From 23a2c27f8b0756dfee54a2d58d9f77aa6314b897 Mon Sep 17 00:00:00 2001 From: Gaming4JC Date: Thu, 17 Oct 2019 19:20:58 -0400 Subject: [PATCH 01/15] Issue #1243 - Update List of NSS Exported Symbols Add NSS_CMSSignedData_GetDigestAlgs and NSS_CMSSignedData_hasDigests which are required for security patches in mailnews applications. Ref: m-c bug 1526473 --- config/external/nss/nss.symbols | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/external/nss/nss.symbols b/config/external/nss/nss.symbols index 7a968b6c8c..9172407b20 100644 --- a/config/external/nss/nss.symbols +++ b/config/external/nss/nss.symbols @@ -216,7 +216,9 @@ NSS_CMSSignedData_Create NSS_CMSSignedData_CreateCertsOnly NSS_CMSSignedData_Destroy NSS_CMSSignedData_GetContentInfo +NSS_CMSSignedData_GetDigestAlgs NSS_CMSSignedData_GetSignerInfo +NSS_CMSSignedData_HasDigests NSS_CMSSignedData_ImportCerts NSS_CMSSignedData_SetDigestValue NSS_CMSSignedData_SignerInfoCount From 2df83f48017128ac80e72f305e0272ee2e312b23 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Mon, 21 Oct 2019 08:42:45 +0200 Subject: [PATCH 02/15] Issue #1231 - Correct defines for Mac and keep universal prefs generic. --- modules/libpref/init/all.js | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index 648ef8a566..5d787033c3 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -732,19 +732,19 @@ pref("gfx.layerscope.port", 23456); // This should be use to quickly find which slow paths are used by test cases. pref("gfx.perf-warnings.enabled", false); +// Color Management System // 0 = Off, 1 = All Images, 2 = Tagged Images Only. // See eCMSMode in gfx/thebes/gfxPlatform.h -#ifdef XP_WIN +// Enabled by default on Windows and Mac, disabled elsewhere +#if defined(XP_WIN) || defined(XP_MACOSX) pref("gfx.color_management.mode", 2); +#else +pref("gfx.color_management.mode", 0); +#endif pref("gfx.color_management.display_profile", ""); pref("gfx.color_management.rendering_intent", 0); pref("gfx.color_management.enablev4", true); -#else -pref("gfx.color_management.mode", 0); -pref("gfx.color_management.display_profile", ""); -pref("gfx.color_management.rendering_intent", 0); -pref("gfx.color_management.enablev4", false); -#endif + pref("gfx.downloadable_fonts.enabled", true); pref("gfx.downloadable_fonts.fallback_delay", 3000); From c87432ab7e40ac646c311beebaa1e7b92a724280 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Mon, 21 Oct 2019 11:16:19 +0200 Subject: [PATCH 03/15] Issue #1229 - Remove fallback for $INSTDIR This resolves #1229 --- toolkit/mozapps/installer/windows/nsis/common.nsh | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/toolkit/mozapps/installer/windows/nsis/common.nsh b/toolkit/mozapps/installer/windows/nsis/common.nsh index bc592bdabf..730a30d09a 100644 --- a/toolkit/mozapps/installer/windows/nsis/common.nsh +++ b/toolkit/mozapps/installer/windows/nsis/common.nsh @@ -5608,21 +5608,6 @@ StrCpy $INSTDIR "$R9" !endif - ; If the user doesn't have write access to the installation directory set - ; the installation directory to a subdirectory of the All Users application - ; directory and if the user can't write to that location set the installation - ; directory to a subdirectory of the users local application directory - ; (e.g. non-roaming). - ${CanWriteToInstallDir} $R9 - StrCmp "$R9" "false" +1 finish_check_install_dir - - SetShellVarContext all ; Set SHCTX to All Users - StrCpy $INSTDIR "$APPDATA\${BrandFullName}\" - ${CanWriteToInstallDir} $R9 - StrCmp "$R9" "false" +2 +1 - StrCpy $INSTDIR "$LOCALAPPDATA\${BrandFullName}\" - - finish_check_install_dir: IfFileExists "$INSTDIR" +3 +1 Pop $R9 Return From d21dc0f76a5f2f201a3a3327b80d7af714dd03fc Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Mon, 21 Oct 2019 22:29:42 +0200 Subject: [PATCH 04/15] Issue #1253 - Reset performance object on navigation This also addresses clearing of document dependent JS slots which might get out of sync with innerWindow navigation; relevant comments added. This resolves #1253 --- dom/base/nsGlobalWindow.cpp | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp index afaa24f09f..ec546f0683 100644 --- a/dom/base/nsGlobalWindow.cpp +++ b/dom/base/nsGlobalWindow.cpp @@ -3224,6 +3224,12 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument, newInnerWindow->mLocalStorage = nullptr; newInnerWindow->mSessionStorage = nullptr; + newInnerWindow->mPerformance = nullptr; + + // This must be called after nulling the internal objects because + // we might recreate them here by calling the getter methods, and + // store them into the JS slots. If we null them after, the slot + // values and the objects will be out of sync. newInnerWindow->ClearDocumentDependentSlots(cx); } } else { @@ -3364,10 +3370,16 @@ nsGlobalWindow::InnerSetNewDocument(JSContext* aCx, nsIDocument* aDocument) } mDoc = aDocument; - ClearDocumentDependentSlots(aCx); mFocusedNode = nullptr; mLocalStorage = nullptr; mSessionStorage = nullptr; + mPerformance = nullptr; + + // This must be called after nulling the internal objects because we might + // recreate them here by calling the getter methods, and store them into the JS + // slots. If we null them after, the slot values and the objects will be + // out of sync. + ClearDocumentDependentSlots(aCx); #ifdef DEBUG mLastOpenedURI = aDocument->GetDocumentURI(); From 4a024d6b52a3ceded065dc5286c8f3e996995918 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Tue, 22 Oct 2019 20:57:58 +0200 Subject: [PATCH 05/15] Avoid uint32_t overflow in js shell by checking size of file before trying to stuff something insanely large into a Uint8Array. See also: BMO 1571911 --- js/src/shell/OSObject.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/js/src/shell/OSObject.cpp b/js/src/shell/OSObject.cpp index 846ec7b156..4fb3d4e77d 100644 --- a/js/src/shell/OSObject.cpp +++ b/js/src/shell/OSObject.cpp @@ -184,6 +184,11 @@ FileAsTypedArray(JSContext* cx, JS::HandleString pathnameStr) return nullptr; JS_ReportErrorUTF8(cx, "can't seek start of %s", pathname.ptr()); } else { + if (len > INT32_MAX) { + JS_ReportErrorUTF8(cx, "file %s is too large for a Uint8Array", + pathname.ptr()); + return nullptr; + } obj = JS_NewUint8Array(cx, len); if (!obj) return nullptr; From d794c3d76280d14a27504b51967eb8e0ec86188b Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Wed, 23 Oct 2019 10:32:13 +0200 Subject: [PATCH 06/15] Issue #1255 - Port upstream fix from libexpat --- parser/expat/lib/xmlparse.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/parser/expat/lib/xmlparse.c b/parser/expat/lib/xmlparse.c index 93a8177645..6ab140c894 100644 --- a/parser/expat/lib/xmlparse.c +++ b/parser/expat/lib/xmlparse.c @@ -335,7 +335,7 @@ initializeEncoding(XML_Parser parser); static enum XML_Error doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, int tok, const char *next, const char **nextPtr, - XML_Bool haveMore); + XML_Bool haveMore, XML_Bool allowClosingDoctype); static enum XML_Error processInternalEntity(XML_Parser parser, ENTITY *entity, XML_Bool betweenDecl); @@ -3760,7 +3760,7 @@ externalParEntProcessor(XML_Parser parser, processor = prologProcessor; return doProlog(parser, encoding, s, end, tok, next, - nextPtr, (XML_Bool)!ps_finalBuffer); + nextPtr, (XML_Bool)!ps_finalBuffer, XML_TRUE); } static enum XML_Error PTRCALL @@ -3810,7 +3810,7 @@ prologProcessor(XML_Parser parser, const char *next = s; int tok = XmlPrologTok(encoding, s, end, &next); return doProlog(parser, encoding, s, end, tok, next, - nextPtr, (XML_Bool)!ps_finalBuffer); + nextPtr, (XML_Bool)!ps_finalBuffer, XML_TRUE); } static enum XML_Error @@ -3821,7 +3821,8 @@ doProlog(XML_Parser parser, int tok, const char *next, const char **nextPtr, - XML_Bool haveMore) + XML_Bool haveMore, + XML_Bool allowClosingDoctype) { #ifdef XML_DTD static const XML_Char externalSubsetName[] = { '#' , '\0' }; @@ -3987,6 +3988,11 @@ doProlog(XML_Parser parser, } break; case XML_ROLE_DOCTYPE_CLOSE: + if (allowClosingDoctype != XML_TRUE) { + /* Must not close doctype from within expanded parameter entities */ + return XML_ERROR_INVALID_TOKEN; + } + if (doctypeName) { startDoctypeDeclHandler(handlerArg, doctypeName, doctypeSysid, doctypePubid, 0); @@ -4892,7 +4898,7 @@ processInternalEntity(XML_Parser parser, ENTITY *entity, if (entity->is_param) { int tok = XmlPrologTok(internalEncoding, textStart, textEnd, &next); result = doProlog(parser, internalEncoding, textStart, textEnd, tok, - next, &next, XML_FALSE); + next, &next, XML_FALSE, XML_FALSE); } else #endif /* XML_DTD */ @@ -4959,7 +4965,7 @@ internalEntityProcessor(XML_Parser parser, if (entity->is_param) { int tok = XmlPrologTok(internalEncoding, textStart, textEnd, &next); result = doProlog(parser, internalEncoding, textStart, textEnd, tok, - next, &next, XML_FALSE); + next, &next, XML_FALSE, XML_TRUE); } else #endif /* XML_DTD */ @@ -4986,7 +4992,7 @@ internalEntityProcessor(XML_Parser parser, processor = prologProcessor; tok = XmlPrologTok(encoding, s, end, &next); return doProlog(parser, encoding, s, end, tok, next, nextPtr, - (XML_Bool)!ps_finalBuffer); + (XML_Bool)!ps_finalBuffer, XML_TRUE); } else #endif /* XML_DTD */ From 96cb9e1c39f618fa3b0e0bcbf4af4784c224a762 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Wed, 23 Oct 2019 10:50:55 +0200 Subject: [PATCH 07/15] Add null check in Http2Session::RecvAltSvc --- netwerk/protocol/http/Http2Session.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp index 86e8c74f64..726b39f74b 100644 --- a/netwerk/protocol/http/Http2Session.cpp +++ b/netwerk/protocol/http/Http2Session.cpp @@ -2182,6 +2182,7 @@ Http2Session::RecvAltSvc(Http2Session *self) } if (NS_FAILED(self->SetInputFrameDataStream(self->mInputFrameID)) || + !self->mInputFrameDataStream || !self->mInputFrameDataStream->Transaction() || !self->mInputFrameDataStream->Transaction()->RequestHead()) { LOG3(("Http2Session::RecvAltSvc %p got frame w/o origin on invalid stream", self)); From 21f7feb805d0306d083626297d4d743781c3e2b5 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Wed, 23 Oct 2019 11:29:38 +0200 Subject: [PATCH 08/15] Avoid following the prototype chain No longer follow the value's prototype chain when creating index updates in IndexedDB. --- dom/indexedDB/IDBObjectStore.cpp | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/dom/indexedDB/IDBObjectStore.cpp b/dom/indexedDB/IDBObjectStore.cpp index f86c619a72..cbac308947 100644 --- a/dom/indexedDB/IDBObjectStore.cpp +++ b/dom/indexedDB/IDBObjectStore.cpp @@ -1114,7 +1114,7 @@ IDBObjectStore::AppendIndexUpdateInfo( } bool isArray; - if (!JS_IsArrayObject(aCx, val, &isArray)) { + if (NS_WARN_IF(!JS_IsArrayObject(aCx, val, &isArray))) { IDB_REPORT_INTERNAL_ERR(); return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR; } @@ -1127,8 +1127,25 @@ IDBObjectStore::AppendIndexUpdateInfo( } for (uint32_t arrayIndex = 0; arrayIndex < arrayLength; arrayIndex++) { - JS::Rooted arrayItem(aCx); - if (NS_WARN_IF(!JS_GetOwnElement(aCx, array, arrayIndex, &arrayItem))) { + JS::RootedId indexId(aCx); + if (NS_WARN_IF(!JS_IndexToId(aCx, arrayIndex, &indexId))) { + IDB_REPORT_INTERNAL_ERR(); + return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR; + } + + bool hasOwnProperty; + if (NS_WARN_IF( + !JS_HasOwnPropertyById(aCx, array, indexId, &hasOwnProperty))) { + IDB_REPORT_INTERNAL_ERR(); + return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR; + } + + if (!hasOwnProperty) { + continue; + } + + JS::RootedValue arrayItem(aCx); + if (NS_WARN_IF(!JS_GetPropertyById(aCx, array, indexId, &arrayItem))) { IDB_REPORT_INTERNAL_ERR(); return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR; } From 8b5250600789b8adbadf886ca6bf420870b2aeee Mon Sep 17 00:00:00 2001 From: Simon Giesecke Date: Wed, 23 Oct 2019 12:19:15 +0200 Subject: [PATCH 09/15] Ensure that file actors created after the database was closed are expired. --- dom/indexedDB/IDBDatabase.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dom/indexedDB/IDBDatabase.cpp b/dom/indexedDB/IDBDatabase.cpp index 5592e7f93e..6ef3528011 100644 --- a/dom/indexedDB/IDBDatabase.cpp +++ b/dom/indexedDB/IDBDatabase.cpp @@ -1257,6 +1257,9 @@ IDBDatabase::LastRelease() AssertIsOnOwningThread(); CloseInternal(); + + // Make sure that file actors created after the database was closed are expired. + ExpireFileActors(/* aExpireAll */ true); if (mBackgroundActor) { mBackgroundActor->SendDeleteMeInternal(); From a194aefa0d593ce282cccac8049fe69cc64f2991 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Wed, 23 Oct 2019 16:40:29 +0200 Subject: [PATCH 10/15] Leverage strings to get working dirs in nsUpdateDriver. --- toolkit/xre/nsUpdateDriver.cpp | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/toolkit/xre/nsUpdateDriver.cpp b/toolkit/xre/nsUpdateDriver.cpp index aac856d6ec..be11fb158a 100644 --- a/toolkit/xre/nsUpdateDriver.cpp +++ b/toolkit/xre/nsUpdateDriver.cpp @@ -75,21 +75,26 @@ GetUpdateLog() #endif static nsresult -GetCurrentWorkingDir(char *buf, size_t size) +GetCurrentWorkingDir(nsACString& aOutPath) { // Cannot use NS_GetSpecialDirectory because XPCOM is not yet initialized. - // This code is duplicated from xpcom/io/SpecialSystemDirectory.cpp: - + + // Just in case junk has been passed in. + aOutPath.Truncate(); + #if defined(XP_WIN) wchar_t wpath[MAX_PATH]; - if (!_wgetcwd(wpath, size)) + if (!_wgetcwd(wpath, ArrayLength(wpath))) return NS_ERROR_FAILURE; - NS_ConvertUTF16toUTF8 path(wpath); - strncpy(buf, path.get(), size); + CopyUTF16toUTF8(nsDependentString(wpath), aOutPath); #else - if(!getcwd(buf, size)) + char path[MAXPATHLEN]; + if (!getcwd(path, ArrayLength(path))) { return NS_ERROR_FAILURE; + } + aOutPath = path; #endif + return NS_OK; } @@ -535,8 +540,8 @@ SwitchToUpdatedApp(nsIFile *greDir, nsIFile *updateDir, return; // Get the current working directory. - char workingDirPath[MAXPATHLEN]; - rv = GetCurrentWorkingDir(workingDirPath, sizeof(workingDirPath)); + nsAutoCString workingDirPath; + rv = GetCurrentWorkingDir(workingDirPath); if (NS_FAILED(rv)) return; @@ -565,7 +570,7 @@ SwitchToUpdatedApp(nsIFile *greDir, nsIFile *updateDir, argv[3] = (char*) applyToDir.get(); argv[4] = (char*) pid.get(); if (appArgc) { - argv[5] = workingDirPath; + argv[5] = (char*) workingDirPath.get(); argv[6] = (char*) appFilePath.get(); for (int i = 1; i < appArgc; ++i) argv[6 + i] = appArgv[i]; @@ -743,8 +748,8 @@ ApplyUpdate(nsIFile *greDir, nsIFile *updateDir, nsIFile *statusFile, } // Get the current working directory. - char workingDirPath[MAXPATHLEN]; - rv = GetCurrentWorkingDir(workingDirPath, sizeof(workingDirPath)); + nsAutoCString workingDirPath; + rv = GetCurrentWorkingDir(workingDirPath); if (NS_FAILED(rv)) return; @@ -786,7 +791,7 @@ ApplyUpdate(nsIFile *greDir, nsIFile *updateDir, nsIFile *statusFile, argv[3] = (char*) applyToDir.get(); argv[4] = (char*) pid.get(); if (restart && appArgc) { - argv[5] = workingDirPath; + argv[5] = (char*) workingDirPath.get(); argv[6] = (char*) appFilePath.get(); for (int i = 1; i < appArgc; ++i) argv[6 + i] = appArgv[i]; From df83678e80ae90d032b7add60dbd7aa0788f2771 Mon Sep 17 00:00:00 2001 From: Byron Campen Date: Thu, 24 Oct 2019 10:28:26 +0200 Subject: [PATCH 11/15] Prevent nr_ice_component_insert_pair from leaking. --- media/mtransport/third_party/nICEr/src/ice/ice_component.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/media/mtransport/third_party/nICEr/src/ice/ice_component.c b/media/mtransport/third_party/nICEr/src/ice/ice_component.c index 2be25efca3..11b4fcbc11 100644 --- a/media/mtransport/third_party/nICEr/src/ice/ice_component.c +++ b/media/mtransport/third_party/nICEr/src/ice/ice_component.c @@ -909,7 +909,6 @@ static int nr_ice_component_process_incoming_check(nr_ice_component *comp, nr_tr nr_ice_candidate_pair_set_state(pair->pctx,pair,NR_ICE_PAIR_STATE_FROZEN); if(r=nr_ice_component_insert_pair(comp,pair)) { *error=(r==R_NO_MEMORY)?500:400; - nr_ice_candidate_pair_destroy(&pair); ABORT(r); } @@ -1615,6 +1614,7 @@ int nr_ice_component_finalize(nr_ice_component *lcomp, nr_ice_component *rcomp) int nr_ice_component_insert_pair(nr_ice_component *pcomp, nr_ice_cand_pair *pair) { int r,_status; + int pair_inserted=0; /* Pairs for peer reflexive are marked SUCCEEDED immediately */ if (pair->state != NR_ICE_PAIR_STATE_FROZEN && @@ -1626,6 +1626,8 @@ int nr_ice_component_insert_pair(nr_ice_component *pcomp, nr_ice_cand_pair *pair if(r=nr_ice_candidate_pair_insert(&pair->remote->stream->check_list,pair)) ABORT(r); + pair_inserted=1; + /* Make sure the check timer is running, if the stream was previously * started. We will not start streams just because a pair was created, * unless it is the first pair to be created across all streams. */ @@ -1642,6 +1644,9 @@ int nr_ice_component_insert_pair(nr_ice_component *pcomp, nr_ice_cand_pair *pair _status=0; abort: + if (_status && !pair_inserted) { + nr_ice_candidate_pair_destroy(&pair); + } return(_status); } From 0e80c15692825754af7ae77df4f5f3508a77885a Mon Sep 17 00:00:00 2001 From: Henri Sivonen Date: Thu, 24 Oct 2019 11:43:25 +0200 Subject: [PATCH 12/15] Adjust tokenization of U+0000 --- parser/html/nsHtml5Tokenizer.cpp | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/parser/html/nsHtml5Tokenizer.cpp b/parser/html/nsHtml5Tokenizer.cpp index 4c815b0c0f..5464d211d7 100644 --- a/parser/html/nsHtml5Tokenizer.cpp +++ b/parser/html/nsHtml5Tokenizer.cpp @@ -1054,9 +1054,6 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu } c = checkChar(buf, pos); switch(c) { - case '\0': { - NS_HTML5_BREAK(stateloop); - } case '-': { clearStrBufAfterOneHyphen(); state = P::transition(mViewSource, NS_HTML5TOKENIZER_COMMENT_START, reconsume, pos); @@ -1461,9 +1458,6 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu NS_HTML5_BREAK(stateloop); } c = checkChar(buf, pos); - if (c == '\0') { - NS_HTML5_BREAK(stateloop); - } switch(c) { case ' ': case '\t': @@ -1471,7 +1465,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu case '\r': case '\f': case '<': - case '&': { + case '&': + case '\0': { emitOrAppendCharRefBuf(returnState); if (!(returnState & NS_HTML5TOKENIZER_DATA_AND_RCDATA_MASK)) { cstart = pos; @@ -1519,9 +1514,6 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu NS_HTML5_BREAK(stateloop); } c = checkChar(buf, pos); - if (c == '\0') { - NS_HTML5_BREAK(stateloop); - } int32_t hilo = 0; if (c <= 'z') { const int32_t* row = nsHtml5NamedCharactersAccel::HILO_ACCEL[c]; @@ -1556,9 +1548,6 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu NS_HTML5_BREAK(stateloop); } c = checkChar(buf, pos); - if (c == '\0') { - NS_HTML5_BREAK(stateloop); - } entCol++; for (; ; ) { if (hi < lo) { From 8896e73c1ac7c848ac16cb74d8b25296c9686582 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Thu, 24 Oct 2019 12:13:26 +0200 Subject: [PATCH 13/15] Fix type barrier in IonBuilder::jsop_getimport. --- js/src/jit/IonBuilder.cpp | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index 05b8f5d9d9..a9bf3519e2 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -8893,10 +8893,8 @@ IonBuilder::jsop_getimport(PropertyName* name) if (!emitted) { // This can happen if we don't have type information. - TypeSet::ObjectKey* staticKey = TypeSet::ObjectKey::get(targetEnv); TemporaryTypeSet* types = bytecodeTypes(pc); - BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), staticKey, - name, types, /* updateObserved = */ true); + BarrierKind barrier = BarrierKind::TypeSet; if (!loadStaticSlot(targetEnv, barrier, types, shape->slot())) return false; From 0771bbb58c0a802abfcd81edf37f3a2406cc59cd Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Thu, 24 Oct 2019 12:17:39 +0200 Subject: [PATCH 14/15] Add size checks to WebGLContext::BufferData() On MacOS, particularly large allocations within the platform limits (1.2G+) will fail and crash. This adds a specific size check for that when working around driver bugs (default). While there, added a generic size_t limited size check for the platform, and reporting OOM if too large. --- dom/canvas/WebGLContextBuffers.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/dom/canvas/WebGLContextBuffers.cpp b/dom/canvas/WebGLContextBuffers.cpp index af506c01c1..f53f9d7d75 100644 --- a/dom/canvas/WebGLContextBuffers.cpp +++ b/dom/canvas/WebGLContextBuffers.cpp @@ -9,6 +9,8 @@ #include "WebGLBuffer.h" #include "WebGLVertexArray.h" +#include "mozilla/CheckedInt.h" + namespace mozilla { WebGLRefPtr* @@ -345,6 +347,16 @@ WebGLContext::BufferData(GLenum target, WebGLsizeiptr size, GLenum usage) //// + const auto checkedSize = CheckedInt(size); + if (!checkedSize.isValid()) + return ErrorOutOfMemory("%s: Size too large for platform.", funcName); + +#if defined(XP_MACOSX) + if (gl->WorkAroundDriverBugs() && size > 1200000000) { + return ErrorOutOfMemory("Allocations larger than 1200000000 fail on MacOS."); + } +#endif + const UniqueBuffer zeroBuffer(calloc(size, 1)); if (!zeroBuffer) return ErrorOutOfMemory("%s: Failed to allocate zeros.", funcName); From abbe1d4499cf24f7f37bb8eb750a5cf3241f0588 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Thu, 24 Oct 2019 17:58:40 +0200 Subject: [PATCH 15/15] Force clobber. --- CLOBBER | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CLOBBER b/CLOBBER index ec72534081..e678820969 100644 --- a/CLOBBER +++ b/CLOBBER @@ -22,4 +22,4 @@ # changes to stick? As of bug 928195, this shouldn't be necessary! Please # don't change CLOBBER for WebIDL changes any more. -Clobber for SpiderMonkey Update +Clobber for NSS Update