Merge branch 'post-git-tracking' into tracking

devtools/client/shared/curl.js

@@ -8,6 +8,7 @@
  * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  * Copyright (C) 2009 Mozilla Foundation. All rights reserved.
+ * Copyright (C) 2022 Moonchild Productions. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -400,9 +401,15 @@ const CurlUtils = {
    */
   escapeStringWin: function (str) {
     /* 
-       Replace dollar sign because of commands (e.g $(cmd.exe)) in
+       Replace the backtick character ` with `` in order to escape it.
-       powershell when using double quotes.
+       The backtick character is an escape character in PowerShell and
-       Useful details http://www.rlmueller.net/PowerShellEscape.htm
+       can, among other things, be used to disable the effect of some
+       of the other escapes created below.
+
+       Replace dollar sign because of commands in powershell when using
+       double quotes. e.g $(calc.exe).
+       
+       Also see http://www.rlmueller.net/PowerShellEscape.htm for details.
 
        Replace quote by double quote (but not by \") because it is
        recognized by both cmd.exe and MS Crt arguments parser.
@@ -416,13 +423,15 @@ const CurlUtils = {
        MS Crt arguments parser won't collapse them.
 
        Replace new line outside of quotes since cmd.exe doesn't let
-       to do it inside.
+       us do it inside.
     */
-    return "\"" + str.replace(/\$/g, "`$")
+    return "\"" + 
-                     .replace(/"/g, "\"\"")
+      str.replaceAll("`", "``")
-                     .replace(/%/g, "\"%\"")
+         .replaceAll("$", "`$")
-                     .replace(/\\/g, "\\\\")
+         .replaceAll('"', '""')
-                     .replace(/[\r\n]+/g, "\"^$&\"") + "\"";
+         .replaceAll("%", '"%"')
+         .replace(/\\/g, "\\\\")
+         .replace(/[\r\n]+/g, "\"^$&\"") + "\"";
   }
 };
 

dom/base/FileReader.cpp

@@ -775,6 +775,7 @@ FileReader::Shutdown()
     mAsyncStream = nullptr;
   }
 
+  ClearProgressEventTimer();
   FreeFileData();
   mResultArrayBuffer = nullptr;
 

dom/indexedDB/ActorsParent.cpp

@@ -26311,13 +26311,17 @@ ObjectStoreAddOrPutRequestOp::DoDatabaseWork(DatabaseConnection* aConnection)
       return rv;
     }
   } else {
-    nsCString flatCloneData;
+    AutoTArray<char, 4096> flatCloneData;  // 4096 from JSStructuredCloneData
-    flatCloneData.SetLength(cloneDataSize);
+    if (!flatCloneData.SetLength(cloneDataSize, fallible)) {
-    auto iter = cloneData.Start();
+      return NS_ERROR_OUT_OF_MEMORY;
-    cloneData.ReadBytes(iter, flatCloneData.BeginWriting(), cloneDataSize);
+    }
+    { // iter scope
+      auto iter = cloneData.Start();
+      MOZ_ALWAYS_TRUE(cloneData.ReadBytes(iter, flatCloneData.Elements(), cloneDataSize));
+    }
 
     // Compress the bytes before adding into the database.
-    const char* uncompressed = flatCloneData.BeginReading();
+    const char* uncompressed = flatCloneData.Elements();
     size_t uncompressedLength = cloneDataSize;
 
     size_t compressedLength = snappy::MaxCompressedLength(uncompressedLength);

dom/media/ADTSDemuxer.cpp

@@ -819,8 +819,9 @@ ADTSTrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize)
 
   const int64_t streamLen = StreamLength();
   if (mInfo && streamLen > 0) {
+    int64_t max = streamLen > aOffset ? streamLen - aOffset : 0;
     // Prevent blocking reads after successful initialization.
-    aSize = std::min<int64_t>(aSize, streamLen - aOffset);
+    aSize = std::min<int64_t>(aSize, max);
   }
 
   uint32_t read = 0;

dom/media/mp3/MP3Demuxer.cpp

@@ -676,8 +676,9 @@ MP3TrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize) {
 
   const int64_t streamLen = StreamLength();
   if (mInfo && streamLen > 0) {
+    uint64_t max = streamLen > aOffset ? streamLen - aOffset : 0;
     // Prevent blocking reads after successful initialization.
-    aSize = std::min<int64_t>(aSize, streamLen - aOffset);
+    aSize = std::min<int64_t>(aSize, max);
   }
 
   uint32_t read = 0;

dom/xslt/xslt/txMozillaXMLOutput.cpp

@@ -236,19 +236,6 @@ txMozillaXMLOutput::endDocument(nsresult aResult)
         }
     }
 
-    if (!mRefreshString.IsEmpty()) {
-        nsPIDOMWindowOuter* win = mDocument->GetWindow();
-        if (win) {
-            nsCOMPtr<nsIRefreshURI> refURI =
-                do_QueryInterface(win->GetDocShell());
-            if (refURI) {
-                refURI->SetupRefreshURIFromHeader(mDocument->GetDocBaseURI(),
-                                                  mDocument->NodePrincipal(),
-                                                  mRefreshString);
-            }
-        }
-    }
-
     if (mNotifier) {
         mNotifier->OnTransformEnd();
     }
@@ -744,35 +731,11 @@ txMozillaXMLOutput::endHTMLElement(nsIContent* aElement)
         mCurrentNodeStack.RemoveObjectAt(last);
         mTableState = static_cast<TableState>
                                  (NS_PTR_TO_INT32(mTableStateStack.pop()));
-
-        return NS_OK;
-    }
-    else if (mCreatingNewDocument && aElement->IsHTMLElement(nsGkAtoms::meta)) {
-        // handle HTTP-EQUIV data
-        nsAutoString httpEquiv;
-        aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::httpEquiv, httpEquiv);
-        if (!httpEquiv.IsEmpty()) {
-            nsAutoString value;
-            aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::content, value);
-            if (!value.IsEmpty()) {
-                nsContentUtils::ASCIIToLower(httpEquiv);
-                nsCOMPtr<nsIAtom> header = NS_Atomize(httpEquiv);
-                processHTTPEquiv(header, value);
-            }
-        }
     }
     
     return NS_OK;
 }
 
-void txMozillaXMLOutput::processHTTPEquiv(nsIAtom* aHeader, const nsString& aValue)
-{
-    // For now we only handle "refresh". There's a longer list in
-    // HTMLContentSink::ProcessHeaderData
-    if (aHeader == nsGkAtoms::refresh)
-        LossyCopyUTF16toASCII(aValue, mRefreshString);
-}
-
 nsresult
 txMozillaXMLOutput::createResultDocument(const nsSubstring& aName, int32_t aNsID,
                                          nsIDOMDocument* aSourceDocument,

dom/xslt/xslt/txMozillaXMLOutput.h

@@ -80,7 +80,6 @@ private:
     nsresult createTxWrapper();
     nsresult startHTMLElement(nsIContent* aElement, bool aXHTML);
     nsresult endHTMLElement(nsIContent* aElement);
-    void processHTTPEquiv(nsIAtom* aHeader, const nsString& aValue);
     nsresult createHTMLElement(nsIAtom* aName,
                                nsIContent** aResult);
 
@@ -105,7 +104,6 @@ private:
     RefPtr<txTransformNotifier> mNotifier;
 
     uint32_t mTreeDepth, mBadChildLevel;
-    nsCString mRefreshString;
 
     txStack mTableStateStack;
     enum TableState {

js/src/vm/StructuredClone.cpp

@@ -545,6 +545,11 @@ ReadStructuredClone(JSContext* cx, JSStructuredCloneData& data,
                     JS::StructuredCloneScope scope, MutableHandleValue vp,
                     const JSStructuredCloneCallbacks* cb, void* cbClosure)
 {
+    if (data.Size() % 8) {
+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                                  JSMSG_SC_BAD_SERIALIZED_DATA, "misaligned");
+        return false;
+    }
     SCInput in(cx, data);
     JSStructuredCloneReader r(in, scope, cb, cbClosure);
     return r.read(vp);

mozglue/build/moz.build

@@ -18,7 +18,13 @@ if CONFIG['MOZ_ASAN']:
 if CONFIG['OS_TARGET'] == 'WINNT':
     DEFFILE = 'mozglue.def'
     # We'll break the DLL blocklist if we immediately load user32.dll
-    DELAYLOAD_DLLS += ['user32.dll']
+    # For the same reason, we delayload these other DLLs to avoid eager
+    # dependencies on user32.dll.
+    DELAYLOAD_DLLS += [
+        'dbghelp.dll',
+        'user32.dll',
+        'version.dll',
+    ]
 
 if not CONFIG['JS_STANDALONE']:
 

security/nss/lib/pkcs7/certread.c

@@ -139,6 +139,11 @@ SEC_ReadPKCS7Certs(SECItem *pkcs7Item, CERTImportCertificateFunc f, void *arg)
         goto done;
     }
 
+    if (contentInfo.content.signedData == NULL) {
+        PORT_SetError(SEC_ERROR_BAD_DER);
+        goto done;
+    }
+
     rv = SECSuccess;
 
     certs = contentInfo.content.signedData->certificates;

widget/windows/nsDataObj.cpp

@@ -24,6 +24,7 @@
 #include "nsIURL.h"
 #include "nsNetUtil.h"
 #include "mozilla/Services.h"
+#include "nsProxyRelease.h"
 #include "nsIOutputStream.h"
 #include "nsXPCOMStrings.h"
 #include "nscore.h"
@@ -442,6 +443,12 @@ STDMETHODIMP_(ULONG) nsDataObj::AddRef()
 {
 	++m_cRef;
 	NS_LOG_ADDREF(this, m_cRef, "nsDataObj", sizeof(*this));
+
+  // When the first reference is taken, hold our own internal reference.
+  if (m_cRef == 1) {
+    mKeepAlive = this;
+  }
+
 	return m_cRef;
 }
 
@@ -528,6 +535,12 @@ STDMETHODIMP_(ULONG) nsDataObj::Release()
 	--m_cRef;
 	
 	NS_LOG_RELEASE(this, m_cRef, "nsDataObj");
+
+  // If we hold the last reference, submit release of it to the main thread.
+  if (m_cRef == 1 && mKeepAlive) {
+    NS_ReleaseOnMainThread(mKeepAlive.forget(), true);
+  }
+
 	if (0 != m_cRef)
 		return m_cRef;
 
@@ -542,6 +555,10 @@ STDMETHODIMP_(ULONG) nsDataObj::Release()
     helper->Attach();
   }
 
+  // In case the destructor ever AddRef/Releases, ensure we don't delete twice
+  // or take mKeepAlive as another reference.
+  m_cRef = 1;
+
 	delete this;
 
 	return 0;
@@ -567,6 +584,9 @@ STDMETHODIMP nsDataObj::GetData(LPFORMATETC aFormat, LPSTGMEDIUM pSTM)
   if (!mTransferable)
     return DV_E_FORMATETC;
 
+  // Hold an extra reference in case we end up spinning the event loop.
+  RefPtr<nsDataObj> keepAliveDuringGetData(this);
+
   uint32_t dfInx = 0;
 
   static CLIPFORMAT fileDescriptorFlavorA = ::RegisterClipboardFormat( CFSTR_FILEDESCRIPTORA ); 

widget/windows/nsDataObj.h

@@ -228,6 +228,7 @@ protected:
                                       // nsDataObj owns and ref counts CEnumFormatEtc,
 
     nsCOMPtr<nsIFile> mCachedTempFile;
+    RefPtr<nsDataObj> mKeepAlive;
 
     BOOL mIsAsyncMode;
     BOOL mIsInOperation;

widget/windows/nsWindow.cpp

@@ -1587,7 +1587,20 @@ NS_IMETHODIMP nsWindow::Show(bool bState)
           // the popup.
           flags |= SWP_NOACTIVATE;
           HWND owner = ::GetWindow(mWnd, GW_OWNER);
-          ::SetWindowPos(mWnd, owner ? 0 : HWND_TOPMOST, 0, 0, 0, 0, flags);
+          if (owner) {
+            // ePopupLevelTop popups should be above all else. All other
+            // types should be placed in front of their owner, without
+            // changing the owner's z-level relative to other windows.
+            if (PopupLevel() != ePopupLevelTop) {
+              ::SetWindowPos(mWnd, owner, 0, 0, 0, 0, flags);
+              ::SetWindowPos(owner, mWnd, 0, 0, 0, 0,
+                             SWP_NOMOVE | SWP_NOSIZE | SWP_NOACTIVATE);
+            } else {
+              ::SetWindowPos(mWnd, HWND_TOP, 0, 0, 0, 0, flags);
+            }
+          } else {
+            ::SetWindowPos(mWnd, HWND_TOPMOST, 0, 0, 0, 0, flags);
+          }
         } else {
           if (mWindowType == eWindowType_dialog && !CanTakeFocus())
             flags |= SWP_NOACTIVATE;
@@ -3449,8 +3462,6 @@ nsWindow::MakeFullScreen(bool aFullScreen, nsIScreen* aTargetScreen)
       taskbarInfo->PrepareFullScreenHWND(mWnd, TRUE);
     }
   } else {
-    if (mSizeMode != nsSizeMode_Fullscreen)
-      return NS_OK;
     SetSizeMode(mOldSizeMode);
   }