- tbb-commits - lists.torproject.org

[tor-browser/esr24] Bug 969226 - Check if there is enough data to read u32 to avoid buffer overflow. r=bgirard, a=abillings
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 5977bbe71d2afc1b836080515fb9503db4a14bfa Author: Jeff Muizelaar <jmuizelaar(a)mozilla.com> Date: Fri Apr 11 10:25:01 2014 -0400 Bug 969226 - Check if there is enough data to read u32 to avoid buffer overflow. r=bgirard, a=abillings --- gfx/qcms/iccread.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gfx/qcms/iccread.c b/gfx/qcms/iccread.c index 5c72cf3..63bd090 100644 --- a/gfx/qcms/iccread.c +++ b/gfx/qcms/iccread.c @@ -1007,6 +1007,9 @@ qcms_profile* qcms_profile_from_memory(const void *mem, size_t size) source.size = size; source.valid = true; + if (size < 4) + return INVALID_PROFILE; + length = read_u32(src, 0); if (length <= size) { // shrink the area that we can read if appropriate

1 0

[tor-browser/esr24] Bug 919482 - Replace mozilla-banner.gif with a plain blue image in 163504-1*.html since we aren't trying to test individual pixel differences in resized image painting there. r=tn, a=test-only
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 502d1968c2f842ae66b17de3865c9f19f0e6a909 Author: Ryan VanderMeulen <ryanvm(a)gmail.com> Date: Thu Mar 27 11:02:27 2014 -0400 Bug 919482 - Replace mozilla-banner.gif with a plain blue image in 163504-1*.html since we aren't trying to test individual pixel differences in resized image painting there. r=tn, a=test-only --- layout/reftests/bugs/163504-1-inner.html | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/layout/reftests/bugs/163504-1-inner.html b/layout/reftests/bugs/163504-1-inner.html index 85f9e15..602ce84 100644 --- a/layout/reftests/bugs/163504-1-inner.html +++ b/layout/reftests/bugs/163504-1-inner.html @@ -5,13 +5,14 @@ <style type="text/css"> html, body { height: 100%; } div { height: 3%; } +img { image-rendering: -moz-crisp-edges; } </style> </head> <body> -<div><img src="mozilla-banner.gif" width="100" style="height: 50%"></div> -<div><img src="mozilla-banner.gif" width="2" style="min-height: 50%"></div> -<div><img src="mozilla-banner.gif" width="100" style="max-height: 50%"></div> +<div><img src="blue-600x58.png" width="100" style="height: 50%"></div> +<div><img src="blue-600x58.png" width="2" style="min-height: 50%"></div> +<div><img src="blue-600x58.png" width="100" style="max-height: 50%"></div> <div><span style="position:relative; top: 30%">text</span></div> <div><span style="position:relative; bottom: 30%">text</span></div>

1 0

[tor-browser/esr24] No bug, Automated blocklist update from host bld-linux64-spot-075 - a=blocklist-update
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 6cc87b4fac83abf36e1ad2e3b83318db8ce5212e Author: ffxbld <none@none> Date: Sat Apr 5 03:11:11 2014 -0700 No bug, Automated blocklist update from host bld-linux64-spot-075 - a=blocklist-update --- browser/app/blocklist.xml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/browser/app/blocklist.xml b/browser/app/blocklist.xml index cb9dca8..6b94ea0 100644 --- a/browser/app/blocklist.xml +++ b/browser/app/blocklist.xml @@ -1,5 +1,5 @@ <?xml version="1.0"?> -<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1396046918000"> +<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1396307847000"> <emItems> <emItem blockID="i454" id="sqlmoz(a)facebook.com"> <versionRange minVersion="0" maxVersion="*" severity="3"> @@ -1038,8 +1038,8 @@ <prefs> </prefs> </emItem> - <emItem blockID="i67" id="youtube2(a)youtube2.com"> - <versionRange minVersion="0" maxVersion="*"> + <emItem blockID="i570" id="jid1-vW9nopuIAJiRHw@jetpack"> + <versionRange minVersion="0" maxVersion="*" severity="1"> </versionRange> <prefs> </prefs> @@ -1418,6 +1418,12 @@ <prefs> </prefs> </emItem> + <emItem blockID="i67" id="youtube2(a)youtube2.com"> + <versionRange minVersion="0" maxVersion="*"> + </versionRange> + <prefs> + </prefs> + </emItem> <emItem blockID="i476" id="mbroctone(a)facebook.com"> <versionRange minVersion="0" maxVersion="*" severity="3"> </versionRange>

1 0

[tor-browser/esr24] Backed out changeset 42531d5e6ca2 (Bug 986843) for test failures
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit a79c2bfce5b8d2416d01250dbbaa7e6cf0dc1ae1 Author: Jon Coppeard <jcoppeard(a)mozilla.com> Date: Wed Apr 2 17:19:28 2014 +0100 Backed out changeset 42531d5e6ca2 (Bug 986843) for test failures --- js/src/gc/RootMarking.cpp | 2 +- js/src/gc/Zone.cpp | 1 + js/src/gc/Zone.h | 2 ++ js/src/jsapi.cpp | 29 +++++++++++------------------ js/src/jscompartment.cpp | 2 +- js/src/jscompartment.h | 2 +- js/src/jsgc.cpp | 4 ++-- 7 files changed, 19 insertions(+), 23 deletions(-) diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp index 88574f3..861c2d6 100644 --- a/js/src/gc/RootMarking.cpp +++ b/js/src/gc/RootMarking.cpp @@ -744,7 +744,7 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots) #endif for (CompartmentsIter c(rt); !c.done(); c.next()) - c->markRoots(trc); + c->mark(trc); /* The embedding can register additional roots here. */ for (size_t i = 0; i < rt->gcBlackRootTracers.length(); i++) { diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp index 0b6161c..5625b99 100644 --- a/js/src/gc/Zone.cpp +++ b/js/src/gc/Zone.cpp @@ -23,6 +23,7 @@ using namespace js::gc; JS::Zone::Zone(JSRuntime *rt) : rt(rt), allocator(this), + hold(false), ionUsingBarriers_(false), active(false), gcScheduled(false), diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h index 39e867d..73e7043 100644 --- a/js/src/gc/Zone.h +++ b/js/src/gc/Zone.h @@ -108,6 +108,8 @@ struct Zone : private JS::shadow::Zone, js::CompartmentVector compartments; + bool hold; + private: bool ionUsingBarriers_; diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp index 68b6afa..3632a74 100644 --- a/js/src/jsapi.cpp +++ b/js/src/jsapi.cpp @@ -3171,32 +3171,23 @@ JS_GetObjectId(JSContext *cx, JSObject *obj, jsid *idp) return JS_TRUE; } -class AutoCompartmentRooter : private JS::CustomAutoRooter +class AutoHoldZone { public: - explicit AutoCompartmentRooter(JSContext *cx, JSCompartment *comp - MOZ_GUARD_OBJECT_NOTIFIER_PARAM) - : CustomAutoRooter(cx), compartment(comp) + explicit AutoHoldZone(Zone *zone + MOZ_GUARD_OBJECT_NOTIFIER_PARAM) + : holdp(&zone->hold) { MOZ_GUARD_OBJECT_NOTIFIER_INIT; + *holdp = true; } - operator JSCompartment *() { - return compartment; - } - - JSCompartment *operator->() { - return compartment; - } - - protected: - virtual void trace(JSTracer *trc) - { - compartment->mark(); + ~AutoHoldZone() { + *holdp = false; } private: - JSCompartment *compartment; + bool *holdp; MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER }; @@ -3218,7 +3209,7 @@ JS_NewGlobalObject(JSContext *cx, JSClass *clasp, JSPrincipals *principals, else zone = ((JSObject *)options.zoneSpec)->zone(); - AutoCompartmentRooter compartment(cx, NewCompartment(cx, zone, principals, options)); + JSCompartment *compartment = NewCompartment(cx, zone, principals, options); if (!compartment) return NULL; @@ -3227,6 +3218,8 @@ JS_NewGlobalObject(JSContext *cx, JSClass *clasp, JSPrincipals *principals, rt->systemZone->isSystem = true; } + AutoHoldZone hold(compartment->zone()); + Rooted<GlobalObject *> global(cx); { AutoCompartment ac(cx, compartment); diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp index 2e66253..c448e10 100644 --- a/js/src/jscompartment.cpp +++ b/js/src/jscompartment.cpp @@ -488,7 +488,7 @@ JSCompartment::markAllCrossCompartmentWrappers(JSTracer *trc) } void -JSCompartment::markRoots(JSTracer *trc) +JSCompartment::mark(JSTracer *trc) { #ifdef JS_ION if (ionCompartment_) diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h index 1ef2ed8..6cc1bc8 100644 --- a/js/src/jscompartment.h +++ b/js/src/jscompartment.h @@ -293,7 +293,7 @@ struct JSCompartment WrapperEnum(JSCompartment *c) : js::WrapperMap::Enum(c->crossCompartmentWrappers) {} }; - void markRoots(JSTracer *trc); + void mark(JSTracer *trc); bool isDiscardingJitCode(JSTracer *trc); void sweep(js::FreeOp *fop, bool releaseTypes); void sweepCrossCompartmentWrappers(); diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp index 3157861..53a636e 100644 --- a/js/src/jsgc.cpp +++ b/js/src/jsgc.cpp @@ -2541,7 +2541,7 @@ SweepZones(FreeOp *fop, bool lastGC) while (read < end) { Zone *zone = *read++; - if (zone->wasGCStarted()) { + if (!zone->hold && zone->wasGCStarted()) { if (zone->allocator.arenas.arenaListsAreEmpty() || lastGC) { zone->allocator.arenas.checkEmptyFreeLists(); if (callback) @@ -2723,7 +2723,7 @@ BeginMarkPhase(JSRuntime *rt) } zone->scheduledForDestruction = false; - zone->maybeAlive = false; + zone->maybeAlive = zone->hold; zone->setPreservingCode(false); }

1 0

[tor-browser/esr24] Bug 989183 - Check for nsXBLJSClass on esr24. r=bz a=sledru
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit bfbab2b7a05871e82aa18ac2a61d14667d8b366e Author: Bobby Holley <bobbyholley(a)gmail.com> Date: Wed Apr 2 16:29:00 2014 -0300 Bug 989183 - Check for nsXBLJSClass on esr24. r=bz a=sledru --- content/xbl/src/nsXBLBinding.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp index 8b6133a6..9832a3c 100644 --- a/content/xbl/src/nsXBLBinding.cpp +++ b/content/xbl/src/nsXBLBinding.cpp @@ -1155,7 +1155,7 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JS::Handle<JSObject*> global, if (!::JS_LookupPropertyWithFlags(cx, global, className.get(), 0, val.address())) return NS_ERROR_OUT_OF_MEMORY; - if (val.isObject()) { + if (val.isObject() && JS_GetClass(&val.toObject())->finalize == XBLFinalize) { *aNew = false; proto = &val.toObject(); } else {

1 0

[tor-browser/esr24] Bug 986843 - Replace AutoHoldZone with AutoCompartmentRooter r=terrence a=lsblakk
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 08927001a0ef1ba4ebf555b8fb26075c251f3e98 Author: Jon Coppeard <jcoppeard(a)mozilla.com> Date: Mon Mar 24 21:45:23 2014 +0000 Bug 986843 - Replace AutoHoldZone with AutoCompartmentRooter r=terrence a=lsblakk --- js/src/gc/RootMarking.cpp | 2 +- js/src/gc/Zone.cpp | 1 - js/src/gc/Zone.h | 2 -- js/src/jsapi.cpp | 29 ++++++++++++++++++----------- js/src/jscompartment.cpp | 2 +- js/src/jscompartment.h | 2 +- js/src/jsgc.cpp | 4 ++-- 7 files changed, 23 insertions(+), 19 deletions(-) diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp index 861c2d6..88574f3 100644 --- a/js/src/gc/RootMarking.cpp +++ b/js/src/gc/RootMarking.cpp @@ -744,7 +744,7 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots) #endif for (CompartmentsIter c(rt); !c.done(); c.next()) - c->mark(trc); + c->markRoots(trc); /* The embedding can register additional roots here. */ for (size_t i = 0; i < rt->gcBlackRootTracers.length(); i++) { diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp index 5625b99..0b6161c 100644 --- a/js/src/gc/Zone.cpp +++ b/js/src/gc/Zone.cpp @@ -23,7 +23,6 @@ using namespace js::gc; JS::Zone::Zone(JSRuntime *rt) : rt(rt), allocator(this), - hold(false), ionUsingBarriers_(false), active(false), gcScheduled(false), diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h index 73e7043..39e867d 100644 --- a/js/src/gc/Zone.h +++ b/js/src/gc/Zone.h @@ -108,8 +108,6 @@ struct Zone : private JS::shadow::Zone, js::CompartmentVector compartments; - bool hold; - private: bool ionUsingBarriers_; diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp index 3632a74..68b6afa 100644 --- a/js/src/jsapi.cpp +++ b/js/src/jsapi.cpp @@ -3171,23 +3171,32 @@ JS_GetObjectId(JSContext *cx, JSObject *obj, jsid *idp) return JS_TRUE; } -class AutoHoldZone +class AutoCompartmentRooter : private JS::CustomAutoRooter { public: - explicit AutoHoldZone(Zone *zone - MOZ_GUARD_OBJECT_NOTIFIER_PARAM) - : holdp(&zone->hold) + explicit AutoCompartmentRooter(JSContext *cx, JSCompartment *comp + MOZ_GUARD_OBJECT_NOTIFIER_PARAM) + : CustomAutoRooter(cx), compartment(comp) { MOZ_GUARD_OBJECT_NOTIFIER_INIT; - *holdp = true; } - ~AutoHoldZone() { - *holdp = false; + operator JSCompartment *() { + return compartment; + } + + JSCompartment *operator->() { + return compartment; + } + + protected: + virtual void trace(JSTracer *trc) + { + compartment->mark(); } private: - bool *holdp; + JSCompartment *compartment; MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER }; @@ -3209,7 +3218,7 @@ JS_NewGlobalObject(JSContext *cx, JSClass *clasp, JSPrincipals *principals, else zone = ((JSObject *)options.zoneSpec)->zone(); - JSCompartment *compartment = NewCompartment(cx, zone, principals, options); + AutoCompartmentRooter compartment(cx, NewCompartment(cx, zone, principals, options)); if (!compartment) return NULL; @@ -3218,8 +3227,6 @@ JS_NewGlobalObject(JSContext *cx, JSClass *clasp, JSPrincipals *principals, rt->systemZone->isSystem = true; } - AutoHoldZone hold(compartment->zone()); - Rooted<GlobalObject *> global(cx); { AutoCompartment ac(cx, compartment); diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp index c448e10..2e66253 100644 --- a/js/src/jscompartment.cpp +++ b/js/src/jscompartment.cpp @@ -488,7 +488,7 @@ JSCompartment::markAllCrossCompartmentWrappers(JSTracer *trc) } void -JSCompartment::mark(JSTracer *trc) +JSCompartment::markRoots(JSTracer *trc) { #ifdef JS_ION if (ionCompartment_) diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h index 6cc1bc8..1ef2ed8 100644 --- a/js/src/jscompartment.h +++ b/js/src/jscompartment.h @@ -293,7 +293,7 @@ struct JSCompartment WrapperEnum(JSCompartment *c) : js::WrapperMap::Enum(c->crossCompartmentWrappers) {} }; - void mark(JSTracer *trc); + void markRoots(JSTracer *trc); bool isDiscardingJitCode(JSTracer *trc); void sweep(js::FreeOp *fop, bool releaseTypes); void sweepCrossCompartmentWrappers(); diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp index 53a636e..3157861 100644 --- a/js/src/jsgc.cpp +++ b/js/src/jsgc.cpp @@ -2541,7 +2541,7 @@ SweepZones(FreeOp *fop, bool lastGC) while (read < end) { Zone *zone = *read++; - if (!zone->hold && zone->wasGCStarted()) { + if (zone->wasGCStarted()) { if (zone->allocator.arenas.arenaListsAreEmpty() || lastGC) { zone->allocator.arenas.checkEmptyFreeLists(); if (callback) @@ -2723,7 +2723,7 @@ BeginMarkPhase(JSRuntime *rt) } zone->scheduledForDestruction = false; - zone->maybeAlive = zone->hold; + zone->maybeAlive = false; zone->setPreservingCode(false); }

1 0

[tor-browser/esr24] Bug 952022 - Add missing detachAsmJSModule (r=bhackett, a=lsblakk)
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit e50a64fad059458f276b9bfd45f96452be9a457c Author: Luke Wagner <luke(a)mozilla.com> Date: Tue Apr 1 09:21:09 2014 -0500 Bug 952022 - Add missing detachAsmJSModule (r=bhackett,a=lsblakk) --- js/src/jit/Ion.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp index 99f8854..83cdb27 100644 --- a/js/src/jit/Ion.cpp +++ b/js/src/jit/Ion.cpp @@ -2044,6 +2044,8 @@ InvalidateActivation(FreeOp *fop, uint8_t *ionTop, bool invalidateAll) // in case anyone tries to read it. ionScript->purgeCaches(script->zone()); + ionScript->detachDependentAsmJSModules(fop); + // This frame needs to be invalidated. We do the following: // // 1. Increment the reference counter to keep the ionScript alive

1 0

[tor-browser/esr24] Bug 961676. r=rstrong. a=abillings
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 94438b0c361590edb3ee667476e28ff83bdf87d5 Author: Brian R. Bondy <netzen(a)gmail.com> Date: Mon Mar 31 12:43:38 2014 -0400 Bug 961676. r=rstrong. a=abillings --- toolkit/mozapps/update/common/updatehelper.cpp | 60 ++++++++++++++++++++---- 1 file changed, 51 insertions(+), 9 deletions(-) diff --git a/toolkit/mozapps/update/common/updatehelper.cpp b/toolkit/mozapps/update/common/updatehelper.cpp index 275b7dc..ab64c2d 100644 --- a/toolkit/mozapps/update/common/updatehelper.cpp +++ b/toolkit/mozapps/update/common/updatehelper.cpp @@ -23,6 +23,7 @@ #include "shlobj.h" #include "updatehelper.h" #include "pathhash.h" +#include "mozilla/Scoped.h" // Needed for PathAppendW #include <shlwapi.h> @@ -216,26 +217,67 @@ StartServiceUpdate(LPCWSTR installDir) CloseServiceHandle(manager); return FALSE; } - CloseServiceHandle(svc); - CloseServiceHandle(manager); // If we reach here, then the service is installed, so // proceed with upgrading it. + CloseServiceHandle(manager); + + // The service exists and we opened it, get the config bytes needed + DWORD bytesNeeded; + if (!QueryServiceConfigW(svc, nullptr, 0, &bytesNeeded) && + GetLastError() != ERROR_INSUFFICIENT_BUFFER) { + CloseServiceHandle(svc); + return FALSE; + } + + // Get the service config information, in particular we want the binary + // path of the service. + mozilla::ScopedDeleteArray<char> serviceConfigBuffer(new char[bytesNeeded]); + if (!QueryServiceConfigW(svc, + reinterpret_cast<QUERY_SERVICE_CONFIGW*>(serviceConfigBuffer.get()), + bytesNeeded, &bytesNeeded)) { + CloseServiceHandle(svc); + return FALSE; + } + + CloseServiceHandle(svc); + + QUERY_SERVICE_CONFIGW &serviceConfig = + *reinterpret_cast<QUERY_SERVICE_CONFIGW*>(serviceConfigBuffer.get()); + + PathUnquoteSpacesW(serviceConfig.lpBinaryPathName); + + // Obtain the temp path of the maintenance service binary + WCHAR tmpService[MAX_PATH + 1] = { L'\0' }; + if (!PathGetSiblingFilePath(tmpService, serviceConfig.lpBinaryPathName, + L"maintenanceservice_tmp.exe")) { + return FALSE; + } + + // Get the new maintenance service path from the install dir + WCHAR newMaintServicePath[MAX_PATH + 1] = { L'\0' }; + wcsncpy(newMaintServicePath, installDir, MAX_PATH); + PathAppendSafe(newMaintServicePath, + L"maintenanceservice.exe"); + + // Copy the temp file in alongside the maintenace service. + // This is a requirement for maintenance service upgrades. + if (!CopyFileW(newMaintServicePath, tmpService, FALSE)) { + return FALSE; + } + + // Start the upgrade comparison process + STARTUPINFOW si = {0}; si.cb = sizeof(STARTUPINFOW); // No particular desktop because no UI si.lpDesktop = L""; PROCESS_INFORMATION pi = {0}; - - WCHAR maintserviceInstallerPath[MAX_PATH + 1] = { L'\0' }; - wcsncpy(maintserviceInstallerPath, installDir, MAX_PATH); - PathAppendSafe(maintserviceInstallerPath, - L"maintenanceservice_installer.exe"); WCHAR cmdLine[64] = { '\0' }; - wcsncpy(cmdLine, L"dummyparam.exe /Upgrade", + wcsncpy(cmdLine, L"dummyparam.exe upgrade", sizeof(cmdLine) / sizeof(cmdLine[0]) - 1); - BOOL svcUpdateProcessStarted = CreateProcessW(maintserviceInstallerPath, + BOOL svcUpdateProcessStarted = CreateProcessW(tmpService, cmdLine, NULL, NULL, FALSE, 0,

1 0

[tor-browser/esr24] Bug 987003 - Be more careful sandboxing javascript: URLs. r=bholley, a=sledru
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 3f9092acb0075896fa3178c95601ffaa7f985779 Author: Boris Zbarsky <bzbarsky(a)mit.edu> Date: Wed Mar 26 21:44:25 2014 -0400 Bug 987003 - Be more careful sandboxing javascript: URLs. r=bholley, a=sledru --- dom/src/jsurl/nsJSProtocolHandler.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dom/src/jsurl/nsJSProtocolHandler.cpp b/dom/src/jsurl/nsJSProtocolHandler.cpp index de5ff3b..27b8ddb 100644 --- a/dom/src/jsurl/nsJSProtocolHandler.cpp +++ b/dom/src/jsurl/nsJSProtocolHandler.cpp @@ -282,7 +282,8 @@ nsresult nsJSThunk::EvaluateScript(nsIChannel *aChannel, nsIXPConnect *xpc = nsContentUtils::XPConnect(); nsCOMPtr<nsIXPConnectJSObjectHolder> sandbox; - rv = xpc->CreateSandbox(cx, principal, getter_AddRefs(sandbox)); + // Important: Use a null principal here + rv = xpc->CreateSandbox(cx, nullptr, getter_AddRefs(sandbox)); NS_ENSURE_SUCCESS(rv, rv); // The nsXPConnect sandbox API gives us a wrapper to the sandbox for

1 0

[tor-browser/esr24] Bug 909305 - Replace mozilla-banner.gif with a plain blue image in 163504-2*.html since we aren't trying to test individual pixel differences in resized image painting there. r=tn, a=test-only
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit e8cf00433ffac6ed0c6294fe64f97910ba7710ee Author: Ryan VanderMeulen <ryanvm(a)gmail.com> Date: Thu Mar 27 11:02:26 2014 -0400 Bug 909305 - Replace mozilla-banner.gif with a plain blue image in 163504-2*.html since we aren't trying to test individual pixel differences in resized image painting there. r=tn, a=test-only --- layout/reftests/bugs/163504-2-inner.html | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/layout/reftests/bugs/163504-2-inner.html b/layout/reftests/bugs/163504-2-inner.html index 991b70c..e77cb44 100644 --- a/layout/reftests/bugs/163504-2-inner.html +++ b/layout/reftests/bugs/163504-2-inner.html @@ -5,13 +5,14 @@ <style type="text/css"> html, body { height: 100%; } div { height: 3%; } +img { image-rendering: -moz-crisp-edges; } </style> </head> <body> -<div><span><img src="mozilla-banner.gif" width="100" style="height: 50%"></span></div> -<div><span><img src="mozilla-banner.gif" width="2" style="min-height: 50%"></span></div> -<div><span><img src="mozilla-banner.gif" width="100" style="max-height: 50%"></span></div> +<div><span><img src="blue-600x58.png" width="100" style="height: 50%"></span></div> +<div><span><img src="blue-600x58.png" width="2" style="min-height: 50%"></span></div> +<div><span><img src="blue-600x58.png" width="100" style="max-height: 50%"></span></div> <div><span><span style="position:relative; top: 30%">text</span></span></div> <div><span><span style="position:relative; bottom: 30%">text</span></span></div>

1 0