GitLab

at 2026-09-14T12:12:31+02:00

Bug 2027336 - Always call forget.  a=dmeehan

Original Revision: https://phabricator.services.mozilla.com/D322230

Differential Revision: https://phabricator.services.mozilla.com/D322280

Bug 2029482 - Don't make ORB exemptions for DevTools.  a=dmeehan DONTBUILD

Original Revision: https://phabricator.services.mozilla.com/D319804

Differential Revision: https://phabricator.services.mozilla.com/D322302

[ESR 153] Bug 2050150 - Require an NV12 destination stride that can hold a chroma row.  a=dmeehan DONTBUILD

Differential Revision: https://phabricator.services.mozilla.com/D320550

Bug 2058018 - Check the payload length in DragEnter before using r=win-reviewers,gstoll

Differential Revision: https://phabricator.services.mozilla.com/D318224

Bug 2062551 - Allow heapsnapshot records when DevTools are active.  a=dmeehan DONTBUILD

Original Revision: https://phabricator.services.mozilla.com/D318392

Differential Revision: https://phabricator.services.mozilla.com/D321173

Bug 2063539 - Always resolve special target names,  a=dmeehan DONTBUILD

Original Revision: https://phabricator.services.mozilla.com/D318844

Differential Revision: https://phabricator.services.mozilla.com/D319952

Bug 2063814 - Handle \ correctly in SplitMimetype  a=dmeehan DONTBUILD

Original Revision: https://phabricator.services.mozilla.com/D319097

Differential Revision: https://phabricator.services.mozilla.com/D320017

Bug 2064026 - Check if iterator has reached the end of the string  a=dmeehan DONTBUILD

Original Revision: https://phabricator.services.mozilla.com/D319073

Differential Revision: https://phabricator.services.mozilla.com/D320016

Bug 2066736 - Validate filter array lengths in FilePickerParent::RecvOpen.  a=dmeehan

The loop in RecvOpen counts with aFilters.Length() but reads
aFilterNames[i]. If a content process sends the message with more filters
than filterNames, the read goes out of bounds and the parent process
crashes. So I added a check that both arrays have the same length.

Original Revision: https://phabricator.services.mozilla.com/D321511

Differential Revision: https://phabricator.services.mozilla.com/D321697

Bug 2068438  a=dmeehan DONTBUILD

Original Revision: https://phabricator.services.mozilla.com/D323156

Differential Revision: https://phabricator.services.mozilla.com/D323435

 #include "mozilla/devtools/HeapSnapshot.h"

 #include "mozilla/devtools/HeapSnapshotTempFileHelperParent.h"

+#include "mozilla/dom/ChromeUtils.h"

 #include "mozilla/ErrorResult.h"

 #include "private/pprio.h"

 mozilla::ipc::IPCResult

 HeapSnapshotTempFileHelperParent::RecvOpenHeapSnapshotTempFile(

     OpenHeapSnapshotTempFileResponse* outResponse) {

+  if (!dom::ChromeUtils::IsDevToolsOpened()) {

+    return IPC_FAIL_NO_REASON(this);

+  }

   auto start = TimeStamp::Now();

   ErrorResult rv;

   nsAutoString filePath;

 // Test saving a heap snapshot in the sandboxed e10s child process.

 function run_test() {

+  ChromeUtils.notifyDevToolsOpened();

   run_test_in_child("test_SaveHeapSnapshot.js");

 }
       ++pos;

     }

-    // Might as well check for base64 now

-    if (*pos != '=') {

+    // Might as well check for base64 now. Note that the loop above may have

+    // stopped because it reached the end of the input, in which case there is

+    // no code point to look at.

+    if (pos == end || *pos != '=') {

       // trim leading and trailing spaces

       while (namePos < pos && NS_IsHTTPWhitespace(*namePos)) {

         ++namePos;

   for (size_t i = 0; i < aMimeType.Length(); i++) {

     char_type c = aMimeType[i];

-    if (c == '\"' && (i == 0 || aMimeType[i - 1] != '\\')) {

+    // https://fetch.spec.whatwg.org/#collect-an-http-quoted-string : a

+    // backslash only escapes inside a quoted string, and it consumes the code

+    // point that follows it, so an escaped backslash does not escape the next

+    // character.

+    if (inQuotes && c == '\\') {

+      ++i;

+    } else if (c == '"') {

       inQuotes = !inQuotes;

     } else if (c == ',' && !inQuotes) {

       mimeTypeParts.AppendElement(Substring(aMimeType, start, i - start));

                                        bool aLookForCallerOnJSStack) {

   MOZ_ASSERT(mDocShell, "Must have docshell");

-  if (aForceNoOpener) {

-    return aName.LowerCaseEqualsLiteral("_self") ||

-           aName.LowerCaseEqualsLiteral("_top") ||

-           aName.LowerCaseEqualsLiteral("_parent");

+  if (aForceNoOpener && !nsContentUtils::IsSpecialName(aName)) {

+    return false;

   }

   if (WindowGlobalChild* wgc = mInnerWindow->GetWindowGlobalChild()) {

     return IPC_OK();

   }

+  if (aFilters.Length() != aFilterNames.Length()) {

+    return IPC_FAIL(this, "PFilePicker::Open filter arrays lengths mismatch");

+  }

+

   mFilePicker->SetAddToRecentDocs(aAddToRecentDocs);

   for (uint32_t i = 0; i < aFilters.Length(); ++i) {

     return NS_ERROR_INVALID_ARG;

   }

+  // An interleaved chroma row is 2 * ceil(width / 2) bytes wide.

+  if (aDestStrideY < aDestSize.width ||

+      aDestStrideUV < 2 * CeilingOfHalf(aDestSize.width)) {

+    NS_WARNING("ConvertToNV12: destination strides too small for NV12");

+    return NS_ERROR_INVALID_ARG;

+  }

+

   if (const PlanarYCbCrData* data = GetPlanarYCbCrData(aImage)) {

     const ImageUtils imageUtils(aImage);

     Maybe<dom::ImageBitmapFormat> format = imageUtils.GetFormat();

 /**

  * Converts aImage to an NV12 image and writes it to the given buffers.

+ *

+ * aDestStrideUV must be at least 2 * ceil(aDestSize.width / 2), since U and V

+ * are interleaved. Returns NS_ERROR_INVALID_ARG if either stride is too small.

  */

 nsresult ConvertToNV12(layers::Image* aImage, uint8_t* aDestY, int aDestStrideY,

                        uint8_t* aDestUV, int aDestStrideUV,

     return {};

   }

-  const auto& tcd = tc->GetInternalData();

-

   SurfaceDescriptor ret;

-  if (!tcd->Serialize(ret)) {

+  if (!tc->ToSurfaceDescriptor(ret)) {

     return {};

   }

   return Some(ret);

     actor = nullptr;

   }

-  TextureData* data = mData;

-  mData = nullptr;

+  TextureData* data;

+  {

+    MutexAutoLock lock(mMutex);

+    data = mData;

+    mData = nullptr;

+  }

   if (data || actor || readLock) {

     TextureDeallocParams params;

 }

 bool TextureClient::ToSurfaceDescriptor(SurfaceDescriptor& aOutDescriptor) {

-  MOZ_ASSERT(IsValid());

-

+  MutexAutoLock lock(mMutex);

   return mData ? mData->Serialize(aOutDescriptor) : false;

 }

   TextureData* GetInternalData() { return mData; }

   const TextureData* GetInternalData() const { return mData; }

+  /**

+   * Serializes the underlying TextureData into aDescriptor. Returns false if

+   * the TextureData has already been destroyed. Safe to call from any thread

+   * concurrently with Destroy().

+   */

+  bool ToSurfaceDescriptor(SurfaceDescriptor& aDescriptor);

+

   uint64_t GetSerial() const { return mSerial; }

   void GetSurfaceDescriptorRemoteDecoder(

       SurfaceDescriptorRemoteDecoder* aOutDesc);

   friend class AtomicRefCountedWithFinalize<TextureClient>;

  protected:

-  /**

-   * Should only be called *once* per texture, in TextureClient::InitIPDLActor.

-   * Some texture implementations rely on the fact that the descriptor will be

-   * deserialized.

-   * Calling ToSurfaceDescriptor again after it has already returned true,

-   * or never constructing a TextureHost with aDescriptor may result in a memory

-   * leak (see TextureClientD3D9 for example).

-   */

-  bool ToSurfaceDescriptor(SurfaceDescriptor& aDescriptor);

-

   void LockActor() const;

   void UnlockActor() const;

       ureldatefmt_open(IcuLocale(aLocale), nf, relDateTimeStyle,

                        UDISPCTX_CAPITALIZATION_FOR_STANDALONE, &status);

+  // Ownership was transferred to mFormatter.

+  closeNumberFormatter.forget();

+

   if (U_FAILURE(status)) {

     return Err(ToICUError(status));

   }

-  // Ownership was transferred to mFormatter.

-  closeNumberFormatter.forget();

-

   UniquePtr<RelativeTimeFormat> rtf = MakeUnique<RelativeTimeFormat>(

       aOptions.numeric, formatter, formattedRelativeDateTime);

     return false;

   }

-  bool isInDevToolsContext;

-  mLoadInfo->GetIsInDevToolsContext(&isInDevToolsContext);

-  if (isInDevToolsContext) {

-    LOGORB("No block: Request created by devtools");

-    return false;

-  }

-

   return true;

 }

   nsresult loadResult = nsClipboard::GetNativeDataOffClipboard(

       pIDataSource, 0, ::RegisterClipboardFormat(CFSTR_PREFERREDDROPEFFECT),

       nullptr, &tempOutData, &tempDataLen);

-  if (NS_SUCCEEDED(loadResult) && tempOutData) {

+  if (NS_SUCCEEDED(loadResult) && tempOutData && tempDataLen >= sizeof(DWORD)) {

     mEffectsPreferred = *((DWORD*)tempOutData);

-    free(tempOutData);

   } else {

     // We have no preference if we can't obtain it

     mEffectsPreferred = DROPEFFECT_NONE;

   }

+  free(tempOutData);

   // Set the native data object into drag session

   session->SetIDataObject(pIDataSource);

ma1 pushed to branch tor-browser-140.16.0esr-15.0-1 at The Tor Project / Applications / Tor Browser

Commits:

13 changed files:

Changes: