From 3bac3ab0b5881df9998c9584c90604be648b79b6 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sun, 16 Feb 2025 19:35:29 +0100 Subject: [PATCH 1/4] No issue - avoid potential underflow in StructuredClone. Prevents potential loop-around if there's bogus internal Map data. --- js/src/vm/StructuredClone.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp index 25e9e93b3b..79f2d23d96 100644 --- a/js/src/vm/StructuredClone.cpp +++ b/js/src/vm/StructuredClone.cpp @@ -1700,6 +1700,8 @@ JSStructuredCloneWriter::write(HandleValue v) return false; if (cls == ESClass::Map) { + if (!counts.back()) + return false; counts.back()--; RootedValue val(context(), entries.back()); entries.popBack(); From c41c1c63d54d209df18e47cd95cfc3b8f58a2a84 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 18 Feb 2025 09:59:26 +0100 Subject: [PATCH 2/4] [DOM] Honor security.csp.reporting.enabled pref in more places. --- dom/security/nsCSPContext.cpp | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp index 60cf33aeac..ad9b33bb2e 100644 --- a/dom/security/nsCSPContext.cpp +++ b/dom/security/nsCSPContext.cpp @@ -263,7 +263,7 @@ nsCSPContext::permitsInternal(CSPDirective aDir, // Do not send a report or notify observers if this is a preload - the // decision may be wrong due to the inability to get the nonce, and will // incorrectly fail the unit tests. - if (!aIsPreload && aSendViolationReports) { + if (CSPService::sCSPReportingEnabled && !aIsPreload && aSendViolationReports) { uint32_t lineNumber = 0; uint32_t columnNumber = 0; nsAutoCString spec; @@ -601,13 +601,15 @@ nsCSPContext::GetAllowsInline(CSPDirective aDirective, } nsAutoString violatedDirective; mPolicies[i]->getDirectiveStringForContentType(aDirective, violatedDirective); - reportInlineViolation(aDirective, - aNonce, - aContent, - violatedDirective, - i, - aLineNumber, - aColumnNumber); + if(CSPService::sCSPReportingEnabled) { + reportInlineViolation(aDirective, + aNonce, + aContent, + violatedDirective, + i, + aLineNumber, + aColumnNumber); + } } } return NS_OK; @@ -648,7 +650,8 @@ nsCSPContext::GetAllowsInline(CSPDirective aDirective, PR_BEGIN_MACRO \ static_assert(directive##_SRC_DIRECTIVE == SCRIPT_SRC_DIRECTIVE || \ directive##_SRC_DIRECTIVE == STYLE_SRC_DIRECTIVE); \ - if (!mPolicies[p]->allows(directive##_SRC_DIRECTIVE, keyword, nonceOrHash, \ + if(CSPService::sCSPReportingEnabled && \ + !mPolicies[p]->allows(directive##_SRC_DIRECTIVE, keyword, nonceOrHash, \ false)) { \ nsAutoString violatedDirective; \ mPolicies[p]->getDirectiveStringForContentType( \ From 8b41e53028703e2d90bc8f79bf3676d69266cef1 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 18 Feb 2025 10:03:17 +0100 Subject: [PATCH 3/4] Issue #2693 - Disable CSP reporting by default in the platform. This is a temporary measure to work around CF OOM situations. Reporting is desirable normally so webmasters get alerted to CSP issues, and this should be flipped back on once we can. --- modules/libpref/init/all.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index 6adcb30ee2..08817b45f9 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -2212,7 +2212,7 @@ pref("security.notification_enable_delay", 500); pref("security.csp.enable", true); pref("security.csp.experimentalEnabled", false); pref("security.csp.enableStrictDynamic", true); -pref("security.csp.reporting.enabled", true); +pref("security.csp.reporting.enabled", false); // Default Content Security Policy to apply to signed contents. pref("security.signed_content.CSP.default", "script-src 'self'; style-src 'self'"); From cb233feea0a6eb0b6f768406e17f85bd270925c4 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 18 Feb 2025 11:17:06 +0100 Subject: [PATCH 4/4] Issue #2693 - Don't reflow children if they have 0 width. This seems to be the main reason for the reflow storm. --- layout/generic/nsGridContainerFrame.cpp | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp index 89352321c4..57b78e810d 100644 --- a/layout/generic/nsGridContainerFrame.cpp +++ b/layout/generic/nsGridContainerFrame.cpp @@ -3793,10 +3793,25 @@ MeasuringReflow(nsIFrame* aChild, nsIFrame::ReflowChildFlags::NoMoveFrame | nsIFrame::ReflowChildFlags::NoSizeView | nsIFrame::ReflowChildFlags::NoDeleteNextInFlowChild; - parent->ReflowChild(aChild, pc, childSize, childRI, wm, - LogicalPoint(wm), nsSize(), flags, childStatus); - parent->FinishReflowChild(aChild, pc, childSize, &childRI, wm, - LogicalPoint(wm), nsSize(), flags); + if (childSize.mBoundingMetrics.width != 0) { + parent->ReflowChild(aChild, + pc, + childSize, + childRI, + wm, + LogicalPoint(wm), + nsSize(), + flags, + childStatus); + parent->FinishReflowChild(aChild, + pc, + childSize, + &childRI, + wm, + LogicalPoint(wm), + nsSize(), + flags); + } #ifdef DEBUG parent->DeleteProperty(nsContainerFrame::DebugReflowingWithInfiniteISize()); #endif