Merge remote-tracking branch 'origin/master' into custom

This commit is contained in:
Roy Tam 2019-05-31 07:28:33 +08:00
commit 6431b85501
96 changed files with 16647 additions and 13653 deletions

View file

@ -1283,7 +1283,7 @@ Element::ToggleAttribute(const nsAString& aName,
if (aForce.WasPassed() && !aForce.Value()) {
return false;
}
nsCOMPtr<nsIAtom> nameAtom = NS_Atomize(nameToUse);
nsCOMPtr<nsIAtom> nameAtom = NS_AtomizeMainThread(nameToUse);
if (!nameAtom) {
aError.Throw(NS_ERROR_OUT_OF_MEMORY);
return false;

View file

@ -304,7 +304,8 @@ nsContentSink::ProcessHeaderData(nsIAtom* aHeader, const nsAString& aValue,
mDocument->SetHeaderData(aHeader, aValue);
if (aHeader == nsGkAtoms::setcookie) {
if (aHeader == nsGkAtoms::setcookie &&
Preferences::GetBool("dom.meta-set-cookie.enabled", true)) {
// Don't allow setting cookies in cookie-averse documents.
if (mDocument->IsCookieAverse()) {
return NS_OK;

View file

@ -301,7 +301,7 @@ nsNodeInfoManager::GetNodeInfo(const nsAString& aName, nsIAtom *aPrefix,
return NS_OK;
}
nsCOMPtr<nsIAtom> nameAtom = NS_Atomize(aName);
nsCOMPtr<nsIAtom> nameAtom = NS_AtomizeMainThread(aName);
NS_ENSURE_TRUE(nameAtom, NS_ERROR_OUT_OF_MEMORY);
RefPtr<NodeInfo> newNodeInfo =

View file

@ -2406,7 +2406,11 @@ CanvasRenderingContext2D::SetStyleFromUnion(const StringOrCanvasGradientOrCanvas
}
if (aValue.IsCanvasPattern()) {
SetStyleFromPattern(aValue.GetAsCanvasPattern(), aWhichStyle);
CanvasPattern& pattern = aValue.GetAsCanvasPattern();
SetStyleFromPattern(pattern, aWhichStyle);
if (pattern.mForceWriteOnly) {
SetWriteOnly();
}
return;
}
@ -2581,11 +2585,12 @@ CanvasRenderingContext2D::CreatePattern(const CanvasImageSource& aSource,
nsLayoutUtils::SurfaceFromElement(element,
nsLayoutUtils::SFE_WANT_FIRST_FRAME, mTarget);
if (!res.GetSourceSurface()) {
RefPtr<SourceSurface> surface = res.GetSourceSurface();
if (!surface) {
return nullptr;
}
RefPtr<CanvasPattern> pat = new CanvasPattern(this, res.GetSourceSurface(), repeatMode,
RefPtr<CanvasPattern> pat = new CanvasPattern(this, surface, repeatMode,
res.mPrincipal, res.mIsWriteOnly,
res.mCORSUsed);
return pat.forget();
@ -4895,8 +4900,8 @@ CanvasRenderingContext2D::CachedSurfaceFromElement(Element* aElement)
res.mSize = res.mSourceSurface->GetSize();
res.mPrincipal = principal.forget();
res.mIsWriteOnly = false;
res.mImageRequest = imgRequest.forget();
res.mIsWriteOnly = CheckWriteOnlySecurity(res.mCORSUsed, res.mPrincipal);
return res;
}

View file

@ -126,5 +126,25 @@ CoerceDouble(const JS::Value& v, double* d)
return true;
}
bool CheckWriteOnlySecurity(bool aCORSUsed, nsIPrincipal* aPrincipal) {
if (!aPrincipal) {
return true;
}
if (!aCORSUsed) {
nsIGlobalObject* incumbentSettingsObject = dom::GetIncumbentGlobal();
if (NS_WARN_IF(!incumbentSettingsObject)) {
return true;
}
nsIPrincipal* principal = incumbentSettingsObject->PrincipalOrNull();
if (NS_WARN_IF(!principal) || !(principal->Subsumes(aPrincipal))) {
return true;
}
}
return false;
}
} // namespace CanvasUtils
} // namespace mozilla

View file

@ -11,6 +11,7 @@
#include "mozilla/dom/ToJSValue.h"
#include "jsapi.h"
#include "mozilla/FloatingPoint.h"
#include "nsLayoutUtils.h"
class nsIPrincipal;
@ -156,6 +157,10 @@ DashArrayToJSVal(nsTArray<T>& dashes,
}
}
// returns true if write-only mode must used for this principal based on
// the incumbent global.
bool CheckWriteOnlySecurity(bool aCORSUsed, nsIPrincipal* aPrincipal);
} // namespace CanvasUtils
} // namespace mozilla

View file

@ -315,36 +315,6 @@ private:
const Maybe<IntRect>& mCropRect;
};
static bool
CheckSecurityForHTMLElements(bool aIsWriteOnly, bool aCORSUsed, nsIPrincipal* aPrincipal)
{
MOZ_ASSERT(aPrincipal);
if (aIsWriteOnly) {
return false;
}
if (!aCORSUsed) {
nsIGlobalObject* incumbentSettingsObject = GetIncumbentGlobal();
if (NS_WARN_IF(!incumbentSettingsObject)) {
return false;
}
nsIPrincipal* principal = incumbentSettingsObject->PrincipalOrNull();
if (NS_WARN_IF(!principal) || !(principal->Subsumes(aPrincipal))) {
return false;
}
}
return true;
}
static bool
CheckSecurityForHTMLElements(const nsLayoutUtils::SurfaceFromElementResult& aRes)
{
return CheckSecurityForHTMLElements(aRes.mIsWriteOnly, aRes.mCORSUsed, aRes.mPrincipal);
}
/*
* A wrapper to the nsLayoutUtils::SurfaceFromElement() function followed by the
* security checking.
@ -365,7 +335,7 @@ GetSurfaceFromElement(nsIGlobalObject* aGlobal, HTMLElementType& aElement,
}
// Check origin-clean and pass back
*aWriteOnly = !CheckSecurityForHTMLElements(res);
*aWriteOnly = res.mIsWriteOnly;
return surface.forget();
}
@ -818,7 +788,7 @@ ImageBitmap::CreateInternal(nsIGlobalObject* aGlobal, HTMLVideoElement& aVideoEl
nsCOMPtr<nsIPrincipal> principal = aVideoEl.GetCurrentVideoPrincipal();
bool CORSUsed = aVideoEl.GetCORSMode() != CORS_NONE;
writeOnly = !CheckSecurityForHTMLElements(false, CORSUsed, principal);
writeOnly = CheckWriteOnlySecurity(CORSUsed, principal);
// Create ImageBitmap.
ImageContainer *container = aVideoEl.GetImageContainer();

View file

@ -115,7 +115,7 @@ WebGLBuffer::BufferData(GLenum target, size_t size, const void* data, GLenum usa
const ScopedLazyBind lazyBind(gl, target, this);
mContext->InvalidateBufferFetching();
#ifdef XP_MACOSX
#if defined(XP_MACOSX) || defined(MOZ_WIDGET_GTK)
// bug 790879
if (gl->WorkAroundDriverBugs() &&
size > INT32_MAX)

View file

@ -39,6 +39,7 @@
#include "mozilla/dom/OSFileSystem.h"
#include "mozilla/dom/Promise.h"
#include "nsNetUtil.h"
#include "nsReadableUtils.h"
namespace mozilla {
namespace dom {
@ -644,6 +645,13 @@ DataTransfer::PrincipalMaySetData(const nsAString& aType,
NS_WARNING("Disallowing adding x-moz-file or x-moz-file-promize types to DataTransfer");
return false;
}
// Disallow content from creating x-moz-place flavors, so that it cannot
// create fake Places smart queries exposing user data.
if (StringBeginsWith(aType, NS_LITERAL_STRING("text/x-moz-place"))) {
NS_WARNING("Disallowing adding moz-place types to DataTransfer");
return false;
}
}
return true;
}

View file

@ -23717,32 +23717,38 @@ TransactionDatabaseOperationBase::SendPreprocessInfoOrResults(
MOZ_ASSERT(mTransaction);
if (NS_WARN_IF(IsActorDestroyed())) {
// Don't send any notifications if the actor was destroyed already.
// Normally we wouldn't need to send any notifications if the actor was
// already destroyed, but this can be a VersionChangeOp which needs to
// notify its parent operation (OpenDatabaseOp) about the failure.
// So SendFailureResult needs to be called even when the actor was
// destroyed. Normal operations redundantly check if the actor was
// destroyed in SendSuccessResult and SendFailureResult, therefore it's
// ok to call it in all cases here.
if (NS_SUCCEEDED(mResultCode)) {
IDB_REPORT_INTERNAL_ERR();
mResultCode = NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
}
} else {
if (mTransaction->IsInvalidated() || mTransaction->IsAborted()) {
// Aborted transactions always see their requests fail with ABORT_ERR,
// even if the request succeeded or failed with another error.
mResultCode = NS_ERROR_DOM_INDEXEDDB_ABORT_ERR;
} else if (NS_SUCCEEDED(mResultCode)) {
if (aSendPreprocessInfo) {
// This should not release the IPDL reference.
mResultCode = SendPreprocessInfo();
} else {
// This may release the IPDL reference.
mResultCode = SendSuccessResult();
}
} else if (mTransaction->IsInvalidated() || mTransaction->IsAborted()) {
// Aborted transactions always see their requests fail with ABORT_ERR,
// even if the request succeeded or failed with another error.
mResultCode = NS_ERROR_DOM_INDEXEDDB_ABORT_ERR;
}
if (NS_SUCCEEDED(mResultCode)) {
if (aSendPreprocessInfo) {
// This should not release the IPDL reference.
mResultCode = SendPreprocessInfo();
} else {
// This may release the IPDL reference.
mResultCode = SendSuccessResult();
}
}
if (NS_FAILED(mResultCode)) {
// This should definitely release the IPDL reference.
if (!SendFailureResult(mResultCode)) {
// Abort the transaction.
mTransaction->Abort(mResultCode, /* aForce */ false);
}
if (NS_FAILED(mResultCode)) {
// This should definitely release the IPDL reference.
if (!SendFailureResult(mResultCode)) {
// Abort the transaction.
mTransaction->Abort(mResultCode, /* aForce */ false);
}
}

View file

@ -5,8 +5,8 @@
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "AudioConverter.h"
#include <string.h>
#include <speex/speex_resampler.h>
#include <string.h>
#include <cmath>
/*
@ -140,24 +140,28 @@ static inline int16_t clipTo15(int32_t aX)
size_t
AudioConverter::DownmixAudio(void* aOut, const void* aIn, size_t aFrames) const
{
MOZ_ASSERT(mIn.Format() == AudioConfig::FORMAT_S16 ||
mIn.Format() == AudioConfig::FORMAT_FLT);
MOZ_ASSERT(mIn.Channels() >= mOut.Channels());
MOZ_ASSERT(mIn.Layout() == AudioConfig::ChannelLayout(mIn.Channels()),
"Can only downmix input data in SMPTE layout");
MOZ_ASSERT(mOut.Layout() == AudioConfig::ChannelLayout(2) ||
mOut.Layout() == AudioConfig::ChannelLayout(1));
MOZ_DIAGNOSTIC_ASSERT(mIn.Format() == AudioConfig::FORMAT_S16 ||
mIn.Format() == AudioConfig::FORMAT_FLT);
MOZ_DIAGNOSTIC_ASSERT(mIn.Channels() >= mOut.Channels());
MOZ_DIAGNOSTIC_ASSERT(
mIn.Layout() == AudioConfig::ChannelLayout(mIn.Channels()),
"Can only downmix input data in SMPTE layout");
MOZ_DIAGNOSTIC_ASSERT(mOut.Layout() == AudioConfig::ChannelLayout(2) ||
mOut.Layout() == AudioConfig::ChannelLayout(1),
"Can only downmix to stereo or mono");
uint32_t channels = mIn.Channels();
uint32_t inChannels = mIn.Channels();
uint32_t outChannels = mOut.Channels();
if (channels == 1 && mOut.Channels() == 1) {
if (inChannels == outChannels) {
// Number of channels is equal; no processing needed, just move data.
if (aOut != aIn) {
memmove(aOut, aIn, FramesOutToBytes(aFrames));
}
return aFrames;
}
if (channels > 2) {
if (inChannels > 2) {
if (mIn.Format() == AudioConfig::FORMAT_FLT) {
// Downmix matrix. Per-row normalization 1 for rows 3,4 and 2 for rows 5-8.
static const float dmatrix[6][8][2]= {
@ -174,12 +178,18 @@ AudioConverter::DownmixAudio(void* aOut, const void* aIn, size_t aFrames) const
for (uint32_t i = 0; i < aFrames; i++) {
float sampL = 0.0;
float sampR = 0.0;
for (uint32_t j = 0; j < channels; j++) {
sampL += in[i*mIn.Channels()+j]*dmatrix[mIn.Channels()-3][j][0];
sampR += in[i*mIn.Channels()+j]*dmatrix[mIn.Channels()-3][j][1];
for (uint32_t j = 0; j < inChannels; j++) {
sampL += in[i * inChannels + j] * dmatrix[inChannels - 3][j][0];
sampR += in[i * inChannels + j] * dmatrix[inChannels - 3][j][1];
}
if (outChannels == 2) {
// Stereo
*out++ = sampL;
*out++ = sampR;
} else {
// Mono
*out++ = (sampL + sampR) * 0.5;
}
*out++ = sampL;
*out++ = sampR;
}
} else if (mIn.Format() == AudioConfig::FORMAT_S16) {
// Downmix matrix. Per-row normalization 1 for rows 3,4 and 2 for rows 5-8.
@ -198,45 +208,51 @@ AudioConverter::DownmixAudio(void* aOut, const void* aIn, size_t aFrames) const
for (uint32_t i = 0; i < aFrames; i++) {
int32_t sampL = 0;
int32_t sampR = 0;
for (uint32_t j = 0; j < channels; j++) {
sampL+=in[i*channels+j]*dmatrix[channels-3][j][0];
sampR+=in[i*channels+j]*dmatrix[channels-3][j][1];
for (uint32_t j = 0; j < inChannels; j++) {
sampL += in[i * inChannels + j] * dmatrix[inChannels - 3][j][0];
sampR += in[i * inChannels + j] * dmatrix[inChannels - 3][j][1];
}
sampL = clipTo15((sampL + 8192) >> 14);
sampR = clipTo15((sampR + 8192) >> 14);
if (outChannels == 2) {
// Stereo
*out++ = sampL;
*out++ = sampR;
} else {
// Mono
*out++ = (sampL + sampR) * 0.5;
}
*out++ = clipTo15((sampL + 8192)>>14);
*out++ = clipTo15((sampR + 8192)>>14);
}
} else {
MOZ_DIAGNOSTIC_ASSERT(false, "Unsupported data type");
}
// If we are to continue downmixing to mono, start working on the output
// buffer.
aIn = aOut;
channels = 2;
return aFrames;
}
if (mOut.Channels() == 1) {
if (mIn.Format() == AudioConfig::FORMAT_FLT) {
const float* in = static_cast<const float*>(aIn);
float* out = static_cast<float*>(aOut);
for (size_t fIdx = 0; fIdx < aFrames; ++fIdx) {
float sample = 0.0;
// The sample of the buffer would be interleaved.
sample = (in[fIdx*channels] + in[fIdx*channels + 1]) * 0.5;
*out++ = sample;
}
} else if (mIn.Format() == AudioConfig::FORMAT_S16) {
const int16_t* in = static_cast<const int16_t*>(aIn);
int16_t* out = static_cast<int16_t*>(aOut);
for (size_t fIdx = 0; fIdx < aFrames; ++fIdx) {
int32_t sample = 0.0;
// The sample of the buffer would be interleaved.
sample = (in[fIdx*channels] + in[fIdx*channels + 1]) * 0.5;
*out++ = sample;
}
} else {
MOZ_DIAGNOSTIC_ASSERT(false, "Unsupported data type");
// If we get here, we're doing a stereo -> mono conversion.
MOZ_DIAGNOSTIC_ASSERT(inChannels == 2 && outChannels == 1);
if (mIn.Format() == AudioConfig::FORMAT_FLT) {
const float* in = static_cast<const float*>(aIn);
float* out = static_cast<float*>(aOut);
for (size_t fIdx = 0; fIdx < aFrames; ++fIdx) {
float sample = 0.0;
// The sample of the buffer would be interleaved.
sample = (in[fIdx * inChannels] + in[fIdx * inChannels + 1]) * 0.5;
*out++ = sample;
}
} else if (mIn.Format() == AudioConfig::FORMAT_S16) {
const int16_t* in = static_cast<const int16_t*>(aIn);
int16_t* out = static_cast<int16_t*>(aOut);
for (size_t fIdx = 0; fIdx < aFrames; ++fIdx) {
int32_t sample = 0.0;
// The sample of the buffer would be interleaved.
sample = (in[fIdx * inChannels] + in[fIdx * inChannels + 1]) * 0.5;
*out++ = sample;
}
} else {
MOZ_DIAGNOSTIC_ASSERT(false, "Unsupported data type");
}
return aFrames;
}