[js] Avoid OOB array copy.

This brings our certdata in line with NSS 3.131.1

dom/base/nsDOMMutationObserver.h

@@ -921,7 +921,7 @@ private:
   // List of nodes referred to by mEntryTable so we can sort them
   // For a specific pseudo element, we use its parent element as the
   // batch target, so they will be put in the same EntryArray.
-  nsTArray<nsINode*> mBatchTargets;
+  nsTArray<nsCOMPtr<nsINode>> mBatchTargets;
 };
 
 inline

gfx/2d/FilterNodeSoftware.cpp

@@ -1554,8 +1554,7 @@ FilterNodeTileSoftware::SetAttribute(uint32_t aIndex,
                                      const IntRect &aSourceRect)
 {
   MOZ_ASSERT(aIndex == ATT_TILE_SOURCE_RECT);
-  mSourceRect = IntRect(int32_t(aSourceRect.x), int32_t(aSourceRect.y),
-                        int32_t(aSourceRect.width), int32_t(aSourceRect.height));
+  mSourceRect = aSourceRect;
   Invalidate();
 }
 
@@ -1595,14 +1594,24 @@ FilterNodeTileSoftware::Render(const IntRect& aRect)
   typedef std::map<IntRect, RefPtr<DataSourceSurface>, CompareIntRects> InputMap;
   InputMap inputs;
 
+  auto IntRectToInt64Rect = [](const IntRect& aRect) {
+    return RectTyped<UnknownUnits, int64_t>(aRect.X(), aRect.Y(), aRect.Width(),
+                                            aRect.Height());
+  };
+
   IntPoint startIndex = TileIndex(mSourceRect, aRect.TopLeft());
   IntPoint endIndex = TileIndex(mSourceRect, aRect.BottomRight());
   for (int32_t ix = startIndex.x; ix <= endIndex.x; ix++) {
     for (int32_t iy = startIndex.y; iy <= endIndex.y; iy++) {
-      IntPoint sourceToDestOffset(ix * mSourceRect.width,
-                                  iy * mSourceRect.height);
-      IntRect destRect = aRect.Intersect(mSourceRect + sourceToDestOffset);
-      IntRect srcRect = destRect - sourceToDestOffset;
+      auto sourceToDestOffset = PointTyped<UnknownUnits, int64_t>(
+          ix * mSourceRect.Width(), iy * mSourceRect.Height());
+      auto destRect64 = IntRectToInt64Rect(aRect).Intersect(
+          IntRectToInt64Rect(mSourceRect) + sourceToDestOffset);
+      auto srcRect64 = destRect64 - sourceToDestOffset;
+      IntRect destRect, srcRect;
+      if (!destRect64.ToIntRect(&destRect) || !srcRect64.ToIntRect(&srcRect)) {
+        return nullptr;
+      }
       if (srcRect.IsEmpty()) {
         continue;
       }

js/src/vm/SelfHosting.cpp

@@ -1373,16 +1373,18 @@ intrinsic_MoveTypedArrayElements(JSContext* cx, unsigned argc, Value* vp)
     MOZ_ASSERT((UINT32_MAX >> ElementShift) >= count);
     uint32_t byteSize = count << ElementShift;
 
-#ifdef DEBUG
     {
         uint32_t viewByteLength = tarray->byteLength();
-        MOZ_ASSERT(byteSize <= viewByteLength);
-        MOZ_ASSERT(byteDest < viewByteLength);
-        MOZ_ASSERT(byteSrc < viewByteLength);
-        MOZ_ASSERT(byteDest <= viewByteLength - byteSize);
-        MOZ_ASSERT(byteSrc <= viewByteLength - byteSize);
+        if (byteSize > viewByteLength ||
+            byteDest >= viewByteLength ||
+            byteSrc >= viewByteLength ||
+            byteDest > viewByteLength - byteSize ||
+            byteSrc > viewByteLength - byteSize) {
+            JS_ReportErrorNumberASCII(
+              cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_OUT_OF_BOUNDS);
+          return false;
+        }
     }
-#endif
 
     SharedMem<uint8_t*> data = tarray->viewDataEither().cast<uint8_t*>();
     jit::AtomicOperations::memmoveSafeWhenRacy(data + byteDest, data + byteSrc, byteSize);

layout/generic/nsSelection.cpp

@@ -2166,20 +2166,20 @@ nsFrameSelection::CommonPageMove(bool aForward,
   //get the frame from the scrollable view
 
   nsIFrame* scrolledFrame = aScrollableFrame->GetScrolledFrame();
-  if (!scrolledFrame) [[unlikely]] {
+  if MOZ_UNLIKELY(!scrolledFrame) {
     return;
   }
 
   // find out where the caret is.
   // we should know mDesiredPos value of nsFrameSelection, but I havent seen that behavior in other windows applications yet.
   nsISelection* domSel = GetSelection(SelectionType::eNormal);
-  if (!domSel) [[unlikely]] {
+  if MOZ_UNLIKELY(!domSel) {
     return;
   }
 
   nsRect caretPos;
   nsIFrame* caretFrame = nsCaret::GetGeometry(domSel, &caretPos);
-  if (!caretFrame) [[unlikely]] {
+  if MOZ_UNLIKELY(!caretFrame) {
     return;
   }
   
@@ -2200,7 +2200,7 @@ nsFrameSelection::CommonPageMove(bool aForward,
   desiredPoint.y = caretPos.y + caretPos.height/2;
   nsIFrame::ContentOffsets offsets = scrolledFrame->GetContentOffsetsFromPoint(desiredPoint);
 
-  if (!offsets.content) [[unlikely]] {
+  if MOZ_UNLIKELY(!offsets.content) {
     return;
   }
 
@@ -2846,7 +2846,12 @@ nsFrameSelection::UnselectCells(nsIContent *aTableContent,
   if (!mDomSelections[index])
     return NS_ERROR_NULL_POINTER;
 
-  nsTableWrapperFrame* tableFrame = do_QueryFrame(aTableContent->GetPrimaryFrame());
+  // This is needed as an nsTableWrapperFrame as we use this to know we can
+  // static cast tableFrame to nsTableWrapperFrame.
+  nsTableWrapperFrame* tableWrapperFrame = do_QueryFrame(aTableContent->GetPrimaryFrame());
+
+  // Declared as weak frame, as the frame may be freed during a call to a listener.
+  nsWeakFrame tableFrame(tableWrapperFrame);
   if (!tableFrame)
     return NS_ERROR_FAILURE;
 
@@ -2878,6 +2883,9 @@ nsFrameSelection::UnselectCells(nsIContent *aTableContent,
             curColIndex < minColIndex || curColIndex > maxColIndex) {
 
           mDomSelections[index]->RemoveRange(range);
+          if (!tableFrame.IsAlive()) {
+            return NS_OK;
+          }
           // Since we've removed the range, decrement pointer to next range
           mSelectedCellIndex--;
         }
@@ -2885,21 +2893,30 @@ nsFrameSelection::UnselectCells(nsIContent *aTableContent,
       } else {
         // Remove cell from selection if it belongs to the given cells range or
         // it is spanned onto the cells range.
+
+        MOZ_ASSERT(tableFrame.IsAlive());
+        // In general, static casting to another table type is not a good idea,
+        // but it is valid here due to the earlier do_QueryFrame() that
+        // established that tableFrame is an nsTableWrapperFrame*.
+        auto tempTableFrame = static_cast<nsTableWrapperFrame*>(tableFrame.GetFrame());
         nsTableCellFrame* cellFrame =
-          tableFrame->GetCellFrameAt(curRowIndex, curColIndex);
+          tempTableFrame->GetCellFrameAt(curRowIndex, curColIndex);
 
         uint32_t origRowIndex = cellFrame->RowIndex();
         uint32_t origColIndex = cellFrame->ColIndex();
         uint32_t actualRowSpan =
-          tableFrame->GetEffectiveRowSpanAt(origRowIndex, origColIndex);
+          tempTableFrame->GetEffectiveRowSpanAt(origRowIndex, origColIndex);
         uint32_t actualColSpan =
-          tableFrame->GetEffectiveColSpanAt(curRowIndex, curColIndex);
+          tempTableFrame->GetEffectiveColSpanAt(curRowIndex, curColIndex);
         if (origRowIndex <= static_cast<uint32_t>(maxRowIndex) && maxRowIndex >= 0 &&
             origRowIndex + actualRowSpan - 1 >= static_cast<uint32_t>(minRowIndex) &&
             origColIndex <= static_cast<uint32_t>(maxColIndex) && maxColIndex >= 0 &&
             origColIndex + actualColSpan - 1 >= static_cast<uint32_t>(minColIndex)) {
 
           mDomSelections[index]->RemoveRange(range);
+          if (!tableFrame.IsAlive()) {
+            return NS_OK;
+          }
           // Since we've removed the range, decrement pointer to next range
           mSelectedCellIndex--;
         }
@@ -2925,7 +2942,12 @@ nsFrameSelection::AddCellsToSelection(nsIContent *aTableContent,
   if (!mDomSelections[index])
     return NS_ERROR_NULL_POINTER;
 
-  nsTableWrapperFrame* tableFrame = do_QueryFrame(aTableContent->GetPrimaryFrame());
+  // This is needed as an nsTableWrapperFrame as we use this to know we can
+  // static cast tableFrame to nsTableWrapperFrame.
+  nsTableWrapperFrame* tableWrapperFrame = do_QueryFrame(aTableContent->GetPrimaryFrame());
+
+  // Declared as weak frame, as the frame may be freed during a call to a listener.
+  nsWeakFrame tableFrame(tableWrapperFrame);
   if (!tableFrame) // Check that |table| is a table.
     return NS_ERROR_FAILURE;
 
@@ -2936,7 +2958,12 @@ nsFrameSelection::AddCellsToSelection(nsIContent *aTableContent,
     uint32_t col = aStartColumnIndex;
     while(true)
     {
-      nsTableCellFrame* cellFrame = tableFrame->GetCellFrameAt(row, col);
+      MOZ_ASSERT(tableFrame.IsAlive());
+      // In general, static casting to another table type is not a good idea,
+      // but it is valid here due to the earlier do_QueryFrame() that
+      // established that tableFrame is an nsTableWrapperFrame*.
+      nsTableCellFrame* cellFrame = 
+          static_cast<nsTableWrapperFrame*>(tableFrame.GetFrame())->GetCellFrameAt(row, col);
 
       // Skip cells that are spanned from previous locations or are already selected
       if (cellFrame) {
@@ -2944,7 +2971,9 @@ nsFrameSelection::AddCellsToSelection(nsIContent *aTableContent,
         uint32_t origCol = cellFrame->ColIndex();
         if (origRow == row && origCol == col && !cellFrame->IsSelected()) {
           result = SelectCellElement(cellFrame->GetContent());
-          if (NS_FAILED(result)) return result;
+          if (NS_FAILED(result) || !tableFrame.IsAlive()) {
+            return result;
+          }
         }
       }
       // Done when we reach end column

modules/libjar/nsJARProtocolHandler.cpp

@@ -111,9 +111,11 @@ nsJARProtocolHandler::GetDefaultPort(int32_t *result)
 NS_IMETHODIMP
 nsJARProtocolHandler::GetProtocolFlags(uint32_t *result)
 {
-    // URI_LOADABLE_BY_ANYONE, since it's our inner URI that will matter
-    // anyway.
-    *result = URI_NORELATIVE | URI_NOAUTH | URI_LOADABLE_BY_ANYONE;
+    // A jar: URI is only ever as loadable as the inner URI it
+    // wraps, and security checks consult the innermost URI. Claim
+    // the restrictive flag here so that consumers which look at the
+    // jar: handler alone don't treat it as web-loadable.
+    *result = URI_NORELATIVE | URI_NOAUTH | URI_IS_LOCAL_FILE;
     /* Although jar uris have their own concept of relative urls
        it is very different from the standard behaviour, so we
        have to say norelative here! */

modules/libpref/init/all.js

@@ -2573,7 +2573,7 @@ pref("layout.css.legacy-negation-pseudo.enabled", false);
 pref("layout.css.is-where-pseudo.enabled", true);
 
 // Is support for the :has() selector enabled?
-pref("layout.css.has-pseudo.enabled", true);
+pref("layout.css.has-pseudo.enabled", false);
 
 // Is support for the ::slotted() selector enabled?
 pref("layout.css.slotted-pseudo.enabled", true);

xpcom/components/nsComponentManager.cpp

@@ -1776,10 +1776,11 @@ nsComponentManagerImpl::CollectReports(nsIHandleReportCallback* aHandleReport,
 
 size_t
 nsComponentManagerImpl::SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf)
-  const
 {
   size_t n = aMallocSizeOf(this);
 
+  SafeMutexAutoLock lock(mLock);
+
   n += mLoaderMap.ShallowSizeOfExcludingThis(aMallocSizeOf);
 
   n += mFactories.ShallowSizeOfExcludingThis(aMallocSizeOf);

xpcom/components/nsComponentManager.h

@@ -327,7 +327,7 @@ public:
 
   nsTArray<PendingServiceInfo> mPendingServices;
 
-  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf);
 
 private:
   ~nsComponentManagerImpl();

xpcom/io/nsLocalFileWin.cpp

@@ -3009,6 +3009,7 @@ nsLocalFile::IsExecutable(bool* aResult)
     }
 
     // Search for any of the set of executable extensions.
+    // Note: always use lower case here since we lowercase the extensions before comparing.
     static const char* const executableExts[] = {
       "ad",
       "ade",         // access project extension
@@ -3016,6 +3017,7 @@ nsLocalFile::IsExecutable(bool* aResult)
       "air",         // Adobe AIR installer
       "app",         // executable application
       "application", // from bug 348763
+      "appcontent-ms",
       "appref-ms",   // ClickOnce link
       "appx",
       "appxbundle",
@@ -3061,11 +3063,12 @@ nsLocalFile::IsExecutable(bool* aResult)
       "msc",
       "msh",         // Microsoft Shell
       "mshxml",      // Microsoft Shell
-      "msi",
+      "msi",         // Standalone microsoft installer package
       "msix",
       "msixbundle",
       "msp",
       "mst",
+      // "msu",         // Windows Update Standalone Installer. Gated by Windows on MS signatures already.
       "ops",         // Office Profile Settings
       "pcd",
       "pif",
@@ -3077,7 +3080,8 @@ nsLocalFile::IsExecutable(bool* aResult)
       "scf",         // Windows explorer command
       "scr",
       "sct",
-      "search-ms",   // Windows Saved Search
+      "searchconnector-ms", // Windows Search connector installs an OpenSearch provider
+      "search-ms",          // Windows Saved Search
       "settingcontent-ms",
       "shb",
       "shs",