Merge remote-tracking branch 'upstream/release' into release

NetworkNeighborhood · Nov 28, 2024 · aecbd14 · aecbd14
2 parents f09be76 + d8bc701
commit aecbd14
Show file tree

Hide file tree

Showing 23 changed files with 133 additions and 299 deletions.
diff --git a/.hgtags b/.hgtags
@@ -5455,3 +5455,7 @@ c0ead00b68efe97ad7b67eddda868c01ef55160b FIREFOX_133_0b9_RELEASE
 bb415f62ee5e9008ef76e7fca71d82f402e23079 FIREFOX_RELEASE_132_END
 24fce2fbde9596c27c0a5607a8f64614d3e884bf FIREFOX-ANDROID_133_0_BUILD1
 24fce2fbde9596c27c0a5607a8f64614d3e884bf FIREFOX_133_0_BUILD1
+8141aab3ba856d7cbae6c851dd71f2e0cb69649c FIREFOX-ANDROID_133_0_BUILD2
+8141aab3ba856d7cbae6c851dd71f2e0cb69649c FIREFOX_133_0_BUILD2
+8141aab3ba856d7cbae6c851dd71f2e0cb69649c FIREFOX_133_0_RELEASE
+8141aab3ba856d7cbae6c851dd71f2e0cb69649c FIREFOX-ANDROID_133_0_RELEASE
diff --git a/browser/config/version.txt b/browser/config/version.txt
@@ -1 +1 @@
-133.0
+133.0.1
diff --git a/browser/config/version_display.txt b/browser/config/version_display.txt
@@ -1 +1 @@
-133.0b2
+133.0.1b1
diff --git a/config/milestone.txt b/config/milestone.txt
@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-133.0
+133.0.1
diff --git a/docshell/base/nsDocShellLoadState.cpp b/docshell/base/nsDocShellLoadState.cpp
@@ -65,6 +65,7 @@ nsDocShellLoadState::nsDocShellLoadState(
   mForceAllowDataURI = aLoadState.ForceAllowDataURI();
   mIsExemptFromHTTPSFirstMode = aLoadState.IsExemptFromHTTPSFirstMode();
   mOriginalFrameSrc = aLoadState.OriginalFrameSrc();
+  mShouldCheckForRecursion = aLoadState.ShouldCheckForRecursion();
   mIsFormSubmission = aLoadState.IsFormSubmission();
   mLoadType = aLoadState.LoadType();
   mTarget = aLoadState.Target();
@@ -170,6 +171,7 @@ nsDocShellLoadState::nsDocShellLoadState(const nsDocShellLoadState& aOther)
       mIsExemptFromHTTPSFirstMode(aOther.mIsExemptFromHTTPSFirstMode),
       mHttpsFirstDowngradeData(aOther.GetHttpsFirstDowngradeData()),
       mOriginalFrameSrc(aOther.mOriginalFrameSrc),
+      mShouldCheckForRecursion(aOther.mShouldCheckForRecursion),
       mIsFormSubmission(aOther.mIsFormSubmission),
       mLoadType(aOther.mLoadType),
       mSHEntry(aOther.mSHEntry),
@@ -226,6 +228,7 @@ nsDocShellLoadState::nsDocShellLoadState(nsIURI* aURI, uint64_t aLoadIdentifier)
       mForceAllowDataURI(false),
       mIsExemptFromHTTPSFirstMode(false),
       mOriginalFrameSrc(false),
+      mShouldCheckForRecursion(false),
       mIsFormSubmission(false),
       mLoadType(LOAD_NORMAL),
       mSrcdocData(VoidString()),
@@ -669,6 +672,15 @@ void nsDocShellLoadState::SetOriginalFrameSrc(bool aOriginalFrameSrc) {
   mOriginalFrameSrc = aOriginalFrameSrc;
 }
 
+bool nsDocShellLoadState::ShouldCheckForRecursion() const {
+  return mShouldCheckForRecursion;
+}
+
+void nsDocShellLoadState::SetShouldCheckForRecursion(
+    bool aShouldCheckForRecursion) {
+  mShouldCheckForRecursion = aShouldCheckForRecursion;
+}
+
 bool nsDocShellLoadState::IsFormSubmission() const { return mIsFormSubmission; }
 
 void nsDocShellLoadState::SetIsFormSubmission(bool aIsFormSubmission) {
@@ -1309,6 +1321,7 @@ DocShellLoadStateInit nsDocShellLoadState::Serialize(
   loadState.ForceAllowDataURI() = mForceAllowDataURI;
   loadState.IsExemptFromHTTPSFirstMode() = mIsExemptFromHTTPSFirstMode;
   loadState.OriginalFrameSrc() = mOriginalFrameSrc;
+  loadState.ShouldCheckForRecursion() = mShouldCheckForRecursion;
   loadState.IsFormSubmission() = mIsFormSubmission;
   loadState.LoadType() = mLoadType;
   loadState.Target() = mTarget;

diff --git a/docshell/base/nsDocShellLoadState.h b/docshell/base/nsDocShellLoadState.h
@@ -158,6 +158,10 @@ class nsDocShellLoadState final {
 
   void SetOriginalFrameSrc(bool aOriginalFrameSrc);
 
+  bool ShouldCheckForRecursion() const;
+
+  void SetShouldCheckForRecursion(bool aShouldCheckForRecursion);
+
   bool IsFormSubmission() const;
 
   void SetIsFormSubmission(bool aIsFormSubmission);
@@ -510,6 +514,12 @@ class nsDocShellLoadState final {
   // element loading its original src (or srcdoc) attribute.
   bool mOriginalFrameSrc;
 
+  // If this attribute is true, this load corresponds to a frame, object, or
+  // embed element that needs a recursion check when loading it's src (or data).
+  // Unlike mOriginalFrameSrc, this attribute will always be set regardless
+  // whether we've loaded the src already.
+  bool mShouldCheckForRecursion;
+
   // If this attribute is true, then the load was initiated by a
   // form submission.
   bool mIsFormSubmission;

diff --git a/docshell/test/navigation/frame_recursive_target.html b/docshell/test/navigation/frame_recursive_target.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<iframe id="static"></iframe>
+<script>
+    const name = "frame_recursive_target";
+    const url = location.href;
+    const iframe = document.querySelector("iframe");
+    let isCrossOrigin = false;
+    try {
+        window.parent.location.hostname;
+    } catch (_) {
+        isCrossOrigin = true;
+    }
+
+    addEventListener("load", async () => {
+        await new Promise(resolve => {
+            iframe.addEventListener("load", resolve);
+            if (!isCrossOrigin) {
+                iframe.name = name;
+            }
+
+            iframe.src = url;
+        });
+
+        if (isCrossOrigin) {
+            const innerWin = iframe.contentWindow.document.querySelector("iframe");
+            await new Promise(resolve => {
+                innerWin.addEventListener("load", resolve);
+                window.open(url, name);
+            });
+        }
+    });
+</script>
diff --git a/docshell/test/navigation/mochitest.toml b/docshell/test/navigation/mochitest.toml
@@ -87,6 +87,7 @@ support-files = [
   "frame_6_out_of_6.html",
   "frame_recursive.html",
   "frame_recursive_dynamic.html",
+  "frame_recursive_target.html",
   "object_recursive_load.html",
   "file_nested_srcdoc.html",
 ]

diff --git a/docshell/test/navigation/test_recursive_frames.html b/docshell/test/navigation/test_recursive_frames.html
@@ -107,6 +107,16 @@
         "about:blank"
       ],
     },
+    { // navigating shouldn't be blocked by recursion check
+      frameId: "navigationIsNotRecursive",
+      expectedLocations: [
+        // eslint-disable-next-line @microsoft/sdl/no-insecure-url
+        "http://example.com/tests/docshell/test/navigation/frame_recursive_target.html",
+        "http://example.com/tests/docshell/test/navigation/frame_recursive_target.html",
+        "http://example.com/tests/docshell/test/navigation/frame_recursive_target.html",
+        "about:blank"
+      ],
+    },
   ];
 
   async function checkRecursiveLoad(level) {
@@ -172,6 +182,7 @@
   <object width="400" height="300" id="recursiveObject" data="http://sub2.xn--lt-uia.mochi.test:8888/tests/docshell/test/navigation/object_recursive_load.html"></object>
   <iframe id="nestedSrcdoc" srcdoc="Srcdoc that will embed an iframe &lt;iframe id=&quot;static&quot; src=&quot;http://example.com/tests/docshell/test/navigation/file_nested_srcdoc.html&quot;&gt;&lt;/iframe&gt;"></iframe>
   <iframe style="height: 100vh; width:25%;" id="dynamicrecursive" src="http://example.com/tests/docshell/test/navigation/frame_recursive_dynamic.html"></iframe>
+  <iframe style="height: 100vh; width:25%;" id="navigationIsNotRecursive" src="http://example.com/tests/docshell/test/navigation/frame_recursive_target.html"></iframe>
 </div>
 </body>
 </html>
diff --git a/dom/base/nsFrameLoader.cpp b/dom/base/nsFrameLoader.cpp
@@ -195,6 +195,7 @@ nsFrameLoader::nsFrameLoader(Element* aOwner, BrowsingContext* aBrowsingContext,
       mHideCalled(false),
       mNetworkCreated(aNetworkCreated),
       mLoadingOriginalSrc(false),
+      mShouldCheckForRecursion(false),
       mRemoteBrowserShown(false),
       mRemoteBrowserSized(false),
       mIsRemoteFrame(aIsRemoteFrame),
@@ -498,7 +499,8 @@ already_AddRefed<nsFrameLoader> nsFrameLoader::Recreate(
   return fl.forget();
 }
 
-void nsFrameLoader::LoadFrame(bool aOriginalSrc) {
+void nsFrameLoader::LoadFrame(bool aOriginalSrc,
+                              bool aShouldCheckForRecursion) {
   if (NS_WARN_IF(!mOwnerContent)) {
     return;
   }
@@ -554,7 +556,7 @@ void nsFrameLoader::LoadFrame(bool aOriginalSrc) {
   }
 
   if (NS_SUCCEEDED(rv)) {
-    rv = LoadURI(uri, principal, csp, aOriginalSrc);
+    rv = LoadURI(uri, principal, csp, aOriginalSrc, aShouldCheckForRecursion);
   }
 
   if (NS_FAILED(rv)) {
@@ -586,14 +588,16 @@ void nsFrameLoader::FireErrorEvent() {
 nsresult nsFrameLoader::LoadURI(nsIURI* aURI,
                                 nsIPrincipal* aTriggeringPrincipal,
                                 nsIContentSecurityPolicy* aCsp,
-                                bool aOriginalSrc) {
+                                bool aOriginalSrc,
+                                bool aShouldCheckForRecursion) {
   if (!aURI) return NS_ERROR_INVALID_POINTER;
   NS_ENSURE_STATE(!mDestroyCalled && mOwnerContent);
   MOZ_ASSERT(
       aTriggeringPrincipal,
       "Must have an explicit triggeringPrincipal to nsFrameLoader::LoadURI.");
 
   mLoadingOriginalSrc = aOriginalSrc;
+  mShouldCheckForRecursion = aShouldCheckForRecursion;
 
   nsCOMPtr<Document> doc = mOwnerContent->OwnerDoc();
 
@@ -626,6 +630,7 @@ void nsFrameLoader::ResumeLoad(uint64_t aPendingSwitchID) {
   }
 
   mLoadingOriginalSrc = false;
+  mShouldCheckForRecursion = false;
   mURIToLoad = nullptr;
   mPendingSwitchID = aPendingSwitchID;
   mTriggeringPrincipal = mOwnerContent->NodePrincipal();
@@ -659,6 +664,7 @@ nsresult nsFrameLoader::ReallyStartLoadingInternal() {
   if (!mPendingSwitchID) {
     loadState = new nsDocShellLoadState(mURIToLoad);
     loadState->SetOriginalFrameSrc(mLoadingOriginalSrc);
+    loadState->SetShouldCheckForRecursion(mShouldCheckForRecursion);
 
     // The triggering principal could be null if the frame is loaded other
     // than the src attribute, for example, the frame is sandboxed. In that
@@ -764,6 +770,7 @@ nsresult nsFrameLoader::ReallyStartLoadingInternal() {
   NS_ENSURE_SUCCESS(rv, rv);
 
   mLoadingOriginalSrc = false;
+  mShouldCheckForRecursion = false;
 
   // Kick off the load...
   bool tmpState = mNeedsAsyncDestroy;

diff --git a/dom/base/nsFrameLoader.h b/dom/base/nsFrameLoader.h
@@ -191,7 +191,7 @@ class nsFrameLoader final : public nsStubMutationObserver,
    * Start loading the frame. This method figures out what to load
    * from the owner content in the frame loader.
    */
-  void LoadFrame(bool aOriginalSrc);
+  void LoadFrame(bool aOriginalSrc, bool aShouldCheckForRecursion);
 
   /**
    * Loads the specified URI in this frame. Behaves identically to loadFrame,
@@ -207,7 +207,8 @@ class nsFrameLoader final : public nsStubMutationObserver,
    *        frame load is upgraded from http to https.
    */
   nsresult LoadURI(nsIURI* aURI, nsIPrincipal* aTriggeringPrincipal,
-                   nsIContentSecurityPolicy* aCsp, bool aOriginalSrc);
+                   nsIContentSecurityPolicy* aCsp, bool aOriginalSrc,
+                   bool aShouldCheckForRecursion);
 
   /**
    * Resume a redirected load within this frame.
@@ -549,6 +550,9 @@ class nsFrameLoader final : public nsStubMutationObserver,
   // attribute of the frame element.
   bool mLoadingOriginalSrc : 1;
 
+  // True if a pending load corresponds to the src attribute being changed.
+  bool mShouldCheckForRecursion : 1;
+
   bool mRemoteBrowserShown : 1;
   bool mRemoteBrowserSized : 1;
   bool mIsRemoteFrame : 1;

diff --git a/dom/base/nsFrameLoaderOwner.cpp b/dom/base/nsFrameLoaderOwner.cpp
@@ -257,7 +257,8 @@ void nsFrameLoaderOwner::ChangeRemoteness(
     if (aOptions.mPendingSwitchID.WasPassed()) {
       mFrameLoader->ResumeLoad(aOptions.mPendingSwitchID.Value());
     } else {
-      mFrameLoader->LoadFrame(false);
+      mFrameLoader->LoadFrame(/* aOriginalSrc */ false,
+                              /* aShouldCheckForRecursion */ false);
     }
   };
 

diff --git a/dom/base/nsObjectLoadingContent.cpp b/dom/base/nsObjectLoadingContent.cpp
@@ -1464,6 +1464,8 @@ nsresult nsObjectLoadingContent::OpenChannel() {
     auto referrerInfo = MakeRefPtr<ReferrerInfo>(*doc);
     loadState->SetReferrerInfo(referrerInfo);
 
+    loadState->SetShouldCheckForRecursion(true);
+
     chan =
         DocumentChannel::CreateForObject(loadState, loadInfo, loadFlags, shim);
     MOZ_ASSERT(chan);

diff --git a/dom/html/HTMLInputElement.cpp b/dom/html/HTMLInputElement.cpp
@@ -5745,7 +5745,7 @@ Nullable<uint32_t> HTMLInputElement::GetSelectionStart(ErrorResult& aRv) {
 }
 
 uint32_t HTMLInputElement::GetSelectionStartIgnoringType(ErrorResult& aRv) {
-  uint32_t selEnd, selStart;
+  uint32_t selEnd = 0, selStart = 0;
   GetSelectionRange(&selStart, &selEnd, aRv);
   return selStart;
 }
@@ -5776,7 +5776,7 @@ Nullable<uint32_t> HTMLInputElement::GetSelectionEnd(ErrorResult& aRv) {
 }
 
 uint32_t HTMLInputElement::GetSelectionEndIgnoringType(ErrorResult& aRv) {
-  uint32_t selEnd, selStart;
+  uint32_t selEnd = 0, selStart = 0;
   GetSelectionRange(&selStart, &selEnd, aRv);
   return selEnd;
 }

diff --git a/dom/html/nsGenericHTMLFrameElement.cpp b/dom/html/nsGenericHTMLFrameElement.cpp
@@ -174,7 +174,7 @@ void nsGenericHTMLFrameElement::LoadSrc() {
 
   bool origSrc = !mSrcLoadHappened;
   mSrcLoadHappened = true;
-  mFrameLoader->LoadFrame(origSrc);
+  mFrameLoader->LoadFrame(origSrc, /* aShouldCheckForRecursion */ true);
 }
 
 nsresult nsGenericHTMLFrameElement::BindToTree(BindContext& aContext,

diff --git a/dom/ipc/DOMTypes.ipdlh b/dom/ipc/DOMTypes.ipdlh
@@ -206,6 +206,7 @@ struct DocShellLoadStateInit
   bool ForceAllowDataURI;
   bool IsExemptFromHTTPSFirstMode;
   bool OriginalFrameSrc;
+  bool ShouldCheckForRecursion;
   bool IsFormSubmission;
   bool FirstParty;
   bool HasValidUserGestureActivation;

diff --git a/dom/quota/ActorsParent.cpp b/dom/quota/ActorsParent.cpp
@@ -3253,6 +3253,32 @@ QuotaManager::GetOrCreateTemporaryOriginDirectory(
   MOZ_ASSERT(IsTemporaryGroupInitializedInternal(aOriginMetadata));
   MOZ_ASSERT(IsTemporaryOriginInitializedInternal(aOriginMetadata));
 
+  // XXX Temporary band-aid fix until the root cause of uninitialized origins
+  // after obtaining a client directory lock via OpenClientDirectory is
+  // identified.
+  QM_TRY(
+      // Expression.
+      MOZ_TO_RESULT(IsTemporaryOriginInitializedInternal(aOriginMetadata))
+          .mapErr([](const nsresult rv) { return NS_ERROR_NOT_INITIALIZED; }),
+      // Custom return value.
+      QM_PROPAGATE,
+      // Cleanup function.
+      ([this, aOriginMetadata](const nsresult) {
+        MOZ_ALWAYS_SUCCEEDS(mOwningThread->Dispatch(
+            NS_NewRunnableFunction(
+                "QuotaManager::GetOrCreateTemporaryOriginDirectory",
+                [aOriginMetadata]() {
+                  QuotaManager* quotaManager = QuotaManager::Get();
+                  MOZ_ASSERT(quotaManager);
+
+                  OriginMetadataArray originMetadataArray;
+                  originMetadataArray.AppendElement(aOriginMetadata);
+
+                  quotaManager->NoteUninitializedOrigins(originMetadataArray);
+                }),
+            NS_DISPATCH_NORMAL));
+      }));
+
   QM_TRY_UNWRAP(auto directory, GetOriginDirectory(aOriginMetadata));
 
   QM_TRY_INSPECT(const bool& created, EnsureOriginDirectory(*directory));

diff --git a/dom/xul/XULFrameElement.cpp b/dom/xul/XULFrameElement.cpp
@@ -110,7 +110,8 @@ void XULFrameElement::LoadSrc() {
         *this, u"XULFrameLoaderCreated"_ns, CanBubble::eYes);
   }
 
-  mFrameLoader->LoadFrame(false);
+  mFrameLoader->LoadFrame(/* aOriginalSrc */ false,
+                          /* aShouldCheckForRecursion */ false);
 }
 
 void XULFrameElement::SwapFrameLoaders(HTMLIFrameElement& aOtherLoaderOwner,
-Original file line number
+Diff line change
@@ Expand Up / @@ -10,4 +10,4 @@ @@
     # hardcoded milestones in the tree from these two files.
     #--------------------------------------------------------
-.0
+.0.1