ma1 pushed to branch tor-browser-140.17.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: d8047c80 by Chun-Min Chang at 2026-10-09T14:36:43+02:00 Bug 2047722 - Clamp the VP8 reference row await in ffvpx a=diannaS Cherry-pick of FFmpeg commit b772f5033c72, carried as vp8-reference-row-clamp.patch and listed in README_MOZILLA until ffvpx is updated past it. Original Revision: https://phabricator.services.mozilla.com/D315478 Differential Revision: https://phabricator.services.mozilla.com/D328288 - - - - - 05f91c29 by David Parks at 2026-10-09T15:13:48+02:00 Bug 2057113 - Part 1: Reject re-entrant native Windows clipboard mutations. a=diannaS DONTBUILD Native clipboard writes can spin a nested event loop or pump the native message queue. A clipboard write dispatched during that period re-enters the platform's backend and mutates state the suspended commit is still using. This exposed a case where the clipboard cache gets out-of-sync due to re-entrant SetData. The older write would win the cache but the native clipboard holds the newer write's contents. Re-entrant requests are now rejected (neither interleaved nor queued). Original Revision: https://phabricator.services.mozilla.com/D326255 Differential Revision: https://phabricator.services.mozilla.com/D328681 - - - - - 1f7a6e56 by David Parks at 2026-10-09T15:15:53+02:00 Bug 2057113 - Part 2: Don't force a synchronous clipboard flush for file promises. a=diannaS DONTBUILD SetNativeClipboardData flushes clipboard writes when text/plain is on the transferable on Windows 11 22H2+. Flushing was added to clipboard write in bug 1774285, because delayed rendering makes Windows Suggested Actions walk the a11y tree, and immediate rendering of data to the clipboard was the lesser evil. Rendering a file promise maps to CF_HDROP, whose renderer is nsDataObj::DropTempFile (which is unintuitively _not_ used for drag and drop, only clipboard). It opens a channel to the promised URL and runs a nested event loop in CStream::WaitForCompletion until it completes, so forcing the flush runs a network fetch in a nested event loop inside the clipboard commit. The duration of the nest is unpredictable but can be as long as the device maintains the connection (modulo any timeout limits). This patch skips the flush if there is a file (or no text) in the payload, avoiding the nested loop altogether when this happens. Without a pref flip (clipboard.imageAsFile.enabled = true), writing both a file and text to clipboard should not be possible, so this case does not occur. This is because only images can be written to the clipboard as files. See [the MDN page for mandatory types](https://www.w3.org/TR/clipboard-apis/#mandatory-data-types) and the comment in ClipboardItem::Supports. Original Revision: https://phabricator.services.mozilla.com/D326256 Differential Revision: https://phabricator.services.mozilla.com/D328682 - - - - - c8e23e99 by Jari Jalkanen at 2026-10-09T15:21:10+02:00 Bug 2058651: Stop WritableFileStreams from following moved paths. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D318103 Differential Revision: https://phabricator.services.mozilla.com/D329253 - - - - - 0aeb186c by Jari Jalkanen at 2026-10-09T15:35:01+02:00 Bug 2059211: Cap streaming request body sizes. r=valentin a=diannaS Original Revision: https://phabricator.services.mozilla.com/D325120 Differential Revision: https://phabricator.services.mozilla.com/D329258 - - - - - 83698774 by Jed Davis at 2026-10-09T16:22:59+02:00 Bug 2067976 - Clean up some unnecessary string copies in SandboxBroker. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D326377 Differential Revision: https://phabricator.services.mozilla.com/D328249 - - - - - 1f9a45a6 by Brad Werth at 2026-10-10T17:58:24+02:00 Bug 2068338: Alias CurrentState in SetFontInternalDisconnected. a=diannaS This prepares future uplifts to map more cleanly. Original Revision: https://phabricator.services.mozilla.com/D324734 Differential Revision: https://phabricator.services.mozilla.com/D330170 - - - - - 45c4e91c by Valentin Gosu at 2026-10-10T20:23:49+02:00 Bug 2068372 - nsSimpleNestedURI::Deserialize should reparse the inner URI a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D327278 Differential Revision: https://phabricator.services.mozilla.com/D328421 - - - - - 0112b6df by Maurice Dauer at 2026-10-10T20:28:42+02:00 Bug 2068420 - Skip the head sentinel, a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D328764 Differential Revision: https://phabricator.services.mozilla.com/D329773 - - - - - 94a287da by hackademix at 2026-10-10T20:41:28+02:00 Bug 2068421 - Make crash helper message reception more robust on Windows 140esr patch version picked from https://hg.mozilla.org/try/rev/423bb0653100ac8c2fbbf8dcc73894a746ac12ba - - - - - a9e5befe by David Shin at 2026-10-10T20:46:25+02:00 Bug 2068441: Make browsing context under printing browsing context not targetable. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D327854 Differential Revision: https://phabricator.services.mozilla.com/D329197 - - - - - 764be7c3 by Valentin Gosu at 2026-10-10T22:29:51+02:00 Bug 2070633 - Only allow setting nsIHttpChannel.allowSTS in parent process a=diannaS DONTBUILD Removes the flag from IPC arguments. It is now only honored in the parent process. Currently used by captive portal service and OCSP checks. Original Revision: https://phabricator.services.mozilla.com/D326843 Differential Revision: https://phabricator.services.mozilla.com/D328422 - - - - - 59ab6eb5 by Randell Jesup at 2026-10-10T22:34:19+02:00 Bug 2069910: Have nsHttpTransaction read a clone of the upload stream a=diannaS Differential Revision: https://phabricator.services.mozilla.com/D329334 - - - - - 2ad3557a by Jonathan Kew at 2026-10-10T22:41:22+02:00 Bug 2072438 - Rework bidi-engine management to allow nested use of nsBidiPresUtils::Resolve. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D327605 Differential Revision: https://phabricator.services.mozilla.com/D328159 - - - - - d9ebb2cf by Dianna Smith at 2026-10-10T22:41:27+02:00 Bug 2072438 - fix bustage on esr153 a=bustage - - - - - 3e536e33 by Iain Ireland at 2026-10-10T22:49:19+02:00 Bug 2073267: Add GuardSpecificObject for global lexical SetGName a=dsmith Original Revision: https://phabricator.services.mozilla.com/D328386 Differential Revision: https://phabricator.services.mozilla.com/D328730 - - - - - 91048598 by Yoshi Cheng-Hao Huang at 2026-10-11T23:52:18+02:00 Bug 2073269 - Part 1: Respect the goal symbol when building CompileOptions for delazification scripts. a=diannaS See https://bugzilla.mozilla.org/show_bug.cgi?id=2073269#c3 Original Revision: https://phabricator.services.mozilla.com/D328086 Differential Revision: https://phabricator.services.mozilla.com/D328633 - - - - - b106715a by Yoshi Cheng-Hao Huang at 2026-10-11T23:52:19+02:00 Bug 2073269 - Part 2: Jit-tests. a=diannaS Original Revision: https://phabricator.services.mozilla.com/D328088 Differential Revision: https://phabricator.services.mozilla.com/D328634 - - - - - 190c538b by Edgar Chen at 2026-10-11T23:52:19+02:00 Bug 2073647; a=diannaS Original Revision: https://phabricator.services.mozilla.com/D329143 Differential Revision: https://phabricator.services.mozilla.com/D330899 - - - - - ed71269a by Jan-Niklas Jaeschke at 2026-10-11T23:52:20+02:00 Bug 2073692 - Use weak reference in nsXMLPrettyPrinter. a=dsmith Original Revision: https://phabricator.services.mozilla.com/D328081 Differential Revision: https://phabricator.services.mozilla.com/D328121 - - - - - 6ee4b74b by Lee Salzman at 2026-10-11T23:52:20+02:00 Bug 2073969. a=diannaS DONTBUILD Differential Revision: https://phabricator.services.mozilla.com/D328280 - - - - - 0b2e0686 by Iain Ireland at 2026-10-11T23:52:21+02:00 Bug 2074164: Resolve primitive object constructors in WarpOracle a=dsmith Original Revision: https://phabricator.services.mozilla.com/D328316 Differential Revision: https://phabricator.services.mozilla.com/D328626 - - - - - 7bed59ca by Emilio Cobos Álvarez at 2026-10-11T23:52:21+02:00 Bug 2074208. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D328462 Differential Revision: https://phabricator.services.mozilla.com/D328755 - - - - - e8a9f66c by az at 2026-10-11T23:52:22+02:00 Bug 2074213 - a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D330064 Differential Revision: https://phabricator.services.mozilla.com/D330191 - - - - - 9016cc66 by Emilio Cobos Álvarez at 2026-10-12T00:08:51+02:00 Bug 2074625 - Avoid updating properties with retargeted animation. a=diannaS DONTBUILD This is the low risk fix. I think we need to figure out whether we even want to use that retargeted effect at all? But that seems like a follow-up bug. Rule tree changes are just assertions that catch this earlier. Original Revision: https://phabricator.services.mozilla.com/D328567 Differential Revision: https://phabricator.services.mozilla.com/D328800 - - - - - 59224c72 by Iain Ireland at 2026-10-12T00:09:11+02:00 Bug 2074632: Invalidate Ion when a pure DOM call reallocates the global's slots a=diannaS Original Revision: https://phabricator.services.mozilla.com/D329341 Differential Revision: https://phabricator.services.mozilla.com/D330540 - - - - - a6477a0d by longsonr at 2026-10-12T00:09:11+02:00 Bug 2074896 - Prevent feTile rect calculations from overflowing a=dmeehan DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D328561 Differential Revision: https://phabricator.services.mozilla.com/D329483 - - - - - 764122e3 by Valentin Gosu at 2026-10-12T00:09:12+02:00 Bug 2040905 - nsStandardURL::Deserialize should reparse the URL a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D309064 Differential Revision: https://phabricator.services.mozilla.com/D328789 - - - - - 067fa4f0 by Matthew Gaudet at 2026-10-12T00:09:12+02:00 Bug 2075998 - Root QueueWithSizes when dequeued a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D330015 Differential Revision: https://phabricator.services.mozilla.com/D330358 - - - - - 5158cb61 by Jan de Mooij at 2026-10-12T00:09:13+02:00 Bug 2076269 - Ensure the default array shape exists for MIR ops depending on this. a=dmeehan DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D330003 Differential Revision: https://phabricator.services.mozilla.com/D330124 - - - - - 67 changed files: - docshell/base/BrowsingContext.cpp - + dom/base/crashtests/2068441.html - dom/base/crashtests/crashtests.list - dom/base/nsImageLoadingContent.cpp - dom/canvas/CanvasRenderingContext2D.cpp - dom/canvas/OffscreenCanvas.cpp - dom/canvas/OffscreenCanvasDisplayHelper.cpp - dom/canvas/OffscreenCanvasDisplayHelper.h - dom/fs/parent/FileSystemHashSource.cpp - dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp - dom/html/HTMLMediaElement.cpp - dom/media/webcodecs/AudioData.cpp - dom/media/webcodecs/EncodedAudioChunk.cpp - dom/media/webcodecs/ImageDecoder.cpp - dom/security/test/unit/test_csp_deserialization.js - dom/streams/QueueWithSizes.h - + dom/xml/crashtests/2073692-frame.xml - + dom/xml/crashtests/2073692.html - dom/xml/crashtests/crashtests.list - dom/xml/nsXMLPrettyPrinter.cpp - dom/xml/nsXMLPrettyPrinter.h - gfx/2d/FilterNodeSoftware.cpp - gfx/cairo/cairo/src/cairo-boxes-intersect.c - gfx/cairo/moz.yaml - + gfx/cairo/patches/0052-Bug-2068420-skip-head-sentinel.patch - + gfx/tests/gtest/TestFilterNodeSoftware.cpp - gfx/tests/gtest/moz.build - js/src/frontend/BytecodeCompiler.cpp - + js/src/jit-test/tests/environments/bug2073267.js - + js/src/jit-test/tests/modules/bug-2073269.js - + js/src/jit-test/tests/parser/bug-2073269-script.js - js/src/jit/CacheIR.cpp - js/src/jit/CodeGenerator.cpp - js/src/jit/CodeGenerator.h - js/src/jit/Ion.cpp - js/src/jit/JitRuntime.h - js/src/jit/WarpOracle.cpp - js/src/vm/Interpreter.cpp - js/src/vm/JSObject.cpp - js/src/vm/NativeObject.cpp - layout/base/nsBidiPresUtils.cpp - layout/base/nsPresContext.cpp - layout/base/nsPresContext.h - layout/style/nsAnimationManager.cpp - media/ffvpx/README_MOZILLA - media/ffvpx/libavcodec/vp8.c - + media/ffvpx/vp8-reference-row-clamp.patch - modules/libpref/init/StaticPrefList.yaml - netwerk/base/nsSimpleNestedURI.cpp - netwerk/base/nsStandardURL.cpp - netwerk/ipc/NeckoChannelParams.ipdlh - netwerk/protocol/http/HttpBaseChannel.cpp - netwerk/protocol/http/HttpChannelChild.cpp - netwerk/protocol/http/HttpChannelParent.cpp - netwerk/protocol/http/HttpChannelParent.h - netwerk/protocol/http/nsHttpTransaction.cpp - netwerk/protocol/http/nsIHttpChannel.idl - security/sandbox/linux/broker/SandboxBroker.cpp - security/sandbox/linux/broker/SandboxBroker.h - servo/components/style/rule_tree/core.rs - + testing/web-platform/tests/web-animations/crashtests/keyframe-effect-cross-doc-target.html - toolkit/crashreporter/crash_helper_common/src/ipc_queue.rs - toolkit/crashreporter/crash_helper_common/src/ipc_queue/windows.rs - toolkit/crashreporter/crash_helper_common/src/platform/windows.rs - widget/nsBaseClipboard.cpp - widget/nsBaseClipboard.h - widget/windows/nsClipboard.cpp The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/050affc... -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/050affc... You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help