From a2417d573b3981eac223e0c014b037150e7797f5 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 12 Jun 2024 12:58:55 +0200 Subject: [PATCH 1/5] [DOM] Clone video info properly. --- dom/media/MediaInfo.h | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/dom/media/MediaInfo.h b/dom/media/MediaInfo.h index 62477cabd8..1ec985636e 100644 --- a/dom/media/MediaInfo.h +++ b/dom/media/MediaInfo.h @@ -210,13 +210,25 @@ public: , mDisplay(aOther.mDisplay) , mStereoMode(aOther.mStereoMode) , mImage(aOther.mImage) - , mCodecSpecificConfig(aOther.mCodecSpecificConfig) - , mExtraData(aOther.mExtraData) + , mCodecSpecificConfig(nullptr) + , mExtraData(nullptr) , mRotation(aOther.mRotation) , mBitDepth(aOther.mBitDepth) , mImageRect(aOther.mImageRect) , mAlphaPresent(aOther.mAlphaPresent) { + if (aOther.mCodecSpecificConfig) { + mCodecSpecificConfig = new MediaByteBuffer(); + mCodecSpecificConfig->AppendElements( + reinterpret_cast(aOther.mCodecSpecificConfig->Elements()), + aOther.mCodecSpecificConfig->Length()); + } + if (aOther.mExtraData) { + mExtraData = new MediaByteBuffer(); + mExtraData->AppendElements( + reinterpret_cast(aOther.mExtraData->Elements()), + aOther.mExtraData->Length()); + } } bool IsValid() const override From b4caa69a9ce7c491f96c4257204e288d2c8ea906 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 12 Jun 2024 19:42:16 +0200 Subject: [PATCH 2/5] [toolkit] Close autocomplete popup when window is resized. --- toolkit/components/satchel/nsFormFillController.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/toolkit/components/satchel/nsFormFillController.cpp b/toolkit/components/satchel/nsFormFillController.cpp index aac1870490..801af3287e 100644 --- a/toolkit/components/satchel/nsFormFillController.cpp +++ b/toolkit/components/satchel/nsFormFillController.cpp @@ -919,6 +919,11 @@ nsFormFillController::HandleEvent(nsIDOMEvent* aEvent) mFocusedPopup->ClosePopup(); return NS_OK; } + if (type.EqualsLiteral("resize")) { + if (mFocusedPopup) + mFocusedPopup->ClosePopup(); + return NS_OK; + } if (type.EqualsLiteral("pagehide")) { nsCOMPtr doc = do_QueryInterface( @@ -1213,6 +1218,8 @@ nsFormFillController::AddWindowListeners(nsPIDOMWindowOuter* aWindow) TrustedEventsAtCapture()); elm->AddEventListenerByType(this, NS_LITERAL_STRING("contextmenu"), TrustedEventsAtCapture()); + elm->AddEventListenerByType(this, NS_LITERAL_STRING("resize"), + TrustedEventsAtCapture()); // Note that any additional listeners added should ensure that they ignore // untrusted events, which might be sent by content that's up to no good. @@ -1257,6 +1264,8 @@ nsFormFillController::RemoveWindowListeners(nsPIDOMWindowOuter* aWindow) TrustedEventsAtCapture()); elm->RemoveEventListenerByType(this, NS_LITERAL_STRING("contextmenu"), TrustedEventsAtCapture()); + elm->RemoveEventListenerByType(this, NS_LITERAL_STRING("resize"), + TrustedEventsAtCapture()); } void From 40c9102d6daf6488f4a0c0ed6524f965d47df2e4 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 12 Jun 2024 20:04:44 +0200 Subject: [PATCH 3/5] [js gc] Suppress GC during JSObject::swap We already suppressed GC for part of this, but we may sweep before the pre-write barrier is established. The simplest and safest thing is to suppress GC for the whole method. --- js/src/jsobj.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp index 46f89e547e..788a35d5c9 100644 --- a/js/src/jsobj.cpp +++ b/js/src/jsobj.cpp @@ -1505,6 +1505,10 @@ JSObject::swap(JSContext* cx, HandleObject a, HandleObject b) if (!JSObject::getGroup(cx, b)) oomUnsafe.crash("JSObject::swap"); + // Don't allow a GC which may observe intermediate states or run before we + // execute all necessary barriers. + AutoSuppressGC suppress(cx); + /* * Neither object may be in the nursery, but ensure we update any embedded * nursery pointers in either object. @@ -1545,10 +1549,6 @@ JSObject::swap(JSContext* cx, HandleObject a, HandleObject b) a->fixDictionaryShapeAfterSwap(); b->fixDictionaryShapeAfterSwap(); } else { - // Avoid GC in here to avoid confusing the tracing code with our - // intermediate state. - AutoSuppressGC suppress(cx); - // When the objects have different sizes, they will have different // numbers of fixed slots before and after the swap, so the slots for // native objects will need to be rearranged. From 9c8bd37fe5391f48b2b9c8360737d33643765895 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 12 Jun 2024 21:34:12 +0200 Subject: [PATCH 4/5] [uri] Implement additional filename checks. --- uriloader/exthandler/nsExternalHelperAppService.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/uriloader/exthandler/nsExternalHelperAppService.cpp b/uriloader/exthandler/nsExternalHelperAppService.cpp index 698090718f..c01e82b0b2 100644 --- a/uriloader/exthandler/nsExternalHelperAppService.cpp +++ b/uriloader/exthandler/nsExternalHelperAppService.cpp @@ -1202,10 +1202,11 @@ nsExternalAppHandler::nsExternalAppHandler(nsIMIMEInfo * aMIMEInfo, // Replace platform specific path separator and illegal characters to avoid any confusion mSuggestedFileName.ReplaceChar(KNOWN_PATH_SEPARATORS, '_'); - mSuggestedFileName.ReplaceChar(FILE_ILLEGAL_CHARACTERS, ' '); - mSuggestedFileName.ReplaceChar(char16_t(0), '_'); + mSuggestedFileName.ReplaceChar(FILE_ILLEGAL_CHARACTERS, '_'); + mSuggestedFileName.ReplaceChar("%", '_'); + mSuggestedFileName.StripChar(char16_t(0)); mTempFileExtension.ReplaceChar(KNOWN_PATH_SEPARATORS, '_'); - mTempFileExtension.ReplaceChar(FILE_ILLEGAL_CHARACTERS, ' '); + mTempFileExtension.ReplaceChar(FILE_ILLEGAL_CHARACTERS, '_'); // Remove unsafe bidi characters which might have spoofing implications (bug 511521). const char16_t unsafeBidiCharacters[] = { From 0e05cb9630c4ac6bea719692d9bd64fd2e26f721 Mon Sep 17 00:00:00 2001 From: Daniel Holbert Date: Wed, 12 Jun 2024 22:31:23 +0200 Subject: [PATCH 5/5] [layout] Initialize PerSpanData members mBaseline and mReflowInput. We null-initialize all of the other pointer members in NewPerSpanData; we should do the same for these ones, for consistency & robustness. (In practice, the callers end up initializing these members before reading them anyway, so it's been benign that we weren't initializing them. But better for safety & futureproofing to have them reliably initialized.) --- layout/generic/nsLineLayout.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/layout/generic/nsLineLayout.cpp b/layout/generic/nsLineLayout.cpp index 579c4ae0b0..aa465d3584 100644 --- a/layout/generic/nsLineLayout.cpp +++ b/layout/generic/nsLineLayout.cpp @@ -401,8 +401,10 @@ nsLineLayout::NewPerSpanData() psd->mFrame = nullptr; psd->mFirstFrame = nullptr; psd->mLastFrame = nullptr; + psd->mReflowInput = nullptr; psd->mContainsFloat = false; psd->mHasNonemptyContent = false; + psd->mBaseline = nullptr; #ifdef DEBUG outerLineLayout->mSpansAllocated++;