[Git][tpo/applications/tor-browser][tor-browser-140.17.0esr-15.0-1] 7 commits: Bug 2056767: Shut down DocAccessibleParents before we shut down platform accessibility. a=pascalc

28 Sep 2026


      ma1 pushed to branch tor-browser-140.17.0esr-15.0-1 at The Tor Project / Applications / Tor Browser


Commits:
19837410 by James Teh at 2026-09-27T15:56:21+02:00
Bug 2056767: Shut down DocAccessibleParents before we shut down platform accessibility.  a=pascalc

Original Revision: https://phabricator.services.mozilla.com/D322228

Differential Revision: https://phabricator.services.mozilla.com/D323108

- - - - -
eca99650 by Rob Wu at 2026-09-27T17:19:00+02:00
Bug 2061470 - Don't drop __proto__ from webRequest bodies r=rpl

Differential Revision: https://phabricator.services.mozilla.com/D323631

- - - - -
bddd4de4 by Marco Bonardo at 2026-09-27T17:30:36+02:00
Bug 2066019.  a=pascalc

Original Revision: https://phabricator.services.mozilla.com/D321246

Differential Revision: https://phabricator.services.mozilla.com/D323563

- - - - -
e8ce3fe3 by Tom Schuster at 2026-09-27T17:32:19+02:00
Bug 2066321 - Update nonceable attribute checks for link elements. r=freddyb

Pending PR: https://github.com/w3c/webappsec-csp/pull/810

Differential Revision: https://phabricator.services.mozilla.com/D322966

- - - - -
5fd1f7de by Leo Tenenbaum at 2026-09-27T17:41:10+02:00
Bug 2067172 -  a=pascalc

Original Revision: https://phabricator.services.mozilla.com/D321879

Differential Revision: https://phabricator.services.mozilla.com/D322306

- - - - -
43f705a3 by Iain Ireland at 2026-09-27T18:23:46+02:00
Bug 2068385: Fix PBL  a=pascalc

Original Revision: https://phabricator.services.mozilla.com/D323744

Differential Revision: https://phabricator.services.mozilla.com/D324712

- - - - -
b6746e50 by Iain Ireland at 2026-09-28T10:08:52+02:00
Bug 2068385: Don't support sparse arrays in SpreadMathMinMax  a=pascalc

Marking the testcase --slow because it takes 7+ minutes on my laptop in an opt-debug build.

Original Revision: https://phabricator.services.mozilla.com/D323120

Differential Revision: https://phabricator.services.mozilla.com/D324692

- - - - -


14 changed files:

- accessible/base/DocManager.cpp
- accessible/ipc/DocAccessibleParent.cpp
- browser/components/places/content/controller.js
- browser/components/places/tests/browser/browser_toolbar_drop_bookmarklet.js
- browser/components/places/tests/browser/browser_toolbar_drop_multiple_with_bookmarklet.js
- dom/base/nsContentUtils.cpp
- dom/script/ScriptLoader.cpp
- dom/security/nsContentSecurityUtils.cpp
- js/src/jit/BaselineIC.cpp
- js/src/jit/CacheIR.cpp
- js/src/jit/CacheIRWriter.h
- js/src/vm/PortableBaselineInterpret.cpp
- toolkit/components/extensions/test/mochitest/test_ext_webrequest_upload.html
- toolkit/components/extensions/webrequest/WebRequestUpload.sys.mjs


Changes:

=====================================
accessible/base/DocManager.cpp
=====================================
@@ -31,6 +31,10 @@
 #include "nsCoreUtils.h"
 #include "xpcAccessibleDocument.h"
 
+#if defined(ANDROID)
+#  include "mozilla/Monitor.h"
+#endif
+
 using namespace mozilla;
 using namespace mozilla::a11y;
 using namespace mozilla::dom;
@@ -195,6 +199,18 @@ void DocManager::Shutdown() {
   }
 
   ClearDocCache();
+  // Even though remote documents aren't strictly managed by this DocManager
+  // instance, destroy them now because they might depend on platform specific
+  // state which is about to be torn down by PlatformShutdown. Iterate the array
+  // backwards because destroying the document removes it from this array.
+  if (sRemoteDocuments) {
+#if defined(ANDROID)
+    MonitorAutoLock mal(nsAccessibilityService::GetAndroidMonitor());
+#endif
+    for (size_t i = sRemoteDocuments->Length(); i-- > 0;) {
+      (*sRemoteDocuments)[i]->Destroy();
+    }
+  }
 }
 
 ////////////////////////////////////////////////////////////////////////////////


=====================================
accessible/ipc/DocAccessibleParent.cpp
=====================================
@@ -1241,15 +1241,14 @@ void DocAccessibleParent::MaybeInitWindowEmulation() {
     isActive = browserParent->GetDocShellIsActive();
   }
 
-  // onCreate is guaranteed to be called synchronously by
-  // nsWinUtils::CreateNativeWindow, so this reference isn't really necessary.
-  // However, static analysis complains without it.
   RefPtr<DocAccessibleParent> thisRef = this;
-  nsWinUtils::NativeWindowCreateProc onCreate([thisRef](HWND aHwnd) -> void {
-    ::SetPropW(aHwnd, kPropNameDocAccParent,
-               reinterpret_cast<HANDLE>(thisRef.get()));
-    thisRef->SetEmulatedWindowHandle(aHwnd);
-  });
+  nsWinUtils::NativeWindowCreateProc onCreate(
+      [thisRef](HWND aHwnd) mutable -> void {
+        thisRef->SetEmulatedWindowHandle(aHwnd);
+        HANDLE val;
+        thisRef.forget(&val);  // Release in SetEmulatedWindowHandle.
+        ::SetPropW(aHwnd, kPropNameDocAccParent, val);
+      });
 
   HWND parentWnd = reinterpret_cast<HWND>(rootDocument->GetNativeWindow());
   DebugOnly<HWND> hWnd = nsWinUtils::CreateNativeWindow(
@@ -1261,6 +1260,7 @@ void DocAccessibleParent::MaybeInitWindowEmulation() {
 void DocAccessibleParent::SetEmulatedWindowHandle(HWND aWindowHandle) {
   if (!aWindowHandle && mEmulatedWindowHandle && IsTopLevel()) {
     ::DestroyWindow(mEmulatedWindowHandle);
+    Release();  // AddRef in MaybeInitWindowEmulation.
   }
   mEmulatedWindowHandle = aWindowHandle;
 }


=====================================
browser/components/places/content/controller.js
=====================================
@@ -1610,7 +1610,7 @@ var PlacesControllerDragHelper = {
         if (
           !flavor.startsWith("text/x-moz-place") &&
           (validNodes.length > 1 || dropCount > 1) &&
-          validNodes.some(n => n.uri?.startsWith("javascript:"))
+          validNodes.some(n => URL.parse(n.uri)?.protocol === "javascript:")
         ) {
           return false;
         }
@@ -1687,18 +1687,14 @@ var PlacesControllerDragHelper = {
     if (
       externalDrag &&
       (nodes.length > 1 || dropCount > 1) &&
-      nodes.some(n => n.uri?.startsWith("javascript:"))
+      nodes.some(n => URL.parse(n.uri)?.protocol === "javascript:")
     ) {
       throw new Error("Javascript bookmarklet passed with uris");
     }
 
     // If a single javascript url is being dropped from the urlbar or an external source,
     // show the bookmark dialog as a speedbump protection against malicious cases.
-    if (
-      nodes.length == 1 &&
-      externalDrag &&
-      nodes[0].uri?.startsWith("javascript")
-    ) {
+    if (nodes.length == 1 && externalDrag) {
       let uri;
       try {
         uri = Services.io.newURI(nodes[0].uri);
@@ -1706,7 +1702,7 @@ var PlacesControllerDragHelper = {
         // Invalid uri, we skip this code and the entry will be discarded later.
       }
 
-      if (uri) {
+      if (uri?.scheme === "javascript") {
         let bookmarkGuid = await PlacesUIUtils.showBookmarkDialog(
           {
             action: "add",


=====================================
browser/components/places/tests/browser/browser_toolbar_drop_bookmarklet.js
=====================================
@@ -9,6 +9,7 @@ const sandbox = sinon.createSandbox();
 const URL1 = "https://example.com/1/";
 const URL2 = "https://example.com/2/";
 const BOOKMARKLET_URL = `javascript: (() => {alert('Hello, World!');})();`;
+const BOOKMARKLET_URL_MIXED_CASE = `JavaScript: (() => {})();`;
 let bookmarks;
 
 registerCleanupFunction(async function () {
@@ -34,12 +35,18 @@ add_task(async function test() {
   Assert.ok(placesItems, "PlacesToolbarItems should not be null");
 
   /**
-   * Simulates a drop of a bookmarklet URI onto the bookmarks bar.
+   * Simulates a drop of a bookmarklet URI onto the bookmarks bar and verifies
+   * the speedbump dialog appears.
    *
    * @param {string} aEffect
    *        The effect to use for the drop operation: move, copy, or link.
+   * @param {string} aBookmarkletUrl
+   *        The bookmarklet URL to be dropped onto the bookmarks bar.
    */
-  let simulateDragDrop = async function (aEffect) {
+  let simulateBookmarkletDragDrop = async function (
+    aEffect,
+    aBookmarkletUrl = BOOKMARKLET_URL
+  ) {
     info("Simulates drag/drop of a new javascript:URL to the bookmarks");
     await withBookmarksDialog(
       true,
@@ -47,7 +54,7 @@ add_task(async function test() {
         EventUtils.synthesizeDrop(
           toolbar,
           placesItems,
-          [[{ type: "text/x-moz-url", data: BOOKMARKLET_URL }]],
+          [[{ type: "text/x-moz-url", data: aBookmarkletUrl }]],
           aEffect,
           window
         );
@@ -61,11 +68,21 @@ add_task(async function test() {
 
         Assert.equal(
           location,
-          BOOKMARKLET_URL,
+          aBookmarkletUrl.trim().replace(/^javascript/i, "javascript"),
           "Should have opened the ShowBookmarksDialog with the correct bookmarklet url to be bookmarked"
         );
       }
     );
+  };
+
+  for (let effect of ["copy", "link"]) {
+    for (let bookmarkletUrl of [
+      BOOKMARKLET_URL,
+      BOOKMARKLET_URL_MIXED_CASE,
+      ` javascript: (() => {})();`,
+    ]) {
+      await simulateBookmarkletDragDrop(effect, bookmarkletUrl);
+    }
 
     info("Simulates drag/drop of a new URL to the bookmarks");
     let spy = sandbox
@@ -81,18 +98,13 @@ add_task(async function test() {
       toolbar,
       placesItems,
       [[{ type: "text/x-moz-url", data: URL1 }]],
-      aEffect,
+      effect,
       window
     );
 
     await promise;
     Assert.ok(spy.notCalled, "ShowBookmarksDialog on drop not called for url");
     sandbox.restore();
-  };
-
-  let effects = ["copy", "link"];
-  for (let effect of effects) {
-    await simulateDragDrop(effect);
   }
 
   info("Move of existing bookmark / bookmarklet on toolbar");


=====================================
browser/components/places/tests/browser/browser_toolbar_drop_multiple_with_bookmarklet.js
=====================================
@@ -18,12 +18,12 @@ add_task(async function test() {
   // matter because we will set its data, effect, and mimeType manually.
   let placesItems = document.getElementById("PlacesToolbarItems");
   Assert.ok(placesItems, "PlacesToolbarItems should not be null");
-  let simulateDragDrop = async function (aEffect, aMimeType) {
-    let urls = [
-      "https://example.com/1/",
-      `javascript: (() => {alert('Hello, World!');})();`,
-      "https://example.com/2/",
-    ];
+  let simulateDragDrop = async function (
+    aEffect,
+    aMimeType,
+    aJsUrl = `javascript: (() => {alert('Hello, World!');})();`
+  ) {
+    let urls = ["https://example.com/1/", aJsUrl, "https://example.com/2/"];
 
     let data = urls.map(spec => spec + "\n" + spec).join("\n");
 
@@ -43,8 +43,13 @@ add_task(async function test() {
 
   // Simulate a bookmark drop for all of the mime types and effects.
   let mimeType = ["text/x-moz-url"];
-  let effects = ["copy", "link"];
-  for (let effect of effects) {
-    await simulateDragDrop(effect, mimeType);
+  for (let effect of ["copy", "link"]) {
+    for (let jsUrl of [
+      `javascript: (() => {alert('Hello, World!');})();`,
+      `JavaScript: (() => {})();`,
+      ` javascript: (() => {})();`,
+    ]) {
+      await simulateDragDrop(effect, mimeType, jsUrl);
+    }
   }
 });


=====================================
dom/base/nsContentUtils.cpp
=====================================
@@ -5635,9 +5635,10 @@ void nsContentUtils::RequestFrameFocus(Element& aFrameElement, bool aCanRaise,
   RefPtr<Element> target = &aFrameElement;
   bool defaultAction = true;
   if (aCanRaise) {
-    DispatchEventOnlyToChrome(target->OwnerDoc(), target,
-                              u"framefocusrequested"_ns, CanBubble::eYes,
-                              Cancelable::eYes, &defaultAction);
+    RefPtr<Document> doc = target->OwnerDoc();
+    DispatchEventOnlyToChrome(doc, target, u"framefocusrequested"_ns,
+                              CanBubble::eYes, Cancelable::eYes,
+                              &defaultAction);
   }
   if (!defaultAction) {
     return;


=====================================
dom/script/ScriptLoader.cpp
=====================================
@@ -240,27 +240,27 @@ ScriptLoader::~ScriptLoader() {
     FireScriptAvailable(NS_ERROR_ABORT, mParserBlockingRequest);
   }
 
-  for (ScriptLoadRequest* req = mXSLTRequests.getFirst(); req;
+  for (RefPtr<ScriptLoadRequest> req = mXSLTRequests.getFirst(); req;
        req = req->getNext()) {
     FireScriptAvailable(NS_ERROR_ABORT, req);
   }
 
-  for (ScriptLoadRequest* req = mDeferRequests.getFirst(); req;
+  for (RefPtr<ScriptLoadRequest> req = mDeferRequests.getFirst(); req;
        req = req->getNext()) {
     FireScriptAvailable(NS_ERROR_ABORT, req);
   }
 
-  for (ScriptLoadRequest* req = mLoadingAsyncRequests.getFirst(); req;
+  for (RefPtr<ScriptLoadRequest> req = mLoadingAsyncRequests.getFirst(); req;
        req = req->getNext()) {
     FireScriptAvailable(NS_ERROR_ABORT, req);
   }
 
-  for (ScriptLoadRequest* req = mLoadedAsyncRequests.getFirst(); req;
+  for (RefPtr<ScriptLoadRequest> req = mLoadedAsyncRequests.getFirst(); req;
        req = req->getNext()) {
     FireScriptAvailable(NS_ERROR_ABORT, req);
   }
 
-  for (ScriptLoadRequest* req =
+  for (RefPtr<ScriptLoadRequest> req =
            mNonAsyncExternalScriptInsertedRequests.getFirst();
        req; req = req->getNext()) {
     FireScriptAvailable(NS_ERROR_ABORT, req);


=====================================
dom/security/nsContentSecurityUtils.cpp
=====================================
@@ -1179,8 +1179,9 @@ nsString nsContentSecurityUtils::GetIsElementNonceableNonce(
   // element’s attribute list:
   if (nsCOMPtr<nsIScriptElement> script =
           do_QueryInterface(const_cast<Element*>(&aElement))) {
-    auto containsScriptOrStyle = [](const nsAString& aStr) {
-      return aStr.LowerCaseFindASCII("<script") != kNotFound ||
+    auto containsLinkScriptOrStyle = [](const nsAString& aStr) {
+      return aStr.LowerCaseFindASCII("<link") != kNotFound ||
+             aStr.LowerCaseFindASCII("<script") != kNotFound ||
              aStr.LowerCaseFindASCII("<style") != kNotFound;
     };
 
@@ -1188,21 +1189,21 @@ nsString nsContentSecurityUtils::GetIsElementNonceableNonce(
     uint32_t i = 0;
     while (BorrowedAttrInfo info = aElement.GetAttrInfoAt(i++)) {
       // Step 2.1. If attribute’s name contains an ASCII case-insensitive match
-      // for "<script" or "<style", return "Not Nonceable".
+      // for "<link", <script" or "<style", return "Not Nonceable".
       const nsAttrName* name = info.mName;
       if (nsAtom* prefix = name->GetPrefix()) {
-        if (containsScriptOrStyle(nsDependentAtomString(prefix))) {
+        if (containsLinkScriptOrStyle(nsDependentAtomString(prefix))) {
           return EmptyString();
         }
       }
-      if (containsScriptOrStyle(nsDependentAtomString(name->LocalName()))) {
+      if (containsLinkScriptOrStyle(nsDependentAtomString(name->LocalName()))) {
         return EmptyString();
       }
 
       // Step 2.2. If attribute’s value contains an ASCII case-insensitive match
-      // for "<script" or "<style", return "Not Nonceable".
+      // for "<link", "<script" or "<style", return "Not Nonceable".
       info.mValue->ToString(value);
-      if (containsScriptOrStyle(value)) {
+      if (containsLinkScriptOrStyle(value)) {
         return EmptyString();
       }
     }


=====================================
js/src/jit/BaselineIC.cpp
=====================================
@@ -1735,10 +1735,15 @@ bool DoSpreadCallFallback(JSContext* cx, BaselineFrame* frame,
   // Transition stub state to megamorphic or generic if warranted.
   MaybeTransition(cx, frame, stub);
 
+  // The array is required to be packed, but may have indexed properties
+  // if its length exceeds MAX_DENSE_ELEMENTS_COUNT. Don't optimize in
+  // that case.
+  bool isIndexed = arr.toObject().as<NativeObject>().isIndexed();
+
   // Try attaching a call stub.
   bool handled = false;
   if (op != JSOp::SpreadEval && op != JSOp::StrictSpreadEval &&
-      stub->state().canAttachStub()) {
+      stub->state().canAttachStub() && !isIndexed) {
     // Try CacheIR first:
     Rooted<ArrayObject*> aobj(cx, &arr.toObject().as<ArrayObject>());
     MOZ_ASSERT(IsPackedArray(aobj));


=====================================
js/src/jit/CacheIR.cpp
=====================================
@@ -6431,7 +6431,9 @@ ObjOperandId InlinableNativeIRGenerator::emitLoadArgsArray() {
   MOZ_ASSERT(!hasBoundArguments());
 
   if (flags_.getArgFormat() == CallFlags::Spread) {
-    return writer.loadSpreadArgs();
+    ObjOperandId result = writer.loadSpreadArgs();
+    writer.guardArrayIsPacked(result);
+    return result;
   }
 
   MOZ_ASSERT(flags_.getArgFormat() == CallFlags::FunApplyArray);


=====================================
js/src/jit/CacheIRWriter.h
=====================================
@@ -523,7 +523,13 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter {
     ArgumentKind kind = ArgumentKind::Arg0;
     uint32_t argc = 1;
     CallFlags flags(CallFlags::Spread);
-    return ObjOperandId(loadArgumentFixedSlot(kind, argc, flags).id());
+    ValOperandId argId = loadArgumentFixedSlot(kind, argc, flags);
+#ifdef ENABLE_PORTABLE_BASELINE_INTERP
+    // PBL doesn't support implicit unboxing of objects.
+    return guardToObject(argId);
+#else
+    return ObjOperandId(argId.id());
+#endif
   }
 
   void callScriptedFunction(ObjOperandId callee, Int32OperandId argc,


=====================================
js/src/vm/PortableBaselineInterpret.cpp
=====================================
@@ -3915,11 +3915,8 @@ uint64_t ICInterpretOps(uint64_t arg0, uint64_t arg1, ICStub* stub,
       CACHEOP_CASE(Int32MinMaxArrayResult) {
         ObjOperandId arrayId = cacheIRReader.objOperandId();
         bool isMax = cacheIRReader.readBool();
-        // ICs that use this opcode depend on implicit unboxing due to
-        // type-overload on ObjOperandId when a value is loaded
-        // directly from an argument slot. We explicitly unbox here.
         NativeObject* nobj = reinterpret_cast<NativeObject*>(
-            &READ_VALUE_REG(arrayId.id()).toObject());
+            READ_REG(arrayId.id()));
         uint32_t len = nobj->getDenseInitializedLength();
         if (len == 0) {
           FAIL_IC();
@@ -3948,11 +3945,8 @@ uint64_t ICInterpretOps(uint64_t arg0, uint64_t arg1, ICStub* stub,
       CACHEOP_CASE(NumberMinMaxArrayResult) {
         ObjOperandId arrayId = cacheIRReader.objOperandId();
         bool isMax = cacheIRReader.readBool();
-        // ICs that use this opcode depend on implicit unboxing due to
-        // type-overload on ObjOperandId when a value is loaded
-        // directly from an argument slot. We explicitly unbox here.
         NativeObject* nobj = reinterpret_cast<NativeObject*>(
-            &READ_VALUE_REG(arrayId.id()).toObject());
+            READ_REG(arrayId.id()));
         uint32_t len = nobj->getDenseInitializedLength();
         if (len == 0) {
           FAIL_IC();


=====================================
toolkit/components/extensions/test/mochitest/test_ext_webrequest_upload.html
=====================================
@@ -27,6 +27,7 @@
   enctype="multipart/form-data"
...
<input type="text" name="textInput2" value="value2">
+<input type="text" name="__proto__" value="regression test for bug 2061470">
 <input type="file" name="testFile">
 <input type="file" name="emptyFile">
 </form>
@@ -161,11 +162,19 @@ add_task(async function test_xhr_forms() {
     }
     let action = new URL(form.action);
     let formData = new FormData(form);
-    let webRequestFD = {};
 
     let updateActionURL = () => {
+      let webRequestFD = {};
       for (let name of formData.keys()) {
-        webRequestFD[name] = name in uploads ? [uploads[name].fileName] : formData.getAll(name);
+        if (Object.hasOwn(webRequestFD, name)) {
+          // Ignore duplicate keys; formData.getAll already read all values.
+          continue;
+        }
+        const value = Object.hasOwn(uploads, name) ? [uploads[name].fileName] : formData.getAll(name);
+        // Cannot use webRequestFD[name] = value, because for "__proto__" as
+        // name, that would trigger the Object.prototype.__proto__ setter
+        // instead of defining a data property.
+        Object.defineProperty(webRequestFD, name, { value, enumerable: true });
       }
       action.searchParams.set("upload", JSON.stringify(webRequestFD));
       action.searchParams.set("enctype", form.enctype);


=====================================
toolkit/components/extensions/webrequest/WebRequestUpload.sys.mjs
=====================================
@@ -117,22 +117,6 @@ class Headers extends Map {
   }
 }
 
-/**
- * Creates a new Object with a corresponding property for every
- * key-value pair in the given Map.
- *
- * @param {Map} map
- *        The map to convert.
- * @returns {object}
- */
-function mapToObject(map) {
-  let result = {};
-  for (let [key, value] of map) {
-    result[key] = value;
-  }
-  return result;
-}
-
 /**
  * Rewinds the given seekable input stream to its beginning, and catches
  * any resulting errors.
@@ -446,7 +430,7 @@ function createFormData(stream, channel, lenient) {
   try {
     let formData = parseFormData(stream, channel, lenient);
     if (formData) {
-      return mapToObject(formData);
+      return Object.fromEntries(formData);
     }
   } catch (e) {
     Cu.reportError(e);



View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/67c9d20...

-- 
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/67c9d20...
You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

    

ma1 (＠ma1)

tags

participants (1)