Youtube's usage patterns have changed regarding video embeds, so we can
remove special handling for the enablejsapi flag.
Applies YouTube embed URL replacement to the path component only.
Per spec, extend escaping of attribute value characters to include
`<` and `>`. We already did this for text fragments, and it makes sense
to apply the same to attribute values. We are at parity with mainstream
that default-escape attribute values this way in current releases.
This changes Rotate{Self}(angle, translateX, translateY) to
Rotate{Self}(rotateX, rotateY, rotateZ) per the spec.
The resulting matrix will be a 3DMatrix
Resolves#2752
This interface inly has a single implementation behind it, which is also
only used in 2 places after the previous commit. That's a lot of
additional complexity and compiler indirection for no good reason.
This change removes the interface and uses direct nsDocShell::Cast calls
instead of going through the interface in the few places left now that
we no longer build on a presentation context for links.
This removes the requirement for there to be a non-null PresShell to
dispatch `Click()` events on `<A>` elements (only), since the exception
to the rule has propagated to the spec.
With these changes it should now be possible do create an anchor and
`Click()` on it from JS without actually first attaching it to the DOM
of the presented document, as abused by scripted downloads in pages
(instead of using the A attribute to custom-name downloads).
Use subject principal as triggering principal in <img> "src" attribute.
Also get rid of the `BeforeMaybeChangeAttr`/`AfterMaybeChangeAttr` dance:
It makes more logical sense for these effects to happen _after_ the
attribute has actually been changed.
In order to tailor certain security checks to the caller that is
attempting to load a particular piece of content, we need to be able to
attach an appropriate triggering principal to the corresponding requests.
Since most HTML content is loaded based on attribute values, this means
capturing the subject principal of the caller who sets those attributes,
which in turn means we need to make it available to `AfterSetAttr` hooks
on all relevant element types.
We're currently fairly vague and inconsistent about the values we provide to
content policy implementations for requestOrigin and requestPrincipal. In some
cases they're the triggering principal, sometimes the loading principal,
sometimes the channel principal.
Our existing content policy implementations which require or expect a
loading principal currently retrieve it from the context node.
Since no current callers require the principal to be the loading
principal, and some already expect it to be the triggering principal
(which there's currently no other way to retrieve), a choice was made
to pass the triggering principal whenever possible, but use the loading
principal to determine the origin URL.
Instead, require users to do so. This is a minor translation-unit size
improvement for anyone who never has to use SourceBufferHolder other than
by reference.
Curiously, we should have had this at our fork point (as it was backported
by Mozilla to 52.5.2) by apparently Tobin's import wasn't actually 52.6.0.
:-/
This is relevant if scripting is terminated due to execution timeout but there are setTimeout/Interval callbacks pending
or if scripting is disabled altogether.
QIing to CC interfaces is a hot path for a few widely-used classes.
Presumably there are many of these objects being created and destroyed.
By making these classes check first for the CC interfaces directly, rather
than going up the inheritance chain, the resulting overhead is reduced.
All DOMProxyHandler::ClearExternalRefsForWrapperRelease now does is clear
a backpointer to the expando, and that's handled during reflector
finalization already, making it redundant.
This removes a lot of the plumbing for having the platform embed itself
through IPC which was required for B2G running the browser as both
shell and browser application.
We already had part of the plumbing for other canvas manipulations, so
this is somewhat simplified.
This excludes the interface as that is breaking the build at this stage.
Some more research is required.
This patch adds an enumerable, configurable, readonly attribute "webdriver" to
the Navigator object. The attribute is always false because we do not support
WebDriver or scripted automation.
The navigator.webdriver attribute is meant as an indication to web authors that
a document is visited by WebDriver. It is important to stress that it is not
meant as a way to detect that a website is being visited by a browser automation
tool or bot, but as a tool for web documents to take alternate code paths.
On the off-chance exposing navigator.webdriver turns out to be catastrophic,
we put it behind a new preference dom.webdriver.enabled that controls its
exposure.
This implementation is different than Mozilla, not indirectly queueing cancel
tasks to be arbitrarily ordered, but rather synchronously close in reverse
top layer order.
