August 2014 - tor-commits - lists.torproject.org

[tor-browser/esr24] Bug 940714 - Add a RAII class to make synchronous decoding safer. r=tn, a=abillings
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 164ccdf7911a3d54b8d14643539e01a9da7a680c Author: Seth Fowler <seth(a)mozilla.com> Date: Wed Nov 20 17:21:51 2013 -0800 Bug 940714 - Add a RAII class to make synchronous decoding safer. r=tn, a=abillings --- image/src/Decoder.h | 44 +++++++++++++++++++++++++++++++++++++++----- image/src/RasterImage.cpp | 40 +++++++++++++++++----------------------- image/src/RasterImage.h | 2 +- 3 files changed, 57 insertions(+), 29 deletions(-) diff --git a/image/src/Decoder.h b/image/src/Decoder.h index 463e473..705cb36 100644 --- a/image/src/Decoder.h +++ b/image/src/Decoder.h @@ -92,11 +92,6 @@ public: mSizeDecode = aSizeDecode; } - void SetSynchronous(bool aSynchronous) - { - mSynchronous = aSynchronous; - } - bool IsSynchronous() const { return mSynchronous; @@ -242,6 +237,17 @@ protected: bool mDataError; private: + // Decode in synchronous mode. This is unsafe off-main-thread since it may + // attempt to allocate frames. To ensure that we never accidentally leave the + // decoder in synchronous mode, this should only be called by + // AutoSetSyncDecode. + void SetSynchronous(bool aSynchronous) + { + mSynchronous = aSynchronous; + } + + friend class AutoSetSyncDecode; + uint32_t mFrameCount; // Number of frames, including anything in-progress nsIntRect mInvalidRect; // Tracks an invalidation region in the current frame. @@ -281,6 +287,34 @@ private: bool mSynchronous; }; +// A RAII helper class to automatically pair a call to SetSynchronous(true) +// with a call to SetSynchronous(false), since failing to do so can lead us +// to try to allocate frames off-main-thread, which is unsafe. Synchronous +// decoding may only happen within the scope of an AutoSetSyncDecode. Nested +// AutoSetSyncDecode's are OK. +class AutoSetSyncDecode +{ +public: + AutoSetSyncDecode(Decoder* aDecoder) + : mDecoder(aDecoder) + { + MOZ_ASSERT(NS_IsMainThread()); + MOZ_ASSERT(mDecoder); + + mOriginalValue = mDecoder->IsSynchronous(); + mDecoder->SetSynchronous(true); + } + + ~AutoSetSyncDecode() + { + mDecoder->SetSynchronous(mOriginalValue); + } + +private: + nsRefPtr<Decoder> mDecoder; + bool mOriginalValue; +}; + } // namespace image } // namespace mozilla diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp index 695df7b..65f8169 100644 --- a/image/src/RasterImage.cpp +++ b/image/src/RasterImage.cpp @@ -1713,10 +1713,11 @@ RasterImage::AddSourceData(const char *aBuffer, uint32_t aCount) // write the data directly to the decoder. (If we haven't gotten the size, // we'll queue up the data and write it out when we do.) if (!StoringSourceData() && mHasSize) { - mDecoder->SetSynchronous(true); - rv = WriteToDecoder(aBuffer, aCount); - mDecoder->SetSynchronous(false); - CONTAINER_ENSURE_SUCCESS(rv); + { + AutoSetSyncDecode syncDecode(mDecoder); + rv = WriteToDecoder(aBuffer, aCount); + CONTAINER_ENSURE_SUCCESS(rv); + } // We're not storing source data, so this data is probably coming straight // from the network. In this case, we want to display data as soon as we @@ -2084,7 +2085,7 @@ RasterImage::StoringSourceData() const { // Sets up a decoder for this image. It is an error to call this function // when decoding is already in process (ie - when mDecoder is non-null). nsresult -RasterImage::InitDecoder(bool aDoSizeDecode, bool aIsSynchronous /* = false */) +RasterImage::InitDecoder(bool aDoSizeDecode) { // Ensure that the decoder is not already initialized NS_ABORT_IF_FALSE(!mDecoder, "Calling InitDecoder() while already decoding!"); @@ -2152,7 +2153,6 @@ RasterImage::InitDecoder(bool aDoSizeDecode, bool aIsSynchronous /* = false */) mDecoder->SetObserver(mDecodeRequest->mStatusTracker->GetDecoderObserver()); mDecoder->SetSizeDecode(aDoSizeDecode); mDecoder->SetDecodeFlags(mFrameDecodeFlags); - mDecoder->SetSynchronous(aIsSynchronous); if (!aDoSizeDecode) { // We already have the size; tell the decoder so it can preallocate a // frame. By default, we create an ARGB frame with no offset. If decoders @@ -2435,14 +2435,8 @@ RasterImage::RequestDecodeCore(RequestDecodeType aDecodeType) // to finish decoding. if (!mDecoded && !mInDecoder && mHasSourceData && aDecodeType == SYNCHRONOUS_NOTIFY_AND_SOME_DECODE) { PROFILER_LABEL_PRINTF("RasterImage", "DecodeABitOf", "%s", GetURIString().get()); - mDecoder->SetSynchronous(true); - + AutoSetSyncDecode syncDecode(mDecoder); DecodePool::Singleton()->DecodeABitOf(this); - - // DecodeABitOf can destroy mDecoder. - if (mDecoder) { - mDecoder->SetSynchronous(false); - } return NS_OK; } @@ -2520,15 +2514,17 @@ RasterImage::SyncDecode() // If we don't have a decoder, create one if (!mDecoder) { - rv = InitDecoder(/* aDoSizeDecode = */ false, /* aIsSynchronous = */ true); + rv = InitDecoder(/* aDoSizeDecode = */ false); CONTAINER_ENSURE_SUCCESS(rv); - } else { - mDecoder->SetSynchronous(true); } - // Write everything we have - rv = DecodeSomeData(mSourceData.Length() - mBytesDecoded); - CONTAINER_ENSURE_SUCCESS(rv); + { + AutoSetSyncDecode syncDecode(mDecoder); + + // Write everything we have + rv = DecodeSomeData(mSourceData.Length() - mBytesDecoded); + CONTAINER_ENSURE_SUCCESS(rv); + } // When we're doing a sync decode, we want to get as much information from the // image as possible. We've send the decoder all of our data, so now's a good @@ -2541,11 +2537,9 @@ RasterImage::SyncDecode() rv = FinishedSomeDecoding(); CONTAINER_ENSURE_SUCCESS(rv); - + + // If our decoder's still open, there's still work to be done. if (mDecoder) { - mDecoder->SetSynchronous(false); - - // If our decoder's still open, there's still work to be done. DecodePool::Singleton()->RequestDecode(this); } diff --git a/image/src/RasterImage.h b/image/src/RasterImage.h index cb51c68..420a470 100644 --- a/image/src/RasterImage.h +++ b/image/src/RasterImage.h @@ -750,7 +750,7 @@ private: // data // Decoding nsresult WantDecodedFrames(); nsresult SyncDecode(); - nsresult InitDecoder(bool aDoSizeDecode, bool aIsSynchronous = false); + nsresult InitDecoder(bool aDoSizeDecode); nsresult WriteToDecoder(const char *aBuffer, uint32_t aCount); nsresult DecodeSomeData(uint32_t aMaxBytes); bool IsDecodeFinished();

1 0

[tor-browser/esr24] Bug 982909 - Consistently use inner window when calling OpenJS. r=jst, r=mrbkap, a=lsblakk
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit cf2d009c8aba6ffd168d87efb99e0f684b71759d Author: Olli Pettay <Olli.Pettay(a)helsinki.fi> Date: Thu Mar 13 15:44:25 2014 -0400 Bug 982909 - Consistently use inner window when calling OpenJS. r=jst, r=mrbkap, a=lsblakk --- content/html/document/src/nsHTMLDocument.cpp | 2 +- dom/base/nsGlobalWindow.cpp | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp index 6608154..6e3635f 100644 --- a/content/html/document/src/nsHTMLDocument.cpp +++ b/content/html/document/src/nsHTMLDocument.cpp @@ -1416,7 +1416,7 @@ nsHTMLDocument::Open(JSContext* /* unused */, NS_ASSERTION(nsContentUtils::CanCallerAccess(static_cast<nsIDOMHTMLDocument*>(this)), "XOW should have caught this!"); - nsCOMPtr<nsIDOMWindow> window = GetWindow(); + nsCOMPtr<nsIDOMWindow> window = GetInnerWindow(); if (!window) { rv.Throw(NS_ERROR_DOM_INVALID_ACCESS_ERR); return nullptr; diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp index bc6ecc4..7b6707a 100644 --- a/dom/base/nsGlobalWindow.cpp +++ b/dom/base/nsGlobalWindow.cpp @@ -426,6 +426,14 @@ nsGlobalWindow::DOMMinTimeoutValue() const { } \ PR_END_MACRO +#define NS_ENSURE_OUTER_WINDOW_OR_ACTIVE_DOCUMENT \ + NS_ENSURE_TRUE(!IsInnerWindow() || \ + (mOuterWindow && \ + ((mOuterWindow->GetCurrentInnerWindow() == this) || \ + (mOuterWindow->GetCurrentInnerWindow() && \ + mOuterWindow->GetCurrentInnerWindow()->GetDoc() == mDoc))),\ + NS_ERROR_NOT_INITIALIZED); + // CIDs static NS_DEFINE_CID(kXULControllersCID, NS_XULCONTROLLERS_CID); @@ -6425,6 +6433,7 @@ NS_IMETHODIMP nsGlobalWindow::OpenJS(const nsAString& aUrl, const nsAString& aName, const nsAString& aOptions, nsIDOMWindow **_retval) { + NS_ENSURE_OUTER_WINDOW_OR_ACTIVE_DOCUMENT return OpenInternal(aUrl, aName, aOptions, false, // aDialog false, // aContentModal @@ -7742,6 +7751,7 @@ nsGlobalWindow::ShowModalDialog(const nsAString& aURI, nsIVariant *aArgs_, const nsAString& aOptions, uint8_t aArgc, nsIVariant **aRetVal) { + NS_ENSURE_OUTER_WINDOW_OR_ACTIVE_DOCUMENT FORWARD_TO_OUTER(ShowModalDialog, (aURI, aArgs_, aOptions, aArgc, aRetVal), NS_ERROR_NOT_INITIALIZED);

1 0

[tor-browser/esr24] Bug 982957 - Fix crash if ConstraintTypeSet::sweep or TypeObject::sweep OOMs. r=bhackett, a=lsblakk
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 3fb3184b540fcd82899c6e8d565941b12372ed72 Author: Jan de Mooij <jdemooij(a)mozilla.com> Date: Thu Mar 13 18:15:25 2014 -0400 Bug 982957 - Fix crash if ConstraintTypeSet::sweep or TypeObject::sweep OOMs. r=bhackett, a=lsblakk --- js/src/jsinfer.cpp | 51 ++++++++++++++++++++++++++++----------------------- 1 file changed, 28 insertions(+), 23 deletions(-) diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp index d43974f..e961f11 100644 --- a/js/src/jsinfer.cpp +++ b/js/src/jsinfer.cpp @@ -6172,6 +6172,15 @@ JSCompartment::getLazyType(JSContext *cx, Class *clasp, TaggedProto proto) // Tracing ///////////////////////////////////////////////////////////////////// +static void +CrashAtUnhandlableOOM(const char *reason) +{ + char msgbuf[1024]; + JS_snprintf(msgbuf, sizeof(msgbuf), "[unhandlable oom] %s", reason); + MOZ_ReportAssertionFailure(msgbuf, __FILE__, __LINE__); + MOZ_CRASH(); +} + void TypeSet::sweep(Zone *zone) { @@ -6196,10 +6205,9 @@ TypeSet::sweep(Zone *zone) TypeObjectKey **pentry = HashSetInsert<TypeObjectKey *,TypeObjectKey,TypeObjectKey> (zone->types.typeLifoAlloc, objectSet, objectCount, object); - if (pentry) - *pentry = object; - else - zone->types.setPendingNukeTypes(); + if (!pentry) + CrashAtUnhandlableOOM("OOM in ConstraintTypeSet::sweep"); + *pentry = object; } } setBaseObjectCount(objectCount); @@ -6279,19 +6287,17 @@ TypeObject::sweep(FreeOp *fop) Property *prop = oldArray[i]; if (prop && prop->types.ownProperty(false)) { Property *newProp = typeLifoAlloc.new_<Property>(*prop); - if (newProp) { - Property **pentry = - HashSetInsert<jsid,Property,Property> - (typeLifoAlloc, propertySet, propertyCount, prop->id); - if (pentry) { - *pentry = newProp; - newProp->types.sweep(zone()); - } else { - zone()->types.setPendingNukeTypes(); - } - } else { - zone()->types.setPendingNukeTypes(); - } + if (!newProp) + CrashAtUnhandlableOOM("OOM in TypeObject::sweep"); + + Property **pentry = + HashSetInsert<jsid,Property,Property> + (typeLifoAlloc, propertySet, propertyCount, prop->id); + if (!pentry) + CrashAtUnhandlableOOM("OOM in TypeObject::sweep"); + + *pentry = newProp; + newProp->types.sweep(zone()); } } setBasePropertyCount(propertyCount); @@ -6299,12 +6305,11 @@ TypeObject::sweep(FreeOp *fop) Property *prop = (Property *) propertySet; if (prop->types.ownProperty(false)) { Property *newProp = typeLifoAlloc.new_<Property>(*prop); - if (newProp) { - propertySet = (Property **) newProp; - newProp->types.sweep(zone()); - } else { - zone()->types.setPendingNukeTypes(); - } + if (!newProp) + CrashAtUnhandlableOOM("OOM in TypeObject::sweep"); + + propertySet = (Property **) newProp; + newProp->types.sweep(zone()); } else { propertySet = NULL; setBasePropertyCount(0);

1 0

[tor-browser/esr24] Bug 896268 - Use a stateless approach to synchronous image decoding. r=jdm, a=abillings
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit dcbe26ea5f1021f44632b086df0b9e8c07142b12 Author: Seth Fowler <seth(a)mozilla.com> Date: Tue Dec 17 14:04:24 2013 -0800 Bug 896268 - Use a stateless approach to synchronous image decoding. r=jdm, a=abillings --- image/decoders/nsBMPDecoder.cpp | 2 +- image/decoders/nsBMPDecoder.h | 2 +- image/decoders/nsGIFDecoder2.cpp | 2 +- image/decoders/nsGIFDecoder2.h | 2 +- image/decoders/nsICODecoder.cpp | 18 +++++++------- image/decoders/nsICODecoder.h | 4 +-- image/decoders/nsIconDecoder.cpp | 2 +- image/decoders/nsIconDecoder.h | 2 +- image/decoders/nsJPEGDecoder.cpp | 9 +++++-- image/decoders/nsJPEGDecoder.h | 2 +- image/decoders/nsPNGDecoder.cpp | 2 +- image/decoders/nsPNGDecoder.h | 2 +- image/src/DecodeStrategy.h | 36 +++++++++++++++++++++++++++ image/src/Decoder.cpp | 16 +++++++----- image/src/Decoder.h | 50 +++----------------------------------- image/src/RasterImage.cpp | 42 +++++++++++++++----------------- image/src/RasterImage.h | 10 +++++--- 17 files changed, 103 insertions(+), 100 deletions(-) diff --git a/image/decoders/nsBMPDecoder.cpp b/image/decoders/nsBMPDecoder.cpp index 8f7b5ad..704c8fc 100644 --- a/image/decoders/nsBMPDecoder.cpp +++ b/image/decoders/nsBMPDecoder.cpp @@ -189,7 +189,7 @@ NS_METHOD nsBMPDecoder::CalcBitShift() } void -nsBMPDecoder::WriteInternal(const char* aBuffer, uint32_t aCount) +nsBMPDecoder::WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy) { NS_ABORT_IF_FALSE(!HasError(), "Shouldn't call WriteInternal after error!"); diff --git a/image/decoders/nsBMPDecoder.h b/image/decoders/nsBMPDecoder.h index a212ec8..51f4140 100644 --- a/image/decoders/nsBMPDecoder.h +++ b/image/decoders/nsBMPDecoder.h @@ -45,7 +45,7 @@ public: // for 32BPP bitmaps. Only use after the bitmap has been processed. bool HasAlphaData() const; - virtual void WriteInternal(const char* aBuffer, uint32_t aCount); + virtual void WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy); virtual void FinishInternal(); private: diff --git a/image/decoders/nsGIFDecoder2.cpp b/image/decoders/nsGIFDecoder2.cpp index 269837c..66bfd65 100644 --- a/image/decoders/nsGIFDecoder2.cpp +++ b/image/decoders/nsGIFDecoder2.cpp @@ -544,7 +544,7 @@ static void ConvertColormap(uint32_t *aColormap, uint32_t aColors) } void -nsGIFDecoder2::WriteInternal(const char *aBuffer, uint32_t aCount) +nsGIFDecoder2::WriteInternal(const char *aBuffer, uint32_t aCount, DecodeStrategy) { NS_ABORT_IF_FALSE(!HasError(), "Shouldn't call WriteInternal after error!"); diff --git a/image/decoders/nsGIFDecoder2.h b/image/decoders/nsGIFDecoder2.h index d056607..328e499 100644 --- a/image/decoders/nsGIFDecoder2.h +++ b/image/decoders/nsGIFDecoder2.h @@ -26,7 +26,7 @@ public: nsGIFDecoder2(RasterImage &aImage); ~nsGIFDecoder2(); - virtual void WriteInternal(const char* aBuffer, uint32_t aCount); + virtual void WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy); virtual void FinishInternal(); virtual Telemetry::ID SpeedHistogram(); diff --git a/image/decoders/nsICODecoder.cpp b/image/decoders/nsICODecoder.cpp index 395965c..8ef2e9a 100644 --- a/image/decoders/nsICODecoder.cpp +++ b/image/decoders/nsICODecoder.cpp @@ -209,13 +209,13 @@ nsICODecoder::SetHotSpotIfCursor() { } void -nsICODecoder::WriteInternal(const char* aBuffer, uint32_t aCount) +nsICODecoder::WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy) { NS_ABORT_IF_FALSE(!HasError(), "Shouldn't call WriteInternal after error!"); if (!aCount) { if (mContainedDecoder) { - WriteToContainedDecoder(aBuffer, aCount); + WriteToContainedDecoder(aBuffer, aCount, aStrategy); } return; } @@ -337,7 +337,7 @@ nsICODecoder::WriteInternal(const char* aBuffer, uint32_t aCount) mContainedDecoder->InitSharedDecoder(mImageData, mImageDataLength, mColormap, mColormapSize, mCurrentFrame); - if (!WriteToContainedDecoder(mSignature, PNGSIGNATURESIZE)) { + if (!WriteToContainedDecoder(mSignature, PNGSIGNATURESIZE, aStrategy)) { return; } } @@ -345,7 +345,7 @@ nsICODecoder::WriteInternal(const char* aBuffer, uint32_t aCount) // If we have a PNG, let the PNG decoder do all of the rest of the work if (mIsPNG && mContainedDecoder && mPos >= mImageOffset + PNGSIGNATURESIZE) { - if (!WriteToContainedDecoder(aBuffer, aCount)) { + if (!WriteToContainedDecoder(aBuffer, aCount, aStrategy)) { return; } @@ -423,7 +423,7 @@ nsICODecoder::WriteInternal(const char* aBuffer, uint32_t aCount) PostDataError(); return; } - if (!WriteToContainedDecoder((const char*)bfhBuffer, sizeof(bfhBuffer))) { + if (!WriteToContainedDecoder((const char*)bfhBuffer, sizeof(bfhBuffer), aStrategy)) { return; } @@ -444,7 +444,7 @@ nsICODecoder::WriteInternal(const char* aBuffer, uint32_t aCount) } // Write out the BMP's bitmap info header - if (!WriteToContainedDecoder(mBIHraw, sizeof(mBIHraw))) { + if (!WriteToContainedDecoder(mBIHraw, sizeof(mBIHraw), aStrategy)) { return; } @@ -492,7 +492,7 @@ nsICODecoder::WriteInternal(const char* aBuffer, uint32_t aCount) toFeed = aCount; } - if (!WriteToContainedDecoder(aBuffer, toFeed)) { + if (!WriteToContainedDecoder(aBuffer, toFeed, aStrategy)) { return; } @@ -568,9 +568,9 @@ nsICODecoder::WriteInternal(const char* aBuffer, uint32_t aCount) } bool -nsICODecoder::WriteToContainedDecoder(const char* aBuffer, uint32_t aCount) +nsICODecoder::WriteToContainedDecoder(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy) { - mContainedDecoder->Write(aBuffer, aCount); + mContainedDecoder->Write(aBuffer, aCount, aStrategy); if (mContainedDecoder->HasDataError()) { mDataError = mContainedDecoder->HasDataError(); } diff --git a/image/decoders/nsICODecoder.h b/image/decoders/nsICODecoder.h index 733d353..73576b8 100644 --- a/image/decoders/nsICODecoder.h +++ b/image/decoders/nsICODecoder.h @@ -37,7 +37,7 @@ public: return mDirEntry.mHeight == 0 ? 256 : mDirEntry.mHeight; } - virtual void WriteInternal(const char* aBuffer, uint32_t aCount); + virtual void WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy); virtual void FinishInternal(); virtual bool NeedsNewFrame() const; virtual nsresult AllocateFrame(); @@ -45,7 +45,7 @@ public: private: // Writes to the contained decoder and sets the appropriate errors // Returns true if there are no errors. - bool WriteToContainedDecoder(const char* aBuffer, uint32_t aCount); + bool WriteToContainedDecoder(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy); // Processes a single dir entry of the icon resource void ProcessDirEntry(IconDirEntry& aTarget); diff --git a/image/decoders/nsIconDecoder.cpp b/image/decoders/nsIconDecoder.cpp index f5c9d33..29abc09 100644 --- a/image/decoders/nsIconDecoder.cpp +++ b/image/decoders/nsIconDecoder.cpp @@ -30,7 +30,7 @@ nsIconDecoder::~nsIconDecoder() { } void -nsIconDecoder::WriteInternal(const char *aBuffer, uint32_t aCount) +nsIconDecoder::WriteInternal(const char *aBuffer, uint32_t aCount, DecodeStrategy) { NS_ABORT_IF_FALSE(!HasError(), "Shouldn't call WriteInternal after error!"); diff --git a/image/decoders/nsIconDecoder.h b/image/decoders/nsIconDecoder.h index 31bf2e0..4fcffcd 100644 --- a/image/decoders/nsIconDecoder.h +++ b/image/decoders/nsIconDecoder.h @@ -41,7 +41,7 @@ public: nsIconDecoder(RasterImage &aImage); virtual ~nsIconDecoder(); - virtual void WriteInternal(const char* aBuffer, uint32_t aCount); + virtual void WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy); uint8_t mWidth; uint8_t mHeight; diff --git a/image/decoders/nsJPEGDecoder.cpp b/image/decoders/nsJPEGDecoder.cpp index fa580d5..24b9fd3 100644 --- a/image/decoders/nsJPEGDecoder.cpp +++ b/image/decoders/nsJPEGDecoder.cpp @@ -179,15 +179,20 @@ nsJPEGDecoder::FinishInternal() * XXXbholley - It seems wrong that this should be necessary, but at the * moment I'm just folding the contents of Flush() into Close() so that * we can get rid of it. + * + * XXX(seth): It'd be great to get rid of this. For now, we treat this as a + * write to a synchronous decoder, which means that this must be called only + * on the main thread. (That's asserted in Decoder::Finish and + * Decoder::FinishSharedDecoder.) */ if ((mState != JPEG_DONE && mState != JPEG_SINK_NON_JPEG_TRAILER) && (mState != JPEG_ERROR) && !IsSizeDecode()) - this->Write(nullptr, 0); + this->Write(nullptr, 0, DECODE_SYNC); } void -nsJPEGDecoder::WriteInternal(const char *aBuffer, uint32_t aCount) +nsJPEGDecoder::WriteInternal(const char *aBuffer, uint32_t aCount, DecodeStrategy) { mSegment = (const JOCTET *)aBuffer; mSegmentLen = aCount; diff --git a/image/decoders/nsJPEGDecoder.h b/image/decoders/nsJPEGDecoder.h index 00409f3..82ec3bb 100644 --- a/image/decoders/nsJPEGDecoder.h +++ b/image/decoders/nsJPEGDecoder.h @@ -55,7 +55,7 @@ public: virtual ~nsJPEGDecoder(); virtual void InitInternal(); - virtual void WriteInternal(const char* aBuffer, uint32_t aCount); + virtual void WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy); virtual void FinishInternal(); virtual Telemetry::ID SpeedHistogram(); diff --git a/image/decoders/nsPNGDecoder.cpp b/image/decoders/nsPNGDecoder.cpp index 23003ea..48ed981 100644 --- a/image/decoders/nsPNGDecoder.cpp +++ b/image/decoders/nsPNGDecoder.cpp @@ -286,7 +286,7 @@ nsPNGDecoder::InitInternal() } void -nsPNGDecoder::WriteInternal(const char *aBuffer, uint32_t aCount) +nsPNGDecoder::WriteInternal(const char *aBuffer, uint32_t aCount, DecodeStrategy) { NS_ABORT_IF_FALSE(!HasError(), "Shouldn't call WriteInternal after error!"); diff --git a/image/decoders/nsPNGDecoder.h b/image/decoders/nsPNGDecoder.h index 51f2ebd..b8c63a7 100644 --- a/image/decoders/nsPNGDecoder.h +++ b/image/decoders/nsPNGDecoder.h @@ -28,7 +28,7 @@ public: virtual ~nsPNGDecoder(); virtual void InitInternal(); - virtual void WriteInternal(const char* aBuffer, uint32_t aCount); + virtual void WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy); virtual Telemetry::ID SpeedHistogram(); void CreateFrame(png_uint_32 x_offset, png_uint_32 y_offset, diff --git a/image/src/DecodeStrategy.h b/image/src/DecodeStrategy.h new file mode 100644 index 0000000..44c64b6 --- /dev/null +++ b/image/src/DecodeStrategy.h @@ -0,0 +1,36 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** @file + * An enumeration used by RasterImage and Decoder to specify which 'strategy' to + * use for image decoding - synchronous or asynchronous. + */ + +#ifndef mozilla_imagelib_DecodeStrategy_h_ +#define mozilla_imagelib_DecodeStrategy_h_ + +namespace mozilla { +namespace image { + +enum DecodeStrategy { + // DECODE_SYNC requests a synchronous decode, which will continue decoding + // frames as long as it has more source data. It returns to the caller only + // once decoding is complete (or until it needs more source data before + // continuing). Because DECODE_SYNC can involve allocating new imgFrames, it + // can only be run on the main thread. + DECODE_SYNC, + + // DECODE_ASYNC requests an asynchronous decode, which will continue decoding + // until it either finishes a frame or runs out of source data. Because + // DECODE_ASYNC does not allocate new imgFrames, it can be safely run off the + // main thread. (And hence workers in the decode pool always use it.) + DECODE_ASYNC +}; + +} // namespace image +} // namespace mozilla + +#endif diff --git a/image/src/Decoder.cpp b/image/src/Decoder.cpp index 5fa835d..85845f6 100644 --- a/image/src/Decoder.cpp +++ b/image/src/Decoder.cpp @@ -28,7 +28,6 @@ Decoder::Decoder(RasterImage &aImage) , mSizeDecode(false) , mInFrame(false) , mIsAnimated(false) - , mSynchronous(false) { } @@ -85,9 +84,10 @@ Decoder::InitSharedDecoder(uint8_t* imageData, uint32_t imageDataLength, } void -Decoder::Write(const char* aBuffer, uint32_t aCount) +Decoder::Write(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy) { PROFILER_LABEL("ImageDecoder", "Write"); + MOZ_ASSERT(NS_IsMainThread() || aStrategy == DECODE_ASYNC); // We're strict about decoder errors NS_ABORT_IF_FALSE(!HasDecoderError(), @@ -103,16 +103,16 @@ Decoder::Write(const char* aBuffer, uint32_t aCount) } // Pass the data along to the implementation - WriteInternal(aBuffer, aCount); + WriteInternal(aBuffer, aCount, aStrategy); // If we're a synchronous decoder and we need a new frame to proceed, let's // create one and call it again. - while (mSynchronous && NeedsNewFrame() && !HasDataError()) { + while (aStrategy == DECODE_SYNC && NeedsNewFrame() && !HasDataError()) { nsresult rv = AllocateFrame(); if (NS_SUCCEEDED(rv)) { // Tell the decoder to use the data it saved when it asked for a new frame. - WriteInternal(nullptr, 0); + WriteInternal(nullptr, 0, aStrategy); } } } @@ -120,6 +120,8 @@ Decoder::Write(const char* aBuffer, uint32_t aCount) void Decoder::Finish(RasterImage::eShutdownIntent aShutdownIntent) { + MOZ_ASSERT(NS_IsMainThread()); + // Implementation-specific finalization if (!HasError()) FinishInternal(); @@ -185,6 +187,8 @@ Decoder::Finish(RasterImage::eShutdownIntent aShutdownIntent) void Decoder::FinishSharedDecoder() { + MOZ_ASSERT(NS_IsMainThread()); + if (!HasError()) { FinishInternal(); } @@ -274,7 +278,7 @@ Decoder::SetSizeOnImage() */ void Decoder::InitInternal() { } -void Decoder::WriteInternal(const char* aBuffer, uint32_t aCount) { } +void Decoder::WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy) { } void Decoder::FinishInternal() { } /* diff --git a/image/src/Decoder.h b/image/src/Decoder.h index 705cb36..285cf59 100644 --- a/image/src/Decoder.h +++ b/image/src/Decoder.h @@ -9,6 +9,7 @@ #include "RasterImage.h" #include "imgDecoderObserver.h" #include "mozilla/RefPtr.h" +#include "DecodeStrategy.h" #include "ImageMetadata.h" namespace mozilla { @@ -48,7 +49,7 @@ public: * * Notifications Sent: TODO */ - void Write(const char* aBuffer, uint32_t aCount); + void Write(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy); /** * Informs the decoder that all the data has been written. @@ -92,11 +93,6 @@ public: mSizeDecode = aSizeDecode; } - bool IsSynchronous() const - { - return mSynchronous; - } - void SetObserver(imgDecoderObserver* aObserver) { MOZ_ASSERT(aObserver); @@ -175,7 +171,7 @@ protected: * only these methods. */ virtual void InitInternal(); - virtual void WriteInternal(const char* aBuffer, uint32_t aCount); + virtual void WriteInternal(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy); virtual void FinishInternal(); /* @@ -237,17 +233,6 @@ protected: bool mDataError; private: - // Decode in synchronous mode. This is unsafe off-main-thread since it may - // attempt to allocate frames. To ensure that we never accidentally leave the - // decoder in synchronous mode, this should only be called by - // AutoSetSyncDecode. - void SetSynchronous(bool aSynchronous) - { - mSynchronous = aSynchronous; - } - - friend class AutoSetSyncDecode; - uint32_t mFrameCount; // Number of frames, including anything in-progress nsIntRect mInvalidRect; // Tracks an invalidation region in the current frame. @@ -284,35 +269,6 @@ private: bool mSizeDecode; bool mInFrame; bool mIsAnimated; - bool mSynchronous; -}; - -// A RAII helper class to automatically pair a call to SetSynchronous(true) -// with a call to SetSynchronous(false), since failing to do so can lead us -// to try to allocate frames off-main-thread, which is unsafe. Synchronous -// decoding may only happen within the scope of an AutoSetSyncDecode. Nested -// AutoSetSyncDecode's are OK. -class AutoSetSyncDecode -{ -public: - AutoSetSyncDecode(Decoder* aDecoder) - : mDecoder(aDecoder) - { - MOZ_ASSERT(NS_IsMainThread()); - MOZ_ASSERT(mDecoder); - - mOriginalValue = mDecoder->IsSynchronous(); - mDecoder->SetSynchronous(true); - } - - ~AutoSetSyncDecode() - { - mDecoder->SetSynchronous(mOriginalValue); - } - -private: - nsRefPtr<Decoder> mDecoder; - bool mOriginalValue; }; } // namespace image diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp index 65f8169..8b066434 100644 --- a/image/src/RasterImage.cpp +++ b/image/src/RasterImage.cpp @@ -1714,8 +1714,7 @@ RasterImage::AddSourceData(const char *aBuffer, uint32_t aCount) // we'll queue up the data and write it out when we do.) if (!StoringSourceData() && mHasSize) { { - AutoSetSyncDecode syncDecode(mDecoder); - rv = WriteToDecoder(aBuffer, aCount); + rv = WriteToDecoder(aBuffer, aCount, DECODE_SYNC); CONTAINER_ENSURE_SUCCESS(rv); } @@ -2261,7 +2260,7 @@ RasterImage::ShutdownDecoder(eShutdownIntent aIntent) // Writes the data to the decoder, updating the total number of bytes written. nsresult -RasterImage::WriteToDecoder(const char *aBuffer, uint32_t aCount) +RasterImage::WriteToDecoder(const char *aBuffer, uint32_t aCount, DecodeStrategy aStrategy) { mDecodingMonitor.AssertCurrentThreadIn(); @@ -2271,7 +2270,7 @@ RasterImage::WriteToDecoder(const char *aBuffer, uint32_t aCount) // Write nsRefPtr<Decoder> kungFuDeathGrip = mDecoder; mInDecoder = true; - mDecoder->Write(aBuffer, aCount); + mDecoder->Write(aBuffer, aCount, aStrategy); mInDecoder = false; CONTAINER_ENSURE_SUCCESS(mDecoder->GetDecoderError()); @@ -2435,8 +2434,7 @@ RasterImage::RequestDecodeCore(RequestDecodeType aDecodeType) // to finish decoding. if (!mDecoded && !mInDecoder && mHasSourceData && aDecodeType == SYNCHRONOUS_NOTIFY_AND_SOME_DECODE) { PROFILER_LABEL_PRINTF("RasterImage", "DecodeABitOf", "%s", GetURIString().get()); - AutoSetSyncDecode syncDecode(mDecoder); - DecodePool::Singleton()->DecodeABitOf(this); + DecodePool::Singleton()->DecodeABitOf(this, DECODE_SYNC); return NS_OK; } @@ -2518,13 +2516,9 @@ RasterImage::SyncDecode() CONTAINER_ENSURE_SUCCESS(rv); } - { - AutoSetSyncDecode syncDecode(mDecoder); - - // Write everything we have - rv = DecodeSomeData(mSourceData.Length() - mBytesDecoded); - CONTAINER_ENSURE_SUCCESS(rv); - } + // Write everything we have + rv = DecodeSomeData(mSourceData.Length() - mBytesDecoded, DECODE_SYNC); + CONTAINER_ENSURE_SUCCESS(rv); // When we're doing a sync decode, we want to get as much information from the // image as possible. We've send the decoder all of our data, so now's a good @@ -2861,7 +2855,7 @@ RasterImage::RequestDiscard() // Flushes up to aMaxBytes to the decoder. nsresult -RasterImage::DecodeSomeData(uint32_t aMaxBytes) +RasterImage::DecodeSomeData(uint32_t aMaxBytes, DecodeStrategy aStrategy) { // We should have a decoder if we get here NS_ABORT_IF_FALSE(mDecoder, "trying to decode without decoder!"); @@ -2873,7 +2867,7 @@ RasterImage::DecodeSomeData(uint32_t aMaxBytes) // passing it a null buffer. if (mDecodeRequest->mAllocatedNewFrame) { mDecodeRequest->mAllocatedNewFrame = false; - nsresult rv = WriteToDecoder(nullptr, 0); + nsresult rv = WriteToDecoder(nullptr, 0, aStrategy); if (NS_FAILED(rv) || mDecoder->NeedsNewFrame()) { return rv; } @@ -2889,7 +2883,8 @@ RasterImage::DecodeSomeData(uint32_t aMaxBytes) uint32_t bytesToDecode = std::min(aMaxBytes, mSourceData.Length() - mBytesDecoded); nsresult rv = WriteToDecoder(mSourceData.Elements() + mBytesDecoded, - bytesToDecode); + bytesToDecode, + aStrategy); return rv; } @@ -3245,7 +3240,7 @@ RasterImage::DecodePool::RequestDecode(RasterImage* aImg) } void -RasterImage::DecodePool::DecodeABitOf(RasterImage* aImg) +RasterImage::DecodePool::DecodeABitOf(RasterImage* aImg, DecodeStrategy aStrategy) { MOZ_ASSERT(NS_IsMainThread()); aImg->mDecodingMonitor.AssertCurrentThreadIn(); @@ -3257,7 +3252,7 @@ RasterImage::DecodePool::DecodeABitOf(RasterImage* aImg) } } - DecodeSomeOfImage(aImg); + DecodeSomeOfImage(aImg, aStrategy); aImg->FinishedSomeDecoding(); @@ -3325,7 +3320,7 @@ RasterImage::DecodePool::DecodeJob::Run() type = DECODE_TYPE_UNTIL_TIME; } - DecodePool::Singleton()->DecodeSomeOfImage(mImage, type, mRequest->mBytesToDecode); + DecodePool::Singleton()->DecodeSomeOfImage(mImage, DECODE_ASYNC, type, mRequest->mBytesToDecode); uint32_t bytesDecoded = mImage->mBytesDecoded - oldByteCount; @@ -3370,7 +3365,9 @@ RasterImage::DecodePool::DecodeUntilSizeAvailable(RasterImage* aImg) } } - nsresult rv = DecodeSomeOfImage(aImg, DECODE_TYPE_UNTIL_SIZE); + // We use DECODE_ASYNC here because we just want to get the size information + // here and defer the rest of the work. + nsresult rv = DecodeSomeOfImage(aImg, DECODE_ASYNC, DECODE_TYPE_UNTIL_SIZE); if (NS_FAILED(rv)) { return rv; } @@ -3388,6 +3385,7 @@ RasterImage::DecodePool::DecodeUntilSizeAvailable(RasterImage* aImg) nsresult RasterImage::DecodePool::DecodeSomeOfImage(RasterImage* aImg, + DecodeStrategy aStrategy, DecodeType aDecodeType /* = DECODE_TYPE_UNTIL_TIME */, uint32_t bytesToDecode /* = 0 */) { @@ -3407,7 +3405,7 @@ RasterImage::DecodePool::DecodeSomeOfImage(RasterImage* aImg, // If we're doing synchronous decodes, and we're waiting on a new frame for // this image, get it now. - if (aImg->mDecoder->IsSynchronous() && aImg->mDecoder->NeedsNewFrame()) { + if (aStrategy == DECODE_SYNC && aImg->mDecoder->NeedsNewFrame()) { MOZ_ASSERT(NS_IsMainThread()); aImg->mDecoder->AllocateFrame(); @@ -3456,7 +3454,7 @@ RasterImage::DecodePool::DecodeSomeOfImage(RasterImage* aImg, (aImg->mDecodeRequest && aImg->mDecodeRequest->mAllocatedNewFrame)) { chunkCount++; uint32_t chunkSize = std::min(bytesToDecode, maxBytes); - nsresult rv = aImg->DecodeSomeData(chunkSize); + nsresult rv = aImg->DecodeSomeData(chunkSize, aStrategy); if (NS_FAILED(rv)) { aImg->DoError(); return rv; diff --git a/image/src/RasterImage.h b/image/src/RasterImage.h index 420a470..87d7286 100644 --- a/image/src/RasterImage.h +++ b/image/src/RasterImage.h @@ -27,6 +27,7 @@ #include "nsTArray.h" #include "imgFrame.h" #include "nsThreadUtils.h" +#include "DecodeStrategy.h" #include "DiscardTracker.h" #include "nsISupportsImpl.h" #include "mozilla/LinkedList.h" @@ -314,6 +315,8 @@ public: eShutdownIntent_AllCount = 3 }; + // Decode strategy + private: imgStatusTracker& CurrentStatusTracker() { @@ -417,7 +420,7 @@ private: * Decode aImg for a short amount of time, and post the remainder to the * queue. */ - void DecodeABitOf(RasterImage* aImg); + void DecodeABitOf(RasterImage* aImg, DecodeStrategy aStrategy); /** * Ask the DecodePool to stop decoding this image. Internally, we also @@ -458,6 +461,7 @@ private: * UNTIL_DONE_BYTES, decode until all bytesToDecode bytes are decoded. */ nsresult DecodeSomeOfImage(RasterImage* aImg, + DecodeStrategy aStrategy, DecodeType aDecodeType = DECODE_TYPE_UNTIL_TIME, uint32_t bytesToDecode = 0); @@ -751,8 +755,8 @@ private: // data nsresult WantDecodedFrames(); nsresult SyncDecode(); nsresult InitDecoder(bool aDoSizeDecode); - nsresult WriteToDecoder(const char *aBuffer, uint32_t aCount); - nsresult DecodeSomeData(uint32_t aMaxBytes); + nsresult WriteToDecoder(const char *aBuffer, uint32_t aCount, DecodeStrategy aStrategy); + nsresult DecodeSomeData(uint32_t aMaxBytes, DecodeStrategy aStrategy); bool IsDecodeFinished(); TimeStamp mDrawStartTime;

1 0

[tor-browser/esr24] Bug 982906 - No free lunches! r=bzbarsky, a=lsblakk
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 98514d2707597dca05a7318e3887b97c3b0b8857 Author: Blake Kaplan <mrbkap(a)gmail.com> Date: Thu Mar 13 18:55:13 2014 -0400 Bug 982906 - No free lunches! r=bzbarsky, a=lsblakk --- dom/base/nsGlobalWindow.cpp | 30 +++++++++++++++--------------- dom/base/nsGlobalWindow.h | 5 ++--- 2 files changed, 17 insertions(+), 18 deletions(-) diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp index 7b6707a..f2192d6 100644 --- a/dom/base/nsGlobalWindow.cpp +++ b/dom/base/nsGlobalWindow.cpp @@ -10829,14 +10829,12 @@ nsGlobalWindow::GetScrollFrame() nsresult nsGlobalWindow::BuildURIfromBase(const char *aURL, nsIURI **aBuiltURI, - bool *aFreeSecurityPass, JSContext **aCXused) { nsIScriptContext *scx = GetContextInternal(); JSContext *cx = nullptr; *aBuiltURI = nullptr; - *aFreeSecurityPass = false; if (aCXused) *aCXused = nullptr; @@ -10877,17 +10875,14 @@ nsGlobalWindow::BuildURIfromBase(const char *aURL, nsIURI **aBuiltURI, if (!sourceWindow) { sourceWindow = do_QueryInterface(NS_ISUPPORTS_CAST(nsIDOMWindow *, this)); - *aFreeSecurityPass = true; } - if (sourceWindow) { - nsCOMPtr<nsIDOMDocument> domDoc; - sourceWindow->GetDocument(getter_AddRefs(domDoc)); - nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc)); - if (doc) { - baseURI = doc->GetDocBaseURI(); - charset = doc->GetDocumentCharacterSet(); - } + nsCOMPtr<nsIDOMDocument> domDoc; + sourceWindow->GetDocument(getter_AddRefs(domDoc)); + nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc)); + if (doc) { + baseURI = doc->GetDocBaseURI(); + charset = doc->GetDocumentCharacterSet(); } if (aCXused) @@ -10899,17 +10894,22 @@ nsresult nsGlobalWindow::SecurityCheckURL(const char *aURL) { JSContext *cxUsed; - bool freePass; nsCOMPtr<nsIURI> uri; - if (NS_FAILED(BuildURIfromBase(aURL, getter_AddRefs(uri), &freePass, &cxUsed))) + if (NS_FAILED(BuildURIfromBase(aURL, getter_AddRefs(uri), &cxUsed))) { return NS_ERROR_FAILURE; + } + + if (!cxUsed) { + return NS_OK; + } AutoPushJSContext cx(cxUsed); - if (!freePass && NS_FAILED(nsContentUtils::GetSecurityManager()-> - CheckLoadURIFromScript(cx, uri))) + if (NS_FAILED(nsContentUtils::GetSecurityManager()-> + CheckLoadURIFromScript(cx, uri))) { return NS_ERROR_FAILURE; + } return NS_OK; } diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h index aab2253..613dd2b 100644 --- a/dom/base/nsGlobalWindow.h +++ b/dom/base/nsGlobalWindow.h @@ -950,9 +950,8 @@ protected: already_AddRefed<nsIBaseWindow> GetTreeOwnerWindow(); already_AddRefed<nsIWebBrowserChrome> GetWebBrowserChrome(); nsresult SecurityCheckURL(const char *aURL); - nsresult BuildURIfromBase(const char *aURL, - nsIURI **aBuiltURI, - bool *aFreeSecurityPass, JSContext **aCXused); + nsresult BuildURIfromBase(const char *aURL, nsIURI **aBuiltURI, + JSContext **aCXused); bool PopupWhitelisted(); PopupControlState RevisePopupAbuseLevel(PopupControlState); void FireAbuseEvents(bool aBlocked, bool aWindow,

1 0

[tor-browser/esr24] Bug 983344. r=sfink, a=dveditz
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 16a2781a8c683c5d10fee560baee00e6da2f055b Author: Jeff Walden <jwalden(a)mit.edu> Date: Fri Mar 14 20:01:37 2014 -0400 Bug 983344. r=sfink, a=dveditz --- js/src/jstypedarray.cpp | 33 +++++++++++++++++++++++++-------- 1 file changed, 25 insertions(+), 8 deletions(-) diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp index b8cf614..1630c5a 100644 --- a/js/src/jstypedarray.cpp +++ b/js/src/jstypedarray.cpp @@ -2335,6 +2335,10 @@ class TypedArrayTemplate copyFromArray(JSContext *cx, HandleObject thisTypedArrayObj, HandleObject ar, uint32_t len, uint32_t offset = 0) { + // Exit early if nothing to copy, to simplify loop conditions below. + if (len == 0) + return true; + JS_ASSERT(thisTypedArrayObj->isTypedArray()); JS_ASSERT(offset <= length(thisTypedArrayObj)); JS_ASSERT(len <= length(thisTypedArrayObj) - offset); @@ -2344,34 +2348,47 @@ class TypedArrayTemplate const Value *src = NULL; NativeType *dest = static_cast<NativeType*>(viewData(thisTypedArrayObj)) + offset; - // The only way the code below can GC is if nativeFromValue fails, but - // in that case we return false immediately, so we do not need to root - // |src| and |dest|. These SkipRoots are to protect from the - // unconditional MaybeCheckStackRoots done by ToNumber. + // These SkipRoots are to protect from the unconditional + // MaybeCheckStackRoots done by ToNumber. SkipRoot skipDest(cx, &dest); SkipRoot skipSrc(cx, &src); +#ifdef DEBUG + JSRuntime *runtime = cx->runtime(); + uint64_t gcNumber = runtime->gcNumber; +#endif + if (ar->isArray() && !ar->isIndexed() && ar->getDenseInitializedLength() >= len) { JS_ASSERT(ar->getArrayLength() == len); src = ar->getDenseElements(); - for (uint32_t i = 0; i < len; ++i) { + uint32_t i = 0; + do { NativeType n; if (!nativeFromValue(cx, src[i], &n)) return false; dest[i] = n; - } + } while (++i < len); + JS_ASSERT(runtime->gcNumber == gcNumber); } else { RootedValue v(cx); - for (uint32_t i = 0; i < len; ++i) { + uint32_t i = 0; + do { if (!JSObject::getElement(cx, ar, ar, i, &v)) return false; NativeType n; if (!nativeFromValue(cx, v, &n)) return false; + + len = Min(len, length(thisTypedArrayObj)); + if (i >= len) + break; + + // Compute every iteration in case getElement acts wacky. + dest = static_cast<NativeType*>(viewData(thisTypedArrayObj)) + offset; dest[i] = n; - } + } while (++i < len); } return true;

1 0

[tor-browser/esr24] Bug 982974 - Be paranoid about neutering ArrayBuffer objects. r=sfink, a=dveditz
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 664b5f505f7fed95256bf5632ed0cd5ba3308fc6 Author: Jeff Walden <jwalden(a)mit.edu> Date: Fri Mar 14 17:20:22 2014 -0700 Bug 982974 - Be paranoid about neutering ArrayBuffer objects. r=sfink, a=dveditz --- js/src/jstypedarray.cpp | 50 ++++++++++++++++++++++++++++-------------- js/src/jstypedarray.h | 27 ++++++++++++++++++++++- js/src/jstypedarrayinlines.h | 6 ----- js/src/vm/ObjectImpl.h | 9 +++++++- 4 files changed, 67 insertions(+), 25 deletions(-) diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp index 1630c5a..9d02d06 100644 --- a/js/src/jstypedarray.cpp +++ b/js/src/jstypedarray.cpp @@ -623,41 +623,57 @@ bool ArrayBufferObject::stealContents(JSContext *cx, JSObject *obj, void **contents, uint8_t **data) { + MOZ_ASSERT(cx); + ArrayBufferObject &buffer = obj->as<ArrayBufferObject>(); JSObject *views = *GetViewList(&buffer); - js::ObjectElements *header = js::ObjectElements::fromElements((js::HeapSlot*)buffer.dataPointer()); - if (buffer.hasDynamicElements() && !buffer.isAsmJSArrayBuffer()) { + + uint32_t byteLen = buffer.byteLength(); + + js::ObjectElements *oldHeader = buffer.getElementsHeader(); + js::ObjectElements *newHeader; + + // If the ArrayBuffer's elements are transferrable, transfer ownership + // directly. Otherwise we have to copy the data into new elements. + bool stolen = buffer.hasStealableContents(); + if (stolen) { + newHeader = AllocateArrayBufferContents(cx, byteLen, NULL); + if (!newHeader) + return false; + *GetViewList(&buffer) = NULL; - *contents = header; + *contents = oldHeader; *data = buffer.dataPointer(); - buffer.setFixedElements(); - header = js::ObjectElements::fromElements((js::HeapSlot*)buffer.dataPointer()); + MOZ_ASSERT(!buffer.isAsmJSArrayBuffer(), + "buffer won't be neutered by neuterAsmJSArrayBuffer"); + + buffer.elements = newHeader->elements(); } else { - uint32_t length = buffer.byteLength(); - js::ObjectElements *newheader = - AllocateArrayBufferContents(cx, length, buffer.dataPointer()); - if (!newheader) { - js_ReportOutOfMemory(cx); + js::ObjectElements *headerCopy = + AllocateArrayBufferContents(cx, byteLen, buffer.dataPointer()); + if (!headerCopy) return false; - } - ArrayBufferObject::setElementsHeader(newheader, length); - *contents = newheader; - *data = reinterpret_cast<uint8_t *>(newheader + 1); + *contents = headerCopy; + *data = reinterpret_cast<uint8_t *>(headerCopy + 1); if (buffer.isAsmJSArrayBuffer()) ArrayBufferObject::neuterAsmJSArrayBuffer(buffer); + + // Keep using the current elements. + newHeader = oldHeader; } // Neuter the donor ArrayBuffer and all views of it - uint32_t flags = header->flags; - ArrayBufferObject::setElementsHeader(header, 0); - header->flags = flags; + uint32_t flags = newHeader->flags; + ArrayBufferObject::setElementsHeader(newHeader, 0); + newHeader->flags = flags; GetViewList(&buffer)->init(views); for (JSObject *view = views; view; view = NextView(view)) TypedArray::neuter(view); + newHeader->setIsNeuteredBuffer(); return true; } diff --git a/js/src/jstypedarray.h b/js/src/jstypedarray.h index f666e52..4751d53 100644 --- a/js/src/jstypedarray.h +++ b/js/src/jstypedarray.h @@ -137,6 +137,24 @@ class ArrayBufferObject : public JSObject static bool saveArrayBufferList(JSCompartment *c, ArrayBufferVector &vector); static void restoreArrayBufferLists(ArrayBufferVector &vector); + bool hasStealableContents() const { + // Inline elements strictly adhere to the corresponding buffer. + if (!hasDynamicElements()) + return false; + + // asm.js buffer contents are transferred by copying, just like inline + // elements. + if (isAsmJSArrayBuffer()) + return false; + + // Neutered contents aren't transferrable because we want a neutered + // array's contents to be backed by zeroed memory equal in length to + // the original buffer contents. Transferring these contents would + // allocate new ones based on the current byteLength, which is 0 for a + // neutered array -- not the original byteLength. + return !isNeutered(); + } + static bool stealContents(JSContext *cx, JSObject *obj, void **contents, uint8_t **data); @@ -164,10 +182,17 @@ class ArrayBufferObject : public JSObject */ inline bool hasData() const; - inline bool isAsmJSArrayBuffer() const; + bool isAsmJSArrayBuffer() const { + return getElementsHeader()->isAsmJSArrayBuffer(); + } + static bool prepareForAsmJS(JSContext *cx, Handle<ArrayBufferObject*> buffer); static void neuterAsmJSArrayBuffer(ArrayBufferObject &buffer); static void releaseAsmJSArrayBuffer(FreeOp *fop, JSObject *obj); + + bool isNeutered() const { + return getElementsHeader()->isNeuteredBuffer(); + } }; /* diff --git a/js/src/jstypedarrayinlines.h b/js/src/jstypedarrayinlines.h index 5af70f5..f26e9cc 100644 --- a/js/src/jstypedarrayinlines.h +++ b/js/src/jstypedarrayinlines.h @@ -56,12 +56,6 @@ ArrayBufferObject::hasData() const return getClass() == &class_; } -inline bool -ArrayBufferObject::isAsmJSArrayBuffer() const -{ - return getElementsHeader()->isAsmJSArrayBuffer(); -} - static inline int32_t ClampIntForUint8Array(int32_t x) { diff --git a/js/src/vm/ObjectImpl.h b/js/src/vm/ObjectImpl.h index 980f935..8eba5da 100644 --- a/js/src/vm/ObjectImpl.h +++ b/js/src/vm/ObjectImpl.h @@ -979,10 +979,11 @@ class ObjectElements enum Flags { CONVERT_DOUBLE_ELEMENTS = 0x1, ASMJS_ARRAY_BUFFER = 0x2, + NEUTERED_BUFFER = 0x4, // Present only if these elements correspond to an array with // non-writable length; never present for non-arrays. - NONWRITABLE_ARRAY_LENGTH = 0x4 + NONWRITABLE_ARRAY_LENGTH = 0x8 }; private: @@ -1036,6 +1037,12 @@ class ObjectElements void setIsAsmJSArrayBuffer() { flags |= ASMJS_ARRAY_BUFFER; } + bool isNeuteredBuffer() const { + return flags & NEUTERED_BUFFER; + } + void setIsNeuteredBuffer() { + flags |= NEUTERED_BUFFER; + } bool hasNonwritableArrayLength() const { return flags & NONWRITABLE_ARRAY_LENGTH; }

1 0

[tor-browser/esr24] No bug, Automated HSTS preload list update from host bld-linux64-spot-353 - a=hsts-update
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 16de9a941b3743a09f99586e3ca2d41b26978fd3 Author: ffxbld <none@none> Date: Sat Mar 15 03:16:43 2014 -0700 No bug, Automated HSTS preload list update from host bld-linux64-spot-353 - a=hsts-update --- security/manager/boot/src/nsSTSPreloadList.errors | 3 --- security/manager/boot/src/nsSTSPreloadList.inc | 6 +++++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/security/manager/boot/src/nsSTSPreloadList.errors b/security/manager/boot/src/nsSTSPreloadList.errors index 63597b7..83719ac 100644 --- a/security/manager/boot/src/nsSTSPreloadList.errors +++ b/security/manager/boot/src/nsSTSPreloadList.errors @@ -32,7 +32,6 @@ dropcam.com: did not receive HSTS header email.lookout.com: could not connect to host emailprivacytester.com: did not receive HSTS header encrypted.google.com: did not receive HSTS header -errors.zenpayroll.com: could not connect to host espra.com: could not connect to host factor.cc: could not connect to host fatzebra.com.au: did not receive HSTS header @@ -76,8 +75,6 @@ paypal.com: max-age too low: 14400 payroll.xero.com: max-age too low: 3600 platform.lookout.com: could not connect to host play.google.com: did not receive HSTS header -plus.google.com: did not receive HSTS header -plus.sandbox.google.com: did not receive HSTS header prodpad.com: did not receive HSTS header profiles.google.com: did not receive HSTS header rapidresearch.me: did not receive HSTS header diff --git a/security/manager/boot/src/nsSTSPreloadList.inc b/security/manager/boot/src/nsSTSPreloadList.inc index eb6e1af..7269072 100644 --- a/security/manager/boot/src/nsSTSPreloadList.inc +++ b/security/manager/boot/src/nsSTSPreloadList.inc @@ -8,7 +8,7 @@ /*****************************************************************************/ #include "mozilla/StandardInteger.h" -const PRTime gPreloadListExpirationTime = INT64_C(1405163237024000); +const PRTime gPreloadListExpirationTime = INT64_C(1405764355403000); class nsSTSPreload { @@ -133,8 +133,11 @@ static const nsSTSPreload kSTSPreloadList[] = { { "paymill.de", false }, { "piratenlogin.de", true }, { "pixi.me", true }, + { "plus.google.com", false }, + { "plus.sandbox.google.com", false }, { "publications.qld.gov.au", false }, { "riseup.net", true }, + { "roddis.net", false }, { "romab.com", true }, { "roundcube.mayfirst.org", false }, { "sandbox.mydigipass.com", false }, @@ -180,6 +183,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "www.mylookout.com", false }, { "www.noisebridge.net", false }, { "www.opsmate.com", true }, + { "www.roddis.net", false }, { "www.simbolo.co.uk", false }, { "www.simple.com", false }, { "www.therapynotes.com", false },

1 0

[tor-browser/esr24] Automated checkin: version bump for firefox 24.4.0esr release. DONTBUILD CLOSED TREE a=release
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 4c92e485d8272fd50863f1ab395215e4444a865c Author: ffxbld <none@none> Date: Sat Mar 15 11:34:14 2014 -0400 Automated checkin: version bump for firefox 24.4.0esr release. DONTBUILD CLOSED TREE a=release --- browser/config/version.txt | 2 +- config/milestone.txt | 2 +- js/src/config/milestone.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/browser/config/version.txt b/browser/config/version.txt index 7a89ba7..2781e2b 100644 --- a/browser/config/version.txt +++ b/browser/config/version.txt @@ -1 +1 @@ -24.3.0esrpre +24.4.0esrpre diff --git a/config/milestone.txt b/config/milestone.txt index eefa94b..6b6c02a 100644 --- a/config/milestone.txt +++ b/config/milestone.txt @@ -10,4 +10,4 @@ # hardcoded milestones in the tree from these two files. #-------------------------------------------------------- -24.3.0 +24.4.0esrpre diff --git a/js/src/config/milestone.txt b/js/src/config/milestone.txt index eefa94b..6b6c02a 100644 --- a/js/src/config/milestone.txt +++ b/js/src/config/milestone.txt @@ -10,4 +10,4 @@ # hardcoded milestones in the tree from these two files. #-------------------------------------------------------- -24.3.0 +24.4.0esrpre

1 0

[tor-browser/esr24] Automated checkin: version bump for thunderbird 24.4.0 release. DONTBUILD CLOSED TREE a=release
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 12d5f5524ef0b57a3cd7b7bf86c413d3a9dd494e Author: tbirdbld <none@none> Date: Sun Mar 16 15:50:47 2014 -0400 Automated checkin: version bump for thunderbird 24.4.0 release. DONTBUILD CLOSED TREE a=release --- config/milestone.txt | 2 +- js/src/config/milestone.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/milestone.txt b/config/milestone.txt index 6b6c02a..c0110c9 100644 --- a/config/milestone.txt +++ b/config/milestone.txt @@ -10,4 +10,4 @@ # hardcoded milestones in the tree from these two files. #-------------------------------------------------------- -24.4.0esrpre +24.4.0 diff --git a/js/src/config/milestone.txt b/js/src/config/milestone.txt index 6b6c02a..c0110c9 100644 --- a/js/src/config/milestone.txt +++ b/js/src/config/milestone.txt @@ -10,4 +10,4 @@ # hardcoded milestones in the tree from these two files. #-------------------------------------------------------- -24.4.0esrpre +24.4.0

1 0