Merge pull request #1037 from Floorp-Projects/upstream-esr115-2024032…

…5022327

Pull upstream

.hgtags

@@ -4399,3 +4399,6 @@ aa9f02961b2bbb92e17fea5d6b8fd14c097baf72 FIREFOX_115_6_0esr_RELEASE
 17fcbdf6426663c10da5d0ba21927e71184304c3 FIREFOX_115_8_0esr_RELEASE
 f3dd0afed51cb7283d4fa06a0c40286eee657e30 FIREFOX_115_9_0esr_BUILD1
 423e963b3d9b923e3c7fae8eae2f626f02c15cf2 FIREFOX_115_9_0esr_BUILD2
+423e963b3d9b923e3c7fae8eae2f626f02c15cf2 FIREFOX_115_9_0esr_RELEASE
+f65068dc82bf6051f520551ba5497a5985877d47 FIREFOX_115_9_1esr_BUILD1
+f65068dc82bf6051f520551ba5497a5985877d47 FIREFOX_115_9_1esr_RELEASE

CLOBBER

@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Merge day clobber 2024-02-19
+Merge day clobber 2024-03-18

browser/base/content/test/popupNotifications/browser_popupNotification_security_delay.js

@@ -5,6 +5,8 @@
 
 const TEST_SECURITY_DELAY = 5000;
 
+SimpleTest.requestCompleteLog();
+
 /**
  * Shows a test PopupNotification.
  */
@@ -395,3 +397,166 @@ add_task(async function test_notificationWindowMove() {
   // Reset window position
   window.moveTo(screenX, screenY);
 });
+
+/**
+ * Tests that the security delay gets extended if a notification is shown during
+ * a full screen transition.
+ */
+add_task(async function test_notificationDuringFullScreenTransition() {
+  // Log full screen transition messages.
+  let loggingObserver = {
+    observe(subject, topic) {
+      info("Observed topic: " + topic);
+    },
+  };
+  Services.obs.addObserver(loggingObserver, "fullscreen-transition-start");
+  Services.obs.addObserver(loggingObserver, "fullscreen-transition-end");
+  // Unregister observers when the test ends:
+  registerCleanupFunction(() => {
+    Services.obs.removeObserver(loggingObserver, "fullscreen-transition-start");
+    Services.obs.removeObserver(loggingObserver, "fullscreen-transition-end");
+  });
+
+  if (Services.appinfo.OS == "Linux") {
+    ok(
+      "Skipping test on Linux because of disabled full screen transition in CI."
+    );
+    return;
+  }
+  // Bug 1882527: Intermittent failures on macOS.
+  if (Services.appinfo.OS == "Darwin") {
+    ok("Skipping test on macOS because of intermittent failures.");
+    return;
+  }
+
+  await BrowserTestUtils.withNewTab("https://example.com", async browser => {
+    await SpecialPowers.pushPrefEnv({
+      set: [
+        // Set a short security delay so we can observe it being extended.
+        ["security.notification_enable_delay", 1],
+        // Set a longer full screen exit transition so the test works on slow builds.
+        ["full-screen-api.transition-duration.leave", "1000 1000"],
+        // Waive the user activation requirement for full screen requests.
+        // The PoC this test is based on relies on spam clicking which grants
+        // user activation in the popup that requests full screen.
+        // This isn't reliable in automation.
+        ["full-screen-api.allow-trusted-requests-only", false],
+        // macOS native full screen is not affected by the full screen
+        // transition overlap. Test with the old full screen implementation.
+        ["full-screen-api.macos-native-full-screen", false],
+      ],
+    });
+
+    await ensureSecurityDelayReady();
+
+    ok(
+      !PopupNotifications.isPanelOpen,
+      "PopupNotification panel should not be open initially."
+    );
+
+    info("Open a notification.");
+    let popupShownPromise = waitForNotificationPanel();
+    showNotification();
+    await popupShownPromise;
+    ok(
+      PopupNotifications.isPanelOpen,
+      "PopupNotification should be open after show call."
+    );
+
+    let notification = PopupNotifications.getNotification("foo", browser);
+    is(notification?.id, "foo", "There should be a notification with id foo");
+
+    info(
+      "Open a new tab via window.open, enter full screen and remove the tab."
+    );
+
+    // There are two transitions, one for full screen entry and one for full screen exit.
+    let transitionStartCount = 0;
+    let transitionEndCount = 0;
+    let promiseFullScreenTransitionStart = TestUtils.topicObserved(
+      "fullscreen-transition-start",
+      () => {
+        transitionStartCount++;
+        return transitionStartCount == 2;
+      }
+    );
+    let promiseFullScreenTransitionEnd = TestUtils.topicObserved(
+      "fullscreen-transition-end",
+      () => {
+        transitionEndCount++;
+        return transitionEndCount == 2;
+      }
+    );
+    let notificationShownPromise = waitForNotificationPanel();
+
+    await SpecialPowers.spawn(browser, [], () => {
+      // Use eval to execute in the privilege context of the website.
+      content.eval(`
+           let button = document.createElement("button");
+           button.id = "triggerBtn";
+           button.innerText = "Open Popup";
+           button.addEventListener("click", () => {
+             let popup = window.open("about:blank");
+             popup.document.write(
+               "<script>setTimeout(() => document.documentElement.requestFullscreen(), 500)</script>"
+             );
+             popup.document.write(
+               "<script>setTimeout(() => window.close(), 1500)</script>"
+             );
+           });
+           // Insert button at the top so the synthesized click works. Otherwise
+           // the button may be outside of the viewport.
+           document.body.prepend(button);
+         `);
+    });
+
+    let timeClick = performance.now();
+    await BrowserTestUtils.synthesizeMouseAtCenter("#triggerBtn", {}, browser);
+
+    info("Wait for the exit transition to start. It's the second transition.");
+    await promiseFullScreenTransitionStart;
+    info("Full screen transition start");
+    ok(true, "Full screen transition started");
+    ok(
+      window.isInFullScreenTransition,
+      "Full screen transition is still running."
+    );
+
+    info(
+      "Wait for notification to re-show on tab switch, after the popup has been closed"
+    );
+    await notificationShownPromise;
+    ok(
+      window.isInFullScreenTransition,
+      "Full screen transition is still running."
+    );
+    info(
+      "about to trigger notification. time between btn click and notification show: " +
+        (performance.now() - timeClick)
+    );
+
+    info(
+      "Trigger main action via button click during the extended security delay."
+    );
+    triggerMainCommand(PopupNotifications.panel);
+
+    await new Promise(resolve => setTimeout(resolve, 0));
+
+    ok(
+      PopupNotifications.isPanelOpen,
+      "PopupNotification should still be open."
+    );
+    notification = PopupNotifications.getNotification(
+      "foo",
+      gBrowser.selectedBrowser
+    );
+    ok(
+      notification,
+      "Notification should still be open because we clicked during the security delay."
+    );
+
+    info("Wait for full screen transition end.");
+    await promiseFullScreenTransitionEnd;
+    info("Full screen transition end");
+  });
+});

browser/components/sessionstore/SessionStore.sys.mjs

@@ -1454,6 +1454,13 @@ var SessionStoreInternal = {
    * and thus enables communication with OOP tabs.
    */
   receiveMessage(aMessage) {
+    if (Services.appinfo.sessionHistoryInParent) {
+      throw new Error(
+        `received unexpected message '${aMessage.name}' with ` +
+          `sessionHistoryInParent enabled`
+      );
+    }
+
     // If we got here, that means we're dealing with a frame message
     // manager message, so the target will be a <xul:browser>.
     var browser = aMessage.target;
@@ -1632,14 +1639,14 @@ var SessionStoreInternal = {
     // internal data about the window.
     aWindow.__SSi = this._generateWindowID();
 
-    let mm = aWindow.getGroupMessageManager("browsers");
-    MESSAGES.forEach(msg => {
-      let listenWhenClosed = CLOSED_MESSAGES.has(msg);
-      mm.addMessageListener(msg, this, listenWhenClosed);
-    });
-
-    // Load the frame script after registering listeners.
     if (!Services.appinfo.sessionHistoryInParent) {
+      let mm = aWindow.getGroupMessageManager("browsers");
+      MESSAGES.forEach(msg => {
+        let listenWhenClosed = CLOSED_MESSAGES.has(msg);
+        mm.addMessageListener(msg, this, listenWhenClosed);
+      });
+
+      // Load the frame script after registering listeners.
       mm.loadFrameScript(
         "chrome://browser/content/content-sessionStore.js",
         true,
@@ -2123,8 +2130,10 @@ var SessionStoreInternal = {
     // Cache the window state until it is completely gone.
     DyingWindowCache.set(aWindow, winData);
 
-    let mm = aWindow.getGroupMessageManager("browsers");
-    MESSAGES.forEach(msg => mm.removeMessageListener(msg, this));
+    if (!Services.appinfo.sessionHistoryInParent) {
+      let mm = aWindow.getGroupMessageManager("browsers");
+      MESSAGES.forEach(msg => mm.removeMessageListener(msg, this));
+    }
 
     this._saveableClosedWindowData.delete(winData);
     delete aWindow.__SSi;

browser/config/version.txt

@@ -1 +1 @@
-115.9.0
+115.10.0

config/milestone.txt

@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-115.9.0
+115.10.0

dom/media/MediaData.h

@@ -94,8 +94,16 @@ class AlignedBuffer {
   }
 
   AlignedBuffer& operator=(AlignedBuffer&& aOther) {
-    this->~AlignedBuffer();
-    new (this) AlignedBuffer(std::move(aOther));
+    if (&aOther == this) {
+      return *this;
+    }
+    mData = aOther.mData;
+    mLength = aOther.mLength;
+    mBuffer = std::move(aOther.mBuffer);
+    mCapacity = aOther.mCapacity;
+    aOther.mData = nullptr;
+    aOther.mLength = 0;
+    aOther.mCapacity = 0;
     return *this;
   }
 

dom/security/featurepolicy/test/mochitest/mochitest.ini

@@ -9,3 +9,4 @@ support-files =
 [test_parser.html]
 fail-if = xorigin
 [test_featureList.html]
+[test_initial_aboutblank.html]

dom/security/featurepolicy/test/mochitest/test_initial_aboutblank.html

@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test feature policy - Initial about:blank</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<iframe name="parentIframe" allow="fullscreen 'none'" srcdoc="
+  <iframe name='regular'></iframe>
+  <iframe name='transient'></iframe>
+  <script>transient.stop()</script>
+"></iframe>
+
+<script type="text/javascript">
+add_task(function testAboutBlank() {
+  isDeeply(frames[0].transient.document.featurePolicy.allowedFeatures(),
+           frames[0].document.featurePolicy.allowedFeatures(),
+           "check allowed feature list for initial about:blank");
+  isDeeply(frames[0].regular.document.featurePolicy.allowedFeatures(),
+           frames[0].document.featurePolicy.allowedFeatures(),
+           "check allowed feature list for real load about:blank");
+});
+</script>
+</body>
+</html>

js/src/jit/CacheIR.cpp

@@ -498,9 +498,14 @@ enum class NativeGetPropKind {
 
 static NativeGetPropKind IsCacheableGetPropCall(NativeObject* obj,
                                                 NativeObject* holder,
-                                                PropertyInfo prop) {
+                                                PropertyInfo prop,
+                                                jsbytecode* pc = nullptr) {
   MOZ_ASSERT(IsCacheableProtoChain(obj, holder));
 
+  if (pc && JSOp(*pc) == JSOp::GetBoundName) {
+    return NativeGetPropKind::None;
+  }
+
   if (!prop.isAccessorProperty()) {
     return NativeGetPropKind::None;
   }
@@ -593,7 +598,7 @@ static NativeGetPropKind CanAttachNativeGetProp(JSContext* cx, JSObject* obj,
       return NativeGetPropKind::Slot;
     }
 
-    return IsCacheableGetPropCall(nobj, *holder, propInfo->ref());
+    return IsCacheableGetPropCall(nobj, *holder, propInfo->ref(), pc);
   }
 
   if (!prop.isFound()) {
@@ -3130,7 +3135,7 @@ AttachDecision GetNameIRGenerator::tryAttachGlobalNameGetter(ObjOperandId objId,
 
   GlobalObject* global = &globalLexical->global();
 
-  NativeGetPropKind kind = IsCacheableGetPropCall(global, holder, *prop);
+  NativeGetPropKind kind = IsCacheableGetPropCall(global, holder, *prop, pc_);
   if (kind != NativeGetPropKind::NativeGetter &&
       kind != NativeGetPropKind::ScriptedGetter) {
     return AttachDecision::NoAction;

js/src/jit/IonAnalysis.cpp

@@ -747,13 +747,13 @@ static bool IsDiamondPattern(MBasicBlock* initialBlock) {
   MTest* initialTest = ins->toTest();
 
   MBasicBlock* trueBranch = initialTest->ifTrue();
-  if (trueBranch->numPredecessors() != 1 || trueBranch->numSuccessors() != 1) {
+  if (trueBranch->numPredecessors() != 1 || !trueBranch->lastIns()->isGoto()) {
     return false;
   }
 
   MBasicBlock* falseBranch = initialTest->ifFalse();
   if (falseBranch->numPredecessors() != 1 ||
-      falseBranch->numSuccessors() != 1) {
+      !falseBranch->lastIns()->isGoto()) {
     return false;
   }
 

security/manager/ssl/StaticHPKPins.h

@@ -775,4 +775,4 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
 
 static const int32_t kUnknownId = -1;
 
-static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1718621565713000);
+static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1719496503162000);