We already blocked x-moz-file(-promise) and x-moz-place* but of course people
would find ways to abuse other internal types. This change now blocks everything
except x-moz-url types which are harmless. (i.e. whitelist instead of blacklist)
In UXP Moonchild changed the implications for this security bug so it actually didn't do what Mozilla intended in an attempt to preserve functionality internally. He failed on both counts. This fix denies web access to any moz-icon but allows it to still work on other protocols like file: and about: etc.
We may want to re-visit the second part of our commit sha 6fa154c0adc64bd43775a79b7b508d87a486882b
Regardless, it seems to now perform as it was intended while not breaking stuff internally.
Some encoders will set ctts flags incorrectly (similar to version) resulting in
libstagefright aborting playback of media based on the media header.
(Looking at you, Twitter)
This change relaxes libstagefright's checking to pass ctts flags 0 or 1 and
falls through to actually trying to decoding the file.
This uses a different approach by modifying the `Boolish` function directly to act differently if we're checking for nullish values.
Partially based on:
Bug 1566141 - Implement the Nullish Coalescing operator (??) proposal
Bug 1599163 - Nullish coalescing operator returns undefined for void expressions
Partially based on:
Bug 1566141 - Implement the Nullish Coalescing operator (??) proposal
Bug 1593415 - Assertion failure: false, at js/src/builtin/ReflectParse.cpp:3092 with nullish coalescing
As part of telemetry removal, d60103257eb83db103f9acab54b1755486b7e9c1 removed the `reportResult` function which also handles the stopping of the sanity test. This also removes unused histogram enumeration values and revises/adds some comments.
Some hoops to make sure the test still works if the default value for the pref
is false, requiring setting and resetting it and making sure the observers have
time to react to these changes before testing.
Even if `<datalist>` is dynamically changed, the autocomplete controller still
uses the previous search result. If changed, we have to ignore the previous
result that may now be invalid.
Also, even if `<datalist>` is changed, we have to keep the selected index
(See Mozilla Bug 595069), so we cannot use `ResetInternalState` in this
situation because it resets the selected index.
This resolves#1509.
This makes FetchStart use StartTime() when the TAO check fails for
PerformanceResourceTiming
Given the recent Fetch spec updates, Step 8.1 in
https://fetch.spec.whatwg.org/#finalize-and-report-timing specifies that start
time(StartTime) and post-redirect start time(FetchStart) should be start time
when the TAO check fails.
This works by stripping the optional chaining characters from the completion part variable, allowing the developer tools' parser to proceed as if it were a regular, non-optional expression.
Tests were partially based on: https://bugzilla.mozilla.org/show_bug.cgi?id=1594009
Tests for features that do not apply to our version of developer tools (e.g. autocomplete for integer literals, ignoring spaces between property accessors, etc) were excluded.
IIUC, we want to process the GOTO in the case of optional chains, and we do not satisfy the requirements mentioned in the comment of snoopControlFlow's caller. Optional chains are not loops, we (probably) don't have a loop in the instruction following the GOTO, and in the GOTO destination, we're either returning an undefined/null value or the actual value.
