ma1 pushed to branch tor-browser-140.17.0esr-15.0-1 at The Tor Project / Applications / Tor Browser

Commits:

• d8047c80
  by Chun-Min Chang at 2026-10-09T14:36:43+02:00

  Bug 2047722 - Clamp the VP8 reference row await in ffvpx  a=diannaS
  
  Cherry-pick of FFmpeg commit b772f5033c72, carried as
  vp8-reference-row-clamp.patch and listed in README_MOZILLA until ffvpx is
  updated past it.
  
  Original Revision: https://phabricator.services.mozilla.com/D315478
  
  Differential Revision: https://phabricator.services.mozilla.com/D328288
  

• 05f91c29
  by David Parks at 2026-10-09T15:13:48+02:00

  Bug 2057113 - Part 1: Reject re-entrant native Windows clipboard mutations.  a=diannaS DONTBUILD
  
  Native clipboard writes can spin a nested event loop or pump the native message
  queue. A clipboard write dispatched during that period re-enters the platform's
  backend and mutates state the suspended commit is still using.  This exposed
  a case where the clipboard cache gets out-of-sync due to re-entrant SetData.
  The older write would win the cache but the native clipboard holds the newer
  write's contents.  Re-entrant requests are now rejected (neither interleaved
  nor queued).
  
  Original Revision: https://phabricator.services.mozilla.com/D326255
  
  Differential Revision: https://phabricator.services.mozilla.com/D328681
  

• 1f7a6e56
  by David Parks at 2026-10-09T15:15:53+02:00

  Bug 2057113 - Part 2: Don't force a synchronous clipboard flush for file promises.  a=diannaS DONTBUILD
  
  SetNativeClipboardData flushes clipboard writes when text/plain is on the
  transferable on Windows 11 22H2+. Flushing was added to clipboard write in
  bug 1774285, because delayed rendering makes Windows Suggested Actions walk
  the a11y tree, and immediate rendering of data to the clipboard was the lesser
  evil.
  
  Rendering a file promise maps to CF_HDROP, whose renderer is
  nsDataObj::DropTempFile (which is unintuitively _not_ used for drag and drop,
  only clipboard).  It opens a channel to the promised URL and runs a nested
  event loop in CStream::WaitForCompletion until it completes, so forcing the
  flush runs a network fetch in a nested event loop inside the clipboard commit.
  The duration of the nest is unpredictable but can be as long as the device
  maintains the connection (modulo any timeout limits).   This patch skips the
  flush if there is a file (or no text) in the payload, avoiding the nested loop
  altogether when this happens.
  
  Without a pref flip (clipboard.imageAsFile.enabled = true), writing both
  a file and text to clipboard should not be possible, so this case does not
  occur.  This is because only images can be written to the clipboard as files.
  See [the MDN page for mandatory types](https://www.w3.org/TR/clipboard-apis/#mandatory-data-types)
  and the comment in ClipboardItem::Supports.
  
  Original Revision: https://phabricator.services.mozilla.com/D326256
  
  Differential Revision: https://phabricator.services.mozilla.com/D328682
  

• c8e23e99
  by Jari Jalkanen at 2026-10-09T15:21:10+02:00

  Bug 2058651: Stop WritableFileStreams from following moved paths.  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D318103
  
  Differential Revision: https://phabricator.services.mozilla.com/D329253
  

• 0aeb186c
  by Jari Jalkanen at 2026-10-09T15:35:01+02:00

  Bug 2059211: Cap streaming request body sizes. r=valentin a=diannaS
  
  Original Revision: https://phabricator.services.mozilla.com/D325120
  
  Differential Revision: https://phabricator.services.mozilla.com/D329258
  

• 83698774
  by Jed Davis at 2026-10-09T16:22:59+02:00

  Bug 2067976 - Clean up some unnecessary string copies in SandboxBroker.  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D326377
  
  Differential Revision: https://phabricator.services.mozilla.com/D328249
  

• 1f9a45a6
  by Brad Werth at 2026-10-10T17:58:24+02:00

  Bug 2068338: Alias CurrentState in SetFontInternalDisconnected.  a=diannaS
  
  This prepares future uplifts to map more cleanly.
  
  Original Revision: https://phabricator.services.mozilla.com/D324734
  
  Differential Revision: https://phabricator.services.mozilla.com/D330170
  

• 45c4e91c
  by Valentin Gosu at 2026-10-10T20:23:49+02:00

  Bug 2068372 - nsSimpleNestedURI::Deserialize should reparse the inner URI  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D327278
  
  Differential Revision: https://phabricator.services.mozilla.com/D328421
  

• 0112b6df
  by Maurice Dauer at 2026-10-10T20:28:42+02:00

  Bug 2068420 - Skip the head sentinel,  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D328764
  
  Differential Revision: https://phabricator.services.mozilla.com/D329773
  

• 94a287da
  by hackademix at 2026-10-10T20:41:28+02:00

  Bug 2068421 - Make crash helper message reception more robust on Windows
  
  140esr patch version picked from
    https://hg.mozilla.org/try/rev/423bb0653100ac8c2fbbf8dcc73894a746ac12ba
  

• a9e5befe
  by David Shin at 2026-10-10T20:46:25+02:00

  Bug 2068441: Make browsing context under printing browsing context not targetable.  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D327854
  
  Differential Revision: https://phabricator.services.mozilla.com/D329197
  

• 764be7c3
  by Valentin Gosu at 2026-10-10T22:29:51+02:00

  Bug 2070633 - Only allow setting nsIHttpChannel.allowSTS in parent process  a=diannaS DONTBUILD
  
  Removes the flag from IPC arguments.
  It is now only honored in the parent process. Currently used by
  captive portal service and OCSP checks.
  
  Original Revision: https://phabricator.services.mozilla.com/D326843
  
  Differential Revision: https://phabricator.services.mozilla.com/D328422
  

• 59ab6eb5
  by Randell Jesup at 2026-10-10T22:34:19+02:00

  Bug 2069910: Have nsHttpTransaction read a clone of the upload stream  a=diannaS
  
  Differential Revision: https://phabricator.services.mozilla.com/D329334
  

• 2ad3557a
  by Jonathan Kew at 2026-10-10T22:41:22+02:00

  Bug 2072438 - Rework bidi-engine management to allow nested use of nsBidiPresUtils::Resolve.  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D327605
  
  Differential Revision: https://phabricator.services.mozilla.com/D328159
  

• d9ebb2cf
  by Dianna Smith at 2026-10-10T22:41:27+02:00

  Bug 2072438 - fix bustage on esr153 a=bustage
  

• 3e536e33
  by Iain Ireland at 2026-10-10T22:49:19+02:00

  Bug 2073267: Add GuardSpecificObject for global lexical SetGName a=dsmith
  
  Original Revision: https://phabricator.services.mozilla.com/D328386
  
  Differential Revision: https://phabricator.services.mozilla.com/D328730
  

• 91048598
  by Yoshi Cheng-Hao Huang at 2026-10-11T23:52:18+02:00

  Bug 2073269 - Part 1: Respect the goal symbol when building CompileOptions for delazification scripts.  a=diannaS
  
  See https://bugzilla.mozilla.org/show_bug.cgi?id=2073269#c3
  
  Original Revision: https://phabricator.services.mozilla.com/D328086
  
  Differential Revision: https://phabricator.services.mozilla.com/D328633
  

• b106715a
  by Yoshi Cheng-Hao Huang at 2026-10-11T23:52:19+02:00

  Bug 2073269 - Part 2: Jit-tests.  a=diannaS
  
  Original Revision: https://phabricator.services.mozilla.com/D328088
  
  Differential Revision: https://phabricator.services.mozilla.com/D328634
  

• 190c538b
  by Edgar Chen at 2026-10-11T23:52:19+02:00

  Bug 2073647;  a=diannaS
  
  Original Revision: https://phabricator.services.mozilla.com/D329143
  
  Differential Revision: https://phabricator.services.mozilla.com/D330899
  

• ed71269a
  by Jan-Niklas Jaeschke at 2026-10-11T23:52:20+02:00

  Bug 2073692 - Use weak reference in nsXMLPrettyPrinter. a=dsmith
  
  Original Revision: https://phabricator.services.mozilla.com/D328081
  
  Differential Revision: https://phabricator.services.mozilla.com/D328121
  

• 6ee4b74b
  by Lee Salzman at 2026-10-11T23:52:20+02:00

  Bug 2073969.  a=diannaS DONTBUILD
  
  Differential Revision: https://phabricator.services.mozilla.com/D328280
  

• 0b2e0686
  by Iain Ireland at 2026-10-11T23:52:21+02:00

  Bug 2074164: Resolve primitive object constructors in WarpOracle a=dsmith
  
  Original Revision: https://phabricator.services.mozilla.com/D328316
  
  Differential Revision: https://phabricator.services.mozilla.com/D328626
  

• 7bed59ca
  by Emilio Cobos Álvarez at 2026-10-11T23:52:21+02:00

  Bug 2074208.  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D328462
  
  Differential Revision: https://phabricator.services.mozilla.com/D328755
  

• e8a9f66c
  by az at 2026-10-11T23:52:22+02:00

  Bug 2074213 -  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D330064
  
  Differential Revision: https://phabricator.services.mozilla.com/D330191
  

• 9016cc66
  by Emilio Cobos Álvarez at 2026-10-12T00:08:51+02:00

  Bug 2074625 - Avoid updating properties with retargeted animation.  a=diannaS DONTBUILD
  
  This is the low risk fix. I think we need to figure out whether we even
  want to use that retargeted effect at all? But that seems like a
  follow-up bug.
  
  Rule tree changes are just assertions that catch this earlier.
  
  Original Revision: https://phabricator.services.mozilla.com/D328567
  
  Differential Revision: https://phabricator.services.mozilla.com/D328800
  

• 59224c72
  by Iain Ireland at 2026-10-12T00:09:11+02:00

  Bug 2074632: Invalidate Ion when a pure DOM call reallocates the global's slots  a=diannaS
  
  Original Revision: https://phabricator.services.mozilla.com/D329341
  
  Differential Revision: https://phabricator.services.mozilla.com/D330540
  

• a6477a0d
  by longsonr at 2026-10-12T00:09:11+02:00

  Bug 2074896 - Prevent feTile rect calculations from overflowing  a=dmeehan DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D328561
  
  Differential Revision: https://phabricator.services.mozilla.com/D329483
  

• 764122e3
  by Valentin Gosu at 2026-10-12T00:09:12+02:00

  Bug 2040905 - nsStandardURL::Deserialize should reparse the URL  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D309064
  
  Differential Revision: https://phabricator.services.mozilla.com/D328789
  

• 067fa4f0
  by Matthew Gaudet at 2026-10-12T00:09:12+02:00

  Bug 2075998 - Root QueueWithSizes when dequeued  a=diannaS DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D330015
  
  Differential Revision: https://phabricator.services.mozilla.com/D330358
  

• 5158cb61
  by Jan de Mooij at 2026-10-12T00:09:13+02:00

  Bug 2076269 - Ensure the default array shape exists for MIR ops depending on this.  a=dmeehan DONTBUILD
  
  Original Revision: https://phabricator.services.mozilla.com/D330003
  
  Differential Revision: https://phabricator.services.mozilla.com/D330124
  

67 changed files:

• docshell/base/BrowsingContext.cpp
• + dom/base/crashtests/2068441.html
• dom/base/crashtests/crashtests.list
• dom/base/nsImageLoadingContent.cpp
• dom/canvas/CanvasRenderingContext2D.cpp
• dom/canvas/OffscreenCanvas.cpp
• dom/canvas/OffscreenCanvasDisplayHelper.cpp
• dom/canvas/OffscreenCanvasDisplayHelper.h
• dom/fs/parent/FileSystemHashSource.cpp
• dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
• dom/html/HTMLMediaElement.cpp
• dom/media/webcodecs/AudioData.cpp
• dom/media/webcodecs/EncodedAudioChunk.cpp
• dom/media/webcodecs/ImageDecoder.cpp
• dom/security/test/unit/test_csp_deserialization.js
• dom/streams/QueueWithSizes.h
• + dom/xml/crashtests/2073692-frame.xml
• + dom/xml/crashtests/2073692.html
• dom/xml/crashtests/crashtests.list
• dom/xml/nsXMLPrettyPrinter.cpp
• dom/xml/nsXMLPrettyPrinter.h
• gfx/2d/FilterNodeSoftware.cpp
• gfx/cairo/cairo/src/cairo-boxes-intersect.c
• gfx/cairo/moz.yaml
• + gfx/cairo/patches/0052-Bug-2068420-skip-head-sentinel.patch
• + gfx/tests/gtest/TestFilterNodeSoftware.cpp
• gfx/tests/gtest/moz.build
• js/src/frontend/BytecodeCompiler.cpp
• + js/src/jit-test/tests/environments/bug2073267.js
• + js/src/jit-test/tests/modules/bug-2073269.js
• + js/src/jit-test/tests/parser/bug-2073269-script.js
• js/src/jit/CacheIR.cpp
• js/src/jit/CodeGenerator.cpp
• js/src/jit/CodeGenerator.h
• js/src/jit/Ion.cpp
• js/src/jit/JitRuntime.h
• js/src/jit/WarpOracle.cpp
• js/src/vm/Interpreter.cpp
• js/src/vm/JSObject.cpp
• js/src/vm/NativeObject.cpp
• layout/base/nsBidiPresUtils.cpp
• layout/base/nsPresContext.cpp
• layout/base/nsPresContext.h
• layout/style/nsAnimationManager.cpp
• media/ffvpx/README_MOZILLA
• media/ffvpx/libavcodec/vp8.c
• + media/ffvpx/vp8-reference-row-clamp.patch
• modules/libpref/init/StaticPrefList.yaml
• netwerk/base/nsSimpleNestedURI.cpp
• netwerk/base/nsStandardURL.cpp
• netwerk/ipc/NeckoChannelParams.ipdlh
• netwerk/protocol/http/HttpBaseChannel.cpp
• netwerk/protocol/http/HttpChannelChild.cpp
• netwerk/protocol/http/HttpChannelParent.cpp
• netwerk/protocol/http/HttpChannelParent.h
• netwerk/protocol/http/nsHttpTransaction.cpp
• netwerk/protocol/http/nsIHttpChannel.idl
• security/sandbox/linux/broker/SandboxBroker.cpp
• security/sandbox/linux/broker/SandboxBroker.h
• servo/components/style/rule_tree/core.rs
• + testing/web-platform/tests/web-animations/crashtests/keyframe-effect-cross-doc-target.html
• toolkit/crashreporter/crash_helper_common/src/ipc_queue.rs
• toolkit/crashreporter/crash_helper_common/src/ipc_queue/windows.rs
• toolkit/crashreporter/crash_helper_common/src/platform/windows.rs
• widget/nsBaseClipboard.cpp
• widget/nsBaseClipboard.h
• widget/windows/nsClipboard.cpp

The diff was not included because it is too large.