ma1 pushed to branch mullvad-browser-140.17.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 53f47142 by Chun-Min Chang at 2026-10-12T00:47:17+02:00 Bug 2047722 - Clamp the VP8 reference row await in ffvpx a=diannaS Cherry-pick of FFmpeg commit b772f5033c72, carried as vp8-reference-row-clamp.patch and listed in README_MOZILLA until ffvpx is updated past it. Original Revision: https://phabricator.services.mozilla.com/D315478 Differential Revision: https://phabricator.services.mozilla.com/D328288 - - - - - 3f7b1f31 by David Parks at 2026-10-12T00:47:18+02:00 Bug 2057113 - Part 1: Reject re-entrant native Windows clipboard mutations. a=diannaS DONTBUILD Native clipboard writes can spin a nested event loop or pump the native message queue. A clipboard write dispatched during that period re-enters the platform's backend and mutates state the suspended commit is still using. This exposed a case where the clipboard cache gets out-of-sync due to re-entrant SetData. The older write would win the cache but the native clipboard holds the newer write's contents. Re-entrant requests are now rejected (neither interleaved nor queued). Original Revision: https://phabricator.services.mozilla.com/D326255 Differential Revision: https://phabricator.services.mozilla.com/D328681 - - - - - 8bb484e1 by David Parks at 2026-10-12T00:47:18+02:00 Bug 2057113 - Part 2: Don't force a synchronous clipboard flush for file promises. a=diannaS DONTBUILD SetNativeClipboardData flushes clipboard writes when text/plain is on the transferable on Windows 11 22H2+. Flushing was added to clipboard write in bug 1774285, because delayed rendering makes Windows Suggested Actions walk the a11y tree, and immediate rendering of data to the clipboard was the lesser evil. Rendering a file promise maps to CF_HDROP, whose renderer is nsDataObj::DropTempFile (which is unintuitively _not_ used for drag and drop, only clipboard). It opens a channel to the promised URL and runs a nested event loop in CStream::WaitForCompletion until it completes, so forcing the flush runs a network fetch in a nested event loop inside the clipboard commit. The duration of the nest is unpredictable but can be as long as the device maintains the connection (modulo any timeout limits). This patch skips the flush if there is a file (or no text) in the payload, avoiding the nested loop altogether when this happens. Without a pref flip (clipboard.imageAsFile.enabled = true), writing both a file and text to clipboard should not be possible, so this case does not occur. This is because only images can be written to the clipboard as files. See [the MDN page for mandatory types](https://www.w3.org/TR/clipboard-apis/#mandatory-data-types) and the comment in ClipboardItem::Supports. Original Revision: https://phabricator.services.mozilla.com/D326256 Differential Revision: https://phabricator.services.mozilla.com/D328682 - - - - - be59c235 by Jari Jalkanen at 2026-10-12T00:47:19+02:00 Bug 2058651: Stop WritableFileStreams from following moved paths. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D318103 Differential Revision: https://phabricator.services.mozilla.com/D329253 - - - - - 99d3b149 by Jari Jalkanen at 2026-10-12T00:47:19+02:00 Bug 2059211: Cap streaming request body sizes. r=valentin a=diannaS Original Revision: https://phabricator.services.mozilla.com/D325120 Differential Revision: https://phabricator.services.mozilla.com/D329258 - - - - - 01f14f72 by Jed Davis at 2026-10-12T00:47:20+02:00 Bug 2067976 - Clean up some unnecessary string copies in SandboxBroker. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D326377 Differential Revision: https://phabricator.services.mozilla.com/D328249 - - - - - e51b3fd5 by Brad Werth at 2026-10-12T00:47:20+02:00 Bug 2068338: Alias CurrentState in SetFontInternalDisconnected. a=diannaS This prepares future uplifts to map more cleanly. Original Revision: https://phabricator.services.mozilla.com/D324734 Differential Revision: https://phabricator.services.mozilla.com/D330170 - - - - - fe98e984 by Valentin Gosu at 2026-10-12T00:47:21+02:00 Bug 2068372 - nsSimpleNestedURI::Deserialize should reparse the inner URI a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D327278 Differential Revision: https://phabricator.services.mozilla.com/D328421 - - - - - d2f340fb by Maurice Dauer at 2026-10-12T00:47:21+02:00 Bug 2068420 - Skip the head sentinel, a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D328764 Differential Revision: https://phabricator.services.mozilla.com/D329773 - - - - - e3e84626 by hackademix at 2026-10-12T00:47:21+02:00 Bug 2068421 - Make crash helper message reception more robust on Windows 140esr patch version picked from https://hg.mozilla.org/try/rev/423bb0653100ac8c2fbbf8dcc73894a746ac12ba - - - - - 3dfae51e by David Shin at 2026-10-12T00:47:22+02:00 Bug 2068441: Make browsing context under printing browsing context not targetable. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D327854 Differential Revision: https://phabricator.services.mozilla.com/D329197 - - - - - 8864d886 by Valentin Gosu at 2026-10-12T00:47:22+02:00 Bug 2070633 - Only allow setting nsIHttpChannel.allowSTS in parent process a=diannaS DONTBUILD Removes the flag from IPC arguments. It is now only honored in the parent process. Currently used by captive portal service and OCSP checks. Original Revision: https://phabricator.services.mozilla.com/D326843 Differential Revision: https://phabricator.services.mozilla.com/D328422 - - - - - 233f616b by Randell Jesup at 2026-10-12T00:47:23+02:00 Bug 2069910: Have nsHttpTransaction read a clone of the upload stream a=diannaS Differential Revision: https://phabricator.services.mozilla.com/D329334 - - - - - 585d0b06 by Jonathan Kew at 2026-10-12T00:47:23+02:00 Bug 2072438 - Rework bidi-engine management to allow nested use of nsBidiPresUtils::Resolve. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D327605 Differential Revision: https://phabricator.services.mozilla.com/D328159 - - - - - fd2e3987 by Dianna Smith at 2026-10-12T00:47:24+02:00 Bug 2072438 - fix bustage on esr153 a=bustage - - - - - abd0241c by Iain Ireland at 2026-10-12T00:47:24+02:00 Bug 2073267: Add GuardSpecificObject for global lexical SetGName a=dsmith Original Revision: https://phabricator.services.mozilla.com/D328386 Differential Revision: https://phabricator.services.mozilla.com/D328730 - - - - - a36ab04b by Yoshi Cheng-Hao Huang at 2026-10-12T00:47:25+02:00 Bug 2073269 - Part 1: Respect the goal symbol when building CompileOptions for delazification scripts. a=diannaS See https://bugzilla.mozilla.org/show_bug.cgi?id=2073269#c3 Original Revision: https://phabricator.services.mozilla.com/D328086 Differential Revision: https://phabricator.services.mozilla.com/D328633 - - - - - 7aeecaab by Yoshi Cheng-Hao Huang at 2026-10-12T00:47:25+02:00 Bug 2073269 - Part 2: Jit-tests. a=diannaS Original Revision: https://phabricator.services.mozilla.com/D328088 Differential Revision: https://phabricator.services.mozilla.com/D328634 - - - - - 046f535d by Edgar Chen at 2026-10-12T00:47:26+02:00 Bug 2073647; a=diannaS Original Revision: https://phabricator.services.mozilla.com/D329143 Differential Revision: https://phabricator.services.mozilla.com/D330899 - - - - - cbf476d7 by Jan-Niklas Jaeschke at 2026-10-12T00:47:26+02:00 Bug 2073692 - Use weak reference in nsXMLPrettyPrinter. a=dsmith Original Revision: https://phabricator.services.mozilla.com/D328081 Differential Revision: https://phabricator.services.mozilla.com/D328121 - - - - - d01bb224 by Lee Salzman at 2026-10-12T00:47:27+02:00 Bug 2073969. a=diannaS DONTBUILD Differential Revision: https://phabricator.services.mozilla.com/D328280 - - - - - 2857255c by Iain Ireland at 2026-10-12T00:47:27+02:00 Bug 2074164: Resolve primitive object constructors in WarpOracle a=dsmith Original Revision: https://phabricator.services.mozilla.com/D328316 Differential Revision: https://phabricator.services.mozilla.com/D328626 - - - - - c83b2712 by Emilio Cobos Álvarez at 2026-10-12T00:47:28+02:00 Bug 2074208. a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D328462 Differential Revision: https://phabricator.services.mozilla.com/D328755 - - - - - f2e4c0a3 by az at 2026-10-12T00:47:28+02:00 Bug 2074213 - a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D330064 Differential Revision: https://phabricator.services.mozilla.com/D330191 - - - - - dfef8b36 by Emilio Cobos Álvarez at 2026-10-12T00:47:28+02:00 Bug 2074625 - Avoid updating properties with retargeted animation. a=diannaS DONTBUILD This is the low risk fix. I think we need to figure out whether we even want to use that retargeted effect at all? But that seems like a follow-up bug. Rule tree changes are just assertions that catch this earlier. Original Revision: https://phabricator.services.mozilla.com/D328567 Differential Revision: https://phabricator.services.mozilla.com/D328800 - - - - - 1a2b7de5 by Iain Ireland at 2026-10-12T00:47:29+02:00 Bug 2074632: Invalidate Ion when a pure DOM call reallocates the global's slots a=diannaS Original Revision: https://phabricator.services.mozilla.com/D329341 Differential Revision: https://phabricator.services.mozilla.com/D330540 - - - - - 7448316b by longsonr at 2026-10-12T00:47:29+02:00 Bug 2074896 - Prevent feTile rect calculations from overflowing a=dmeehan DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D328561 Differential Revision: https://phabricator.services.mozilla.com/D329483 - - - - - d13f55b7 by Valentin Gosu at 2026-10-12T00:47:30+02:00 Bug 2040905 - nsStandardURL::Deserialize should reparse the URL a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D309064 Differential Revision: https://phabricator.services.mozilla.com/D328789 - - - - - 424299bc by Matthew Gaudet at 2026-10-12T00:47:30+02:00 Bug 2075998 - Root QueueWithSizes when dequeued a=diannaS DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D330015 Differential Revision: https://phabricator.services.mozilla.com/D330358 - - - - - 3e08d243 by Jan de Mooij at 2026-10-12T00:47:31+02:00 Bug 2076269 - Ensure the default array shape exists for MIR ops depending on this. a=dmeehan DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D330003 Differential Revision: https://phabricator.services.mozilla.com/D330124 - - - - - 67 changed files: - docshell/base/BrowsingContext.cpp - + dom/base/crashtests/2068441.html - dom/base/crashtests/crashtests.list - dom/base/nsImageLoadingContent.cpp - dom/canvas/CanvasRenderingContext2D.cpp - dom/canvas/OffscreenCanvas.cpp - dom/canvas/OffscreenCanvasDisplayHelper.cpp - dom/canvas/OffscreenCanvasDisplayHelper.h - dom/fs/parent/FileSystemHashSource.cpp - dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp - dom/html/HTMLMediaElement.cpp - dom/media/webcodecs/AudioData.cpp - dom/media/webcodecs/EncodedAudioChunk.cpp - dom/media/webcodecs/ImageDecoder.cpp - dom/security/test/unit/test_csp_deserialization.js - dom/streams/QueueWithSizes.h - + dom/xml/crashtests/2073692-frame.xml - + dom/xml/crashtests/2073692.html - dom/xml/crashtests/crashtests.list - dom/xml/nsXMLPrettyPrinter.cpp - dom/xml/nsXMLPrettyPrinter.h - gfx/2d/FilterNodeSoftware.cpp - gfx/cairo/cairo/src/cairo-boxes-intersect.c - gfx/cairo/moz.yaml - + gfx/cairo/patches/0052-Bug-2068420-skip-head-sentinel.patch - + gfx/tests/gtest/TestFilterNodeSoftware.cpp - gfx/tests/gtest/moz.build - js/src/frontend/BytecodeCompiler.cpp - + js/src/jit-test/tests/environments/bug2073267.js - + js/src/jit-test/tests/modules/bug-2073269.js - + js/src/jit-test/tests/parser/bug-2073269-script.js - js/src/jit/CacheIR.cpp - js/src/jit/CodeGenerator.cpp - js/src/jit/CodeGenerator.h - js/src/jit/Ion.cpp - js/src/jit/JitRuntime.h - js/src/jit/WarpOracle.cpp - js/src/vm/Interpreter.cpp - js/src/vm/JSObject.cpp - js/src/vm/NativeObject.cpp - layout/base/nsBidiPresUtils.cpp - layout/base/nsPresContext.cpp - layout/base/nsPresContext.h - layout/style/nsAnimationManager.cpp - media/ffvpx/README_MOZILLA - media/ffvpx/libavcodec/vp8.c - + media/ffvpx/vp8-reference-row-clamp.patch - modules/libpref/init/StaticPrefList.yaml - netwerk/base/nsSimpleNestedURI.cpp - netwerk/base/nsStandardURL.cpp - netwerk/ipc/NeckoChannelParams.ipdlh - netwerk/protocol/http/HttpBaseChannel.cpp - netwerk/protocol/http/HttpChannelChild.cpp - netwerk/protocol/http/HttpChannelParent.cpp - netwerk/protocol/http/HttpChannelParent.h - netwerk/protocol/http/nsHttpTransaction.cpp - netwerk/protocol/http/nsIHttpChannel.idl - security/sandbox/linux/broker/SandboxBroker.cpp - security/sandbox/linux/broker/SandboxBroker.h - servo/components/style/rule_tree/core.rs - + testing/web-platform/tests/web-animations/crashtests/keyframe-effect-cross-doc-target.html - toolkit/crashreporter/crash_helper_common/src/ipc_queue.rs - toolkit/crashreporter/crash_helper_common/src/ipc_queue/windows.rs - toolkit/crashreporter/crash_helper_common/src/platform/windows.rs - widget/nsBaseClipboard.cpp - widget/nsBaseClipboard.h - widget/windows/nsClipboard.cpp The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/594... -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/594... You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help