Merge remote-tracking branch 'origin/tracking' into custom

devtools/client/framework/toolbox.js

@@ -46,8 +46,6 @@ loader.lazyRequireGetter(this, "InspectorFront",
   "devtools/shared/fronts/inspector", true);
 loader.lazyRequireGetter(this, "flags",
   "devtools/shared/flags");
-loader.lazyRequireGetter(this, "showDoorhanger",
-  "devtools/client/shared/doorhanger", true);
 loader.lazyRequireGetter(this, "createPerformanceFront",
   "devtools/shared/fronts/performance", true);
 loader.lazyRequireGetter(this, "system",
@@ -2184,14 +2182,16 @@ Toolbox.prototype = {
         .then(() => {
           this._removeHostListeners();
 
-          // `location` may already be null if the toolbox document is already
+          // `location` may already be invalid if the toolbox document is
-          // in process of destruction. Otherwise if it is still around, ensure
+          // already in process of destruction. Otherwise if it is still
-          // releasing toolbox document and triggering cleanup thanks to unload
+          // around, ensure releasing toolbox document and triggering cleanup
-          // event. We do that precisely here, before nullifying the target as
+          // thanks to unload event. We do that precisely here, before
-          // various cleanup code depends on the target attribute to be still
+          // nullifying the target as various cleanup code depends on the
-          // defined.
+          // target attribute to be still defined.
-          if (win.location) {
+          try {
             win.location.replace("about:blank");
+          } catch (e) {
+            // Do nothing.
           }
 
           // Targets need to be notified that the toolbox is being torn down.

devtools/client/responsivedesign/responsivedesign.jsm

@@ -8,7 +8,6 @@ const Cu = Components.utils;
 
 var {loader, require} = Cu.import("resource://devtools/shared/Loader.jsm", {});
 var Telemetry = require("devtools/client/shared/telemetry");
-var {showDoorhanger} = require("devtools/client/shared/doorhanger");
 var {TouchEventSimulator} = require("devtools/shared/touch/simulator");
 var {Task} = require("devtools/shared/task");
 var promise = require("promise");

devtools/client/shared/doorhanger.js

@@ -1,137 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-"use strict";
-
-const { Ci, Cc } = require("chrome");
-const Services = require("Services");
-const { DOMHelpers } = require("resource://devtools/client/shared/DOMHelpers.jsm");
-const { Task } = require("devtools/shared/task");
-const defer = require("devtools/shared/defer");
-const { getMostRecentBrowserWindow } = require("sdk/window/utils");
-
-const XULNS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-const LOCALE = Cc["@mozilla.org/chrome/chrome-registry;1"]
-               .getService(Ci.nsIXULChromeRegistry)
-               .getSelectedLocale("global");
-
-var TYPES = {
-  // We don't support any doorhanger types at the moment.
-  // This is vestigial from the FF dev edition promo.
-};
-
-var panelAttrs = {
-  orient: "vertical",
-  hidden: "false",
-  consumeoutsideclicks: "true",
-  noautofocus: "true",
-  align: "start",
-  role: "alert"
-};
-
-/**
- * Helper to call a doorhanger, defined in `TYPES`, with defined conditions,
- * success handlers and loads its own XUL in a frame. Takes an object with
- * several properties:
- *
- * @param {XULWindow} window
- *        The window that should house the doorhanger.
- * @param {String} type
- *        The type of doorhanger to be displayed is, using the `TYPES`
- *        definition.
- * @param {String} selector
- *        The selector that the doorhanger should be appended to within
- *        `window`.  Defaults to a XUL Document's `window` element.
- */
-exports.showDoorhanger = Task.async(function* ({ window, type, anchor }) {
-  let { predicate, success, url, action } = TYPES[type];
-  // Abort if predicate fails
-  if (!predicate()) {
-    return;
-  }
-
-  // Call success function to set preferences/cleanup immediately,
-  // so if triggered multiple times, only happens once (Windows/Linux)
-  success();
-
-  // Wait 200ms to prevent flickering where the popup is displayed
-  // before the underlying window (Windows 7, 64bit)
-  yield wait(200);
-
-  let document = window.document;
-
-  let panel = document.createElementNS(XULNS, "panel");
-  let frame = document.createElementNS(XULNS, "iframe");
-  let parentEl = document.querySelector("window");
-
-  frame.setAttribute("src", url);
-  let close = () => parentEl.removeChild(panel);
-
-  setDoorhangerStyle(panel, frame);
-
-  panel.appendChild(frame);
-  parentEl.appendChild(panel);
-
-  yield onFrameLoad(frame);
-
-  panel.openPopup(anchor);
-
-  let closeBtn = frame.contentDocument.querySelector("#close");
-  if (closeBtn) {
-    closeBtn.addEventListener("click", close);
-  }
-
-  let goBtn = frame.contentDocument.querySelector("#go");
-  if (goBtn) {
-    goBtn.addEventListener("click", () => {
-      if (action) {
-        action();
-      }
-      close();
-    });
-  }
-});
-
-function setDoorhangerStyle(panel, frame) {
-  Object.keys(panelAttrs).forEach(prop => {
-    return panel.setAttribute(prop, panelAttrs[prop]);
-  });
-  panel.style.margin = "20px";
-  panel.style.borderRadius = "5px";
-  panel.style.border = "none";
-  panel.style.MozAppearance = "none";
-  panel.style.backgroundColor = "transparent";
-
-  frame.style.borderRadius = "5px";
-  frame.setAttribute("flex", "1");
-  frame.setAttribute("width", "450");
-  frame.setAttribute("height", "179");
-}
-
-function onFrameLoad(frame) {
-  let { resolve, promise } = defer();
-
-  if (frame.contentWindow) {
-    let domHelper = new DOMHelpers(frame.contentWindow);
-    domHelper.onceDOMReady(resolve);
-  } else {
-    let callback = () => {
-      frame.removeEventListener("DOMContentLoaded", callback);
-      resolve();
-    };
-    frame.addEventListener("DOMContentLoaded", callback);
-  }
-
-  return promise;
-}
-
-function getGBrowser() {
-  return getMostRecentBrowserWindow().gBrowser;
-}
-
-function wait(n) {
-  let { resolve, promise } = defer();
-  setTimeout(resolve, n);
-  return promise;
-}

devtools/client/shared/moz.build

@@ -26,7 +26,6 @@ DevToolsModules(
     'devices.js',
     'devtools-file-watcher.js',
     'DOMHelpers.jsm',
-    'doorhanger.js',
     'file-watcher-worker.js',
     'file-watcher.js',
     'getjson.js',

devtools/client/webconsole/hudservice.js

@@ -19,7 +19,6 @@ loader.lazyRequireGetter(this, "WebConsoleFrame", "devtools/client/webconsole/we
 loader.lazyRequireGetter(this, "gDevTools", "devtools/client/framework/devtools", true);
 loader.lazyRequireGetter(this, "DebuggerServer", "devtools/server/main", true);
 loader.lazyRequireGetter(this, "DebuggerClient", "devtools/shared/client/main", true);
-loader.lazyRequireGetter(this, "showDoorhanger", "devtools/client/shared/doorhanger", true);
 loader.lazyRequireGetter(this, "viewSource", "devtools/client/shared/view-source");
 
 const STRINGS_URI = "devtools/client/locales/webconsole.properties";

dom/workers/WorkerPrefs.h

@@ -26,7 +26,6 @@ WORKER_SIMPLE_PREF("browser.dom.window.dump.enabled", DumpEnabled, DUMP)
 WORKER_SIMPLE_PREF("canvas.imagebitmap_extensions.enabled", ImageBitmapExtensionsEnabled, IMAGEBITMAP_EXTENSIONS_ENABLED)
 WORKER_SIMPLE_PREF("dom.caches.enabled", DOMCachesEnabled, DOM_CACHES)
 WORKER_SIMPLE_PREF("dom.caches.testing.enabled", DOMCachesTestingEnabled, DOM_CACHES_TESTING)
-WORKER_SIMPLE_PREF("dom.min_timeout_value", DOMMinTimeoutValue, DOM_MIN_TIMEOUT_VALUE)
 WORKER_SIMPLE_PREF("dom.performance.enable_user_timing_logging", PerformanceLoggingEnabled, PERFORMANCE_LOGGING_ENABLED)
 WORKER_SIMPLE_PREF("dom.webnotifications.enabled", DOMWorkerNotificationEnabled, DOM_WORKERNOTIFICATION)
 WORKER_SIMPLE_PREF("dom.webnotifications.serviceworker.enabled", DOMServiceWorkerNotificationEnabled, DOM_SERVICEWORKERNOTIFICATION)

dom/workers/WorkerPrivate.cpp

@@ -171,6 +171,8 @@ const nsIID kDEBUGWorkerEventTargetIID = {
 
 // The number of nested timeouts before we start clamping. HTML says 5.
 const uint32_t kClampTimeoutNestingLevel = 5u;
+// The minimum interval we clamp timers in workers to. HTML says 4ms.
+const uint32_t kClampTimeoutInterval = 4u;
 
 template <class T>
 class AutoPtrComparator
@@ -1997,20 +1999,10 @@ struct WorkerPrivate::TimeoutInfo
 
   void CalculateTargetTime(JSContext* aCx) {
     auto target = mInterval;
-    int32_t minTimeoutValue;
+
-    
-    // We're on a worker thread; go through WorkerPrivate for the pref.
-    WorkerPrivate* workerPrivate = GetWorkerPrivateFromContext(aCx);
-    if (workerPrivate) {
-      minTimeoutValue = workerPrivate->DOMMinTimeoutValue();
-    } else {
-      // fall back to default 4 ms
-      minTimeoutValue = 4;
-    }
-      
     // Clamp timeout for workers, except chrome workers
     if (mNestingLevel >= kClampTimeoutNestingLevel && !mOnChromeWorker) {
-      target = TimeDuration::Max(mInterval,TimeDuration::FromMilliseconds(minTimeoutValue));
+      target = TimeDuration::Max(mInterval, TimeDuration::FromMilliseconds(kClampTimeoutInterval));
     }
     mTargetTime = TimeStamp::Now() + target;
   }
@@ -5169,7 +5161,9 @@ WorkerPrivate::ScheduleDeletion(WorkerRanOrNot aRanOrNot)
   if (WorkerRan == aRanOrNot) {
     nsIThread* currentThread = NS_GetCurrentThread();
     MOZ_ASSERT(currentThread);
-    MOZ_ASSERT(!NS_HasPendingEvents(currentThread));
+    // On the worker thread WorkerRunnable will refuse to run if not nested
+    // on top of a WorkerThreadPrimaryRunnable.
+    Unused << NS_WARN_IF(NS_HasPendingEvents(currentThread));
   }
 #endif
 

dom/workers/WorkerRunnable.cpp

@@ -11,6 +11,7 @@
 #include "nsIRunnable.h"
 #include "nsThreadUtils.h"
 
+#include "mozilla/CycleCollectedJSContext.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/ErrorResult.h"
 #include "mozilla/Unused.h"
@@ -231,6 +232,19 @@ WorkerRunnable::Run()
   bool targetIsWorkerThread = mBehavior == WorkerThreadModifyBusyCount ||
                               mBehavior == WorkerThreadUnchangedBusyCount;
 
+  if (targetIsWorkerThread) {
+    // On a worker thread, a WorkerRunnable should only run when there is an
+    // underlying WorkerThreadPrimaryRunnable active, which means we should
+    // find a CycleCollectedJSContext.
+    if (!CycleCollectedJSContext::Get()) {
+      MOZ_DIAGNOSTIC_ASSERT(false,
+                            "A WorkerRunnable was executed after "
+                            "WorkerThreadPrimaryRunnable ended.");
+
+      return NS_OK;
+    }
+  }
+
 #ifdef DEBUG
   MOZ_ASSERT_IF(mCallingCancelWithinRun, targetIsWorkerThread);
   if (targetIsWorkerThread) {

layout/generic/nsImageMap.cpp

@@ -529,7 +529,7 @@ void PolyArea::Draw(nsIFrame* aFrame, DrawTarget& aDrawTarget,
       Point p1(pc->CSSPixelsToDevPixels(mCoords[0]),
                pc->CSSPixelsToDevPixels(mCoords[1]));
       Point p2, p1snapped, p2snapped;
-      for (int32_t i = 2; i < mNumCoords; i += 2) {
+      for (int32_t i = 2; i < mNumCoords - 1; i += 2) {
         p2.x = pc->CSSPixelsToDevPixels(mCoords[i]);
         p2.y = pc->CSSPixelsToDevPixels(mCoords[i+1]);
         p1snapped = p1;
@@ -556,7 +556,7 @@ void PolyArea::GetRect(nsIFrame* aFrame, nsRect& aRect)
     nscoord x1, x2, y1, y2, xtmp, ytmp;
     x1 = x2 = nsPresContext::CSSPixelsToAppUnits(mCoords[0]);
     y1 = y2 = nsPresContext::CSSPixelsToAppUnits(mCoords[1]);
-    for (int32_t i = 2; i < mNumCoords; i += 2) {
+    for (int32_t i = 2; i < mNumCoords - 1; i += 2) {
       xtmp = nsPresContext::CSSPixelsToAppUnits(mCoords[i]);
       ytmp = nsPresContext::CSSPixelsToAppUnits(mCoords[i+1]);
       x1 = x1 < xtmp ? x1 : xtmp;

netwerk/streamconv/converters/nsMultiMixedConv.cpp

@@ -1018,11 +1018,14 @@ nsMultiMixedConv::ParseHeaders(nsIChannel *aChannel, char *&aPtr,
             } else if (headerStr.LowerCaseEqualsLiteral("content-disposition")) {
                 mContentDisposition = headerVal;
             } else if (headerStr.LowerCaseEqualsLiteral("set-cookie")) {
+                // Do not allow cookies to be set from multipart/mixed content parts
+                // as a mitigation to CVE-2024-1551
+                /*
                 nsCOMPtr<nsIHttpChannelInternal> httpInternal =
                     do_QueryInterface(aChannel);
                 if (httpInternal) {
                     httpInternal->SetCookie(headerVal.get());
-                }
+                }*/
             } else if (headerStr.LowerCaseEqualsLiteral("content-range") || 
                        headerStr.LowerCaseEqualsLiteral("range") ) {
                 // something like: Content-range: bytes 7000-7999/8000