Bug 1736385 - Make sure thread is alive in CacheIOThread::ThreadFunc

Catch the case where we are in worker-shutdown but are still connecting
and make filing and closing connections a bit more robust with a RefPtr.

config/external/nspr/pr/moz.build

@@ -85,7 +85,7 @@ elif CONFIG['OS_TARGET'] == 'WINNT':
     else:
         DEFINES['_X86_'] = True
 else:
-    error('Not a supported OS_TARGET for NSPR in moz.build: "%s". Use --with-system-nspr' % CONFIG['OS_TARGET'])
+    error('Not a supported OS_TARGET for NSPR in moz.build: "%s". Cannot build.' % CONFIG['OS_TARGET'])
 
 
 LOCAL_INCLUDES += [

config/rules.mk

@@ -411,6 +411,10 @@ EXTRA_DSO_LDOPTS += -Wl,--version-script,$(SYMBOLS_FILE)
 else
 ifeq ($(OS_TARGET),Darwin)
 EXTRA_DSO_LDOPTS += -Wl,-exported_symbols_list,$(SYMBOLS_FILE)
+else
+ifeq ($(OS_TARGET),SunOS)
+EXTRA_DSO_LDOPTS += -Wl,-M,$(SYMBOLS_FILE)
+endif
 endif
 endif
 endif

dom/base/Crypto.cpp

@@ -118,7 +118,7 @@ Crypto::GetRandomValues(JSContext* aCx, const ArrayBufferView& aArray,
 void Crypto::RandomUUID(nsAString& aRetVal)
 {
   // NSID_LENGTH == 39 == 36 UUID chars + 2 curly braces + 1 NUL byte
-  static_assert(NSID_LENGTH == 39);
+  static_assert(NSID_LENGTH == 39, "Crypto:RandomUUID: NSID_LENGTH must be 39");
 
   nsCOMPtr<nsIUUIDGenerator> uuidgen =
     do_GetService("@mozilla.org/uuid-generator;1");

dom/base/WebSocket.cpp

@@ -2548,16 +2548,22 @@ WebSocket::Close(const Optional<uint16_t>& aCode,
     return;
   }
 
-  // If the webSocket is not closed we MUST have a mImpl.
-  MOZ_ASSERT(mImpl);
+  // If we don't have mImpl, we are in a shutting down worker where we are still
+  // in CONNECTING state, but already disconnected internally.
+  if (!mImpl) {
+    MOZ_ASSERT(readyState == CONNECTING);
+    SetReadyState(CLOSING);
+    return;
+  }
 
+  RefPtr<WebSocketImpl> impl = mImpl;
   if (readyState == CONNECTING) {
-    mImpl->FailConnection(closeCode, closeReason);
+    impl->FailConnection(closeCode, closeReason);
     return;
   }
 
   MOZ_ASSERT(readyState == OPEN);
-  mImpl->CloseConnection(closeCode, closeReason);
+  impl->CloseConnection(closeCode, closeReason);
 }
 
 //-----------------------------------------------------------------------------

dom/canvas/WebGLContext.cpp

@@ -676,9 +676,11 @@ WebGLContext::CreateAndInitGL(bool forceEnabled,
                               std::vector<FailureReason>* const out_failReasons)
 {
     const gl::SurfaceCaps baseCaps = BaseCaps(mOptions, this);
-    gl::CreateContextFlags flags = gl::CreateContextFlags::NO_VALIDATION;
-    bool tryNativeGL = true;
-    bool tryANGLE = false;
+    gl::CreateContextFlags flags = gl::CreateContextFlags::NONE;
+    
+    if (Preferences::GetBool("webgl.gl_khr_no_validation", false)) {
+        flags |= gl::CreateContextFlags::NO_VALIDATION;
+    }
 
     if (forceEnabled) {
         flags |= gl::CreateContextFlags::FORCE_ENABLE_HARDWARE;
@@ -694,6 +696,9 @@ WebGLContext::CreateAndInitGL(bool forceEnabled,
 
     const bool useEGL = PR_GetEnv("MOZ_WEBGL_FORCE_EGL");
 
+    bool tryNativeGL = true;
+    bool tryANGLE = false;
+
 #ifdef XP_WIN
     tryNativeGL = false;
     tryANGLE = true;

dom/canvas/WebGLTextureUpload.cpp

@@ -2188,6 +2188,7 @@ WebGLTexture::CopyTexImage2D(TexImageTarget target, GLint level, GLenum internal
                              srcTotalWidth, srcTotalHeight, srcUsage, 0, 0, 0, width,
                              height, dstUsage))
     {
+        Truncate();
         return;
     }
 

dom/locales/en-US/chrome/plugins.properties

@@ -22,7 +22,6 @@ suffixes_label=Suffixes
 learn_more_label=Learn More
 
 # GMP Plugins
-#ifdef MOZ_GMP
 gmp_license_info=License information
 gmp_privacy_info=Privacy Information
 
@@ -31,4 +30,3 @@ openH264_description2=This plugin is automatically installed by Mozilla to compl
 
 widevine_name=Widevine Content Decryption Module provided by Google Inc.
 widevine_description2=Play back protected web video.
-#endif

dom/locales/jar.mn

@@ -15,7 +15,7 @@
   locale/@AB_CD@/global/global.dtd                             (%chrome/global.dtd)
   locale/@AB_CD@/global/appstrings.properties                  (%chrome/appstrings.properties)
   locale/@AB_CD@/global/global-strres.properties               (%chrome/global-strres.properties)
-* locale/@AB_CD@/global/plugins.properties                     (%chrome/plugins.properties)
+  locale/@AB_CD@/global/plugins.properties                     (%chrome/plugins.properties)
   locale/@AB_CD@/global/nsWebBrowserPersist.properties         (%chrome/nsWebBrowserPersist.properties)
   locale/@AB_CD@/global/xslt/xslt.properties                   (%chrome/xslt/xslt.properties)
   locale/@AB_CD@/global/dom/dom.properties                     (%chrome/dom/dom.properties)

dom/messagechannel/MessagePort.cpp

@@ -296,6 +296,11 @@ MessagePort::MessagePort(nsIGlobalObject* aGlobal)
 MessagePort::~MessagePort()
 {
   CloseForced();
+  MOZ_ASSERT(!mActor);
+  if (mActor) {
+    mActor->SetPort(nullptr);
+    mActor = nullptr;
+  }
   MOZ_ASSERT(!mWorkerHolder);
 }
 

dom/script/ModuleScript.cpp

@@ -53,29 +53,41 @@ LoadedScript::LoadedScript(ScriptKind aKind,
 LoadedScript::~LoadedScript() { DropJSObjects(this); }
 
 void LoadedScript::AssociateWithScript(JSScript* aScript) {
-  // Set a JSScript's private value to point to this object and
-  // increment our reference count. This is decremented by
-  // HostFinalizeTopLevelScript() below when the JSScript dies.
+  // Set a JSScript's private value to point to this object. The JS engine will
+  // increment our reference count by calling HostAddRefTopLevelScript(). This
+  // is decremented by HostReleaseTopLevelScript() below when the JSScript dies.
 
   MOZ_ASSERT(JS::GetScriptPrivate(aScript).isUndefined());
   JS::SetScriptPrivate(aScript, JS::PrivateValue(this));
-  AddRef();
 }
 
-void HostFinalizeTopLevelScript(JSFreeOp* aFop, const JS::Value& aPrivate) {
-  // Decrement the reference count of a LoadedScript object that is
-  // pointed to by a dying JSScript. The reference count was
-  // originally incremented by AssociateWithScript() above.
-
-  auto script = static_cast<LoadedScript*>(aPrivate.toPrivate());
-
+inline void CheckModuleScriptPrivate(LoadedScript* script,
+                                     const JS::Value& aPrivate) {
 #ifdef DEBUG
   if (script->IsModuleScript()) {
     JSObject* module = script->AsModuleScript()->mModuleRecord.unbarrieredGet();
     MOZ_ASSERT_IF(module, JS::GetModulePrivate(module) == aPrivate);
   }
 #endif
+}
 
+void HostAddRefTopLevelScript(const JS::Value& aPrivate) {
+  // Increment the reference count of a LoadedScript object that is now pointed
+  // to by a JSScript. The reference count is decremented by
+  // HostReleaseTopLevelScript() below.
+
+  auto script = static_cast<LoadedScript*>(aPrivate.toPrivate());
+  CheckModuleScriptPrivate(script, aPrivate);
+  script->AddRef();
+}
+
+void HostReleaseTopLevelScript(const JS::Value& aPrivate) {
+  // Decrement the reference count of a LoadedScript object that was pointed to
+  // by a JSScript. The reference count was originally incremented by
+  // HostAddRefTopLevelScript() above.
+
+  auto script = static_cast<LoadedScript*>(aPrivate.toPrivate());
+  CheckModuleScriptPrivate(script, aPrivate);
   script->Release();
 }
 
@@ -132,7 +144,6 @@ ModuleScript::UnlinkModuleRecord()
                this);
     JS::SetModulePrivate(mModuleRecord, JS::UndefinedValue());
     mModuleRecord = nullptr;
-    Release();
   }
 }
 
@@ -151,13 +162,13 @@ ModuleScript::SetModuleRecord(JS::Handle<JSObject*> aModuleRecord)
 
   mModuleRecord = aModuleRecord;
 
-  // Make module's host defined field point to this object and
-  // increment our reference count. This is decremented by
-  // UnlinkModuleRecord() above.
+  // Make module's host defined field point to this object. The JS engine will
+  // increment our reference count by calling HostAddRefTopLevelScript(). This
+  // is decremented when the field is cleared in UnlinkModuleRecord() above or
+  // when the module record dies.
   MOZ_ASSERT(JS::GetModulePrivate(mModuleRecord).isUndefined());
   JS::SetModulePrivate(mModuleRecord, JS::PrivateValue(this));
   HoldJSObjects(this);
-  AddRef();
 }
 
 void

dom/script/ModuleScript.h

@@ -18,7 +18,8 @@ namespace dom {
 
 class ScriptLoader;
 
-void HostFinalizeTopLevelScript(JSFreeOp* aFop, const JS::Value& aPrivate);
+void HostAddRefTopLevelScript(const JS::Value& aPrivate);
+void HostReleaseTopLevelScript(const JS::Value& aPrivate);
 
 class ClassicScript;
 class ModuleScript;
@@ -63,7 +64,6 @@ class ClassicScript final : public LoadedScript
 
 class ModuleScript final : public LoadedScript
 {
-  JS::Heap<JSObject*> mModuleRecord;
   JS::Heap<JS::Value> mParseError;
   JS::Heap<JS::Value> mErrorToRethrow;
 
@@ -74,6 +74,8 @@ public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_INHERITED(ModuleScript,
                                                          LoadedScript)
 
+  JS::Heap<JSObject*> mModuleRecord;
+
   ModuleScript(ScriptFetchOptions* aFetchOptions, nsIURI* aBaseURL);
 
   void SetModuleRecord(JS::Handle<JSObject*> aModuleRecord);
@@ -89,7 +91,7 @@ public:
 
   void UnlinkModuleRecord();
 
-  friend void HostFinalizeTopLevelScript(JSFreeOp*, const JS::Value&);
+  friend void CheckModuleScriptPrivate(LoadedScript*, const JS::Value&);
 };
 
 ClassicScript* LoadedScript::AsClassicScript() {

dom/script/ScriptLoader.cpp

@@ -185,7 +185,11 @@ ScriptLoadRequest::MaybeCancelOffThreadScript()
   }
 
   JSContext* cx = danger::GetJSContext();
-  JS::CancelOffThreadScript(cx, mOffThreadToken);
+  if (IsModuleRequest()) {
+    JS::CancelOffThreadModule(cx, mOffThreadToken);
+  } else {
+    JS::CancelOffThreadScript(cx, mOffThreadToken);
+  }
   mOffThreadToken = nullptr;
 }
 
@@ -1109,8 +1113,9 @@ void ScriptLoader::EnsureModuleHooksInitialized() {
 
   JS::SetModuleResolveHook(rt, HostResolveImportedModule);
   JS::SetModuleMetadataHook(jsapi.cx(), HostPopulateImportMeta);
-  JS::SetScriptPrivateFinalizeHook(jsapi.cx(), HostFinalizeTopLevelScript);
- 
+  JS::SetScriptPrivateReferenceHooks(jsapi.cx(), HostAddRefTopLevelScript,
+                                     HostReleaseTopLevelScript);
+
   Preferences::RegisterCallbackAndCall(DynamicImportPrefChangedCallback,
                                        "javascript.options.dynamicImport",
                                        (void*)nullptr);
@@ -2647,7 +2652,7 @@ ScriptLoader::OnStreamComplete(nsIIncrementalStreamLoader* aLoader,
   // Process our request and/or any pending ones
   ProcessPendingRequests();
 
-  return NS_OK;
+  return rv;
 }
 
 nsresult
@@ -2747,6 +2752,9 @@ ScriptLoader::HandleLoadError(ScriptLoadRequest *aRequest, nsresult aResult) {
       if (aRequest->isInList()) {
         RefPtr<ScriptLoadRequest> req = mDynamicImportRequests.Steal(aRequest);
         modReq->Cancel();
+        // FinishDynamicImport must happen exactly once for each dynamic import
+        // request. If the load is aborted we do it when we remove the request
+        // from mDynamicImportRequests.
         FinishDynamicImport(modReq, aResult);
       }
     } else {
@@ -2968,8 +2976,12 @@ ScriptLoader::ParsingComplete(bool aTerminated)
     for (ScriptLoadRequest* req = mDynamicImportRequests.getFirst(); req;
          req = req->getNext()) {
       req->Cancel();
+      // FinishDynamicImport must happen exactly once for each dynamic import
+      // request. If the load is aborted we do it when we remove the request
+      // from mDynamicImportRequests.
       FinishDynamicImport(req->AsModuleRequest(), NS_ERROR_ABORT);
     }
+    mDynamicImportRequests.Clear();
 
     if (mParserBlockingRequest) {
       mParserBlockingRequest->Cancel();

dom/security/nsMixedContentBlocker.cpp

@@ -729,10 +729,10 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
   docShell->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
   NS_ASSERTION(sameTypeRoot, "No root tree item from docshell!");
 
-  // When navigating an iframe, the iframe may be https
-  // but its parents may not be.  Check the parents to see if any of them are https.
-  // If none of the parents are https, allow the load.
-  if (aContentType == TYPE_SUBDOCUMENT && !rootHasSecureConnection) {
+  // When navigating an iframe, the iframe may be https but its parents may not
+  // be. Check the parents to see if any of them are https. If none of the
+  // parents are https, allow the load.
+  if (aContentType == TYPE_SUBDOCUMENT && !rootHasSecureConnection && !parentIsHttps) {
 
     bool httpsParentExists = false;
 

dom/svg/SVGUseElement.cpp

@@ -426,6 +426,17 @@ SVGUseElement::LookupHref()
   nsCOMPtr<nsIURI> targetURI;
   nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(targetURI), href,
                                             GetComposedDoc(), baseURI);
+  
+  // Do not allow 'data:' schemes in <use> elements.
+  // See spec update: https://github.com/w3c/svgwg/pull/901
+  if (targetURI) {
+    bool isData;
+    mozilla::Unused << targetURI->SchemeIs("data", &isData);
+    if (isData) {
+      return;
+    }
+  }
+  
   mSource.Reset(this, targetURI);
 }
 

js/src/builtin/ModuleObject.cpp

@@ -1607,7 +1607,10 @@ js::StartDynamicModuleImport(JSContext* cx, HandleValue referencingPrivate, Hand
 
     JS::ModuleDynamicImportHook importHook = cx->runtime()->moduleDynamicImportHook;
     MOZ_ASSERT(importHook);
+    cx->runtime()->addRefScriptPrivate(referencingPrivate);
     if (!importHook(cx, referencingPrivate, specifier, promise)) {
+        cx->runtime()->releaseScriptPrivate(referencingPrivate);
+
         if (!RejectPromiseWithPendingError(cx, promise))
             return nullptr;
         return promise;
@@ -1622,6 +1625,9 @@ js::FinishDynamicModuleImport(JSContext* cx, HandleValue referencingPrivate, Han
 {
     Handle<PromiseObject*> promise = promiseArg.as<PromiseObject>();
 
+    auto releasePrivate = mozilla::MakeScopeExit(
+        [&] { cx->runtime()->releaseScriptPrivate(referencingPrivate); });
+
     if (cx->isExceptionPending()) {
         return RejectPromiseWithPendingError(cx, promise);
     }

js/src/jsapi.cpp

@@ -4729,7 +4729,8 @@ JS::CompileModule(JSContext* cx, const ReadOnlyCompileOptions& options,
 JS_PUBLIC_API(void)
 JS::SetModulePrivate(JSObject* module, const JS::Value& value)
 {
-    module->as<ModuleObject>().scriptSourceObject()->setPrivate(value);
+    JSRuntime* rt = module->compartment()->runtimeFromMainThread();
+    module->as<ModuleObject>().scriptSourceObject()->setPrivate(rt, value);
 }
 
 JS_PUBLIC_API(JS::Value)
@@ -4741,7 +4742,8 @@ JS::GetModulePrivate(JSObject* module)
 JS_PUBLIC_API(void)
 JS::SetScriptPrivate(JSScript* script, const JS::Value& value)
 {
-    script->scriptSourceUnwrap().setPrivate(value);
+    JSRuntime* rt = script->compartment()->runtimeFromMainThread();
+    script->scriptSourceUnwrap().setPrivate(rt, value);
 }
 
 JS_PUBLIC_API(JS::Value)
@@ -4764,18 +4766,13 @@ JS::GetScriptedCallerPrivate(JSContext* cx)
   return FindScriptOrModulePrivateForScript(iter.script());
 }
 
-JS_PUBLIC_API(JS::ScriptPrivateFinalizeHook)
-JS::GetScriptPrivateFinalizeHook(JSContext* cx) 
-{
-  AssertHeapIsIdle(cx);
-  return cx->runtime()->scriptPrivateFinalizeHook;
-}
-
 JS_PUBLIC_API(void)
-JS::SetScriptPrivateFinalizeHook(JSContext* cx, JS::ScriptPrivateFinalizeHook func)
+JS::SetScriptPrivateReferenceHooks(JSContext* cx, JS::ScriptPrivateReferenceHook addRefHook,
+                                   JS::ScriptPrivateReferenceHook releaseHook)
 {
   AssertHeapIsIdle(cx);
-  cx->runtime()->scriptPrivateFinalizeHook = func;
+  cx->runtime()->scriptPrivateAddRefHook = addRefHook;
+  cx->runtime()->scriptPrivateReleaseHook = releaseHook;
 }
 
 JS_PUBLIC_API(bool)

js/src/jsapi.h

@@ -4432,24 +4432,18 @@ extern JS_PUBLIC_API(JS::Value)
 GetScriptedCallerPrivate(JSContext* cx);
 
 /**
- * A hook that's called whenever a script or module which has a private value
- * set with SetScriptPrivate() or SetModulePrivate() is finalized. This can be
- * used to clean up the private state. The private value is passed as an
- * argument.
+ * Hooks called when references to a script private value are created or
+ * destroyed. This allows use of a reference counted object as the
+ * script private.
  */
-using ScriptPrivateFinalizeHook = void (*)(JSFreeOp*, const JS::Value&);
-
-/**
- * Get the script private finalize hook for the runtime.
- */
-extern JS_PUBLIC_API(ScriptPrivateFinalizeHook)
-GetScriptPrivateFinalizeHook(JSContext* cx);
+using ScriptPrivateReferenceHook = void (*)(const JS::Value&);
 
 /**
  * Set the script private finalize hook for the runtime to the given function.
  */
 extern JS_PUBLIC_API(void)
-SetScriptPrivateFinalizeHook(JSContext* cx, ScriptPrivateFinalizeHook func);
+SetScriptPrivateReferenceHooks(JSContext* cx, ScriptPrivateReferenceHook addRefHook,
+                               ScriptPrivateReferenceHook releaseHook);
 
 /*
  * Perform the ModuleInstantiate operation on the given source text module

js/src/jsscript.cpp

@@ -1419,15 +1419,8 @@ ScriptSourceObject::finalize(FreeOp* fop, JSObject* obj)
     sso->source()->decref();
     sso->setReservedSlot(SOURCE_SLOT, PrivateValue(nullptr));
 
-    Value value = sso->canonicalPrivate();
-    if (!value.isUndefined()) {
-        // The embedding may need to dispose of its private data.
-        JS::AutoSuppressGCAnalysis suppressGC;
-        if (JS::ScriptPrivateFinalizeHook hook =
-            fop->runtime()->scriptPrivateFinalizeHook) {
-                hook(fop, value);
-            }
-    }
+    // Clear the private value, calling the release hook if necessary.
+    sso->setPrivate(fop->runtime(), UndefinedValue());
 }
 
 static const ClassOps ScriptSourceObjectClassOps = {
@@ -1532,6 +1525,25 @@ ScriptSourceObject::initFromOptions(JSContext* cx, HandleScriptSource source,
     return true;
 }
 
+void ScriptSourceObject::setPrivate(JSRuntime* rt, const Value& value)
+{
+  // Update the private value, calling addRef/release hooks if necessary
+  // to allow the embedding to maintain a reference count for the
+  // private data.
+  Value prevValue = getReservedSlot(PRIVATE_SLOT);
+  if (!prevValue.isUndefined()) {
+    if (auto releaseHook = rt->scriptPrivateReleaseHook) {
+      releaseHook(prevValue);
+    }
+  }
+  setReservedSlot(PRIVATE_SLOT, value);
+  if (!value.isUndefined()) {
+    if (auto addRefHook = rt->scriptPrivateAddRefHook) {
+      addRefHook(value);
+    }
+  }
+}
+
 /* static */ bool
 JSScript::loadSource(JSContext* cx, ScriptSource* ss, bool* worked)
 {

js/src/jsscript.h

@@ -675,9 +675,7 @@ class ScriptSourceObject : public NativeObject
         return static_cast<JSScript*>(untyped);
     }
 
-    void setPrivate(const Value& value) {
-        setReservedSlot(PRIVATE_SLOT, value);
-    }
+    void setPrivate(JSRuntime* rt, const Value& value);
 
     Value getPrivate() const {
         return getReservedSlot(PRIVATE_SLOT);

js/src/old-configure.in

@@ -925,11 +925,11 @@ case "$target" in
     ;;
 
 i*86-*-solaris*)
-    MOZ_FIX_LINK_PATHS="-L${DIST}/bin -R'\$\$ORIGIN':/usr/gcc/7/lib"
+    MOZ_FIX_LINK_PATHS="-L${DIST}/bin -R'\$\$ORIGIN':/usr/gcc/10/lib"
     ;;
 
 x86_64-*-solaris*)
-    MOZ_FIX_LINK_PATHS="-L${DIST}/bin -R'\$\$ORIGIN':/usr/gcc/7/lib/amd64"
+    MOZ_FIX_LINK_PATHS="-L${DIST}/bin -R'\$\$ORIGIN':/usr/gcc/10/lib/amd64"
     ;;
 
 esac

js/src/vm/Runtime.cpp

@@ -252,7 +252,8 @@ JSRuntime::JSRuntime(JSRuntime* parentRuntime)
     moduleResolveHook(),
     moduleMetadataHook(),
     moduleDynamicImportHook(),
-    scriptPrivateFinalizeHook()
+    scriptPrivateAddRefHook(),
+    scriptPrivateReleaseHook()
 {
     setGCStoreBufferPtr(&gc.storeBuffer);
 

js/src/vm/Runtime.h

@@ -1316,8 +1316,21 @@ struct JSRuntime : public JS::shadow::Runtime,
     // HostImportModuleDynamically.
     JS::ModuleDynamicImportHook moduleDynamicImportHook;
 
-    // A hook called on script finalization.
-    JS::ScriptPrivateFinalizeHook scriptPrivateFinalizeHook;
+    // Hooks called when script private references are created and destroyed.
+    JS::ScriptPrivateReferenceHook scriptPrivateAddRefHook;
+    JS::ScriptPrivateReferenceHook scriptPrivateReleaseHook;
+
+    void addRefScriptPrivate(const JS::Value& value) {
+      if (!value.isUndefined() && scriptPrivateAddRefHook) {
+        scriptPrivateAddRefHook(value);
+      }
+    }
+
+    void releaseScriptPrivate(const JS::Value& value) {
+      if (!value.isUndefined() && scriptPrivateReleaseHook) {
+        scriptPrivateReleaseHook(value);
+      }
+    }
 };
 
 namespace js {

layout/generic/nsTextFrame.cpp

@@ -711,7 +711,11 @@ GlyphObserver::NotifyGlyphsChanged()
 
 int32_t nsTextFrame::GetContentEnd() const {
   nsTextFrame* next = static_cast<nsTextFrame*>(GetNextContinuation());
-  return next ? next->GetContentOffset() : mContent->GetText()->GetLength();
+  // In case of allocation failure when setting/modifying the textfragment,
+  // it's possible our text might be missing. So we check the fragment length,
+  // in addition to the offset of the next continuation (if any).  
+  int32_t fragLen = mContent->GetText()->GetLength();
+  return next ? std::min(fragLen, next->GetContentOffset()) : fragLen;
 }
 
 struct FlowLengthProperty {
@@ -1078,8 +1082,8 @@ public:
     nsIFrame*    mAncestorControllingInitialBreak;
     
     int32_t GetContentEnd() {
-      return mEndFrame ? mEndFrame->GetContentOffset()
-          : mStartFrame->GetContent()->GetText()->GetLength();
+      int32_t fragLen = mStartFrame->GetContent()->GetText()->GetLength();
+      return mEndFrame ? std::min(fragLen, mEndFrame->GetContentOffset()) : fragLen;
     }
   };
 

memory/mozalloc/throw_gcc.h

@@ -6,6 +6,9 @@
 #ifndef mozilla_throw_gcc_h
 #define mozilla_throw_gcc_h
 
+// Wrapping shouldn't be needed on libcpp 14+
+#if !defined(_LIBCPP_VERSION) || _LIBCPP_VERSION < 14000
+
 #include "mozilla/Attributes.h"
 
 #include <stdio.h>              // snprintf
@@ -140,4 +143,6 @@ __throw_system_error(int err)
 
 #undef MOZ_THROW_NORETURN
 
+#endif // !_LIBCPP_VERSION || _LIBCPP_VERSION < 14000
+
 #endif  // mozilla_throw_gcc_h

modules/libpref/init/all.js

@@ -4288,6 +4288,13 @@ pref("webgl.dxgl.enabled", true);
 pref("webgl.dxgl.needs-finish", false);
 #endif
 
+// Disable ANGLE's validation layer?
+#ifdef XP_WIN
+pref("webgl.gl_khr_no_validation", false);
+#else
+pref("webgl.gl_khr_no_validation", true);
+#endif
+
 pref("gfx.offscreencanvas.enabled", false);
 
 // Stagefright prefs
@@ -5100,3 +5107,10 @@ pref("media.sourceErrorDetails.enabled", true);
 #else
 pref("media.sourceErrorDetails.enabled", false);
 #endif
+
+// Whether Navigator.Clipboard methods are a thing.
+pref("dom.events.asyncClipboard", false);
+// Whether arbitrary data transfer methods (not plaintext) are allowed.
+pref("dom.events.asyncClipboard.dataTransfer", false);
+// Whether to use ClipboardItem spec or not.
+pref("dom.events.asyncClipboard.clipboardItem", false);

netwerk/base/nsStandardURL.cpp

@@ -2541,7 +2541,15 @@ nsStandardURL::Resolve(const nsACString &in, nsACString &out)
         // locate result path
         resultPath = PL_strstr(result, "://");
         if (resultPath) {
-            resultPath = PL_strchr(resultPath + 3, '/');
+            // If there are multiple slashes after :// we must ignore them
+            // otherwise net_CoalesceDirs may think the host is a part of the path.
+            resultPath += 3;
+            if (protocol.IsEmpty() && !SegmentIs(mScheme,"file")) {
+              while (*resultPath == '/') {
+                resultPath++;
+              }
+            }
+            resultPath = PL_strchr(resultPath, '/');
             if (resultPath)
                 net_CoalesceDirs(coalesceFlag,resultPath);
         }

netwerk/cache2/CacheIOThread.cpp

@@ -417,6 +417,7 @@ void CacheIOThread::ThreadFunc()
       threadInternal->SetObserver(this);
 
     mXPCOMThread = xpcomThread.forget().take();
+    nsCOMPtr<nsIThread> thread = NS_GetCurrentThread();
 
     lock.NotifyAll();
 
@@ -437,7 +438,6 @@ loopStart:
         bool processedEvent;
         nsresult rv;
         do {
-          nsIThread *thread = mXPCOMThread;
           rv = thread->ProcessNextEvent(false, &processedEvent);
 
           MOZ_ASSERT(mBlockingIOWatcher);

netwerk/protocol/http/nsCORSListenerProxy.cpp

@@ -1038,13 +1038,6 @@ nsCORSListenerProxy::CheckPreflightNeeded(nsIChannel* aChannel, UpdateType aUpda
     return NS_OK;
   }
 
-  // A preflight is needed. But if we've already been cross-site, then
-  // we already did a preflight when that happened, and so we're not allowed
-  // to do another preflight again.
-  if (aUpdateType != UpdateType::InternalOrHSTSRedirect) {
-    NS_ENSURE_FALSE(mHasBeenCrossSite, NS_ERROR_DOM_BAD_URI);
-  }
-
   nsCOMPtr<nsIHttpChannelInternal> internal = do_QueryInterface(http);
   NS_ENSURE_TRUE(internal, NS_ERROR_DOM_BAD_URI);
 

old-configure.in

@@ -1127,9 +1127,9 @@ dnl default mode that relies on relative symlinks being handled a certain way.
     fi
 
     if test "$CPU_ARCH" = "x86"; then
-       MOZ_FIX_LINK_PATHS="-L${DIST}/bin -R'\$\$ORIGIN':/usr/gcc/7/lib"
+       MOZ_FIX_LINK_PATHS="-L${DIST}/bin -R'\$\$ORIGIN':/usr/gcc/10/lib"
     elif test "$CPU_ARCH" = "x86_64"; then
-       MOZ_FIX_LINK_PATHS="-L${DIST}/bin -R'\$\$ORIGIN':/usr/gcc/7/lib/amd64"
+       MOZ_FIX_LINK_PATHS="-L${DIST}/bin -R'\$\$ORIGIN':/usr/gcc/10/lib/amd64"
     fi    
     ;;
 
@@ -5250,10 +5250,6 @@ RC=
 dist=$MOZ_BUILD_ROOT/dist
 ac_configure_args="$_SUBDIR_CONFIG_ARGS"
 
-# --with-system-nspr will have been converted into the relevant $NSPR_CFLAGS
-# and $NSPR_LIBS.
-ac_configure_args="`echo $ac_configure_args | sed -e 's/--with-system-nspr\S* *//'`"
-
 if test -n "$NSPR_CFLAGS" -o -n "$NSPR_LIBS"; then
     ac_configure_args="$ac_configure_args --with-nspr-cflags='$NSPR_CFLAGS'"
     ac_configure_args="$ac_configure_args --with-nspr-libs='$NSPR_LIBS'"

python/mozbuild/mozbuild/action/generate_symbols_file.py

@@ -83,6 +83,20 @@ def generate_symbols_file(output, *args):
         # };
         output.write('{\nglobal:\n  %s;\nlocal:\n  *;\n};'
                      % ';\n  '.join(symbols))
+    elif buildconfig.substs['OS_TARGET'] == 'SunOS':
+        # A linker version script is generated for Sun LD that looks like the
+        # following:
+        # $mapfile_version 2
+        # SYMBOL_VERSION SUNW_1.1 {
+        # global:
+        #   symbol1;
+        #   symbol2;
+        #   ...
+        # local:
+        #   *;
+        # };
+        output.write('$mapfile_version 2\nSYMBOL_VERSION SUNW_1.1 {\nglobal:\n  %s;\nlocal:\n  *;\n};'
+                     % ';\n  '.join(symbols))
     elif buildconfig.substs['OS_TARGET'] == 'Darwin':
         # A list of symbols is generated for Apple ld that simply lists all
         # symbols, with an underscore prefix.

security/generate_mapfile.py

@@ -17,8 +17,6 @@ import buildconfig
 
 
 def main(output, input):
-    # There's a check in old-configure.in under the system-nss handling
-    # that should match this.
     if buildconfig.substs['OS_ARCH'] not in ('Linux', 'SunOS', 'Darwin', 'FreeBSD'):
         print "Error: unhandled OS_ARCH %s" % buildconfig.substs['OS_ARCH']
         return 1

toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties

@@ -58,9 +58,7 @@ notification.installError=There was an error installing %1$S.
 notification.installError.retry=Try again
 notification.installError.retry.tooltip=Try downloading and installing this add-on again
 #LOCALIZATION NOTE (notification.gmpPending) %1$S is the add-on name.
-#ifdef MOZ_GMP
 notification.gmpPending=%1$S will be installed shortly.
-#endif
 
 #LOCALIZATION NOTE (contributionAmount2) %S is the currency amount recommended for contributions
 contributionAmount2=Suggested Contribution: %S
@@ -103,9 +101,7 @@ details.notification.uninstall=%1$S will be uninstalled after you restart %2$S.
 #LOCALIZATION NOTE (details.notification.upgrade) %1$S is the add-on name, %2$S is brand name
 details.notification.upgrade=%1$S will be updated after you restart %2$S.
 #LOCALIZATION NOTE (details.notification.gmpPending) %1$S is the add-on name
-#ifdef MOZ_GMP
 details.notification.gmpPending=%1$S will be installed shortly.
-#endif
 
 installFromFile.dialogTitle=Select add-on to install
 installFromFile.filterName=Add-ons

toolkit/locales/jar.mn

@@ -96,7 +96,7 @@
   locale/@AB_CD@/mozapps/downloads/downloads.dtd                  (%chrome/mozapps/downloads/downloads.dtd)
   locale/@AB_CD@/mozapps/downloads/downloads.properties           (%chrome/mozapps/downloads/downloads.properties)
   locale/@AB_CD@/mozapps/extensions/extensions.dtd                (%chrome/mozapps/extensions/extensions.dtd)
-* locale/@AB_CD@/mozapps/extensions/extensions.properties         (%chrome/mozapps/extensions/extensions.properties)
+  locale/@AB_CD@/mozapps/extensions/extensions.properties         (%chrome/mozapps/extensions/extensions.properties)
   locale/@AB_CD@/mozapps/extensions/blocklist.dtd                 (%chrome/mozapps/extensions/blocklist.dtd)
   locale/@AB_CD@/mozapps/extensions/about.dtd                     (%chrome/mozapps/extensions/about.dtd)
   locale/@AB_CD@/mozapps/extensions/selectAddons.dtd              (%chrome/mozapps/extensions/selectAddons.dtd)

widget/GfxDriverInfo.cpp

@@ -15,7 +15,7 @@ uint64_t GfxDriverInfo::allDriverVersions = ~(uint64_t(0));
 GfxDeviceFamily* const GfxDriverInfo::allDevices = nullptr;
 
 GfxDeviceFamily* GfxDriverInfo::mDeviceFamilies[DeviceFamilyMax];
-nsAString* GfxDriverInfo::mDeviceVendors[DeviceVendorMax];
+nsString* GfxDriverInfo::mDeviceVendors[DeviceVendorMax];
 
 GfxDriverInfo::GfxDriverInfo()
   : mOperatingSystem(OperatingSystem::Unknown),

widget/GfxDriverInfo.h

@@ -165,7 +165,7 @@ struct GfxDriverInfo
   static GfxDeviceFamily* mDeviceFamilies[DeviceFamilyMax];
 
   static const nsAString& GetDeviceVendor(DeviceVendor id);
-  static nsAString* mDeviceVendors[DeviceVendorMax];
+  static nsString* mDeviceVendors[DeviceVendorMax];
 
   nsString mModel, mHardware, mProduct, mManufacturer;
 

xpcom/io/nsLocalFileUnix.cpp

@@ -1699,6 +1699,47 @@ nsLocalFile::Contains(nsIFile* aInFile, bool* aResult)
   return NS_OK;
 }
 
+static nsresult ReadLinkSafe(const nsCString& aTarget, int32_t aExpectedSize,
+                             nsACString& aOutBuffer) {
+  // If we call readlink with a buffer size S it returns S, then we cannot tell
+  // if the buffer was big enough to hold the entire path. We allocate an
+  // additional byte so we can check if the buffer was large enough.
+  const auto allocSize = CheckedInt<size_t>(aExpectedSize) + 1;
+  if (!allocSize.isValid()) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  auto result = aOutBuffer.BulkWrite(allocSize.value(), 0, false);
+  if (result.isErr()) {
+    return result.unwrapErr();
+  }
+
+  auto handle = result.unwrap();
+
+  while (true) {
+    ssize_t bytesWritten =
+        readlink(aTarget.get(), handle.Elements(), handle.Length());
+    if (bytesWritten < 0) {
+      return NSRESULT_FOR_ERRNO();
+    }
+
+    // written >= 0 so it is safe to cast to size_t.
+    if ((size_t)bytesWritten < handle.Length()) {
+      // Target might have changed since the lstat call, or lstat might lie, see
+      // bug 1791029.
+      handle.Finish(bytesWritten, false);
+      return NS_OK;
+    }
+
+    // The buffer was not large enough, so double it and try again.
+    auto restartResult = handle.RestartBulkWrite(handle.Length() * 2, 0, false);
+    if (restartResult.isErr()) {
+      return restartResult.unwrapErr();
+    }
+  }
+}
+
+
 NS_IMETHODIMP
 nsLocalFile::GetNativeTarget(nsACString& aResult)
 {
@@ -1714,21 +1755,12 @@ nsLocalFile::GetNativeTarget(nsACString& aResult)
     return NS_ERROR_FILE_INVALID_PATH;
   }
 
-  int32_t size = (int32_t)symStat.st_size;
   nsAutoCString target;
-  if (!target.SetLength(size, mozilla::fallible)) {
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsresult rv = ReadLinkSafe(mPath, symStat.st_size, target);
+  if (NS_FAILED(rv)) {
+    return rv;
   }
 
-  ssize_t written = readlink(mPath.get(), target.BeginWriting(), size_t(size));
-  if (written < 0) {
-    return NSRESULT_FOR_ERRNO();
-  }
-  // Target might have changed since the lstat call, or lstat might lie, see bug
-  // 1791029.
-  target.Truncate(written);
-
-  nsresult rv = NS_OK;
   nsCOMPtr<nsIFile> self(this);
   int32_t maxLinks = 40;
   while (true) {
@@ -1766,22 +1798,12 @@ nsLocalFile::GetNativeTarget(nsACString& aResult)
       break;
     }
 
-    int32_t newSize = (int32_t)symStat.st_size;
-    size = newSize;
     nsAutoCString newTarget;
-    if (!newTarget.SetLength(size, mozilla::fallible)) {
-      rv = NS_ERROR_OUT_OF_MEMORY;
+    rv = ReadLinkSafe(flatRetval, symStat.st_size, newTarget);
+    if (NS_FAILED(rv)) {
       break;
     }
 
-    ssize_t linkLen = readlink(flatRetval.get(), newTarget.BeginWriting(), size);
-    if (linkLen == -1) {
-      rv = NSRESULT_FOR_ERRNO();
-      break;
-    }
-    // Target might have changed since the lstat call, or lstat might lie, see bug
-    // 1791029.
-    newTarget.Truncate(linkLen);
     target = newTarget;
   }