Version bump for release.

This re-applies the patch for this with added typename declaration.

application/palemoon/branding/shared/pref/uaoverrides.inc

@@ -76,7 +76,7 @@ pref("@GUAO_PREF@.netflix.com","Mozilla/5.0 (@OS_SLICE@ rv:45.9) @GK_SLICE@ Fire
 pref("@GUAO_PREF@.netflximg.net","Mozilla/5.0 (@OS_SLICE@ rv:45.9) @GK_SLICE@ Firefox/45.9");
 
 // UA-sniffing domains that are "app/vendor-specific" and do not like Pale Moon
-pref("@GUAO_PREF@.web.whatsapp.com","Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36");
+pref("@GUAO_PREF@.web.whatsapp.com","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36");
 
 // The following domains do not like the Goanna slice
 pref("@GUAO_PREF@.hitbox.tv","Mozilla/5.0 (@OS_SLICE@ rv:@GK_VERSION@) @GK_SLICE@ @FX_SLICE@");

application/palemoon/config/version.txt

@@ -1 +1 @@
-28.6.0a1
+28.6.1

dom/base/nsGlobalWindow.cpp

@@ -2504,8 +2504,7 @@ nsGlobalWindow::WouldReuseInnerWindow(nsIDocument* aNewDocument)
   }
 
   bool equal;
-  if (NS_SUCCEEDED(mDoc->NodePrincipal()->Equals(aNewDocument->NodePrincipal(),
-                                                 &equal)) &&
+  if (NS_SUCCEEDED(mDoc->NodePrincipal()->EqualsConsideringDomain(aNewDocument->NodePrincipal(), &equal)) &&
       equal) {
     // The origin is the same.
     return true;
@@ -9335,7 +9334,7 @@ nsGlobalWindow::EnterModalState()
 
     topWin->mSuspendedDoc = topDoc;
     if (topDoc) {
-      topDoc->SuppressEventHandling(nsIDocument::eEvents);
+      topDoc->SuppressEventHandling(nsIDocument::eAnimationsOnly);
     }
 
     nsGlobalWindow* inner = topWin->GetCurrentInnerWindowInternal();
@@ -9372,7 +9371,7 @@ nsGlobalWindow::LeaveModalState()
 
     if (topWin->mSuspendedDoc) {
       nsCOMPtr<nsIDocument> currentDoc = topWin->GetExtantDoc();
-      topWin->mSuspendedDoc->UnsuppressEventHandlingAndFireEvents(nsIDocument::eEvents,
+      topWin->mSuspendedDoc->UnsuppressEventHandlingAndFireEvents(nsIDocument::eAnimationsOnly,
                                                                   currentDoc == topWin->mSuspendedDoc);
       topWin->mSuspendedDoc = nullptr;
     }

dom/canvas/WebGLBuffer.cpp

@@ -134,6 +134,7 @@ WebGLBuffer::BufferData(GLenum target, size_t size, const void* data, GLenum usa
         if (error) {
             MOZ_ASSERT(error == LOCAL_GL_OUT_OF_MEMORY);
             mContext->ErrorOutOfMemory("%s: Error from driver: 0x%04x", funcName, error);
+            mByteLength = 0;
             return;
         }
     } else {

dom/canvas/WebGLContext.h

@@ -20,6 +20,7 @@
 #include "mozilla/gfx/2D.h"
 #include "mozilla/LinkedList.h"
 #include "mozilla/UniquePtr.h"
+#include "mozilla/WeakPtr.h"
 #include "nsCycleCollectionNoteChild.h"
 #include "nsICanvasRenderingContextInternal.h"
 #include "nsLayoutUtils.h"
@@ -299,6 +300,7 @@ class WebGLContext
     , public WebGLContextUnchecked
     , public WebGLRectangleObject
     , public nsWrapperCache
+    , public SupportsWeakPtr<WebGLContext>
 {
     friend class ScopedDrawHelper;
     friend class ScopedDrawWithTransformFeedback;
@@ -342,6 +344,7 @@ public:
 
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(WebGLContext,
                                                            nsIDOMWebGLRenderingContext)
+    MOZ_DECLARE_WEAKREFERENCE_TYPENAME(WebGLContext)
 
     virtual JSObject* WrapObject(JSContext* cx, JS::Handle<JSObject*> givenProto) override = 0;
 

dom/canvas/WebGLExtensionDebugShaders.cpp

@@ -29,15 +29,10 @@ WebGLExtensionDebugShaders::GetTranslatedShaderSource(const WebGLShader& shader,
 {
     retval.SetIsVoid(true);
 
-    if (mIsLost) {
-        mContext->ErrorInvalidOperation("%s: Extension is lost.",
-                                        "getTranslatedShaderSource");
+    if (mIsLost || !mContext) {
         return;
     }
 
-    if (mContext->IsContextLost())
-        return;
-
     if (!mContext->ValidateObject("getShaderTranslatedSource: shader", shader))
         return;
 

dom/canvas/WebGLExtensionDisjointTimerQuery.cpp

@@ -40,8 +40,10 @@ void
 WebGLExtensionDisjointTimerQuery::DeleteQueryEXT(WebGLQuery* query) const
 {
     const char funcName[] = "deleteQueryEXT";
-    if (mIsLost)
-        return;
+
+    if (mIsLost || !mContext) {
+      return;
+    }
 
     mContext->DeleteQuery(query, funcName);
 }
@@ -50,8 +52,10 @@ bool
 WebGLExtensionDisjointTimerQuery::IsQueryEXT(const WebGLQuery* query) const
 {
     const char funcName[] = "isQueryEXT";
-    if (mIsLost)
-        return false;
+
+    if (mIsLost || !mContext) {
+      return false;
+    }
 
     return mContext->IsQuery(query, funcName);
 }
@@ -60,8 +64,10 @@ void
 WebGLExtensionDisjointTimerQuery::BeginQueryEXT(GLenum target, WebGLQuery& query) const
 {
     const char funcName[] = "beginQueryEXT";
-    if (mIsLost)
-        return;
+
+    if (mIsLost || !mContext) {
+      return;
+    }
 
     mContext->BeginQuery(target, query, funcName);
 }
@@ -70,8 +76,10 @@ void
 WebGLExtensionDisjointTimerQuery::EndQueryEXT(GLenum target) const
 {
     const char funcName[] = "endQueryEXT";
-    if (mIsLost)
-        return;
+
+    if (mIsLost || !mContext) {
+      return;
+    }
 
     mContext->EndQuery(target, funcName);
 }
@@ -80,8 +88,10 @@ void
 WebGLExtensionDisjointTimerQuery::QueryCounterEXT(WebGLQuery& query, GLenum target) const
 {
     const char funcName[] = "queryCounterEXT";
-    if (mIsLost)
-        return;
+
+    if (mIsLost || !mContext) {
+      return;
+    }
 
     if (!mContext->ValidateObject(funcName, query))
         return;
@@ -95,8 +105,10 @@ WebGLExtensionDisjointTimerQuery::GetQueryEXT(JSContext* cx, GLenum target, GLen
 {
     const char funcName[] = "getQueryEXT";
     retval.setNull();
-    if (mIsLost)
-        return;
+
+    if (mIsLost || !mContext) {
+      return;
+    }
 
     mContext->GetQuery(cx, target, pname, retval, funcName);
 }
@@ -108,8 +120,10 @@ WebGLExtensionDisjointTimerQuery::GetQueryObjectEXT(JSContext* cx,
 {
     const char funcName[] = "getQueryObjectEXT";
     retval.setNull();
-    if (mIsLost)
-        return;
+
+    if (mIsLost || !mContext) {
+      return;
+    }
 
     mContext->GetQueryParameter(cx, query, pname, retval, funcName);
 }

dom/canvas/WebGLExtensionDrawBuffers.cpp

@@ -36,7 +36,9 @@ void
 WebGLExtensionDrawBuffers::DrawBuffersWEBGL(const dom::Sequence<GLenum>& buffers)
 {
     if (mIsLost) {
-        mContext->ErrorInvalidOperation("drawBuffersWEBGL: Extension is lost.");
+        if (mContext) {
+            mContext->ErrorInvalidOperation("drawBuffersWEBGL: Extension is lost.");
+        }
         return;
     }
 

dom/canvas/WebGLExtensionInstancedArrays.cpp

@@ -28,8 +28,10 @@ WebGLExtensionInstancedArrays::DrawArraysInstancedANGLE(GLenum mode,
                                                         GLsizei primcount)
 {
     if (mIsLost) {
-        mContext->ErrorInvalidOperation("%s: Extension is lost.",
-                                        "drawArraysInstancedANGLE");
+        if (mContext) {
+            mContext->ErrorInvalidOperation("%s: Extension is lost.",
+                                            "drawArraysInstancedANGLE");
+        }
         return;
     }
 
@@ -44,8 +46,10 @@ WebGLExtensionInstancedArrays::DrawElementsInstancedANGLE(GLenum mode,
                                                           GLsizei primcount)
 {
     if (mIsLost) {
-        mContext->ErrorInvalidOperation("%s: Extension is lost.",
-                                        "drawElementsInstancedANGLE");
+        if (mContext) {
+            mContext->ErrorInvalidOperation("%s: Extension is lost.",
+                                            "drawElementsInstancedANGLE");
+        }
         return;
     }
 
@@ -57,8 +61,10 @@ WebGLExtensionInstancedArrays::VertexAttribDivisorANGLE(GLuint index,
                                                         GLuint divisor)
 {
     if (mIsLost) {
-        mContext->ErrorInvalidOperation("%s: Extension is lost.",
-                                        "vertexAttribDivisorANGLE");
+        if (mContext) {
+            mContext->ErrorInvalidOperation("%s: Extension is lost.",
+                                            "vertexAttribDivisorANGLE");
+        }
         return;
     }
 

dom/canvas/WebGLExtensionLoseContext.cpp

@@ -22,12 +22,14 @@ WebGLExtensionLoseContext::~WebGLExtensionLoseContext()
 void
 WebGLExtensionLoseContext::LoseContext()
 {
+    if (!mContext) return;
     mContext->LoseContext();
 }
 
 void
 WebGLExtensionLoseContext::RestoreContext()
 {
+    if (!mContext) return;
     mContext->RestoreContext();
 }
 

dom/canvas/WebGLExtensionVertexArray.cpp

@@ -25,7 +25,7 @@ WebGLExtensionVertexArray::~WebGLExtensionVertexArray()
 already_AddRefed<WebGLVertexArray>
 WebGLExtensionVertexArray::CreateVertexArrayOES()
 {
-    if (mIsLost)
+    if (mIsLost || !mContext)
         return nullptr;
 
     return mContext->CreateVertexArray();
@@ -34,7 +34,7 @@ WebGLExtensionVertexArray::CreateVertexArrayOES()
 void
 WebGLExtensionVertexArray::DeleteVertexArrayOES(WebGLVertexArray* array)
 {
-    if (mIsLost)
+    if (mIsLost || !mContext)
         return;
 
     mContext->DeleteVertexArray(array);
@@ -43,7 +43,7 @@ WebGLExtensionVertexArray::DeleteVertexArrayOES(WebGLVertexArray* array)
 bool
 WebGLExtensionVertexArray::IsVertexArrayOES(const WebGLVertexArray* array)
 {
-    if (mIsLost)
+    if (mIsLost || !mContext)
         return false;
 
     return mContext->IsVertexArray(array);
@@ -52,7 +52,7 @@ WebGLExtensionVertexArray::IsVertexArrayOES(const WebGLVertexArray* array)
 void
 WebGLExtensionVertexArray::BindVertexArrayOES(WebGLVertexArray* array)
 {
-    if (mIsLost)
+    if (mIsLost || !mContext)
         return;
 
     mContext->BindVertexArray(array);

dom/canvas/WebGLObjectModel.h

@@ -6,8 +6,8 @@
 #ifndef WEBGLOBJECTMODEL_H_
 #define WEBGLOBJECTMODEL_H_
 
+#include "mozilla/WeakPtr.h"
 #include "nsCycleCollectionNoteChild.h"
-
 #include "WebGLTypes.h"
 
 namespace mozilla {
@@ -24,7 +24,7 @@ class WebGLContext;
 class WebGLContextBoundObject
 {
 public:
-    WebGLContext* const mContext;
+    const WeakPtr<WebGLContext> mContext;
 private:
     const uint32_t mContextGeneration;
 

dom/canvas/WebGLRenderbuffer.cpp

@@ -215,6 +215,16 @@ WebGLRenderbuffer::RenderbufferStorage(const char* funcName, uint32_t samples,
     if (error) {
         const char* errorName = mContext->ErrorName(error);
         mContext->GenerateWarning("%s generated error %s", funcName, errorName);
+        if (error == LOCAL_GL_OUT_OF_MEMORY) {
+          // Truncate.
+          mSamples = 0;
+          mFormat = nullptr;
+          mWidth = 0;
+          mHeight = 0;
+          mImageDataStatus = WebGLImageDataStatus::NoImageData;
+
+          InvalidateStatusOfAttachedFBs();
+        }
         return;
     }
 

dom/canvas/WebGLTexture.cpp

@@ -51,8 +51,6 @@ WebGLTexture::ImageInfo::Clear()
 WebGLTexture::ImageInfo&
 WebGLTexture::ImageInfo::operator =(const ImageInfo& a)
 {
-    MOZ_ASSERT(a.IsDefined());
-
     Mutable(mFormat) = a.mFormat;
     Mutable(mWidth) = a.mWidth;
     Mutable(mHeight) = a.mHeight;
@@ -1216,6 +1214,12 @@ WebGLTexture::TexParameter(TexTarget texTarget, GLenum pname, const FloatOrInt&
         mContext->gl->fTexParameterf(texTarget.get(), pname, clamped.f);
 }
 
+void WebGLTexture::Truncate() {
+  for (auto& cur : mImageInfoArr) {
+    SetImageInfo(&cur, ImageInfo());
+  }
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_0(WebGLTexture)

dom/canvas/WebGLTexture.h

@@ -386,6 +386,7 @@ public:
                     bool* const out_initFailed);
 
     bool IsMipmapCubeComplete() const;
+    void Truncate();
 
     bool IsCubeMap() const { return (mTarget == LOCAL_GL_TEXTURE_CUBE_MAP); }
 

dom/canvas/WebGLTextureUpload.cpp

@@ -1178,6 +1178,7 @@ WebGLTexture::TexStorage(const char* funcName, TexTarget target, GLsizei levels,
     if (error == LOCAL_GL_OUT_OF_MEMORY) {
         mContext->ErrorOutOfMemory("%s: Ran out of memory during texture allocation.",
                                    funcName);
+        Truncate();
         return;
     }
     if (error) {
@@ -1310,6 +1311,7 @@ WebGLTexture::TexImage(const char* funcName, TexImageTarget target, GLint level,
     if (glError == LOCAL_GL_OUT_OF_MEMORY) {
         mContext->ErrorOutOfMemory("%s: Driver ran out of memory during upload.",
                                    funcName);
+        Truncate();
         return;
     }
 
@@ -1398,6 +1400,7 @@ WebGLTexture::TexSubImage(const char* funcName, TexImageTarget target, GLint lev
     if (glError == LOCAL_GL_OUT_OF_MEMORY) {
         mContext->ErrorOutOfMemory("%s: Driver ran out of memory during upload.",
                                    funcName);
+        Truncate();
         return;
     }
 
@@ -1514,6 +1517,7 @@ WebGLTexture::CompressedTexImage(const char* funcName, TexImageTarget target, GL
                                         blob->mAvailBytes, blob->mPtr);
     if (error == LOCAL_GL_OUT_OF_MEMORY) {
         mContext->ErrorOutOfMemory("%s: Ran out of memory during upload.", funcName);
+        Truncate();
         return;
     }
     if (error) {
@@ -1664,6 +1668,7 @@ WebGLTexture::CompressedTexSubImage(const char* funcName, TexImageTarget target,
                                            blob->mAvailBytes, blob->mPtr);
     if (error == LOCAL_GL_OUT_OF_MEMORY) {
         mContext->ErrorOutOfMemory("%s: Ran out of memory during upload.", funcName);
+        Truncate();
         return;
     }
     if (error) {
@@ -1992,7 +1997,7 @@ WebGLTexture::ValidateCopyTexImageForFeedback(const char* funcName, uint32_t lev
 
 static bool
 DoCopyTexOrSubImage(WebGLContext* webgl, const char* funcName, bool isSubImage,
-                    const WebGLTexture* tex, TexImageTarget target, GLint level,
+                    WebGLTexture* tex, TexImageTarget target, GLint level,
                     GLint xWithinSrc, GLint yWithinSrc,
                     uint32_t srcTotalWidth, uint32_t srcTotalHeight,
                     const webgl::FormatUsageInfo* srcUsage,
@@ -2069,6 +2074,7 @@ DoCopyTexOrSubImage(WebGLContext* webgl, const char* funcName, bool isSubImage,
 
     if (error == LOCAL_GL_OUT_OF_MEMORY) {
         webgl->ErrorOutOfMemory("%s: Ran out of memory during texture copy.", funcName);
+        tex->Truncate();
         return false;
     }
 

dom/indexedDB/ActorsChild.cpp

@@ -2385,9 +2385,14 @@ BackgroundVersionChangeTransactionChild::RecvComplete(const nsresult& aResult)
     database->Close();
   }
 
+  RefPtr<IDBOpenDBRequest> request = mOpenDBRequest;
+  MOZ_ASSERT(request);
+
   mTransaction->FireCompleteOrAbortEvents(aResult);
 
-  mOpenDBRequest->SetTransaction(nullptr);
+  request->SetTransaction(nullptr);
+  request = nullptr;
+
   mOpenDBRequest = nullptr;
 
   NoteComplete();

dom/media/MediaResource.cpp

@@ -1525,7 +1525,7 @@ void BaseMediaResource::SetLoadInBackground(bool aLoadInBackground) {
     NS_WARNING("Null owner in MediaResource::SetLoadInBackground()");
     return;
   }
-  dom::HTMLMediaElement* element = owner->GetMediaElement();
+  RefPtr<dom::HTMLMediaElement> element = owner->GetMediaElement();
   if (!element) {
     NS_WARNING("Null element in MediaResource::SetLoadInBackground()");
     return;

dom/network/UDPSocketChild.cpp

@@ -172,19 +172,28 @@ UDPSocketChild::Bind(nsIUDPSocketInternal* aSocket,
 
   NS_ENSURE_ARG(aSocket);
 
-  mSocket = aSocket;
-  AddIPDLReference();
+  if (NS_IsMainThread()) {
+    if (!gNeckoChild->SendPUDPSocketConstructor(
+            this, IPC::Principal(aPrincipal), mFilterName)) {
+      return NS_ERROR_FAILURE;
+    }
+  } else {
+    if (!mBackgroundManager) {
+      return NS_ERROR_NOT_AVAILABLE;
+    }
 
-  if (mBackgroundManager) {
     // If we want to support a passed-in principal here we'd need to
     // convert it to a PrincipalInfo
     MOZ_ASSERT(!aPrincipal);
-    mBackgroundManager->SendPUDPSocketConstructor(this, void_t(), mFilterName);
-  } else {
-    gNeckoChild->SendPUDPSocketConstructor(this, IPC::Principal(aPrincipal),
-                                           mFilterName);
+    if (!mBackgroundManager->SendPUDPSocketConstructor(
+            this, void_t(), mFilterName)) {
+      return NS_ERROR_FAILURE;
+    }
   }
 
+  mSocket = aSocket;
+  AddIPDLReference();
+
   SendBind(UDPAddressInfo(nsCString(aHost), aPort), aAddressReuse, aLoopback,
            recvBufferSize, sendBufferSize);
   return NS_OK;

dom/plugins/base/nsPluginStreamListenerPeer.cpp

@@ -1381,7 +1381,7 @@ nsPluginStreamListenerPeer::AsyncOnChannelRedirect(nsIChannel *oldChannel, nsICh
     return NS_ERROR_FAILURE;
   }
 
-  // Don't allow cross-origin 307 POST redirects.
+  // Don't allow cross-origin 307/308 POST redirects.
   nsCOMPtr<nsIHttpChannel> oldHttpChannel(do_QueryInterface(oldChannel));
   if (oldHttpChannel) {
     uint32_t responseStatus;
@@ -1389,7 +1389,7 @@ nsPluginStreamListenerPeer::AsyncOnChannelRedirect(nsIChannel *oldChannel, nsICh
     if (NS_FAILED(rv)) {
       return rv;
     }
-    if (responseStatus == 307) {
+    if (responseStatus == 307 || responseStatus == 308) {
       nsAutoCString method;
       rv = oldHttpChannel->GetRequestMethod(method);
       if (NS_FAILED(rv)) {

dom/security/nsContentSecurityManager.cpp

@@ -95,9 +95,14 @@ nsContentSecurityManager::AllowTopLevelNavigationToDataURI(nsIChannel* aChannel)
 /* static */ nsresult
 nsContentSecurityManager::CheckFTPSubresourceLoad(nsIChannel* aChannel)
 {
-  // We dissallow using FTP resources as a subresource everywhere.
+  // We dissallow using FTP resources as a subresource almost everywhere.
   // The only valid way to use FTP resources is loading it as
   // a top level document.
+  
+  // Override blocking if the pref is set to allow.
+  if (!mozilla::net::nsIOService::BlockFTPSubresources()) {
+    return NS_OK;
+  }
 
   nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
   if (!loadInfo) {
@@ -105,6 +110,13 @@ nsContentSecurityManager::CheckFTPSubresourceLoad(nsIChannel* aChannel)
   }
 
   nsContentPolicyType type = loadInfo->GetExternalContentPolicyType();
+
+  // Allow save-as download of FTP files on HTTP pages.
+  if (type == nsIContentPolicy::TYPE_SAVEAS_DOWNLOAD) {
+    return NS_OK;
+  }
+
+  // Allow direct document requests
   if (type == nsIContentPolicy::TYPE_DOCUMENT) {
     return NS_OK;
   }
@@ -116,11 +128,22 @@ nsContentSecurityManager::CheckFTPSubresourceLoad(nsIChannel* aChannel)
     return NS_OK;
   }
 
+  // Allow if it's not the FTP protocol
   bool isFtpURI = (NS_SUCCEEDED(uri->SchemeIs("ftp", &isFtpURI)) && isFtpURI);
   if (!isFtpURI) {
     return NS_OK;
   }
 
+  // Allow loading FTP subresources in top-level FTP documents.
+  nsIPrincipal* triggeringPrincipal = loadInfo->TriggeringPrincipal();
+  nsCOMPtr<nsIURI> tURI;
+  triggeringPrincipal->GetURI(getter_AddRefs(tURI));
+  bool isTrigFtpURI = (NS_SUCCEEDED(tURI->SchemeIs("ftp", &isTrigFtpURI)) && isTrigFtpURI);
+  if (isTrigFtpURI) {
+    return NS_OK;
+  }
+
+  // If we get here, the request is blocked and should be reported.
   nsCOMPtr<nsIDocument> doc;
   if (nsINode* node = loadInfo->LoadingNode()) {
     doc = node->OwnerDoc();

js/src/jit/arm64/Architecture-arm64.h

@@ -299,10 +299,12 @@ static const uint32_t ION_FRAME_SLACK_SIZE = 24;
 
 static const uint32_t ShadowStackSpace = 0;
 
-// TODO:
-// This constant needs to be updated to account for whatever near/far branching
-// strategy is used by ARM64.
-static const uint32_t JumpImmediateRange = UINT32_MAX;
+// When our only strategy for far jumps is to encode the offset directly, and
+// not insert any jump islands during assembly for even further jumps, then the
+// architecture restricts us to -2^27 .. 2^27-4, to fit into a signed 28-bit
+// value.  We further reduce this range to allow the far-jump inserting code to
+// have some breathing room.
+static const uint32_t JumpImmediateRange = ((1 << 27) - (20 * 1024 * 1024));
 
 static const uint32_t ABIStackAlignment = 16;
 static const uint32_t CodeAlignment = 16;

js/src/jsarray.cpp

@@ -1048,7 +1048,7 @@ struct StringSeparatorOp
 
 template <typename SeparatorOp>
 static bool
-ArrayJoinDenseKernel(JSContext* cx, SeparatorOp sepOp, HandleNativeObject obj, uint64_t length,
+ArrayJoinDenseKernel(JSContext* cx, SeparatorOp sepOp, HandleNativeObject obj, uint32_t length,
                      StringBuffer& sb, uint32_t* numProcessed)
 {
     // This loop handles all elements up to initializedLength. If

layout/base/nsPresShell.cpp

@@ -8192,9 +8192,6 @@ PresShell::HandleEventInternal(WidgetEvent* aEvent,
           }
         }
       }
-      if (aEvent->mMessage == eKeyDown) {
-        mIsLastKeyDownCanceled = aEvent->mFlags.mDefaultPrevented;
-      }
       break;
     }
     case eMouseUp:
@@ -8984,9 +8981,6 @@ PresShell::FireOrClearDelayedEvents(bool aFireEvents)
            !doc->EventHandlingSuppressed()) {
       nsAutoPtr<DelayedEvent> ev(mDelayedEvents[0].forget());
       mDelayedEvents.RemoveElementAt(0);
-      if (ev->IsKeyPressEvent() && mIsLastKeyDownCanceled) {
-        continue;
-      }
       ev->Dispatch();
     }
     if (!doc->EventHandlingSuppressed()) {
@@ -9781,12 +9775,6 @@ PresShell::DelayedKeyEvent::DelayedKeyEvent(WidgetKeyboardEvent* aEvent) :
   mEvent = keyEvent;
 }
 
-bool
-PresShell::DelayedKeyEvent::IsKeyPressEvent()
-{
-  return mEvent->mMessage == eKeyPress;
-}
-
 // Start of DEBUG only code
 
 #ifdef DEBUG

layout/base/nsPresShell.h

@@ -617,7 +617,6 @@ protected:
   public:
     virtual ~DelayedEvent() { }
     virtual void Dispatch() { }
-    virtual bool IsKeyPressEvent() { return false; }
   };
 
   class DelayedInputEvent : public DelayedEvent
@@ -642,7 +641,6 @@ protected:
   {
   public:
     explicit DelayedKeyEvent(mozilla::WidgetKeyboardEvent* aEvent);
-    virtual bool IsKeyPressEvent() override;
   };
 
   // Check if aEvent is a mouse event and record the mouse location for later
@@ -953,8 +951,6 @@ protected:
   // Whether the widget has received a paint message yet.
   bool                      mHasReceivedPaintMessage : 1;
 
-  bool                      mIsLastKeyDownCanceled : 1;
-
   static bool               sDisableNonTestMouseEvents;
 };
 

modules/libpref/init/all.js

@@ -1331,6 +1331,10 @@ pref("image.animation_mode",                "normal");
 // Same-origin policy for file URIs, "false" is traditional
 pref("security.fileuri.strict_origin_policy", true);
 
+// Treat all file URIs as having a unique origin.
+// Only has an effect if strict origin policy is true.
+pref("security.fileuri.unique_origin", true);
+
 // If this pref is true, prefs in the logging.config branch will be cleared on
 // startup. This is done so that setting a log-file and log-modules at runtime
 // doesn't persist across restarts leading to huge logfile and low disk space.
@@ -1988,6 +1992,13 @@ pref("network.generic-ntlm-auth.workstation", "WORKSTATION");
 //   2 - allow the cross-origin authentication as well.
 pref("network.auth.subresource-http-auth-allow", 2);
 
+// Sub-resources HTTP-authentication for cross-origin images:
+// true - presenting the http auth. dialog for cross-origin images is allowed.
+// false - suppress the http auth. dialog for cross-origin images.
+// If network.auth.subresource-http-auth-allow has a value of 0 or 1, this pref
+// does not have any effect.
+pref("network.auth.subresource-http-img-XO-auth", false);
+
 // This preference controls whether to allow sending default credentials (SSO) to
 // NTLM/Negotiate servers allowed in the "trusted uri" list when navigating them
 // in a Private Browsing window.
@@ -5440,6 +5451,9 @@ pref("layout.css.servo.enabled", true);
 // URL-Bar will not be blocked when flipping this pref.
 pref("security.data_uri.block_toplevel_data_uri_navigations", true);
 
+// If true, all FTP subresource loads will be blocked.
+pref("security.block_ftp_subresources", true);
+
 // Disable Storage api in release builds.
 #ifdef NIGHTLY_BUILD
 pref("dom.storageManager.enabled", true);

netwerk/base/nsIOService.cpp

@@ -166,6 +166,7 @@ uint32_t   nsIOService::gDefaultSegmentSize = 4096;
 uint32_t   nsIOService::gDefaultSegmentCount = 24;
 
 bool nsIOService::sBlockToplevelDataUriNavigations = false;
+bool nsIOService::sBlockFTPSubresources = false;
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -243,6 +244,8 @@ nsIOService::Init()
 
     Preferences::AddBoolVarCache(&sBlockToplevelDataUriNavigations,
                                  "security.data_uri.block_toplevel_data_uri_navigations", false);
+    Preferences::AddBoolVarCache(&sBlockFTPSubresources,
+                                 "security.block_ftp_subresources", true);
     Preferences::AddBoolVarCache(&mOfflineMirrorsConnectivity, OFFLINE_MIRRORS_CONNECTIVITY, true);
 
     gIOService = this;
@@ -1869,5 +1872,11 @@ nsIOService::BlockToplevelDataUriNavigations()
   return sBlockToplevelDataUriNavigations;
 }
 
+/*static*/ bool
+nsIOService::BlockFTPSubresources()
+{
+  return sBlockFTPSubresources;
+}
+
 } // namespace net
 } // namespace mozilla

netwerk/base/nsIOService.h

@@ -94,6 +94,8 @@ public:
 
     static bool BlockToplevelDataUriNavigations();
 
+    static bool BlockFTPSubresources();
+
     // Used to trigger a recheck of the captive portal status
     nsresult RecheckCaptivePortal();
 private:
@@ -175,6 +177,8 @@ private:
 
     static bool                          sBlockToplevelDataUriNavigations;
 
+    static bool                          sBlockFTPSubresources;
+
     // Time a network tearing down started.
     mozilla::Atomic<PRIntervalTime> mNetTearingDownStarted;
 public:

netwerk/base/nsNetUtil.cpp

@@ -10,6 +10,7 @@
 #include "mozilla/LoadContext.h"
 #include "mozilla/LoadInfo.h"
 #include "mozilla/BasePrincipal.h"
+#include "mozilla/Preferences.h"
 #include "mozilla/Telemetry.h"
 #include "nsNetUtil.h"
 #include "nsNetUtilInlines.h"
@@ -1821,33 +1822,40 @@ NS_RelaxStrictFileOriginPolicy(nsIURI *aTargetURI,
     return false;
   }
 
-  //
-  // If the file to be loaded is in a subdirectory of the source
-  // (or same-dir if source is not a directory) then it will
-  // inherit its source principal and be scriptable by that source.
-  //
-  bool sourceIsDir;
-  bool allowed = false;
-  nsresult rv = sourceFile->IsDirectory(&sourceIsDir);
-  if (NS_SUCCEEDED(rv) && sourceIsDir) {
-    rv = sourceFile->Contains(targetFile, &allowed);
-  } else {
-    nsCOMPtr<nsIFile> sourceParent;
-    rv = sourceFile->GetParent(getter_AddRefs(sourceParent));
-    if (NS_SUCCEEDED(rv) && sourceParent) {
-      rv = sourceParent->Equals(targetFile, &allowed);
-      if (NS_FAILED(rv) || !allowed) {
-        rv = sourceParent->Contains(targetFile, &allowed);
-      } else {
-        MOZ_ASSERT(aAllowDirectoryTarget,
-                   "sourceFile->Parent == targetFile, but targetFile "
-                   "should've been disallowed if it is a directory");
+  bool uniqueOrigin = true;
+  uniqueOrigin = Preferences::GetBool("security.fileuri.unique_origin");
+  
+  // If treating all files as unique origins, we can skip this because
+  // it should always be refused.
+  if (!uniqueOrigin) {
+    //
+    // If the file to be loaded is in a subdirectory of the source
+    // (or same-dir if source is not a directory) then it will
+    // inherit its source principal and be scriptable by that source.
+    //
+    bool sourceIsDir;
+    bool allowed = false;
+    nsresult rv = sourceFile->IsDirectory(&sourceIsDir);
+    if (NS_SUCCEEDED(rv) && sourceIsDir) {
+      rv = sourceFile->Contains(targetFile, &allowed);
+    } else {
+      nsCOMPtr<nsIFile> sourceParent;
+      rv = sourceFile->GetParent(getter_AddRefs(sourceParent));
+      if (NS_SUCCEEDED(rv) && sourceParent) {
+        rv = sourceParent->Equals(targetFile, &allowed);
+        if (NS_FAILED(rv) || !allowed) {
+          rv = sourceParent->Contains(targetFile, &allowed);
+        } else {
+          MOZ_ASSERT(aAllowDirectoryTarget,
+                     "sourceFile->Parent == targetFile, but targetFile "
+                     "should've been disallowed if it is a directory");
+        }
       }
     }
-  }
 
-  if (NS_SUCCEEDED(rv) && allowed) {
-    return true;
+    if (NS_SUCCEEDED(rv) && allowed) {
+      return true;
+    }
   }
 
   return false;

netwerk/base/nsStandardURL.cpp

@@ -575,7 +575,7 @@ nsStandardURL::ValidIPv6orHostname(const char *host, uint32_t length)
     }
 
     const char *end = host + length;
-    if (end != net_FindCharInSet(host, end, CONTROL_CHARACTERS " #/:?@[\\]*<>|\"")) {
+    if (end != net_FindCharInSet(host, end, CONTROL_CHARACTERS " #/:?@[\\]*<>|\"^")) {
         // We still allow % because it is in the ID of addons.
         // Any percent encoded ASCII characters that are not allowed in the
         // hostname are not percent decoded, and will be parsed just fine.

netwerk/protocol/http/AlternateServices.cpp

@@ -121,6 +121,11 @@ AltSvcMapping::ProcessHeader(const nsCString &buf, const nsCString &originScheme
       continue;
     }
 
+    if (NS_FAILED(NS_CheckPortSafety(portno, originScheme.get()))) {
+      LOG(("Alt Svc does not allow port %d, ignoring request", portno));
+      continue;
+    }
+
     // unescape modifies a c string in place, so afterwards
     // update nsCString length
     nsUnescape(npnToken.BeginWriting());

netwerk/protocol/http/Http2Push.cpp

@@ -30,8 +30,8 @@ class CallChannelOnPush final : public Runnable {
                     Http2PushedStream *pushStream)
     : mAssociatedChannel(associatedChannel)
     , mPushedURI(pushedURI)
-    , mPushedStream(pushStream)
   {
+    mPushedStreamWrapper = new Http2PushedStreamWrapper(pushStream);
   }
 
   NS_IMETHOD Run() override
@@ -40,21 +40,94 @@ class CallChannelOnPush final : public Runnable {
     RefPtr<nsHttpChannel> channel;
     CallQueryInterface(mAssociatedChannel, channel.StartAssignment());
     MOZ_ASSERT(channel);
-    if (channel && NS_SUCCEEDED(channel->OnPush(mPushedURI, mPushedStream))) {
+    if (channel && NS_SUCCEEDED(channel->OnPush(mPushedURI, mPushedStreamWrapper))) {
       return NS_OK;
     }
 
     LOG3(("Http2PushedStream Orphan %p failed OnPush\n", this));
-    mPushedStream->OnPushFailed();
+    mPushedStreamWrapper->OnPushFailed();
     return NS_OK;
   }
 
 private:
   nsCOMPtr<nsIHttpChannelInternal> mAssociatedChannel;
   const nsCString mPushedURI;
-  Http2PushedStream *mPushedStream;
+  RefPtr<Http2PushedStreamWrapper> mPushedStreamWrapper;
 };
 
+// Because WeakPtr isn't thread-safe we must ensure that the object is destroyed
+// on the socket thread, so any Release() called on a different thread is
+// dispatched to the socket thread.
+bool Http2PushedStreamWrapper::DispatchRelease() {
+  if (PR_GetCurrentThread() == gSocketThread) {
+    return false;
+  }
+
+  gSocketTransportService->Dispatch(
+      NewNonOwningRunnableMethod(this, &Http2PushedStreamWrapper::Release),
+      NS_DISPATCH_NORMAL);
+
+  return true;
+}
+
+NS_IMPL_ADDREF(Http2PushedStreamWrapper)
+NS_IMETHODIMP_(MozExternalRefCountType)
+Http2PushedStreamWrapper::Release() {
+  nsrefcnt count = mRefCnt - 1;
+  if (DispatchRelease()) {
+    // Redispatched to the socket thread.
+    return count;
+  }
+
+  MOZ_ASSERT(0 != mRefCnt, "dup release");
+  count = --mRefCnt;
+  NS_LOG_RELEASE(this, count, "Http2PushedStreamWrapper");
+
+  if (0 == count) {
+    mRefCnt = 1;
+    delete (this);
+    return 0;
+  }
+
+  return count;
+}
+
+NS_INTERFACE_MAP_BEGIN(Http2PushedStreamWrapper)
+NS_INTERFACE_MAP_END
+
+Http2PushedStreamWrapper::Http2PushedStreamWrapper(
+    Http2PushedStream* aPushStream) {
+  MOZ_ASSERT(PR_GetCurrentThread() == gSocketThread, "not on socket thread");
+  mStream = aPushStream;
+  mRequestString = aPushStream->GetRequestString();
+}
+
+Http2PushedStreamWrapper::~Http2PushedStreamWrapper() {
+  MOZ_ASSERT(PR_GetCurrentThread() == gSocketThread, "not on socket thread");
+}
+
+Http2PushedStream* Http2PushedStreamWrapper::GetStream() {
+  MOZ_ASSERT(PR_GetCurrentThread() == gSocketThread, "not on socket thread");
+  if (mStream) {
+    Http2Stream* stream = mStream;
+    return static_cast<Http2PushedStream*>(stream);
+  }
+  return nullptr;
+}
+
+void Http2PushedStreamWrapper::OnPushFailed() {
+  if (PR_GetCurrentThread() == gSocketThread) {
+    if (mStream) {
+      Http2Stream* stream = mStream;
+      static_cast<Http2PushedStream*>(stream)->OnPushFailed();
+    }
+  } else {
+    gSocketTransportService->Dispatch(
+        NewRunnableMethod(this, &Http2PushedStreamWrapper::OnPushFailed),
+        NS_DISPATCH_NORMAL);
+  }
+}
+
 //////////////////////////////////////////
 // Http2PushedStream
 //////////////////////////////////////////

netwerk/protocol/http/Http2Push.h

@@ -123,6 +123,24 @@ private:
   uint32_t mBufferedHTTP1Consumed;
 };
 
+class Http2PushedStreamWrapper : public nsISupports {
+public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+  bool DispatchRelease();
+
+  explicit Http2PushedStreamWrapper(Http2PushedStream* aPushStream);
+
+  nsCString& GetRequestString() { return mRequestString; }
+  Http2PushedStream* GetStream();
+  void OnPushFailed();
+
+private:
+  virtual ~Http2PushedStreamWrapper();
+
+  nsCString mRequestString;
+  WeakPtr<Http2Stream> mStream;
+};
+
 } // namespace net
 } // namespace mozilla
 

netwerk/protocol/http/Http2Session.cpp

@@ -380,12 +380,24 @@ Http2Session::AddStream(nsAHttpTransaction *aHttpTransaction,
 
   if (mClosed || mShouldGoAway) {
     nsHttpTransaction *trans = aHttpTransaction->QueryHttpTransaction();
-    if (trans && !trans->GetPushedStream()) {
-      LOG3(("Http2Session::AddStream %p atrans=%p trans=%p session unusable - resched.\n",
-            this, aHttpTransaction, trans));
-      aHttpTransaction->SetConnection(nullptr);
-      gHttpHandler->InitiateTransaction(trans, trans->Priority());
-      return true;
+    if (trans) {
+      RefPtr<Http2PushedStreamWrapper> pushedStreamWrapper;
+      pushedStreamWrapper = trans->GetPushedStream();
+      if (!pushedStreamWrapper || !pushedStreamWrapper->GetStream()) {
+        LOG3(
+            ("Http2Session::AddStream %p atrans=%p trans=%p session unusable - "
+             "resched.\n", this, aHttpTransaction, trans));
+        aHttpTransaction->SetConnection(nullptr);
+        nsresult rv =
+            gHttpHandler->InitiateTransaction(trans, trans->Priority());
+        if (NS_FAILED(rv)) {
+          LOG3(
+              ("Http2Session::AddStream %p atrans=%p trans=%p failed to "
+               "initiate transaction (%08x).\n",
+               this, aHttpTransaction, trans, static_cast<uint32_t>(rv)));
+        }
+        return true;
+      }
     }
   }
 

netwerk/protocol/http/Http2Stream.cpp

@@ -442,12 +442,14 @@ Http2Stream::ParseHttpRequestHeaders(const char *buf,
       requestContext->GetSpdyPushCache(&cache);
     }
 
+    RefPtr<Http2PushedStreamWrapper> pushedStreamWrapper;
     Http2PushedStream *pushedStream = nullptr;
 
     // If a push stream is attached to the transaction via onPush, match only with that
     // one. This occurs when a push was made with in conjunction with a nsIHttpPushListener
     nsHttpTransaction *trans = mTransaction->QueryHttpTransaction();
-    if (trans && (pushedStream = trans->TakePushedStream())) {
+    if (trans && (pushedStreamWrapper = trans->TakePushedStream()) &&
+        (pushedStream = pushedStreamWrapper->GetStream())) {
       if (pushedStream->mSession == mSession) {
         LOG3(("Pushed Stream match based on OnPush correlation %p", pushedStream));
       } else {

netwerk/protocol/http/Http2Stream.h

@@ -28,8 +28,10 @@ class Http2Decompressor;
 class Http2Stream
   : public nsAHttpSegmentReader
   , public nsAHttpSegmentWriter
+  , public SupportsWeakPtr<Http2Stream>
 {
 public:
+  MOZ_DECLARE_WEAKREFERENCE_TYPENAME(Http2Stream)
   NS_DECL_NSAHTTPSEGMENTREADER
   NS_DECL_NSAHTTPSEGMENTWRITER
 

netwerk/protocol/http/nsHttpChannel.cpp

@@ -7828,7 +7828,7 @@ nsHttpChannel::AwaitingCacheCallbacks()
 }
 
 void
-nsHttpChannel::SetPushedStream(Http2PushedStream *stream)
+nsHttpChannel::SetPushedStream(Http2PushedStreamWrapper *stream)
 {
     MOZ_ASSERT(stream);
     MOZ_ASSERT(!mPushedStream);
@@ -7836,7 +7836,7 @@ nsHttpChannel::SetPushedStream(Http2PushedStream *stream)
 }
 
 nsresult
-nsHttpChannel::OnPush(const nsACString &url, Http2PushedStream *pushedStream)
+nsHttpChannel::OnPush(const nsACString &url, Http2PushedStreamWrapper *pushedStream)
 {
     MOZ_ASSERT(NS_IsMainThread());
     LOG(("nsHttpChannel::OnPush [this=%p]\n", this));

netwerk/protocol/http/nsHttpChannel.h

@@ -126,7 +126,7 @@ public:
                           const nsID& aChannelId,
                           nsContentPolicyType aContentPolicyType) override;
 
-    nsresult OnPush(const nsACString &uri, Http2PushedStream *pushedStream);
+    nsresult OnPush(const nsACString &uri, Http2PushedStreamWrapper *pushedStream);
 
     static bool IsRedirectStatus(uint32_t status);
 
@@ -448,7 +448,7 @@ private:
     nsresult OpenCacheInputStream(nsICacheEntry* cacheEntry, bool startBuffering,
                                   bool checkingAppCacheEntry);
 
-    void SetPushedStream(Http2PushedStream *stream);
+    void SetPushedStream(Http2PushedStreamWrapper *stream);
 
     void SetDoNotTrack();
 
@@ -578,9 +578,10 @@ private:
     nsTArray<nsContinueRedirectionFunc> mRedirectFuncStack;
 
     // Needed for accurate DNS timing
-    RefPtr<nsDNSPrefetch>           mDNSPrefetch;
+    RefPtr<nsDNSPrefetch>             mDNSPrefetch;
 
-    Http2PushedStream                 *mPushedStream;
+    RefPtr<Http2PushedStreamWrapper>  mPushedStream;
+    
     // True if the channel's principal was found on a phishing, malware, or
     // tracking (if tracking protection is enabled) blocklist
     bool                              mLocalBlocklist;

netwerk/protocol/http/nsHttpChannelAuthProvider.cpp

@@ -95,6 +95,8 @@ nsHttpChannelAuthProvider::~nsHttpChannelAuthProvider()
 uint32_t nsHttpChannelAuthProvider::sAuthAllowPref =
     SUBRESOURCE_AUTH_DIALOG_ALLOW_ALL;
 
+bool nsHttpChannelAuthProvider::sImgCrossOriginAuthAllowPref = false;
+
 void
 nsHttpChannelAuthProvider::InitializePrefs()
 {
@@ -102,6 +104,9 @@ nsHttpChannelAuthProvider::InitializePrefs()
   mozilla::Preferences::AddUintVarCache(&sAuthAllowPref,
                                         "network.auth.subresource-http-auth-allow",
                                         SUBRESOURCE_AUTH_DIALOG_ALLOW_ALL);
+  mozilla::Preferences::AddBoolVarCache(&sImgCrossOriginAuthAllowPref,
+                                        "network.auth.subresource-http-img-XO-auth",
+                                        false);
 }
 
 NS_IMETHODIMP
@@ -867,15 +872,15 @@ nsHttpChannelAuthProvider::GetCredentialsForChallenge(const char *challenge,
             else if (authFlags & nsIHttpAuthenticator::IDENTITY_ENCRYPTED)
                 level = nsIAuthPrompt2::LEVEL_PW_ENCRYPTED;
 
-            // Depending on the pref setting, the authentication dialog may be
+            // Depending on the pref settings, the authentication dialog may be
             // blocked for all sub-resources, blocked for cross-origin
             // sub-resources, or always allowed for sub-resources.
-            // For more details look at the bug 647010.
-            // BlockPrompt will set mCrossOrigin parameter as well.
+            // If always allowed, image prompts may still be blocked by pref.
+            // BlockPrompt() will set the mCrossOrigin parameter as well.
             if (BlockPrompt()) {
                 LOG(("nsHttpChannelAuthProvider::GetCredentialsForChallenge: "
-                     "Prompt is blocked [this=%p pref=%d]\n",
-                      this, sAuthAllowPref));
+                     "Prompt is blocked [this=%p pref=%d img-pref=%d]\n",
+                     this, sAuthAllowPref, sImgCrossOriginAuthAllowPref));
                 return NS_ERROR_ABORT;
             }
 
@@ -983,7 +988,15 @@ nsHttpChannelAuthProvider::BlockPrompt()
         // the sub-resources only if they are not cross-origin.
         return !topDoc && !xhr && mCrossOrigin;
     case SUBRESOURCE_AUTH_DIALOG_ALLOW_ALL:
-        // Allow the http-authentication dialog.
+        // Allow the http-authentication dialog for subresources.
+        // If the pref network.auth.subresource-http-img-XO-auth is set to false,
+        // the http authentication dialog for image subresources is still blocked.
+        if (!sImgCrossOriginAuthAllowPref &&
+            loadInfo &&
+            ((loadInfo->GetExternalContentPolicyType() == nsIContentPolicy::TYPE_IMAGE) ||
+             (loadInfo->GetExternalContentPolicyType() == nsIContentPolicy::TYPE_IMAGESET))) {
+            return true;
+        }
         return false;
     default:
         // This is an invalid value.

netwerk/protocol/http/nsHttpChannelAuthProvider.h

@@ -179,10 +179,11 @@ private:
 
     RefPtr<nsHttpHandler>           mHttpHandler;  // keep gHttpHandler alive
 
-    // A variable holding the preference settings to whether to open HTTP
+    // Variables holding the preference settings for whether to open HTTP
     // authentication credentials dialogs for sub-resources and cross-origin
     // sub-resources.
     static uint32_t                   sAuthAllowPref;
+    static bool                       sImgCrossOriginAuthAllowPref;
     nsCOMPtr<nsICancelable>           mGenerateCredentialsCancelable;
 };
 

netwerk/protocol/http/nsHttpConnectionMgr.cpp

@@ -373,8 +373,12 @@ nsHttpConnectionMgr::VerifyTraffic()
 nsresult
 nsHttpConnectionMgr::DoShiftReloadConnectionCleanup(nsHttpConnectionInfo *aCI)
 {
+    RefPtr<nsHttpConnectionInfo> ci;
+    if (aCI) {
+      ci = aCI->Clone();
+    }
     return PostEvent(&nsHttpConnectionMgr::OnMsgDoShiftReloadConnectionCleanup,
-                     0, aCI);
+                     0, ci);
 }
 
 class SpeculativeConnectArgs : public ARefBase
@@ -504,9 +508,13 @@ nsHttpConnectionMgr::UpdateParam(nsParamName name, uint16_t value)
 }
 
 nsresult
-nsHttpConnectionMgr::ProcessPendingQ(nsHttpConnectionInfo *ci)
+nsHttpConnectionMgr::ProcessPendingQ(nsHttpConnectionInfo* aCI)
 {
-    LOG(("nsHttpConnectionMgr::ProcessPendingQ [ci=%s]\n", ci->HashKey().get()));
+    LOG(("nsHttpConnectionMgr::ProcessPendingQ [ci=%s]\n", aCI->HashKey().get()));
+    RefPtr<nsHttpConnectionInfo> ci;
+    if (aCI) {
+        ci = aCI->Clone();
+    }    
     return PostEvent(&nsHttpConnectionMgr::OnMsgProcessPendingQ, 0, ci);
 }
 
@@ -1819,13 +1827,18 @@ nsHttpConnectionMgr::ProcessNewTransaction(nsHttpTransaction *trans)
 
     trans->SetPendingTime();
 
-    Http2PushedStream *pushedStream = trans->GetPushedStream();
-    if (pushedStream) {
-        LOG(("  ProcessNewTransaction %p tied to h2 session push %p\n",
-             trans, pushedStream->Session()));
-        return pushedStream->Session()->
-            AddStream(trans, trans->Priority(), false, nullptr) ?
-            NS_OK : NS_ERROR_UNEXPECTED;
+    RefPtr<Http2PushedStreamWrapper> pushedStreamWrapper =
+        trans->GetPushedStream();
+    if (pushedStreamWrapper) {
+      Http2PushedStream* pushedStream = pushedStreamWrapper->GetStream();
+      if (pushedStream) {
+        LOG(("  ProcessNewTransaction %p tied to h2 session push %p\n", trans,
+             pushedStream->Session()));
+        return pushedStream->Session()->AddStream(trans, trans->Priority(), false,
+                                                  nullptr)
+                   ? NS_OK
+                   : NS_ERROR_UNEXPECTED;
+      }
     }
 
     nsresult rv = NS_OK;

netwerk/protocol/http/nsHttpHandler.h

@@ -246,7 +246,8 @@ public:
                                 uint32_t caps = 0)
     {
         TickleWifi(callbacks);
-        return mConnMgr->SpeculativeConnect(ci, callbacks, caps);
+        RefPtr<nsHttpConnectionInfo> clone = ci->Clone();
+        return mConnMgr->SpeculativeConnect(clone, callbacks, caps);
     }
 
     // Alternate Services Maps are main thread only

netwerk/protocol/http/nsHttpTransaction.h

@@ -131,14 +131,14 @@ public:
 
     nsHttpTransaction *QueryHttpTransaction() override { return this; }
 
-    Http2PushedStream *GetPushedStream() { return mPushedStream; }
-    Http2PushedStream *TakePushedStream()
-    {
-        Http2PushedStream *r = mPushedStream;
-        mPushedStream = nullptr;
-        return r;
+    already_AddRefed<Http2PushedStreamWrapper> GetPushedStream() {
+      return do_AddRef(mPushedStream);
     }
-    void SetPushedStream(Http2PushedStream *push) { mPushedStream = push; }
+    already_AddRefed<Http2PushedStreamWrapper> TakePushedStream() {
+      return mPushedStream.forget();
+    }
+
+    void SetPushedStream(Http2PushedStreamWrapper* push) { mPushedStream = push; }
     uint32_t InitialRwin() const { return mInitialRwin; };
     bool ChannelPipeFull() { return mWaitingOnPipeOut; }
 
@@ -264,7 +264,7 @@ private:
     // so far been skipped.
     uint32_t                        mInvalidResponseBytesRead;
 
-    Http2PushedStream               *mPushedStream;
+    RefPtr<Http2PushedStreamWrapper> mPushedStream;
     uint32_t                        mInitialRwin;
 
     nsHttpChunkedDecoder            *mChunkedDecoder;

parser/html/javasrc/Tokenizer.java

@@ -3850,12 +3850,9 @@ public class Tokenizer implements Locator {
                                     tokenHandler.characters(
                                             Tokenizer.LT_SOLIDUS, 0, 2);
                                     emitStrBuf();
-                                    if (c == '\u0000') {
-                                        emitReplacementCharacter(buf, pos);
-                                    } else {
-                                        cstart = pos; // don't drop the
-                                        // character
-                                    }
+                                    cstart = pos; // don't drop the
+                                                  // character
+                                    reconsume = true;
                                     state = transition(state, returnState, reconsume, pos);
                                     continue stateloop;
                             }

parser/html/nsHtml5Tokenizer.cpp

@@ -2091,11 +2091,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               default: {
                 tokenHandler->characters(nsHtml5Tokenizer::LT_SOLIDUS, 0, 2);
                 emitStrBuf();
-                if (c == '\0') {
-                  emitReplacementCharacter(buf, pos);
-                } else {
-                  cstart = pos;
-                }
+                cstart = pos;
+                reconsume = true;
                 state = P::transition(mViewSource, returnState, reconsume, pos);
                 NS_HTML5_CONTINUE(stateloop);
               }

security/nss/coreconf/coreconf.dep

@@ -10,4 +10,3 @@
  */
 
 #error "Do not include this header file."
-

security/nss/lib/cryptohi/seckey.c

@@ -639,6 +639,11 @@ seckey_ExtractPublicKey(const CERTSubjectPublicKeyInfo *spki)
                     return pubk;
                 break;
             case SEC_OID_ANSIX962_EC_PUBLIC_KEY:
+                /* A basic sanity check on inputs. */
+                if (spki->algorithm.parameters.len == 0 || newOs.len == 0) {
+                    PORT_SetError(SEC_ERROR_INPUT_LEN);
+                    break;
+                }
                 pubk->keyType = ecKey;
                 pubk->u.ec.size = 0;
 

security/nss/lib/freebl/dh.c

@@ -210,7 +210,8 @@ DH_Derive(SECItem *publicValue,
     unsigned int len = 0;
     unsigned int nb;
     unsigned char *secret = NULL;
-    if (!publicValue || !prime || !privateValue || !derivedSecret) {
+    if (!publicValue || !publicValue->len || !prime || !prime->len ||
+        !privateValue || !privateValue->len || !derivedSecret) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }

security/nss/lib/freebl/ec.c

@@ -202,8 +202,8 @@ ec_NewKey(ECParams *ecParams, ECPrivateKey **privKey,
 #endif
     MP_DIGITS(&k) = 0;
 
-    if (!ecParams || !privKey || !privKeyBytes || (privKeyLen < 0) ||
-        !ecParams->name) {
+    if (!ecParams || ecParams->name == ECCurve_noName ||
+        !privKey || !privKeyBytes || privKeyLen <= 0) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
@@ -391,7 +391,7 @@ EC_NewKey(ECParams *ecParams, ECPrivateKey **privKey)
     int len;
     unsigned char *privKeyBytes = NULL;
 
-    if (!ecParams) {
+    if (!ecParams || ecParams->name == ECCurve_noName || !privKey) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
@@ -430,7 +430,8 @@ EC_ValidatePublicKey(ECParams *ecParams, SECItem *publicValue)
     mp_err err = MP_OKAY;
     int len;
 
-    if (!ecParams || !publicValue || !ecParams->name) {
+    if (!ecParams || ecParams->name == ECCurve_noName ||
+        !publicValue || !publicValue->len) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
@@ -536,8 +537,9 @@ ECDH_Derive(SECItem *publicValue,
     int i;
 #endif
 
-    if (!publicValue || !ecParams || !privateValue || !derivedSecret ||
-        !ecParams->name) {
+    if (!publicValue || !publicValue->len ||
+        !ecParams || ecParams->name == ECCurve_noName ||
+        !privateValue || !privateValue->len || !derivedSecret) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }

security/nss/lib/freebl/ecl/ecp_25519.c

@@ -114,6 +114,9 @@ ec_Curve25519_pt_mul(SECItem *X, SECItem *k, SECItem *P)
         }
         px = P->data;
     }
+    if (k->len != 32) {
+        return SECFailure;
+    }
 
     SECStatus rv = ec_Curve25519_mul(X->data, k->data, px);
     if (NSS_SecureMemcmpZero(X->data, X->len) == 0) {

security/nss/lib/nss/nss.h

@@ -22,10 +22,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define NSS_VERSION "3.41.1" _NSS_CUSTOMIZED
+#define NSS_VERSION "3.41.2" _NSS_CUSTOMIZED
 #define NSS_VMAJOR 3
 #define NSS_VMINOR 41
-#define NSS_VPATCH 1
+#define NSS_VPATCH 2
 #define NSS_VBUILD 0
 #define NSS_BETA PR_FALSE
 

security/nss/lib/pk11wrap/pk11akey.c

@@ -190,7 +190,6 @@ PK11_ImportPublicKey(PK11SlotInfo *slot, SECKEYPublicKey *pubKey,
                 attrs++;
                 PK11_SETATTRS(attrs, CKA_DERIVE, &cktrue, sizeof(CK_BBOOL));
                 attrs++;
-                signedattr = attrs;
                 PK11_SETATTRS(attrs, CKA_EC_PARAMS,
                               pubKey->u.ec.DEREncodedParams.data,
                               pubKey->u.ec.DEREncodedParams.len);
@@ -224,10 +223,13 @@ PK11_ImportPublicKey(PK11SlotInfo *slot, SECKEYPublicKey *pubKey,
         }
 
         templateCount = attrs - theTemplate;
-        signedcount = attrs - signedattr;
         PORT_Assert(templateCount <= (sizeof(theTemplate) / sizeof(CK_ATTRIBUTE)));
-        for (attrs = signedattr; signedcount; attrs++, signedcount--) {
-            pk11_SignedToUnsigned(attrs);
+        if (pubKey->keyType != ecKey) {
+            PORT_Assert(signedattr);
+            signedcount = attrs - signedattr;
+            for (attrs = signedattr; signedcount; attrs++, signedcount--) {
+                pk11_SignedToUnsigned(attrs);
+            }
         }
         rv = PK11_CreateNewObject(slot, CK_INVALID_SESSION, theTemplate,
                                   templateCount, isToken, &objectID);
@@ -1074,9 +1076,13 @@ pk11_loadPrivKeyWithFlags(PK11SlotInfo *slot, SECKEYPrivateKey *privKey,
                                         &cktrue, &ckfalse);
 
     /* Not everyone can handle zero padded key values, give
-      * them the raw data as unsigned */
-    for (ap = attrs; extra_count; ap++, extra_count--) {
-        pk11_SignedToUnsigned(ap);
+     * them the raw data as unsigned. The exception is EC,
+     * where the values are encoded or zero-preserving
+     * per-RFC5915 */
+    if (privKey->keyType != ecKey) {
+        for (ap = attrs; extra_count; ap++, extra_count--) {
+            pk11_SignedToUnsigned(ap);
+        }
     }
 
     /* now Store the puppies */

security/nss/lib/pk11wrap/pk11cert.c

@@ -184,7 +184,9 @@ PK11_IsUserCert(PK11SlotInfo *slot, CERTCertificate *cert,
             SECKEY_DestroyPublicKey(pubKey);
             return PR_FALSE;
         }
-        pk11_SignedToUnsigned(&theTemplate);
+        if (pubKey->keyType != ecKey) {
+            pk11_SignedToUnsigned(&theTemplate);
+        }
         if (pk11_FindObjectByTemplate(slot, &theTemplate, 1) != CK_INVALID_HANDLE) {
             SECKEY_DestroyPublicKey(pubKey);
             return PR_TRUE;

security/nss/lib/pk11wrap/pk11pk12.c

@@ -505,7 +505,7 @@ PK11_ImportAndReturnPrivateKey(PK11SlotInfo *slot, SECKEYRawPrivateKey *lpk,
             }
             PK11_SETATTRS(attrs, CKA_ID, ck_id->data, ck_id->len);
             attrs++;
-            signedattr = attrs;
+            /* No signed attrs for EC */
             /* curveOID always is a copy of AlgorithmID.parameters. */
             PK11_SETATTRS(attrs, CKA_EC_PARAMS, lpk->u.ec.curveOID.data,
                           lpk->u.ec.curveOID.len);
@@ -523,11 +523,12 @@ PK11_ImportAndReturnPrivateKey(PK11SlotInfo *slot, SECKEYRawPrivateKey *lpk,
     }
     templateCount = attrs - theTemplate;
     PORT_Assert(templateCount <= sizeof(theTemplate) / sizeof(CK_ATTRIBUTE));
-    PORT_Assert(signedattr != NULL);
-    signedcount = attrs - signedattr;
-
-    for (ap = signedattr; signedcount; ap++, signedcount--) {
-        pk11_SignedToUnsigned(ap);
+    if (lpk->keyType != ecKey) {
+        PORT_Assert(signedattr);
+        signedcount = attrs - signedattr;
+        for (ap = signedattr; signedcount; ap++, signedcount--) {
+            pk11_SignedToUnsigned(ap);
+        }
     }
 
     rv = PK11_CreateNewObject(slot, CK_INVALID_SESSION,

security/nss/lib/softoken/legacydb/lgattr.c

@@ -950,9 +950,9 @@ lg_FindECPrivateKeyAttribute(NSSLOWKEYPrivateKey *key, CK_ATTRIBUTE_TYPE type,
         case CKA_UNWRAP:
             return LG_CLONE_ATTR(attribute, type, lg_StaticFalseAttr);
         case CKA_VALUE:
-            return lg_CopyPrivAttrSigned(attribute, type,
-                                         key->u.ec.privateValue.data,
-                                         key->u.ec.privateValue.len, sdbpw);
+            return lg_CopyPrivAttribute(attribute, type,
+                                        key->u.ec.privateValue.data,
+                                        key->u.ec.privateValue.len, sdbpw);
         case CKA_EC_PARAMS:
             return lg_CopyAttributeSigned(attribute, type,
                                           key->u.ec.ecParams.DEREncoding.data,

security/nss/lib/softoken/pkcs11c.c

@@ -7568,7 +7568,7 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession,
 
             rv = ECDH_Derive(&ecPoint, &privKey->u.ec.ecParams, &ecScalar,
                              withCofactor, &tmp);
-            PORT_Free(ecScalar.data);
+            PORT_ZFree(ecScalar.data, ecScalar.len);
             ecScalar.data = NULL;
             if (privKey != sourceKey->objectInfo) {
                 nsslowkey_DestroyPrivateKey(privKey);

security/nss/lib/softoken/sftkpwd.c

@@ -36,9 +36,9 @@
 
 const int NSS_DEFAULT_ITERATION_COUNT =
 #ifdef DEBUG
-    1000
+    25
 #else
-    60000
+    500
 #endif
     ;
 

security/nss/lib/softoken/softkver.h

@@ -17,10 +17,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define SOFTOKEN_VERSION "3.41.1" SOFTOKEN_ECC_STRING
+#define SOFTOKEN_VERSION "3.41.2" SOFTOKEN_ECC_STRING
 #define SOFTOKEN_VMAJOR 3
 #define SOFTOKEN_VMINOR 41
-#define SOFTOKEN_VPATCH 1
+#define SOFTOKEN_VPATCH 2
 #define SOFTOKEN_VBUILD 0
 #define SOFTOKEN_BETA PR_FALSE
 

security/nss/lib/ssl/ssl3con.c

@@ -64,6 +64,7 @@ static SECStatus ssl3_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags);
 static CK_MECHANISM_TYPE ssl3_GetHashMechanismByHashType(SSLHashType hashType);
 static CK_MECHANISM_TYPE ssl3_GetMgfMechanismByHashType(SSLHashType hash);
 PRBool ssl_IsRsaPssSignatureScheme(SSLSignatureScheme scheme);
+PRBool ssl_IsRsaPkcs1SignatureScheme(SSLSignatureScheme scheme);
 
 const PRUint8 ssl_hello_retry_random[] = {
     0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
@@ -4060,6 +4061,9 @@ ssl_SignatureSchemeValid(SSLSignatureScheme scheme, SECOidTag spkiOid,
         if (ssl_SignatureSchemeToHashType(scheme) == ssl_hash_sha1) {
             return PR_FALSE;
         }
+        if (ssl_IsRsaPkcs1SignatureScheme(scheme)) {
+            return PR_FALSE;
+        }
         /* With TLS 1.3, EC keys should have been selected based on calling
          * ssl_SignatureSchemeFromSpki(), reject them otherwise. */
         return spkiOid != SEC_OID_ANSIX962_EC_PUBLIC_KEY;
@@ -4309,6 +4313,22 @@ ssl_IsRsaPssSignatureScheme(SSLSignatureScheme scheme)
     return PR_FALSE;
 }
 
+PRBool
+ssl_IsRsaPkcs1SignatureScheme(SSLSignatureScheme scheme)
+{
+    switch (scheme) {
+        case ssl_sig_rsa_pkcs1_sha256:
+        case ssl_sig_rsa_pkcs1_sha384:
+        case ssl_sig_rsa_pkcs1_sha512:
+        case ssl_sig_rsa_pkcs1_sha1:
+            return PR_TRUE;
+
+        default:
+            return PR_FALSE;
+    }
+    return PR_FALSE;
+}
+
 SSLAuthType
 ssl_SignatureSchemeToAuthType(SSLSignatureScheme scheme)
 {

security/nss/lib/util/nssutil.h

@@ -19,10 +19,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <Beta>]"
  */
-#define NSSUTIL_VERSION "3.41.1"
+#define NSSUTIL_VERSION "3.41.2"
 #define NSSUTIL_VMAJOR 3
 #define NSSUTIL_VMINOR 41
-#define NSSUTIL_VPATCH 1
+#define NSSUTIL_VPATCH 2
 #define NSSUTIL_VBUILD 0
 #define NSSUTIL_BETA PR_FALSE
 

security/nss/lib/util/quickder.c

@@ -757,6 +757,13 @@ DecodeItem(void* dest,
                         }
 
                         case SEC_ASN1_BIT_STRING: {
+                            /* Can't be 8 or more spare bits, or any spare bits
+                             * if there are no octets. */
+                            if (temp.data[0] >= 8 || (temp.data[0] > 0 && temp.len == 1)) {
+                                PORT_SetError(SEC_ERROR_BAD_DER);
+                                rv = SECFailure;
+                                break;
+                            }
                             /* change the length in the SECItem to be the number
                                of bits */
                             temp.len = (temp.len - 1) * 8 - (temp.data[0] & 0x7);

toolkit/components/passwordmgr/test/subtst_master_pass.html

@@ -2,6 +2,11 @@
 This form triggers a MP and gets filled in.<br>
 <form>
 Username: <input type="text"     id="userfield" name="u"><br>
-Password: <input type="password" id="passfield" name="p"
-                 oninput="parent.postMessage('filled', '*');"><br>
+Password: <input type="password" id="passfield" name="p"><br>
+<script>
+    // Only notify when we fill in the password field.
+    document.getElementById("passfield").addEventListener("input", function() {
+        parent.postMessage("filled", "*");
+    });
+</script>
 </form>

xpcom/io/nsLocalFileWin.cpp

@@ -3034,6 +3034,7 @@ nsLocalFile::IsExecutable(bool* aResult)
       "ins",
       "isp",
       "jar",         // java application bundle
+      "jnlp",        // java web start
       "js",
       "jse",
       "lnk",