[tor-commits] [Git][tpo/applications/tor-browser][tor-browser-140.17.0esr-15.0-1] 7 commits: Bug 2056767: Shut down DocAccessibleParents before we shut down platform accessibility. a=pascalc

ma1 pushed to branch tor-browser-140.17.0esr-15.0-1 at The Tor Project / Applications / Tor Browser

Commits:

19837410

by James Teh at 2026-09-27T15:56:21+02:00

Bug 2056767: Shut down DocAccessibleParents before we shut down platform accessibility.  a=pascalc

Original Revision: https://phabricator.services.mozilla.com/D322228

Differential Revision: https://phabricator.services.mozilla.com/D323108

eca99650

by Rob Wu at 2026-09-27T17:19:00+02:00

Bug 2061470 - Don't drop __proto__ from webRequest bodies r=rpl

Differential Revision: https://phabricator.services.mozilla.com/D323631

bddd4de4

by Marco Bonardo at 2026-09-27T17:30:36+02:00

Bug 2066019.  a=pascalc

Original Revision: https://phabricator.services.mozilla.com/D321246

Differential Revision: https://phabricator.services.mozilla.com/D323563

e8ce3fe3

by Tom Schuster at 2026-09-27T17:32:19+02:00

Bug 2066321 - Update nonceable attribute checks for link elements. r=freddyb

Pending PR: https://github.com/w3c/webappsec-csp/pull/810

Differential Revision: https://phabricator.services.mozilla.com/D322966

5fd1f7de

by Leo Tenenbaum at 2026-09-27T17:41:10+02:00

Bug 2067172 -  a=pascalc

Original Revision: https://phabricator.services.mozilla.com/D321879

Differential Revision: https://phabricator.services.mozilla.com/D322306

43f705a3

by Iain Ireland at 2026-09-27T18:23:46+02:00

Bug 2068385: Fix PBL  a=pascalc

Original Revision: https://phabricator.services.mozilla.com/D323744

Differential Revision: https://phabricator.services.mozilla.com/D324712

b6746e50

by Iain Ireland at 2026-09-28T10:08:52+02:00

Bug 2068385: Don't support sparse arrays in SpreadMathMinMax  a=pascalc

Marking the testcase --slow because it takes 7+ minutes on my laptop in an opt-debug build.

Original Revision: https://phabricator.services.mozilla.com/D323120

Differential Revision: https://phabricator.services.mozilla.com/D324692

14 changed files:

accessible/base/DocManager.cpp
accessible/ipc/DocAccessibleParent.cpp
browser/components/places/content/controller.js
browser/components/places/tests/browser/browser_toolbar_drop_bookmarklet.js
browser/components/places/tests/browser/browser_toolbar_drop_multiple_with_bookmarklet.js
dom/base/nsContentUtils.cpp
dom/script/ScriptLoader.cpp
dom/security/nsContentSecurityUtils.cpp
js/src/jit/BaselineIC.cpp
js/src/jit/CacheIR.cpp
js/src/jit/CacheIRWriter.h
js/src/vm/PortableBaselineInterpret.cpp
toolkit/components/extensions/test/mochitest/test_ext_webrequest_upload.html
toolkit/components/extensions/webrequest/WebRequestUpload.sys.mjs

Changes:

accessible/base/DocManager.cpp

@@ -31,6 +31,10 @@
  #include "nsCoreUtils.h"
  #include "xpcAccessibleDocument.h"
 +#if defined(ANDROID)
 +#  include "mozilla/Monitor.h"
 +#endif
++
  using namespace mozilla;
  using namespace mozilla::a11y;
  using namespace mozilla::dom;
@@ -195,6 +199,18 @@ void DocManager::Shutdown() {
+   }
    ClearDocCache();
 +  // Even though remote documents aren't strictly managed by this DocManager
 +  // instance, destroy them now because they might depend on platform specific
 +  // state which is about to be torn down by PlatformShutdown. Iterate the array
 +  // backwards because destroying the document removes it from this array.
 +  if (sRemoteDocuments) {
 +#if defined(ANDROID)
 +    MonitorAutoLock mal(nsAccessibilityService::GetAndroidMonitor());
 +#endif
 +    for (size_t i = sRemoteDocuments->Length(); i-- > 0;) {
 +      (*sRemoteDocuments)[i]->Destroy();
 +    }
 +  }
+ }
  ////////////////////////////////////////////////////////////////////////////////

accessible/ipc/DocAccessibleParent.cpp

@@ -1241,15 +1241,14 @@ void DocAccessibleParent::MaybeInitWindowEmulation() {
      isActive = browserParent->GetDocShellIsActive();
+   }
 -  // onCreate is guaranteed to be called synchronously by
 -  // nsWinUtils::CreateNativeWindow, so this reference isn't really necessary.
 -  // However, static analysis complains without it.
    RefPtr<DocAccessibleParent> thisRef = this;
 -  nsWinUtils::NativeWindowCreateProc onCreate([thisRef](HWND aHwnd) -> void {
 -    ::SetPropW(aHwnd, kPropNameDocAccParent,
 -               reinterpret_cast<HANDLE>(thisRef.get()));
 -    thisRef->SetEmulatedWindowHandle(aHwnd);
 -  });
 +  nsWinUtils::NativeWindowCreateProc onCreate(
 +      [thisRef](HWND aHwnd) mutable -> void {
 +        thisRef->SetEmulatedWindowHandle(aHwnd);
 +        HANDLE val;
 +        thisRef.forget(&val);  // Release in SetEmulatedWindowHandle.
 +        ::SetPropW(aHwnd, kPropNameDocAccParent, val);
 +      });
    HWND parentWnd = reinterpret_cast<HWND>(rootDocument->GetNativeWindow());
    DebugOnly<HWND> hWnd = nsWinUtils::CreateNativeWindow(
@@ -1261,6 +1260,7 @@ void DocAccessibleParent::MaybeInitWindowEmulation() {
  void DocAccessibleParent::SetEmulatedWindowHandle(HWND aWindowHandle) {
    if (!aWindowHandle && mEmulatedWindowHandle && IsTopLevel()) {
      ::DestroyWindow(mEmulatedWindowHandle);
 +    Release();  // AddRef in MaybeInitWindowEmulation.
+   }
    mEmulatedWindowHandle = aWindowHandle;
+ }

browser/components/places/content/controller.js

@@ -1610,7 +1610,7 @@ var PlacesControllerDragHelper = {
          if (
            !flavor.startsWith("text/x-moz-place") &&
            (validNodes.length > 1 || dropCount > 1) &&
 -          validNodes.some(n => n.uri?.startsWith("_javascript_:"))
 +          validNodes.some(n => URL.parse(n.uri)?.protocol === "_javascript_:")
          ) {
            return false;
+         }
@@ -1687,18 +1687,14 @@ var PlacesControllerDragHelper = {
      if (
        externalDrag &&
        (nodes.length > 1 || dropCount > 1) &&
 -      nodes.some(n => n.uri?.startsWith("_javascript_:"))
 +      nodes.some(n => URL.parse(n.uri)?.protocol === "_javascript_:")
      ) {
        throw new Error("_javascript_ bookmarklet passed with uris");
+     }
      // If a single _javascript_ url is being dropped from the urlbar or an external source,
      // show the bookmark dialog as a speedbump protection against malicious cases.
 -    if (
 -      nodes.length == 1 &&
 -      externalDrag &&
 -      nodes[0].uri?.startsWith("_javascript_")
 -    ) {
 +    if (nodes.length == 1 && externalDrag) {
        let uri;
        try {
          uri = Services.io.newURI(nodes[0].uri);
@@ -1706,7 +1702,7 @@ var PlacesControllerDragHelper = {
          // Invalid uri, we skip this code and the entry will be discarded later.
+       }
 -      if (uri) {
 +      if (uri?.scheme === "_javascript_") {
          let bookmarkGuid = await PlacesUIUtils.showBookmarkDialog(
+           {
              action: "add",

browser/components/places/tests/browser/browser_toolbar_drop_bookmarklet.js

@@ -9,6 +9,7 @@ const sandbox = sinon.createSandbox();
  const URL1 = "https://example.com/1/";
  const URL2 = "https://example.com/2/";
  const BOOKMARKLET_URL = `_javascript_: (() => {alert('Hello, World!');})();`;
 +const BOOKMARKLET_URL_MIXED_CASE = `_javascript_: (() => {})();`;
  let bookmarks;
  registerCleanupFunction(async function () {
@@ -34,12 +35,18 @@ add_task(async function test() {
    Assert.ok(placesItems, "PlacesToolbarItems should not be null");
    /**
 -   * Simulates a drop of a bookmarklet URI onto the bookmarks bar.
 +   * Simulates a drop of a bookmarklet URI onto the bookmarks bar and verifies
 +   * the speedbump dialog appears.
+    *
     * @param {string} aEffect
     *        The effect to use for the drop operation: move, copy, or link.
 +   * @param {string} aBookmarkletUrl
 +   *        The bookmarklet URL to be dropped onto the bookmarks bar.
     */
 -  let simulateDragDrop = async function (aEffect) {
 +  let simulateBookmarkletDragDrop = async function (
 +    aEffect,
 +    aBookmarkletUrl = BOOKMARKLET_URL
 +  ) {
      info("Simulates drag/drop of a new _javascript_:URL to the bookmarks");
      await withBookmarksDialog(
        true,
@@ -47,7 +54,7 @@ add_task(async function test() {
          EventUtils.synthesizeDrop(
            toolbar,
            placesItems,
 -          [[{ type: "text/x-moz-url", data: BOOKMARKLET_URL }]],
 +          [[{ type: "text/x-moz-url", data: aBookmarkletUrl }]],
            aEffect,
            window
          );
@@ -61,11 +68,21 @@ add_task(async function test() {
          Assert.equal(
            location,
 -          BOOKMARKLET_URL,
 +          aBookmarkletUrl.trim().replace(/^_javascript_/i, "_javascript_"),
            "Should have opened the ShowBookmarksDialog with the correct bookmarklet url to be bookmarked"
          );
+       }
      );
 +  };
++
 +  for (let effect of ["copy", "link"]) {
 +    for (let bookmarkletUrl of [
 +      BOOKMARKLET_URL,
 +      BOOKMARKLET_URL_MIXED_CASE,
 +      ` _javascript_: (() => {})();`,
 +    ]) {
 +      await simulateBookmarkletDragDrop(effect, bookmarkletUrl);
 +    }
      info("Simulates drag/drop of a new URL to the bookmarks");
      let spy = sandbox
@@ -81,18 +98,13 @@ add_task(async function test() {
        toolbar,
        placesItems,
        [[{ type: "text/x-moz-url", data: URL1 }]],
 -      aEffect,
 +      effect,
        window
      );
      await promise;
      Assert.ok(spy.notCalled, "ShowBookmarksDialog on drop not called for url");
      sandbox.restore();
 -  };
+-
 -  let effects = ["copy", "link"];
 -  for (let effect of effects) {
 -    await simulateDragDrop(effect);
+   }
    info("Move of existing bookmark / bookmarklet on toolbar");

browser/components/places/tests/browser/browser_toolbar_drop_multiple_with_bookmarklet.js

@@ -18,12 +18,12 @@ add_task(async function test() {
    // matter because we will set its data, effect, and mimeType manually.
    let placesItems = document.getElementById("PlacesToolbarItems");
    Assert.ok(placesItems, "PlacesToolbarItems should not be null");
 -  let simulateDragDrop = async function (aEffect, aMimeType) {
 -    let urls = [
 -      "https://example.com/1/",
 -      `_javascript_: (() => {alert('Hello, World!');})();`,
 -      "https://example.com/2/",
 -    ];
 +  let simulateDragDrop = async function (
 +    aEffect,
 +    aMimeType,
 +    aJsUrl = `_javascript_: (() => {alert('Hello, World!');})();`
 +  ) {
 +    let urls = ["https://example.com/1/", aJsUrl, "https://example.com/2/"];
      let data = urls.map(spec => spec + "\n" + spec).join("\n");
@@ -43,8 +43,13 @@ add_task(async function test() {
    // Simulate a bookmark drop for all of the mime types and effects.
    let mimeType = ["text/x-moz-url"];
 -  let effects = ["copy", "link"];
 -  for (let effect of effects) {
 -    await simulateDragDrop(effect, mimeType);
 +  for (let effect of ["copy", "link"]) {
 +    for (let jsUrl of [
 +      `_javascript_: (() => {alert('Hello, World!');})();`,
 +      `_javascript_: (() => {})();`,
 +      ` _javascript_: (() => {})();`,
 +    ]) {
 +      await simulateDragDrop(effect, mimeType, jsUrl);
 +    }
+   }
  });

dom/base/nsContentUtils.cpp

@@ -5635,9 +5635,10 @@ void nsContentUtils::RequestFrameFocus(Element& aFrameElement, bool aCanRaise,
    RefPtr<Element> target = &aFrameElement;
    bool defaultAction = true;
    if (aCanRaise) {
 -    DispatchEventOnlyToChrome(target->OwnerDoc(), target,
 -                              u"framefocusrequested"_ns, CanBubble::eYes,
 -                              Cancelable::eYes, &defaultAction);
 +    RefPtr<Document> doc = target->OwnerDoc();
 +    DispatchEventOnlyToChrome(doc, target, u"framefocusrequested"_ns,
 +                              CanBubble::eYes, Cancelable::eYes,
 +                              &defaultAction);
+   }
    if (!defaultAction) {
      return;

dom/script/ScriptLoader.cpp

@@ -240,27 +240,27 @@ ScriptLoader::~ScriptLoader() {
      FireScriptAvailable(NS_ERROR_ABORT, mParserBlockingRequest);
+   }
 -  for (ScriptLoadRequest* req = mXSLTRequests.getFirst(); req;
 +  for (RefPtr<ScriptLoadRequest> req = mXSLTRequests.getFirst(); req;
         req = req->getNext()) {
      FireScriptAvailable(NS_ERROR_ABORT, req);
+   }
 -  for (ScriptLoadRequest* req = mDeferRequests.getFirst(); req;
 +  for (RefPtr<ScriptLoadRequest> req = mDeferRequests.getFirst(); req;
         req = req->getNext()) {
      FireScriptAvailable(NS_ERROR_ABORT, req);
+   }
 -  for (ScriptLoadRequest* req = mLoadingAsyncRequests.getFirst(); req;
 +  for (RefPtr<ScriptLoadRequest> req = mLoadingAsyncRequests.getFirst(); req;
         req = req->getNext()) {
      FireScriptAvailable(NS_ERROR_ABORT, req);
+   }
 -  for (ScriptLoadRequest* req = mLoadedAsyncRequests.getFirst(); req;
 +  for (RefPtr<ScriptLoadRequest> req = mLoadedAsyncRequests.getFirst(); req;
         req = req->getNext()) {
      FireScriptAvailable(NS_ERROR_ABORT, req);
+   }
 -  for (ScriptLoadRequest* req =
 +  for (RefPtr<ScriptLoadRequest> req =
             mNonAsyncExternalScriptInsertedRequests.getFirst();
         req; req = req->getNext()) {
      FireScriptAvailable(NS_ERROR_ABORT, req);

dom/security/nsContentSecurityUtils.cpp

@@ -1179,8 +1179,9 @@ nsString nsContentSecurityUtils::GetIsElementNonceableNonce(
    // element’s attribute list:
    if (nsCOMPtr<nsIScriptElement> script =
            do_QueryInterface(const_cast<Element*>(&aElement))) {
 -    auto containsScriptOrStyle = [](const nsAString& aStr) {
 -      return aStr.LowerCaseFindASCII("<script") != kNotFound ||
 +    auto containsLinkScriptOrStyle = [](const nsAString& aStr) {
 +      return aStr.LowerCaseFindASCII("<link") != kNotFound ||
 +             aStr.LowerCaseFindASCII("<script") != kNotFound ||
               aStr.LowerCaseFindASCII("<style") != kNotFound;
      };
@@ -1188,21 +1189,21 @@ nsString nsContentSecurityUtils::GetIsElementNonceableNonce(
      uint32_t i = 0;
      while (BorrowedAttrInfo info = aElement.GetAttrInfoAt(i++)) {
        // Step 2.1. If attribute’s name contains an ASCII case-insensitive match
 -      // for "<script" or "<style", return "Not Nonceable".
 +      // for "<link", <script" or "<style", return "Not Nonceable".
        const nsAttrName* name = info.mName;
        if (nsAtom* prefix = name->GetPrefix()) {
 -        if (containsScriptOrStyle(nsDependentAtomString(prefix))) {
 +        if (containsLinkScriptOrStyle(nsDependentAtomString(prefix))) {
            return EmptyString();
+         }
+       }
 -      if (containsScriptOrStyle(nsDependentAtomString(name->LocalName()))) {
 +      if (containsLinkScriptOrStyle(nsDependentAtomString(name->LocalName()))) {
          return EmptyString();
+       }
        // Step 2.2. If attribute’s value contains an ASCII case-insensitive match
 -      // for "<script" or "<style", return "Not Nonceable".
 +      // for "<link", "<script" or "<style", return "Not Nonceable".
        info.mValue->ToString(value);
 -      if (containsScriptOrStyle(value)) {
 +      if (containsLinkScriptOrStyle(value)) {
          return EmptyString();
+       }
+     }

js/src/jit/BaselineIC.cpp

@@ -1735,10 +1735,15 @@ bool DoSpreadCallFallback(JSContext* cx, BaselineFrame* frame,
    // Transition stub state to megamorphic or generic if warranted.
    MaybeTransition(cx, frame, stub);
 +  // The array is required to be packed, but may have indexed properties
 +  // if its length exceeds MAX_DENSE_ELEMENTS_COUNT. Don't optimize in
 +  // that case.
 +  bool isIndexed = arr.toObject().as<NativeObject>().isIndexed();
++
    // Try attaching a call stub.
    bool handled = false;
    if (op != JSOp::SpreadEval && op != JSOp::StrictSpreadEval &&
 -      stub->state().canAttachStub()) {
 +      stub->state().canAttachStub() && !isIndexed) {
      // Try CacheIR first:
      Rooted<ArrayObject*> aobj(cx, &arr.toObject().as<ArrayObject>());
      MOZ_ASSERT(IsPackedArray(aobj));

js/src/jit/CacheIR.cpp

@@ -6431,7 +6431,9 @@ ObjOperandId InlinableNativeIRGenerator::emitLoadArgsArray() {
    MOZ_ASSERT(!hasBoundArguments());
    if (flags_.getArgFormat() == CallFlags::Spread) {
 -    return writer.loadSpreadArgs();
 +    ObjOperandId result = writer.loadSpreadArgs();
 +    writer.guardArrayIsPacked(result);
 +    return result;
+   }
    MOZ_ASSERT(flags_.getArgFormat() == CallFlags::FunApplyArray);

js/src/jit/CacheIRWriter.h

@@ -523,7 +523,13 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter {
      ArgumentKind kind = ArgumentKind::Arg0;
      uint32_t argc = 1;
      CallFlags flags(CallFlags::Spread);
 -    return ObjOperandId(loadArgumentFixedSlot(kind, argc, flags).id());
 +    ValOperandId argId = loadArgumentFixedSlot(kind, argc, flags);
 +#ifdef ENABLE_PORTABLE_BASELINE_INTERP
 +    // PBL doesn't support implicit unboxing of objects.
 +    return guardToObject(argId);
 +#else
 +    return ObjOperandId(argId.id());
 +#endif
+   }
    void callScriptedFunction(ObjOperandId callee, Int32OperandId argc,

js/src/vm/PortableBaselineInterpret.cpp

@@ -3915,11 +3915,8 @@ uint64_t ICInterpretOps(uint64_t arg0, uint64_t arg1, ICStub* stub,
        CACHEOP_CASE(Int32MinMaxArrayResult) {
          ObjOperandId arrayId = cacheIRReader.objOperandId();
          bool isMax = cacheIRReader.readBool();
 -        // ICs that use this opcode depend on implicit unboxing due to
 -        // type-overload on ObjOperandId when a value is loaded
 -        // directly from an argument slot. We explicitly unbox here.
          NativeObject* nobj = reinterpret_cast<NativeObject*>(
 -            &READ_VALUE_REG(arrayId.id()).toObject());
 +            READ_REG(arrayId.id()));
          uint32_t len = nobj->getDenseInitializedLength();
          if (len == 0) {
            FAIL_IC();
@@ -3948,11 +3945,8 @@ uint64_t ICInterpretOps(uint64_t arg0, uint64_t arg1, ICStub* stub,
        CACHEOP_CASE(NumberMinMaxArrayResult) {
          ObjOperandId arrayId = cacheIRReader.objOperandId();
          bool isMax = cacheIRReader.readBool();
 -        // ICs that use this opcode depend on implicit unboxing due to
 -        // type-overload on ObjOperandId when a value is loaded
 -        // directly from an argument slot. We explicitly unbox here.
          NativeObject* nobj = reinterpret_cast<NativeObject*>(
 -            &READ_VALUE_REG(arrayId.id()).toObject());
 +            READ_REG(arrayId.id()));
          uint32_t len = nobj->getDenseInitializedLength();
          if (len == 0) {
            FAIL_IC();

toolkit/components/extensions/test/mochitest/test_ext_webrequest_upload.html

@@ -27,6 +27,7 @@
    enctype="multipart/form-data"
+   >
  <input type="text" name="textInput2" value="value2">
 +<input type="text" name="__proto__" value="regression test for bug 2061470">
  <input type="file" name="testFile">
  <input type="file" name="emptyFile">
  </form>
@@ -161,11 +162,19 @@ add_task(async function test_xhr_forms() {
+     }
      let action = new URL(form.action);
      let formData = new FormData(form);
 -    let webRequestFD = {};
      let updateActionURL = () => {
 +      let webRequestFD = {};
        for (let name of formData.keys()) {
 -        webRequestFD[name] = name in uploads ? [uploads[name].fileName] : formData.getAll(name);
 +        if (Object.hasOwn(webRequestFD, name)) {
 +          // Ignore duplicate keys; formData.getAll already read all values.
 +          continue;
 +        }
 +        const value = Object.hasOwn(uploads, name) ? [uploads[name].fileName] : formData.getAll(name);
 +        // Cannot use webRequestFD[name] = value, because for "__proto__" as
 +        // name, that would trigger the Object.prototype.__proto__ setter
 +        // instead of defining a data property.
 +        Object.defineProperty(webRequestFD, name, { value, enumerable: true });
+       }
        action.searchParams.set("upload", JSON.stringify(webRequestFD));
        action.searchParams.set("enctype", form.enctype);

toolkit/components/extensions/webrequest/WebRequestUpload.sys.mjs

@@ -117,22 +117,6 @@ class Headers extends Map {
+   }
+ }
 -/**
 - * Creates a new Object with a corresponding property for every
 - * key-value pair in the given Map.
 - *
 - * @param {Map} map
 - *        The map to convert.
 - * @returns {object}
 - */
 -function mapToObject(map) {
 -  let result = {};
 -  for (let [key, value] of map) {
 -    result[key] = value;
 -  }
 -  return result;
 -}
+-
  /**
   * Rewinds the given seekable input stream to its beginning, and catches
   * any resulting errors.
@@ -446,7 +430,7 @@ function createFormData(stream, channel, lenient) {
    try {
      let formData = parseFormData(stream, channel, lenient);
      if (formData) {
 -      return mapToObject(formData);
 +      return Object.fromEntries(formData);
+     }
    } catch (e) {
      Cu.reportError(e);