From 7d96ee2fe653a42c8cda8231cba2e205117018c5 Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:01:39 +0800 Subject: [PATCH 01/11] Bug 1740389; r=handyman, a=tjr Bug 1735071: Make Windows non-ePopupLevelTop popups respect owner z-order. r=edgar, a=tjr --- widget/windows/nsWindow.cpp | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/widget/windows/nsWindow.cpp b/widget/windows/nsWindow.cpp index 0b3c129edc..1dc25c6964 100644 --- a/widget/windows/nsWindow.cpp +++ b/widget/windows/nsWindow.cpp @@ -1587,7 +1587,20 @@ NS_IMETHODIMP nsWindow::Show(bool bState) // the popup. flags |= SWP_NOACTIVATE; HWND owner = ::GetWindow(mWnd, GW_OWNER); - ::SetWindowPos(mWnd, owner ? 0 : HWND_TOPMOST, 0, 0, 0, 0, flags); + if (owner) { + // ePopupLevelTop popups should be above all else. All other + // types should be placed in front of their owner, without + // changing the owner's z-level relative to other windows. + if (PopupLevel() != ePopupLevelTop) { + ::SetWindowPos(mWnd, owner, 0, 0, 0, 0, flags); + ::SetWindowPos(owner, mWnd, 0, 0, 0, 0, + SWP_NOMOVE | SWP_NOSIZE | SWP_NOACTIVATE); + } else { + ::SetWindowPos(mWnd, HWND_TOP, 0, 0, 0, 0, flags); + } + } else { + ::SetWindowPos(mWnd, HWND_TOPMOST, 0, 0, 0, 0, flags); + } } else { if (mWindowType == eWindowType_dialog && !CanTakeFocus()) flags |= SWP_NOACTIVATE; @@ -3449,8 +3462,6 @@ nsWindow::MakeFullScreen(bool aFullScreen, nsIScreen* aTargetScreen) taskbarInfo->PrepareFullScreenHWND(mWnd, TRUE); } } else { - if (mSizeMode != nsSizeMode_Fullscreen) - return NS_OK; SetSizeMode(mOldSizeMode); } From afc2f71d70cd003b6b6bb7d7a49e7ce0feacb6e1 Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:02:30 +0800 Subject: [PATCH 02/11] Bug 1664149: Hold a self reference in nsDataObj. r=smaug, a=RyanVM --- widget/windows/nsDataObj.cpp | 20 ++++++++++++++++++++ widget/windows/nsDataObj.h | 1 + 2 files changed, 21 insertions(+) diff --git a/widget/windows/nsDataObj.cpp b/widget/windows/nsDataObj.cpp index f3dec2cb09..7d46551fca 100644 --- a/widget/windows/nsDataObj.cpp +++ b/widget/windows/nsDataObj.cpp @@ -24,6 +24,7 @@ #include "nsIURL.h" #include "nsNetUtil.h" #include "mozilla/Services.h" +#include "nsProxyRelease.h" #include "nsIOutputStream.h" #include "nsXPCOMStrings.h" #include "nscore.h" @@ -442,6 +443,12 @@ STDMETHODIMP_(ULONG) nsDataObj::AddRef() { ++m_cRef; NS_LOG_ADDREF(this, m_cRef, "nsDataObj", sizeof(*this)); + + // When the first reference is taken, hold our own internal reference. + if (m_cRef == 1) { + mKeepAlive = this; + } + return m_cRef; } @@ -528,6 +535,12 @@ STDMETHODIMP_(ULONG) nsDataObj::Release() --m_cRef; NS_LOG_RELEASE(this, m_cRef, "nsDataObj"); + + // If we hold the last reference, submit release of it to the main thread. + if (m_cRef == 1 && mKeepAlive) { + NS_ReleaseOnMainThread(mKeepAlive.forget(), true); + } + if (0 != m_cRef) return m_cRef; @@ -542,6 +555,10 @@ STDMETHODIMP_(ULONG) nsDataObj::Release() helper->Attach(); } + // In case the destructor ever AddRef/Releases, ensure we don't delete twice + // or take mKeepAlive as another reference. + m_cRef = 1; + delete this; return 0; @@ -567,6 +584,9 @@ STDMETHODIMP nsDataObj::GetData(LPFORMATETC aFormat, LPSTGMEDIUM pSTM) if (!mTransferable) return DV_E_FORMATETC; + // Hold an extra reference in case we end up spinning the event loop. + RefPtr keepAliveDuringGetData(this); + uint32_t dfInx = 0; static CLIPFORMAT fileDescriptorFlavorA = ::RegisterClipboardFormat( CFSTR_FILEDESCRIPTORA ); diff --git a/widget/windows/nsDataObj.h b/widget/windows/nsDataObj.h index 61f209e857..8dabce7b8a 100644 --- a/widget/windows/nsDataObj.h +++ b/widget/windows/nsDataObj.h @@ -228,6 +228,7 @@ protected: // nsDataObj owns and ref counts CEnumFormatEtc, nsCOMPtr mCachedTempFile; + RefPtr mKeepAlive; BOOL mIsAsyncMode; BOOL mIsInOperation; From e3fb994063468440dcdf47c04d0a7ed1d6da4003 Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:03:35 +0800 Subject: [PATCH 03/11] Bug 1735028 - check for missing signedData field r=keeler --- security/nss/lib/pkcs7/certread.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/nss/lib/pkcs7/certread.c b/security/nss/lib/pkcs7/certread.c index 3091f9947e..15094f2d78 100644 --- a/security/nss/lib/pkcs7/certread.c +++ b/security/nss/lib/pkcs7/certread.c @@ -139,6 +139,11 @@ SEC_ReadPKCS7Certs(SECItem *pkcs7Item, CERTImportCertificateFunc f, void *arg) goto done; } + if (contentInfo.content.signedData == NULL) { + PORT_SetError(SEC_ERROR_BAD_DER); + goto done; + } + rv = SECSuccess; certs = contentInfo.content.signedData->certificates; From 2ceec8871e6994118b8bb28ca4c28cf906969a15 Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:08:08 +0800 Subject: [PATCH 04/11] Bug 1743515 - Add dynamic check for valid serialized length. r=jonco, a=RyanVM --- js/src/vm/StructuredClone.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp index 6c082d6065..9cd4f1e072 100644 --- a/js/src/vm/StructuredClone.cpp +++ b/js/src/vm/StructuredClone.cpp @@ -545,6 +545,11 @@ ReadStructuredClone(JSContext* cx, JSStructuredCloneData& data, JS::StructuredCloneScope scope, MutableHandleValue vp, const JSStructuredCloneCallbacks* cb, void* cbClosure) { + if (data.Size() % 8) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_SC_BAD_SERIALIZED_DATA, "misaligned"); + return false; + } SCInput in(cx, data); JSStructuredCloneReader r(in, scope, cb, cbClosure); return r.read(vp); From b2b02865a87b9480b5ece9d0262f17ab96b3aff5 Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:11:03 +0800 Subject: [PATCH 05/11] Bug 1746720 - Don't special-case refresh for XSLT. r=ckerschb,freddyb a=RyanVM --- dom/xslt/xslt/txMozillaXMLOutput.cpp | 37 ---------------------------- dom/xslt/xslt/txMozillaXMLOutput.h | 2 -- 2 files changed, 39 deletions(-) diff --git a/dom/xslt/xslt/txMozillaXMLOutput.cpp b/dom/xslt/xslt/txMozillaXMLOutput.cpp index 21b3c228f2..16163eca86 100644 --- a/dom/xslt/xslt/txMozillaXMLOutput.cpp +++ b/dom/xslt/xslt/txMozillaXMLOutput.cpp @@ -236,19 +236,6 @@ txMozillaXMLOutput::endDocument(nsresult aResult) } } - if (!mRefreshString.IsEmpty()) { - nsPIDOMWindowOuter* win = mDocument->GetWindow(); - if (win) { - nsCOMPtr refURI = - do_QueryInterface(win->GetDocShell()); - if (refURI) { - refURI->SetupRefreshURIFromHeader(mDocument->GetDocBaseURI(), - mDocument->NodePrincipal(), - mRefreshString); - } - } - } - if (mNotifier) { mNotifier->OnTransformEnd(); } @@ -744,35 +731,11 @@ txMozillaXMLOutput::endHTMLElement(nsIContent* aElement) mCurrentNodeStack.RemoveObjectAt(last); mTableState = static_cast (NS_PTR_TO_INT32(mTableStateStack.pop())); - - return NS_OK; - } - else if (mCreatingNewDocument && aElement->IsHTMLElement(nsGkAtoms::meta)) { - // handle HTTP-EQUIV data - nsAutoString httpEquiv; - aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::httpEquiv, httpEquiv); - if (!httpEquiv.IsEmpty()) { - nsAutoString value; - aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::content, value); - if (!value.IsEmpty()) { - nsContentUtils::ASCIIToLower(httpEquiv); - nsCOMPtr header = NS_Atomize(httpEquiv); - processHTTPEquiv(header, value); - } - } } return NS_OK; } -void txMozillaXMLOutput::processHTTPEquiv(nsIAtom* aHeader, const nsString& aValue) -{ - // For now we only handle "refresh". There's a longer list in - // HTMLContentSink::ProcessHeaderData - if (aHeader == nsGkAtoms::refresh) - LossyCopyUTF16toASCII(aValue, mRefreshString); -} - nsresult txMozillaXMLOutput::createResultDocument(const nsSubstring& aName, int32_t aNsID, nsIDOMDocument* aSourceDocument, diff --git a/dom/xslt/xslt/txMozillaXMLOutput.h b/dom/xslt/xslt/txMozillaXMLOutput.h index acdf9bd02e..f58dbb118c 100644 --- a/dom/xslt/xslt/txMozillaXMLOutput.h +++ b/dom/xslt/xslt/txMozillaXMLOutput.h @@ -80,7 +80,6 @@ private: nsresult createTxWrapper(); nsresult startHTMLElement(nsIContent* aElement, bool aXHTML); nsresult endHTMLElement(nsIContent* aElement); - void processHTTPEquiv(nsIAtom* aHeader, const nsString& aValue); nsresult createHTMLElement(nsIAtom* aName, nsIContent** aResult); @@ -105,7 +104,6 @@ private: RefPtr mNotifier; uint32_t mTreeDepth, mBadChildLevel; - nsCString mRefreshString; txStack mTableStateStack; enum TableState { From 62a879b69415557a15d464842915030d6936d1bd Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:11:44 +0800 Subject: [PATCH 06/11] Bug 1746011 - Handle truncated ADTS stream. r=bryce, a=RyanVM --- dom/media/ADTSDemuxer.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dom/media/ADTSDemuxer.cpp b/dom/media/ADTSDemuxer.cpp index 89148ce241..cc68a34947 100644 --- a/dom/media/ADTSDemuxer.cpp +++ b/dom/media/ADTSDemuxer.cpp @@ -819,8 +819,9 @@ ADTSTrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize) const int64_t streamLen = StreamLength(); if (mInfo && streamLen > 0) { + int64_t max = streamLen > aOffset ? streamLen - aOffset : 0; // Prevent blocking reads after successful initialization. - aSize = std::min(aSize, streamLen - aOffset); + aSize = std::min(aSize, max); } uint32_t read = 0; From 258790bf38f74d93f3579e46889cd72af2368a5c Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:13:45 +0800 Subject: [PATCH 07/11] Bug 1737816 - Handle truncated mp3 resources. r=bryce, a=RyanVM --- dom/media/mp3/MP3Demuxer.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dom/media/mp3/MP3Demuxer.cpp b/dom/media/mp3/MP3Demuxer.cpp index ccc515afb4..8fbe8da796 100644 --- a/dom/media/mp3/MP3Demuxer.cpp +++ b/dom/media/mp3/MP3Demuxer.cpp @@ -676,8 +676,9 @@ MP3TrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize) { const int64_t streamLen = StreamLength(); if (mInfo && streamLen > 0) { + uint64_t max = streamLen > aOffset ? streamLen - aOffset : 0; // Prevent blocking reads after successful initialization. - aSize = std::min(aSize, streamLen - aOffset); + aSize = std::min(aSize, max); } uint32_t read = 0; From 7d7c1ab08a6f39c1217c232b818c763d852136e1 Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:14:30 +0800 Subject: [PATCH 08/11] Bug 1741201 - Increase intermediate byte storage maximum capacity. r=janv, a=tjr --- dom/indexedDB/ActorsParent.cpp | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/dom/indexedDB/ActorsParent.cpp b/dom/indexedDB/ActorsParent.cpp index 9203f9ee41..52f221d78a 100644 --- a/dom/indexedDB/ActorsParent.cpp +++ b/dom/indexedDB/ActorsParent.cpp @@ -26311,13 +26311,17 @@ ObjectStoreAddOrPutRequestOp::DoDatabaseWork(DatabaseConnection* aConnection) return rv; } } else { - nsCString flatCloneData; - flatCloneData.SetLength(cloneDataSize); - auto iter = cloneData.Start(); - cloneData.ReadBytes(iter, flatCloneData.BeginWriting(), cloneDataSize); + AutoTArray flatCloneData; // 4096 from JSStructuredCloneData + if (!flatCloneData.SetLength(cloneDataSize, fallible)) { + return NS_ERROR_OUT_OF_MEMORY; + } + { // iter scope + auto iter = cloneData.Start(); + MOZ_ALWAYS_TRUE(cloneData.ReadBytes(iter, flatCloneData.Elements(), cloneDataSize)); + } // Compress the bytes before adding into the database. - const char* uncompressed = flatCloneData.BeginReading(); + const char* uncompressed = flatCloneData.Elements(); size_t uncompressedLength = cloneDataSize; size_t compressedLength = snappy::MaxCompressedLength(uncompressedLength); From b2d3ec5e924e9527eb0be4fd0e63ceb3f56bfe09 Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:17:36 +0800 Subject: [PATCH 09/11] Bug 1650214 - Cancel progress timer when shutting down FileReader. r=asuth, a=RyanVM --- dom/base/FileReader.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/dom/base/FileReader.cpp b/dom/base/FileReader.cpp index 273e192d0c..7a8cb31d6e 100644 --- a/dom/base/FileReader.cpp +++ b/dom/base/FileReader.cpp @@ -775,6 +775,7 @@ FileReader::Shutdown() mAsyncStream = nullptr; } + ClearProgressEventTimer(); FreeFileData(); mResultArrayBuffer = nullptr; From 5ad78a48db6b50b1b3eb741e5c6db28752b6e22c Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:18:44 +0800 Subject: [PATCH 10/11] Bug 1737252 - [devtools] Escaping back tick signs. r=nchevobbe, a=RyanVM --- devtools/client/shared/curl.js | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js index 54cdc05cbf..f514ae1d74 100644 --- a/devtools/client/shared/curl.js +++ b/devtools/client/shared/curl.js @@ -8,6 +8,7 @@ * Copyright (C) 2008, 2009 Anthony Ricaud * Copyright (C) 2011 Google Inc. All rights reserved. * Copyright (C) 2009 Mozilla Foundation. All rights reserved. + * Copyright (C) 2022 Moonchild Productions. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -400,9 +401,15 @@ const CurlUtils = { */ escapeStringWin: function (str) { /* - Replace dollar sign because of commands (e.g $(cmd.exe)) in - powershell when using double quotes. - Useful details http://www.rlmueller.net/PowerShellEscape.htm + Replace the backtick character ` with `` in order to escape it. + The backtick character is an escape character in PowerShell and + can, among other things, be used to disable the effect of some + of the other escapes created below. + + Replace dollar sign because of commands in powershell when using + double quotes. e.g $(calc.exe). + + Also see http://www.rlmueller.net/PowerShellEscape.htm for details. Replace quote by double quote (but not by \") because it is recognized by both cmd.exe and MS Crt arguments parser. @@ -416,13 +423,15 @@ const CurlUtils = { MS Crt arguments parser won't collapse them. Replace new line outside of quotes since cmd.exe doesn't let - to do it inside. + us do it inside. */ - return "\"" + str.replace(/\$/g, "`$") - .replace(/"/g, "\"\"") - .replace(/%/g, "\"%\"") - .replace(/\\/g, "\\\\") - .replace(/[\r\n]+/g, "\"^$&\"") + "\""; + return "\"" + + str.replaceAll("`", "``") + .replaceAll("$", "`$") + .replaceAll('"', '""') + .replaceAll("%", '"%"') + .replace(/\\/g, "\\\\") + .replace(/[\r\n]+/g, "\"^$&\"") + "\""; } }; From 16447338481c4d1ee56c63fd86eed241737a11c3 Mon Sep 17 00:00:00 2001 From: roytam1 Date: Wed, 19 Jan 2022 10:19:41 +0800 Subject: [PATCH 11/11] Issue #unknown, update mozglue delay-load DLL list. --- mozglue/build/moz.build | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/mozglue/build/moz.build b/mozglue/build/moz.build index de7feb76a7..9197eda1bc 100644 --- a/mozglue/build/moz.build +++ b/mozglue/build/moz.build @@ -18,7 +18,13 @@ if CONFIG['MOZ_ASAN']: if CONFIG['OS_TARGET'] == 'WINNT': DEFFILE = 'mozglue.def' # We'll break the DLL blocklist if we immediately load user32.dll - DELAYLOAD_DLLS += ['user32.dll'] + # For the same reason, we delayload these other DLLs to avoid eager + # dependencies on user32.dll. + DELAYLOAD_DLLS += [ + 'dbghelp.dll', + 'user32.dll', + 'version.dll', + ] if not CONFIG['JS_STANDALONE']: