: always + # Set true to allow resolving proxy for localhost - name: network.proxy.allow_hijacking_localhost type: RelaxedAtomicBool ===================================== netwerk/base/nsIOService.cpp ===================================== @@ -239,6 +239,7 @@ static const char* gCallbackPrefsForSocketProcess[] = { "network.proxy.allow_hijacking_localhost", "network.connectivity-service.", "network.captive-portal-service.testMode", + "network.socket.ip_addr_any.disabled", nullptr, }; ===================================== netwerk/base/nsSocketTransport2.cpp ===================================== @@ -1241,6 +1241,15 @@ nsresult nsSocketTransport::InitiateSocket() { if (gIOService->IsNetTearingDown()) { return NS_ERROR_ABORT; } + + // Since https://github.com/whatwg/fetch/pull/1763, + // we need to disable access to 0.0.0.0 for non-test purposes + if (StaticPrefs::network_socket_ip_addr_any_disabled() && + mNetAddr.IsIPAddrAny() && !mProxyTransparentResolvesHost) { + SOCKET_LOG(("connection refused NS_ERROR_CONNECTION_REFUSED\n")); + return NS_ERROR_CONNECTION_REFUSED; + } + if (gIOService->IsOffline()) { if (StaticPrefs::network_disable_localhost_when_offline() || !isLocal) { return NS_ERROR_OFFLINE; ===================================== netwerk/protocol/http/HttpConnectionUDP.cpp ===================================== @@ -19,6 +19,7 @@ #include "ASpdySession.h" #include "mozilla/StaticPrefs_network.h" +#include "mozilla/glean/NetwerkMetrics.h" #include "mozilla/Telemetry.h" #include "HttpConnectionUDP.h" #include "nsHttpHandler.h" @@ -88,6 +89,22 @@ nsresult HttpConnectionUDP::Init(nsHttpConnectionInfo* info, return rv; } + // We are disabling 0.0.0.0 for non-test purposes. + // See https://github.com/whatwg/fetch/pull/1763 for context. + if (peerAddr.IsIPAddrAny()) { + if (StaticPrefs::network_socket_ip_addr_any_disabled()) { + mozilla::glean::networking::http_ip_addr_any_count + .Get("blocked_requests"_ns) + .Add(1); + LOG(("Connection refused because of 0.0.0.0 IP address\n")); + return NS_ERROR_CONNECTION_REFUSED; + } + + mozilla::glean::networking::http_ip_addr_any_count + .Get("not_blocked_requests"_ns) + .Add(1); + } + mSocket = do_CreateInstance("@mozilla.org/network/udp-socket;1", &rv); if (NS_FAILED(rv)) { return rv; ===================================== netwerk/test/unit/trr_common.js ===================================== @@ -1027,6 +1027,7 @@ async function test_ipv4_trr_fallback() { async function test_no_retry_without_doh() { info("Bug 1648147 - if the TRR returns 0.0.0.0 we should not retry with DNS"); Services.prefs.setBoolPref("network.trr.fallback-on-zero-response", false); + Services.prefs.setBoolPref("network.socket.ip_addr_any.disabled", false); async function test(url, ip) { setModeAndURI(2, `doh?responseIP=${ip}`); @@ -1073,6 +1074,8 @@ async function test_no_retry_without_doh() { await test(`http://unknown.ipv4.stuff:666/path`, "0.0.0.0"); await test(`http://unknown.ipv6.stuff:666/path`, "::"); } + + Services.prefs.clearUserPref("network.socket.ip_addr_any.disabled"); } async function test_connection_reuse_and_cycling() { ===================================== toolkit/components/aboutmemory/content/aboutMemory.js ===================================== @@ -508,19 +508,11 @@ window.onload = function () { appendElementWithText(gFooter, "div", "legend", legendText1); appendElementWithText(gFooter, "div", "legend hiddenOnMobile", legendText2); - // See if we're loading from a file. (Because about:memory is a non-standard - // URL, location.search is undefined, so we have to use location.href - // instead.) - let search = location.href.split("?")[1]; - if (search) { - let searchSplit = search.split("&"); - for (let s of searchSplit) { - if (s.toLowerCase().startsWith("file=")) { - let filename = s.substring("file=".length); - updateAboutMemoryFromFile(decodeURIComponent(filename)); - return; - } - } + // See if we're loading from a file. + let { searchParams } = URL.fromURI(document.documentURIObject); + let fileParam = searchParams.get("file"); + if (fileParam) { + updateAboutMemoryFromFile(fileParam); } }; View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/6c… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/6c… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-128.11.0esr-14.5-1-build2
by morgan (＠morgan) 26 May '25

26 May '25

morgan pushed new tag tor-browser-128.11.0esr-14.5-1-build2 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.11.0esr-14.5-1] Deleted 1 commit: Merge branch 'tb43811_sb128' into 'tor-browser-128.11.0esr-14.5-1'
by morgan (＠morgan) 26 May '25

26 May '25

morgan pushed to branch tor-browser-128.11.0esr-14.5-1 at The Tor Project / Applications / Tor Browser WARNING: The push did not contain any new commits, but force pushed to delete the commits and changes below. Deleted commits: ab178f3e by morgan at 2025-05-26T15:45:37+00:00 Merge branch 'tb43811_sb128' into 'tor-browser-128.11.0esr-14.5-1' BB 43811 (esr128): Backport security fixes from Firefox 139 See merge request ma1/tor-browser-confidential!19 - - - - - 0 changed files: Changes: View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ab178f3… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ab178f3… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Deleted tag tor-browser-128.11.0esr-14.5-1-build2
by morgan (＠morgan) 26 May '25

26 May '25

morgan deleted tag tor-browser-128.11.0esr-14.5-1-build2 at The Tor Project / Applications / Tor Browser -- You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-128.11.0esr-14.5-1-build2
by morgan (＠morgan) 26 May '25

26 May '25

morgan pushed new tag tor-browser-128.11.0esr-14.5-1-build2 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.11.0esr-14.5-1] 8 commits: Bug 1889130 - block http requests on 0.0.0.0 address. r=necko-reviewers,valentin,kershaw
by morgan (＠morgan) 26 May '25

26 May '25

morgan pushed to branch tor-browser-128.11.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: cf2ad16e by smayya at 2025-05-23T15:19:13+02:00 Bug 1889130 - block http requests on 0.0.0.0 address. r=necko-reviewers,valentin,kershaw Differential Revision: https://phabricator.services.mozilla.com/D219041 - - - - - cfce6bf9 by hackademix at 2025-05-23T15:32:07+02:00 fixup! Firefox preference overrides. BB 43811: Block 0.0.0.0 - - - - - 35fdd814 by Oskar Mansfeld at 2025-05-23T15:32:20+02:00 Bug 1914583 - Block IPAddrAny on H3 code path. r=necko-reviewers,kershaw Differential Revision: https://phabricator.services.mozilla.com/D239514 - - - - - 43f9f11c by Daniel Holbert at 2025-05-23T15:32:21+02:00 Bug 1742738 part 1: Tighten up tearoff-table removal for DOMSVGPointList and DOMSVGStringList. r=firefox-svg-reviewers,longsonr Differential Revision: https://phabricator.services.mozilla.com/D246062 - - - - - 52f4b900 by Daniel Holbert at 2025-05-23T15:32:22+02:00 Bug 1742738 part 2: Tighten up tearoff-table removal for DOMSVGLength. r=firefox-svg-reviewers,longsonr I'm doing this one in its own patch since it's slightly more subtle than the others, due to the existence of multiple instance-creation codepaths, some of which generate instances that never end up in the tearoff table. Differential Revision: https://phabricator.services.mozilla.com/D246063 - - - - - bec689db by Daniel Holbert at 2025-05-23T15:32:22+02:00 Bug 1742738 part 3: Tighten up tearoff-table removal for DOMSVGPoint. r=firefox-svg-reviewers,longsonr I'm doing this one in its own patch since it's slightly more subtle than the others, due to the existence of multiple instance-creation codepaths, some of which generate instances that never end up in the tearoff table. Differential Revision: https://phabricator.services.mozilla.com/D246065 - - - - - bdc25770 by Gijs Kruitbosch at 2025-05-23T16:01:30+02:00 Bug 1959298 - use search params in about:memory, r=mccr8 Differential Revision: https://phabricator.services.mozilla.com/D245049 - - - - - ab178f3e by morgan at 2025-05-26T15:45:37+00:00 Merge branch 'tb43811_sb128' into 'tor-browser-128.11.0esr-14.5-1' BB 43811 (esr128): Backport security fixes from Firefox 139 See merge request ma1/tor-browser-confidential!19 - - - - - 15 changed files: - browser/app/profile/001-base-profile.js - dom/svg/DOMSVGLength.cpp - dom/svg/DOMSVGLength.h - dom/svg/DOMSVGPoint.cpp - dom/svg/DOMSVGPoint.h - dom/svg/DOMSVGPointList.cpp - dom/svg/DOMSVGPointList.h - dom/svg/DOMSVGStringList.cpp - dom/svg/DOMSVGStringList.h - modules/libpref/init/StaticPrefList.yaml - netwerk/base/nsIOService.cpp - netwerk/base/nsSocketTransport2.cpp - netwerk/protocol/http/HttpConnectionUDP.cpp - netwerk/test/unit/trr_common.js - toolkit/components/aboutmemory/content/aboutMemory.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -536,6 +536,11 @@ pref("network.proxy.failover_direct", false, locked); // alters content load order in a page. See tor-browser#24686 pref("network.http.tailing.enabled", true, locked); +// Block 0.0.0.0 +// https://bugzilla.mozilla.org/show_bug.cgi?id=1889130 +// tor-browser#43811 +pref("network.socket.ip_addr_any.disabled", true); + // tor-browser#23044: Make sure we don't have any GIO supported protocols // (defense in depth measure). // As of Firefox 118 (Bug 1843763), upstream does not add any protocol by ===================================== dom/svg/DOMSVGLength.cpp ===================================== @@ -51,6 +51,7 @@ DOMSVGLength::DOMSVGLength(DOMSVGLengthList* aList, uint8_t aAttrEnum, mListIndex(aListIndex), mAttrEnum(aAttrEnum), mIsAnimValItem(aIsAnimValItem), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) { MOZ_ASSERT(aList, "bad arg"); MOZ_ASSERT(mAttrEnum == aAttrEnum, "bitfield too small"); @@ -63,6 +64,7 @@ DOMSVGLength::DOMSVGLength() mListIndex(0), mAttrEnum(0), mIsAnimValItem(false), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) {} DOMSVGLength::DOMSVGLength(SVGAnimatedLength* aVal, SVGElement* aSVGElement, @@ -71,6 +73,7 @@ DOMSVGLength::DOMSVGLength(SVGAnimatedLength* aVal, SVGElement* aSVGElement, mListIndex(0), mAttrEnum(aVal->mAttrEnum), mIsAnimValItem(aAnimVal), + mIsInTearoffTable(false), mUnit(SVGLength_Binding::SVG_LENGTHTYPE_NUMBER) { MOZ_ASSERT(aVal, "bad arg"); MOZ_ASSERT(mAttrEnum == aVal->mAttrEnum, "bitfield too small"); @@ -88,22 +91,33 @@ void DOMSVGLength::CleanupWeakRefs() { // Similarly, we must update the tearoff table to remove its (non-owning) // pointer to mVal. - if (nsCOMPtr<SVGElement> svg = do_QueryInterface(mOwner)) { - auto& table = mIsAnimValItem ? sAnimSVGLengthTearOffTable - : sBaseSVGLengthTearOffTable; - table.RemoveTearoff(svg->GetAnimatedLength(mAttrEnum)); + if (mIsInTearoffTable) { + nsCOMPtr<SVGElement> svg = do_QueryInterface(mOwner); + MOZ_ASSERT(svg, + "We need our svgElement reference in order to remove " + "ourselves from tearoff table..."); + if (MOZ_LIKELY(svg)) { + auto& table = mIsAnimValItem ? sAnimSVGLengthTearOffTable + : sBaseSVGLengthTearOffTable; + table.RemoveTearoff(svg->GetAnimatedLength(mAttrEnum)); + mIsInTearoffTable = false; + } } } already_AddRefed<DOMSVGLength> DOMSVGLength::GetTearOff(SVGAnimatedLength* aVal, SVGElement* aSVGElement, bool aAnimVal) { + MOZ_ASSERT(aVal && aSVGElement, "Expecting non-null aVal and aSVGElement"); + MOZ_ASSERT(aVal == aSVGElement->GetAnimatedLength(aVal->mAttrEnum), + "Mismatched aVal/SVGElement?"); auto& table = aAnimVal ? sAnimSVGLengthTearOffTable : sBaseSVGLengthTearOffTable; RefPtr<DOMSVGLength> domLength = table.GetTearoff(aVal); if (!domLength) { domLength = new DOMSVGLength(aVal, aSVGElement, aAnimVal); table.AddTearoff(aVal, domLength); + domLength->mIsInTearoffTable = true; } return domLength.forget(); ===================================== dom/svg/DOMSVGLength.h ===================================== @@ -15,7 +15,7 @@ #include "mozilla/Attributes.h" #include "nsWrapperCache.h" -#define MOZ_SVG_LIST_INDEX_BIT_COUNT 22 // supports > 4 million list items +#define MOZ_SVG_LIST_INDEX_BIT_COUNT 21 // supports > 2 million list items namespace mozilla { @@ -204,6 +204,13 @@ class DOMSVGLength final : public nsWrapperCache { uint32_t mAttrEnum : 4; // supports up to 16 attributes uint32_t mIsAnimValItem : 1; + // Tracks whether we're in the tearoff table. Initialized to false in the + // ctor, but then immediately set to true after we're added to the table + // (unless we're an instance created via 'Copy()'; those never get added to + // the table). Updated to false when we're removed from the table (at which + // point we're being destructed or soon-to-be destructed). + uint32_t mIsInTearoffTable : 1; + // The following members are only used when we're not in a list: uint32_t mUnit : 5; // can handle 31 units (the 10 SVG 1.1 units + rem, vw, // vh, wm, calc + future additions) ===================================== dom/svg/DOMSVGPoint.cpp ===================================== @@ -167,6 +167,7 @@ already_AddRefed<DOMSVGPoint> DOMSVGPoint::GetTranslateTearOff( if (!domPoint) { domPoint = new DOMSVGPoint(aVal, aSVGSVGElement); sSVGTranslateTearOffTable.AddTearoff(aVal, domPoint); + domPoint->mIsInTearoffTable = true; } return domPoint.forget(); @@ -203,12 +204,18 @@ void DOMSVGPoint::CleanupWeakRefs() { pointList->mItems[mListIndex] = nullptr; } + if (mIsInTearoffTable) { + // Similarly, we must update the tearoff table to remove its (non-owning) + // pointer to mVal. + MOZ_ASSERT(mVal && mIsTranslatePoint, + "Tearoff table should only be used for translate-point objects " + "with non-null mVal (see GetTranslateTearOff and its callers)"); + sSVGTranslateTearOffTable.RemoveTearoff(mVal); + mIsInTearoffTable = false; + } + if (mVal) { - if (mIsTranslatePoint) { - // Similarly, we must update the tearoff table to remove its (non-owning) - // pointer to mVal. - sSVGTranslateTearOffTable.RemoveTearoff(mVal); - } else { + if (!mIsTranslatePoint) { // In this case we own mVal delete mVal; } ===================================== dom/svg/DOMSVGPoint.h ===================================== @@ -17,7 +17,7 @@ #include "mozilla/dom/SVGSVGElement.h" #include "mozilla/gfx/2D.h" -#define MOZ_SVG_LIST_INDEX_BIT_COUNT 30 +#define MOZ_SVG_LIST_INDEX_BIT_COUNT 29 namespace mozilla::dom { struct DOMMatrix2DInit; @@ -51,7 +51,8 @@ class DOMSVGPoint final : public nsWrapperCache { mOwner(aList), mListIndex(aListIndex), mIsAnimValItem(aIsAnimValItem), - mIsTranslatePoint(false) { + mIsTranslatePoint(false), + mIsInTearoffTable(false) { // These shifts are in sync with the members. MOZ_ASSERT(aList && aListIndex <= MaxListIndex(), "bad arg"); @@ -60,7 +61,10 @@ class DOMSVGPoint final : public nsWrapperCache { // Constructor for unowned points and SVGSVGElement.createSVGPoint explicit DOMSVGPoint(const Point& aPt) - : mListIndex(0), mIsAnimValItem(false), mIsTranslatePoint(false) { + : mListIndex(0), + mIsAnimValItem(false), + mIsTranslatePoint(false), + mIsInTearoffTable(false) { // In this case we own mVal mVal = new SVGPoint(aPt.x, aPt.y); } @@ -72,7 +76,8 @@ class DOMSVGPoint final : public nsWrapperCache { mOwner(ToSupports(aSVGSVGElement)), mListIndex(0), mIsAnimValItem(false), - mIsTranslatePoint(true) {} + mIsTranslatePoint(true), + mIsInTearoffTable(false) {} virtual ~DOMSVGPoint() { CleanupWeakRefs(); } @@ -178,6 +183,12 @@ class DOMSVGPoint final : public nsWrapperCache { uint32_t mListIndex : MOZ_SVG_LIST_INDEX_BIT_COUNT; uint32_t mIsAnimValItem : 1; // True if We're the animated value of a list uint32_t mIsTranslatePoint : 1; // true iff our owner is a SVGSVGElement + + // Tracks whether we're in the tearoff table. Initialized to false in the + // ctor, but then immediately set to true if/when we're added to the table + // (not all instances are). Updated to false when we're removed from the + // table (at which point we're being destructed or soon-to-be destructed). + uint32_t mIsInTearoffTable : 1; }; } // namespace mozilla::dom ===================================== dom/svg/DOMSVGPointList.cpp ===================================== @@ -90,9 +90,12 @@ void DOMSVGPointList::RemoveFromTearoffTable() { // // There are now no longer any references to us held by script or list items. // Note we must use GetAnimValKey/GetBaseValKey here, NOT InternalList()! - void* key = mIsAnimValList ? InternalAList().GetAnimValKey() - : InternalAList().GetBaseValKey(); - SVGPointListTearoffTable().RemoveTearoff(key); + if (mIsInTearoffTable) { + void* key = mIsAnimValList ? InternalAList().GetAnimValKey() + : InternalAList().GetBaseValKey(); + SVGPointListTearoffTable().RemoveTearoff(key); + mIsInTearoffTable = false; + } } DOMSVGPointList::~DOMSVGPointList() { RemoveFromTearoffTable(); } ===================================== dom/svg/DOMSVGPointList.h ===================================== @@ -251,6 +251,12 @@ class DOMSVGPointList final : public nsISupports, public nsWrapperCache { RefPtr<dom::SVGElement> mElement; bool mIsAnimValList; + + // Tracks whether we're in the tearoff table. Initialized to true, since all + // new instances are added to the table right after construction. Updated to + // false when we're removed from the table (at which point we're being + // destructed or soon-to-be destructed). + bool mIsInTearoffTable = true; }; NS_DEFINE_STATIC_IID_ACCESSOR(DOMSVGPointList, MOZILLA_DOMSVGPOINTLIST_IID) ===================================== dom/svg/DOMSVGStringList.cpp ===================================== @@ -91,7 +91,10 @@ already_AddRefed<DOMSVGStringList> DOMSVGStringList::GetDOMWrapper( void DOMSVGStringList::RemoveFromTearoffTable() { // Script no longer has any references to us. - SVGStringListTearoffTable().RemoveTearoff(&InternalList()); + if (mIsInTearoffTable) { + SVGStringListTearoffTable().RemoveTearoff(&InternalList()); + mIsInTearoffTable = false; + } } DOMSVGStringList::~DOMSVGStringList() { RemoveFromTearoffTable(); } ===================================== dom/svg/DOMSVGStringList.h ===================================== @@ -108,6 +108,12 @@ class DOMSVGStringList final : public nsISupports, public nsWrapperCache { uint8_t mAttrEnum; bool mIsConditionalProcessingAttribute; + + // Tracks whether we're in the tearoff table. Initialized to true, since all + // new instances are added to the table right after construction. Updated to + // false when we're removed from the table (at which point we're being + // destructed or soon-to-be destructed). + bool mIsInTearoffTable = true; }; } // namespace dom ===================================== modules/libpref/init/StaticPrefList.yaml ===================================== @@ -12183,6 +12183,13 @@ value: true mirror: always +# Disable requests to 0.0.0.0 +# See Bug 1889130 +- name: network.socket.ip_addr_any.disabled + type: RelaxedAtomicBool + value: @IS_EARLY_BETA_OR_EARLIER@ + mirror: always + # Set true to allow resolving proxy for localhost - name: network.proxy.allow_hijacking_localhost type: RelaxedAtomicBool ===================================== netwerk/base/nsIOService.cpp ===================================== @@ -239,6 +239,7 @@ static const char* gCallbackPrefsForSocketProcess[] = { "network.proxy.allow_hijacking_localhost", "network.connectivity-service.", "network.captive-portal-service.testMode", + "network.socket.ip_addr_any.disabled", nullptr, }; ===================================== netwerk/base/nsSocketTransport2.cpp ===================================== @@ -1247,6 +1247,15 @@ nsresult nsSocketTransport::InitiateSocket() { if (gIOService->IsNetTearingDown()) { return NS_ERROR_ABORT; } + + // Since https://github.com/whatwg/fetch/pull/1763, + // we need to disable access to 0.0.0.0 for non-test purposes + if (StaticPrefs::network_socket_ip_addr_any_disabled() && + mNetAddr.IsIPAddrAny() && !mProxyTransparentResolvesHost) { + SOCKET_LOG(("connection refused NS_ERROR_CONNECTION_REFUSED\n")); + return NS_ERROR_CONNECTION_REFUSED; + } + if (gIOService->IsOffline()) { if (StaticPrefs::network_disable_localhost_when_offline() || !isLocal) { return NS_ERROR_OFFLINE; ===================================== netwerk/protocol/http/HttpConnectionUDP.cpp ===================================== @@ -19,6 +19,7 @@ #include "ASpdySession.h" #include "mozilla/StaticPrefs_network.h" +#include "mozilla/glean/NetwerkMetrics.h" #include "mozilla/Telemetry.h" #include "HttpConnectionUDP.h" #include "nsHttpHandler.h" @@ -88,6 +89,22 @@ nsresult HttpConnectionUDP::Init(nsHttpConnectionInfo* info, return rv; } + // We are disabling 0.0.0.0 for non-test purposes. + // See https://github.com/whatwg/fetch/pull/1763 for context. + if (peerAddr.IsIPAddrAny()) { + if (StaticPrefs::network_socket_ip_addr_any_disabled()) { + mozilla::glean::networking::http_ip_addr_any_count + .Get("blocked_requests"_ns) + .Add(1); + LOG(("Connection refused because of 0.0.0.0 IP address\n")); + return NS_ERROR_CONNECTION_REFUSED; + } + + mozilla::glean::networking::http_ip_addr_any_count + .Get("not_blocked_requests"_ns) + .Add(1); + } + mSocket = do_CreateInstance("@mozilla.org/network/udp-socket;1", &rv); if (NS_FAILED(rv)) { return rv; ===================================== netwerk/test/unit/trr_common.js ===================================== @@ -1027,6 +1027,7 @@ async function test_ipv4_trr_fallback() { async function test_no_retry_without_doh() { info("Bug 1648147 - if the TRR returns 0.0.0.0 we should not retry with DNS"); Services.prefs.setBoolPref("network.trr.fallback-on-zero-response", false); + Services.prefs.setBoolPref("network.socket.ip_addr_any.disabled", false); async function test(url, ip) { setModeAndURI(2, `doh?responseIP=${ip}`); @@ -1073,6 +1074,8 @@ async function test_no_retry_without_doh() { await test(`http://unknown.ipv4.stuff:666/path`, "0.0.0.0"); await test(`http://unknown.ipv6.stuff:666/path`, "::"); } + + Services.prefs.clearUserPref("network.socket.ip_addr_any.disabled"); } async function test_connection_reuse_and_cycling() { ===================================== toolkit/components/aboutmemory/content/aboutMemory.js ===================================== @@ -508,19 +508,11 @@ window.onload = function () { appendElementWithText(gFooter, "div", "legend", legendText1); appendElementWithText(gFooter, "div", "legend hiddenOnMobile", legendText2); - // See if we're loading from a file. (Because about:memory is a non-standard - // URL, location.search is undefined, so we have to use location.href - // instead.) - let search = location.href.split("?")[1]; - if (search) { - let searchSplit = search.split("&"); - for (let s of searchSplit) { - if (s.toLowerCase().startsWith("file=")) { - let filename = s.substring("file=".length); - updateAboutMemoryFromFile(decodeURIComponent(filename)); - return; - } - } + // See if we're loading from a file. + let { searchParams } = URL.fromURI(document.documentURIObject); + let fileParam = searchParams.get("file"); + if (fileParam) { + updateAboutMemoryFromFile(fileParam); } }; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/33b39b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/33b39b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.0a1-15.0-1] 10 commits: Revert "Bug 1967673 - [devtools] Don't omit valid safe getter undefined values...
by Pier Angelo Vendrame (＠pierov) 26 May '25

26 May '25

Pier Angelo Vendrame pushed to branch tor-browser-140.0a1-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 04d5ed8b by Cristian Tuns at 2025-05-25T10:25:19+00:00 Revert "Bug 1967673 - [devtools] Don't omit valid safe getter undefined values in _findSafeGetterValues. r=devtools-reviewers,jdescottes" for causing failures with "1 not in success codes: [0] " This reverts commit f73f8eabd8fa3ac6eda50c66cca3b397de343861. - - - - - e2e0c44c by Nicolas Chevobbe at 2025-05-25T10:56:48+00:00 Bug 1967673 - [devtools] Don't omit valid safe getter undefined values in _findSafeGetterValues. r=devtools-reviewers,jdescottes DONTBUILD Differential Revision: https://phabricator.services.mozilla.com/D250613 - - - - - e44cf8eb by Emilio Cobos Álvarez at 2025-05-25T12:31:48+00:00 Bug 1967551 - Remove native tabbox support. r=desktop-theme-reviewers,mac-reviewers,win-reviewers,tabbrowser-reviewers,gstoll,mstange,dao Eventually I want to simplify a lot of how the theming code deals with overriding border / padding, and this helps with that. Since bug 1765076 this isn't used anywhere, so I think simplifying this is the right trade-off. Thunderbird also doesn't use it. Differential Revision: https://phabricator.services.mozilla.com/D250314 - - - - - 6888f3ba by Release Engineering Landoscript at 2025-05-25T18:55:06+00:00 No Bug - Bumping Firefox l10n changesets r=release a=l10n-bump DONTBUILD CLOSED TREE ach -> a27e2491a9387a8146c3ff72960639f1f2c7591d af -> a27e2491a9387a8146c3ff72960639f1f2c7591d an -> a27e2491a9387a8146c3ff72960639f1f2c7591d ar -> a27e2491a9387a8146c3ff72960639f1f2c7591d ast -> a27e2491a9387a8146c3ff72960639f1f2c7591d az -> a27e2491a9387a8146c3ff72960639f1f2c7591d be -> a27e2491a9387a8146c3ff72960639f1f2c7591d bg -> a27e2491a9387a8146c3ff72960639f1f2c7591d bn -> a27e2491a9387a8146c3ff72960639f1f2c7591d bo -> a27e2491a9387a8146c3ff72960639f1f2c7591d br -> a27e2491a9387a8146c3ff72960639f1f2c7591d brx -> a27e2491a9387a8146c3ff72960639f1f2c7591d bs -> a27e2491a9387a8146c3ff72960639f1f2c7591d ca -> a27e2491a9387a8146c3ff72960639f1f2c7591d ca-valencia -> a27e2491a9387a8146c3ff72960639f1f2c7591d cak -> a27e2491a9387a8146c3ff72960639f1f2c7591d ckb -> a27e2491a9387a8146c3ff72960639f1f2c7591d cs -> a27e2491a9387a8146c3ff72960639f1f2c7591d cy -> a27e2491a9387a8146c3ff72960639f1f2c7591d da -> a27e2491a9387a8146c3ff72960639f1f2c7591d de -> a27e2491a9387a8146c3ff72960639f1f2c7591d dsb -> a27e2491a9387a8146c3ff72960639f1f2c7591d el -> a27e2491a9387a8146c3ff72960639f1f2c7591d en-CA -> a27e2491a9387a8146c3ff72960639f1f2c7591d en-GB -> a27e2491a9387a8146c3ff72960639f1f2c7591d eo -> a27e2491a9387a8146c3ff72960639f1f2c7591d es-AR -> a27e2491a9387a8146c3ff72960639f1f2c7591d es-CL -> a27e2491a9387a8146c3ff72960639f1f2c7591d es-ES -> a27e2491a9387a8146c3ff72960639f1f2c7591d es-MX -> a27e2491a9387a8146c3ff72960639f1f2c7591d et -> a27e2491a9387a8146c3ff72960639f1f2c7591d eu -> a27e2491a9387a8146c3ff72960639f1f2c7591d fa -> a27e2491a9387a8146c3ff72960639f1f2c7591d ff -> a27e2491a9387a8146c3ff72960639f1f2c7591d fi -> a27e2491a9387a8146c3ff72960639f1f2c7591d fr -> a27e2491a9387a8146c3ff72960639f1f2c7591d fur -> a27e2491a9387a8146c3ff72960639f1f2c7591d fy-NL -> a27e2491a9387a8146c3ff72960639f1f2c7591d ga-IE -> a27e2491a9387a8146c3ff72960639f1f2c7591d gd -> a27e2491a9387a8146c3ff72960639f1f2c7591d gl -> a27e2491a9387a8146c3ff72960639f1f2c7591d gn -> a27e2491a9387a8146c3ff72960639f1f2c7591d gu-IN -> a27e2491a9387a8146c3ff72960639f1f2c7591d he -> a27e2491a9387a8146c3ff72960639f1f2c7591d hi-IN -> a27e2491a9387a8146c3ff72960639f1f2c7591d hr -> a27e2491a9387a8146c3ff72960639f1f2c7591d hsb -> a27e2491a9387a8146c3ff72960639f1f2c7591d hu -> a27e2491a9387a8146c3ff72960639f1f2c7591d hy-AM -> a27e2491a9387a8146c3ff72960639f1f2c7591d hye -> a27e2491a9387a8146c3ff72960639f1f2c7591d ia -> a27e2491a9387a8146c3ff72960639f1f2c7591d id -> a27e2491a9387a8146c3ff72960639f1f2c7591d is -> a27e2491a9387a8146c3ff72960639f1f2c7591d it -> a27e2491a9387a8146c3ff72960639f1f2c7591d ja -> a27e2491a9387a8146c3ff72960639f1f2c7591d ja-JP-mac -> a27e2491a9387a8146c3ff72960639f1f2c7591d ka -> a27e2491a9387a8146c3ff72960639f1f2c7591d kab -> a27e2491a9387a8146c3ff72960639f1f2c7591d kk -> a27e2491a9387a8146c3ff72960639f1f2c7591d km -> a27e2491a9387a8146c3ff72960639f1f2c7591d kn -> a27e2491a9387a8146c3ff72960639f1f2c7591d ko -> a27e2491a9387a8146c3ff72960639f1f2c7591d lij -> a27e2491a9387a8146c3ff72960639f1f2c7591d lo -> a27e2491a9387a8146c3ff72960639f1f2c7591d lt -> a27e2491a9387a8146c3ff72960639f1f2c7591d ltg -> a27e2491a9387a8146c3ff72960639f1f2c7591d lv -> a27e2491a9387a8146c3ff72960639f1f2c7591d meh -> a27e2491a9387a8146c3ff72960639f1f2c7591d mk -> a27e2491a9387a8146c3ff72960639f1f2c7591d ml -> a27e2491a9387a8146c3ff72960639f1f2c7591d mr -> a27e2491a9387a8146c3ff72960639f1f2c7591d ms -> a27e2491a9387a8146c3ff72960639f1f2c7591d my -> a27e2491a9387a8146c3ff72960639f1f2c7591d nb-NO -> a27e2491a9387a8146c3ff72960639f1f2c7591d ne-NP -> a27e2491a9387a8146c3ff72960639f1f2c7591d nl -> a27e2491a9387a8146c3ff72960639f1f2c7591d nn-NO -> a27e2491a9387a8146c3ff72960639f1f2c7591d oc -> a27e2491a9387a8146c3ff72960639f1f2c7591d pa-IN -> a27e2491a9387a8146c3ff72960639f1f2c7591d pl -> a27e2491a9387a8146c3ff72960639f1f2c7591d pt-BR -> a27e2491a9387a8146c3ff72960639f1f2c7591d pt-PT -> a27e2491a9387a8146c3ff72960639f1f2c7591d rm -> a27e2491a9387a8146c3ff72960639f1f2c7591d ro -> a27e2491a9387a8146c3ff72960639f1f2c7591d ru -> a27e2491a9387a8146c3ff72960639f1f2c7591d sat -> a27e2491a9387a8146c3ff72960639f1f2c7591d sc -> a27e2491a9387a8146c3ff72960639f1f2c7591d scn -> a27e2491a9387a8146c3ff72960639f1f2c7591d sco -> a27e2491a9387a8146c3ff72960639f1f2c7591d si -> a27e2491a9387a8146c3ff72960639f1f2c7591d sk -> a27e2491a9387a8146c3ff72960639f1f2c7591d skr -> a27e2491a9387a8146c3ff72960639f1f2c7591d sl -> a27e2491a9387a8146c3ff72960639f1f2c7591d son -> a27e2491a9387a8146c3ff72960639f1f2c7591d sq -> a27e2491a9387a8146c3ff72960639f1f2c7591d sr -> a27e2491a9387a8146c3ff72960639f1f2c7591d sv-SE -> a27e2491a9387a8146c3ff72960639f1f2c7591d szl -> a27e2491a9387a8146c3ff72960639f1f2c7591d ta -> a27e2491a9387a8146c3ff72960639f1f2c7591d te -> a27e2491a9387a8146c3ff72960639f1f2c7591d tg -> a27e2491a9387a8146c3ff72960639f1f2c7591d th -> a27e2491a9387a8146c3ff72960639f1f2c7591d tl -> a27e2491a9387a8146c3ff72960639f1f2c7591d tr -> a27e2491a9387a8146c3ff72960639f1f2c7591d trs -> a27e2491a9387a8146c3ff72960639f1f2c7591d uk -> a27e2491a9387a8146c3ff72960639f1f2c7591d ur -> a27e2491a9387a8146c3ff72960639f1f2c7591d uz -> a27e2491a9387a8146c3ff72960639f1f2c7591d vi -> a27e2491a9387a8146c3ff72960639f1f2c7591d wo -> a27e2491a9387a8146c3ff72960639f1f2c7591d xh -> a27e2491a9387a8146c3ff72960639f1f2c7591d zh-CN -> a27e2491a9387a8146c3ff72960639f1f2c7591d zh-TW -> a27e2491a9387a8146c3ff72960639f1f2c7591d - - - - - c2c88dc8 by Release Engineering Landoscript at 2025-05-25T18:55:10+00:00 No Bug - Bumping Mobile l10n changesets r=release a=l10n-bump DONTBUILD CLOSED TREE ach -> a27e2491a9387a8146c3ff72960639f1f2c7591d an -> a27e2491a9387a8146c3ff72960639f1f2c7591d ar -> a27e2491a9387a8146c3ff72960639f1f2c7591d ast -> a27e2491a9387a8146c3ff72960639f1f2c7591d az -> a27e2491a9387a8146c3ff72960639f1f2c7591d be -> a27e2491a9387a8146c3ff72960639f1f2c7591d bg -> a27e2491a9387a8146c3ff72960639f1f2c7591d bn -> a27e2491a9387a8146c3ff72960639f1f2c7591d br -> a27e2491a9387a8146c3ff72960639f1f2c7591d bs -> a27e2491a9387a8146c3ff72960639f1f2c7591d ca -> a27e2491a9387a8146c3ff72960639f1f2c7591d cak -> a27e2491a9387a8146c3ff72960639f1f2c7591d cs -> a27e2491a9387a8146c3ff72960639f1f2c7591d cy -> a27e2491a9387a8146c3ff72960639f1f2c7591d da -> a27e2491a9387a8146c3ff72960639f1f2c7591d de -> a27e2491a9387a8146c3ff72960639f1f2c7591d dsb -> a27e2491a9387a8146c3ff72960639f1f2c7591d el -> a27e2491a9387a8146c3ff72960639f1f2c7591d en-CA -> a27e2491a9387a8146c3ff72960639f1f2c7591d en-GB -> a27e2491a9387a8146c3ff72960639f1f2c7591d eo -> a27e2491a9387a8146c3ff72960639f1f2c7591d es-AR -> a27e2491a9387a8146c3ff72960639f1f2c7591d es-CL -> a27e2491a9387a8146c3ff72960639f1f2c7591d es-ES -> a27e2491a9387a8146c3ff72960639f1f2c7591d es-MX -> a27e2491a9387a8146c3ff72960639f1f2c7591d et -> a27e2491a9387a8146c3ff72960639f1f2c7591d eu -> a27e2491a9387a8146c3ff72960639f1f2c7591d fa -> a27e2491a9387a8146c3ff72960639f1f2c7591d ff -> a27e2491a9387a8146c3ff72960639f1f2c7591d fi -> a27e2491a9387a8146c3ff72960639f1f2c7591d fr -> a27e2491a9387a8146c3ff72960639f1f2c7591d fy-NL -> a27e2491a9387a8146c3ff72960639f1f2c7591d ga-IE -> a27e2491a9387a8146c3ff72960639f1f2c7591d gd -> a27e2491a9387a8146c3ff72960639f1f2c7591d gl -> a27e2491a9387a8146c3ff72960639f1f2c7591d gn -> a27e2491a9387a8146c3ff72960639f1f2c7591d gu-IN -> a27e2491a9387a8146c3ff72960639f1f2c7591d he -> a27e2491a9387a8146c3ff72960639f1f2c7591d hi-IN -> a27e2491a9387a8146c3ff72960639f1f2c7591d hr -> a27e2491a9387a8146c3ff72960639f1f2c7591d hsb -> a27e2491a9387a8146c3ff72960639f1f2c7591d hu -> a27e2491a9387a8146c3ff72960639f1f2c7591d hy-AM -> a27e2491a9387a8146c3ff72960639f1f2c7591d ia -> a27e2491a9387a8146c3ff72960639f1f2c7591d id -> a27e2491a9387a8146c3ff72960639f1f2c7591d is -> a27e2491a9387a8146c3ff72960639f1f2c7591d it -> a27e2491a9387a8146c3ff72960639f1f2c7591d ja -> a27e2491a9387a8146c3ff72960639f1f2c7591d ka -> a27e2491a9387a8146c3ff72960639f1f2c7591d kab -> a27e2491a9387a8146c3ff72960639f1f2c7591d kk -> a27e2491a9387a8146c3ff72960639f1f2c7591d km -> a27e2491a9387a8146c3ff72960639f1f2c7591d kn -> a27e2491a9387a8146c3ff72960639f1f2c7591d ko -> a27e2491a9387a8146c3ff72960639f1f2c7591d lij -> a27e2491a9387a8146c3ff72960639f1f2c7591d lo -> a27e2491a9387a8146c3ff72960639f1f2c7591d lt -> a27e2491a9387a8146c3ff72960639f1f2c7591d ltg -> a27e2491a9387a8146c3ff72960639f1f2c7591d lv -> a27e2491a9387a8146c3ff72960639f1f2c7591d meh -> a27e2491a9387a8146c3ff72960639f1f2c7591d mix -> a27e2491a9387a8146c3ff72960639f1f2c7591d ml -> a27e2491a9387a8146c3ff72960639f1f2c7591d mr -> a27e2491a9387a8146c3ff72960639f1f2c7591d ms -> a27e2491a9387a8146c3ff72960639f1f2c7591d my -> a27e2491a9387a8146c3ff72960639f1f2c7591d nb-NO -> a27e2491a9387a8146c3ff72960639f1f2c7591d ne-NP -> a27e2491a9387a8146c3ff72960639f1f2c7591d nl -> a27e2491a9387a8146c3ff72960639f1f2c7591d nn-NO -> a27e2491a9387a8146c3ff72960639f1f2c7591d oc -> a27e2491a9387a8146c3ff72960639f1f2c7591d pa-IN -> a27e2491a9387a8146c3ff72960639f1f2c7591d pl -> a27e2491a9387a8146c3ff72960639f1f2c7591d pt-BR -> a27e2491a9387a8146c3ff72960639f1f2c7591d pt-PT -> a27e2491a9387a8146c3ff72960639f1f2c7591d rm -> a27e2491a9387a8146c3ff72960639f1f2c7591d ro -> a27e2491a9387a8146c3ff72960639f1f2c7591d ru -> a27e2491a9387a8146c3ff72960639f1f2c7591d sk -> a27e2491a9387a8146c3ff72960639f1f2c7591d sl -> a27e2491a9387a8146c3ff72960639f1f2c7591d son -> a27e2491a9387a8146c3ff72960639f1f2c7591d sq -> a27e2491a9387a8146c3ff72960639f1f2c7591d sr -> a27e2491a9387a8146c3ff72960639f1f2c7591d sv-SE -> a27e2491a9387a8146c3ff72960639f1f2c7591d ta -> a27e2491a9387a8146c3ff72960639f1f2c7591d te -> a27e2491a9387a8146c3ff72960639f1f2c7591d th -> a27e2491a9387a8146c3ff72960639f1f2c7591d tl -> a27e2491a9387a8146c3ff72960639f1f2c7591d tr -> a27e2491a9387a8146c3ff72960639f1f2c7591d trs -> a27e2491a9387a8146c3ff72960639f1f2c7591d uk -> a27e2491a9387a8146c3ff72960639f1f2c7591d ur -> a27e2491a9387a8146c3ff72960639f1f2c7591d uz -> a27e2491a9387a8146c3ff72960639f1f2c7591d vi -> a27e2491a9387a8146c3ff72960639f1f2c7591d wo -> a27e2491a9387a8146c3ff72960639f1f2c7591d xh -> a27e2491a9387a8146c3ff72960639f1f2c7591d zam -> a27e2491a9387a8146c3ff72960639f1f2c7591d zh-CN -> a27e2491a9387a8146c3ff72960639f1f2c7591d zh-TW -> a27e2491a9387a8146c3ff72960639f1f2c7591d - - - - - 027d1bde by Release Engineering Landoscript at 2025-05-26T00:10:35+00:00 No Bug - Import translations from https://github.com/mozilla-l10n/android-l10n CLOSED TREE - - - - - 4c56f201 by Release Engineering Landoscript at 2025-05-26T06:54:02+00:00 No Bug - Bumping Firefox l10n changesets r=release a=l10n-bump DONTBUILD CLOSED TREE ach -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa af -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa an -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ar -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ast -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa az -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa be -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa bg -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa bn -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa bo -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa br -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa brx -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa bs -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ca -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ca-valencia -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa cak -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ckb -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa cs -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa cy -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa da -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa de -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa dsb -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa el -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa en-CA -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa en-GB -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa eo -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa es-AR -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa es-CL -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa es-ES -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa es-MX -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa et -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa eu -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa fa -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ff -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa fi -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa fr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa fur -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa fy-NL -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ga-IE -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa gd -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa gl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa gn -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa gu-IN -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa he -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hi-IN -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hsb -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hu -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hy-AM -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hye -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ia -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa id -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa is -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa it -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ja -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ja-JP-mac -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ka -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa kab -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa kk -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa km -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa kn -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ko -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa lij -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa lo -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa lt -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ltg -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa lv -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa meh -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa mk -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ml -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa mr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ms -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa my -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa nb-NO -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ne-NP -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa nl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa nn-NO -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa oc -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa pa-IN -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa pl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa pt-BR -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa pt-PT -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa rm -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ro -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ru -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sat -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sc -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa scn -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sco -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa si -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sk -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa skr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa son -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sq -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sv-SE -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa szl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ta -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa te -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa tg -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa th -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa tl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa tr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa trs -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa uk -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ur -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa uz -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa vi -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa wo -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa xh -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa zh-CN -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa zh-TW -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa - - - - - c5eaeb28 by Release Engineering Landoscript at 2025-05-26T06:54:05+00:00 No Bug - Bumping Mobile l10n changesets r=release a=l10n-bump DONTBUILD CLOSED TREE ach -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa an -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ar -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ast -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa az -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa be -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa bg -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa bn -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa br -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa bs -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ca -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa cak -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa cs -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa cy -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa da -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa de -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa dsb -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa el -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa en-CA -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa en-GB -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa eo -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa es-AR -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa es-CL -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa es-ES -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa es-MX -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa et -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa eu -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa fa -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ff -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa fi -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa fr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa fy-NL -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ga-IE -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa gd -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa gl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa gn -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa gu-IN -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa he -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hi-IN -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hsb -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hu -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa hy-AM -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ia -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa id -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa is -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa it -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ja -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ka -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa kab -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa kk -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa km -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa kn -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ko -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa lij -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa lo -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa lt -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ltg -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa lv -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa meh -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa mix -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ml -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa mr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ms -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa my -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa nb-NO -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ne-NP -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa nl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa nn-NO -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa oc -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa pa-IN -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa pl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa pt-BR -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa pt-PT -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa rm -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ro -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ru -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sk -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa son -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sq -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa sv-SE -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ta -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa te -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa th -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa tl -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa tr -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa trs -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa uk -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa ur -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa uz -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa vi -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa wo -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa xh -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa zam -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa zh-CN -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa zh-TW -> cf4770fc0875f74ddfe493598957b08a0ddbc2fa - - - - - 178d2615 by Yulia at 2025-05-26T07:20:24+00:00 Bug 1967805: use a modIterator for cancellable tasks;r=iain,arai Differential Revision: https://phabricator.services.mozilla.com/D250610 - - - - - f1e32fa7 by Yulia at 2025-05-26T07:20:27+00:00 Bug 1967805: add test for cancellables held past shutdown; r=iain Differential Revision: https://phabricator.services.mozilla.com/D250611 - - - - - 37 changed files: - browser/locales/l10n-changesets.json - browser/themes/osx/browser.css - browser/themes/shared/tabbrowser/tabs.css - + js/src/jit-test/tests/atomics/bug1967805.js - js/src/vm/OffThreadPromiseRuntimeState.cpp - + mobile/android/android-components/components/compose/base/src/main/res/values-in/strings.xml - mobile/android/android-components/components/compose/browser-toolbar/src/main/res/values-es-rES/strings.xml - mobile/android/android-components/components/compose/browser-toolbar/src/main/res/values-in/strings.xml - mobile/android/android-components/components/feature/addons/src/main/res/values-bqi/strings.xml - mobile/android/android-components/components/feature/addons/src/main/res/values-hr/strings.xml - mobile/android/android-components/components/feature/downloads/src/main/res/values-hr/strings.xml - mobile/android/android-components/components/feature/downloads/src/main/res/values-in/strings.xml - mobile/android/android-components/components/feature/privatemode/src/main/res/values-hr/strings.xml - mobile/android/fenix/app/src/main/res/values-bqi/strings.xml - mobile/android/fenix/app/src/main/res/values-es-rES/strings.xml - mobile/android/fenix/app/src/main/res/values-et/strings.xml - mobile/android/fenix/app/src/main/res/values-hr/strings.xml - mobile/android/fenix/app/src/main/res/values-in/strings.xml - mobile/android/fenix/app/src/main/res/values-is/strings.xml - mobile/android/fenix/app/src/main/res/values-kk/strings.xml - mobile/android/fenix/app/src/main/res/values-nn-rNO/strings.xml - mobile/android/fenix/app/src/main/res/values-sv-rSE/strings.xml - mobile/android/fenix/app/src/main/res/values-tr/strings.xml - mobile/android/fenix/app/src/main/res/values-vi/strings.xml - mobile/locales/l10n-changesets.json - servo/components/style/values/specified/box.rs - toolkit/themes/linux/global/jar.mn - toolkit/themes/osx/global/jar.mn - − toolkit/themes/osx/global/tabbox.css - toolkit/themes/shared/desktop-jar.inc.mn - toolkit/themes/shared/in-content/common-shared.css - toolkit/themes/linux/global/tabbox.css → toolkit/themes/shared/tabbox.css - toolkit/themes/windows/global/jar.mn - − toolkit/themes/windows/global/tabbox.css - widget/cocoa/nsNativeThemeCocoa.h - widget/cocoa/nsNativeThemeCocoa.mm - widget/windows/nsNativeThemeWin.cpp The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/a287c0… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/a287c0… You're receiving this email because of your account on gitlab.torproject.org.

1 0