, because
+ // after "removing" the custom elements data, this is again a known
+ // built-in and thus defined element.
+ SetDefined(!nsContentUtils::IsCustomElementName(NodeInfo()->NameAtom(),
+ NodeInfo()->NamespaceID()));
+
+ nsExtendedDOMSlots* slots = ExtendedDOMSlots();
+ slots->mCustomElementData = nullptr;
+}
+
nsTArray
>& Element::EnsureCustomStates() {
MOZ_ASSERT(IsHTMLElement());
nsExtendedDOMSlots* slots = ExtendedDOMSlots();
diff -Nru thunderbird-140.11.0esr/dom/base/Element.h thunderbird-140.12.0esr/dom/base/Element.h
--- thunderbird-140.11.0esr/dom/base/Element.h 2026-05-15 21:31:19.000000000 +0000
+++ thunderbird-140.12.0esr/dom/base/Element.h 2026-06-13 03:47:55.000000000 +0000
@@ -676,6 +676,8 @@
*/
void SetCustomElementData(UniquePtr aData);
+ void ClearCustomElementData();
+
nsTArray>& EnsureCustomStates();
/**
diff -Nru thunderbird-140.11.0esr/dom/base/nsContentUtils.cpp thunderbird-140.12.0esr/dom/base/nsContentUtils.cpp
--- thunderbird-140.11.0esr/dom/base/nsContentUtils.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/base/nsContentUtils.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -10147,19 +10147,24 @@
return CheckedInt(numEncodedChars) * maxCharExtraSpace;
}
+static void AppendEncodedAtomAttributeValue(nsAtom* aAtom,
+ StringBuilder& aBuilder) {
+ nsDependentAtomString atomStr(aAtom);
+ auto space = ExtraSpaceNeededForAttrEncoding(atomStr);
+ if (space.isValid() && !space.value()) {
+ aBuilder.Append(aAtom);
+ } else {
+ aBuilder.AppendWithAttrEncode(nsString(atomStr), space + atomStr.Length());
+ }
+}
+
static void AppendEncodedAttributeValue(const nsAttrValue& aValue,
StringBuilder& aBuilder) {
if (nsAtom* atom = aValue.GetStoredAtom()) {
- nsDependentAtomString atomStr(atom);
- auto space = ExtraSpaceNeededForAttrEncoding(atomStr);
- if (space.isValid() && !space.value()) {
- aBuilder.Append(atom);
- } else {
- aBuilder.AppendWithAttrEncode(nsString(atomStr),
- space + atomStr.Length());
- }
+ AppendEncodedAtomAttributeValue(atom, aBuilder);
return;
}
+
// NOTE(emilio): In most cases this will just be a reference to the stored
// nsStringBuffer.
nsString str;
@@ -10188,7 +10193,7 @@
nsAtom* isAttr = ceData->GetIs(aElement);
if (isAttr && !aElement->HasAttr(nsGkAtoms::is)) {
aBuilder.Append(uR"( is=")");
- aBuilder.Append(isAttr);
+ AppendEncodedAtomAttributeValue(isAttr, aBuilder);
aBuilder.Append(uR"(")");
}
}
diff -Nru thunderbird-140.11.0esr/dom/base/nsINode.h thunderbird-140.12.0esr/dom/base/nsINode.h
--- thunderbird-140.11.0esr/dom/base/nsINode.h 2026-05-15 21:31:19.000000000 +0000
+++ thunderbird-140.12.0esr/dom/base/nsINode.h 2026-06-13 03:47:55.000000000 +0000
@@ -2216,6 +2216,9 @@
bool HasCustomElementData() const {
return GetBoolFlag(ElementHasCustomElementData);
}
+ void ClearHasCustomElementData() {
+ ClearBoolFlag(ElementHasCustomElementData);
+ }
void SetElementCreatedFromPrototypeAndHasUnmodifiedL10n() {
SetBoolFlag(ElementCreatedFromPrototypeAndHasUnmodifiedL10n);
diff -Nru thunderbird-140.11.0esr/dom/base/nsObjectLoadingContent.cpp thunderbird-140.12.0esr/dom/base/nsObjectLoadingContent.cpp
--- thunderbird-140.11.0esr/dom/base/nsObjectLoadingContent.cpp 2026-05-15 21:31:19.000000000 +0000
+++ thunderbird-140.12.0esr/dom/base/nsObjectLoadingContent.cpp 2026-06-13 03:47:55.000000000 +0000
@@ -298,7 +298,8 @@
NS_GetFinalChannelURI(mChannel, getter_AddRefs(mURI)));
}
- return mFinalListener->OnStartRequest(aRequest);
+ nsCOMPtr listener = mFinalListener;
+ return listener->OnStartRequest(aRequest);
}
// Otherwise we should be state loading, and call LoadObject with the channel
diff -Nru thunderbird-140.11.0esr/dom/base/nsSyncLoadService.cpp thunderbird-140.12.0esr/dom/base/nsSyncLoadService.cpp
--- thunderbird-140.11.0esr/dom/base/nsSyncLoadService.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/base/nsSyncLoadService.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -100,12 +100,14 @@
channel->SetContentType("text/xml"_ns);
}
- return mListener->OnStartRequest(aRequest);
+ nsCOMPtr listener = mListener;
+ return listener->OnStartRequest(aRequest);
}
NS_IMETHODIMP
nsForceXMLListener::OnStopRequest(nsIRequest* aRequest, nsresult aStatusCode) {
- return mListener->OnStopRequest(aRequest, aStatusCode);
+ nsCOMPtr listener = mListener;
+ return listener->OnStopRequest(aRequest, aStatusCode);
}
nsSyncLoader::~nsSyncLoader() {
@@ -244,7 +246,8 @@
NS_IMETHODIMP
nsSyncLoader::OnStartRequest(nsIRequest* aRequest) {
- return mListener->OnStartRequest(aRequest);
+ nsCOMPtr listener = mListener;
+ return listener->OnStartRequest(aRequest);
}
NS_IMETHODIMP
@@ -252,7 +255,8 @@
if (NS_SUCCEEDED(mAsyncLoadStatus) && NS_FAILED(aStatusCode)) {
mAsyncLoadStatus = aStatusCode;
}
- nsresult rv = mListener->OnStopRequest(aRequest, aStatusCode);
+ nsCOMPtr listener = mListener;
+ nsresult rv = listener->OnStopRequest(aRequest, aStatusCode);
if (NS_SUCCEEDED(mAsyncLoadStatus) && NS_FAILED(rv)) {
mAsyncLoadStatus = rv;
}
diff -Nru thunderbird-140.11.0esr/dom/base/nsTreeSanitizer.cpp thunderbird-140.12.0esr/dom/base/nsTreeSanitizer.cpp
--- thunderbird-140.11.0esr/dom/base/nsTreeSanitizer.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/base/nsTreeSanitizer.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -11,6 +11,7 @@
#include "mozilla/DeclarationBlock.h"
#include "mozilla/StaticPrefs_dom.h"
#include "mozilla/StyleSheetInlines.h"
+#include "mozilla/dom/CustomElementRegistry.h"
#include "mozilla/dom/DocumentFragment.h"
#include "mozilla/dom/HTMLFormElement.h"
#include "mozilla/dom/HTMLTemplateElement.h"
@@ -1448,6 +1449,11 @@
NS_ASSERTION(ns == kNameSpaceID_XHTML || ns == kNameSpaceID_SVG ||
ns == kNameSpaceID_MathML,
"Should have only HTML, MathML or SVG here!");
+ if (elt->HasCustomElementData()) {
+ MOZ_ASSERT(elt->GetCustomElementData()->GetIs(elt),
+ "CustomElementData without an |is| attribute?");
+ elt->ClearCustomElementData();
+ }
AllowedAttributes allowed;
if (ns == kNameSpaceID_XHTML) {
allowed.mNames = sAttributesHTML;
diff -Nru thunderbird-140.11.0esr/dom/bindings/Codegen.py thunderbird-140.12.0esr/dom/bindings/Codegen.py
--- thunderbird-140.11.0esr/dom/bindings/Codegen.py 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/bindings/Codegen.py 2026-06-13 03:47:55.000000000 +0000
@@ -2121,7 +2121,33 @@
def finalizeHook(descriptor, gcx, obj):
+ def cleanUpObservableArrayProxy(descriptor, obj):
+ ret = ""
+ parent = descriptor.interface.parent
+ if parent:
+ ret += cleanUpObservableArrayProxy(
+ descriptor.getDescriptor(parent.identifier.name), obj
+ )
+ for m in descriptor.interface.members:
+ if m.isAttr() and m.type.isObservableArray():
+ ret += fill(
+ """
+ {
+ JS::Value val = JS::GetReservedSlot(${obj}, ${slot});
+ if (!val.isUndefined()) {
+ JSObject* obj = &val.toObject();
+ js::SetProxyReservedSlot(obj, OBSERVABLE_ARRAY_DOM_INTERFACE_SLOT, JS::UndefinedValue());
+ }
+ }
+ """,
+ obj=obj,
+ slot=memberReservedSlot(m, descriptor),
+ )
+ return ret
+
finalize = "JS::SetReservedSlot(%s, DOM_OBJECT_SLOT, JS::UndefinedValue());\n" % obj
+ finalize += cleanUpObservableArrayProxy(descriptor, obj)
+
if descriptor.interface.getExtendedAttribute("LegacyOverrideBuiltIns"):
finalize += fill(
"""
@@ -2145,20 +2171,6 @@
""",
obj=obj,
)
- for m in descriptor.interface.members:
- if m.isAttr() and m.type.isObservableArray():
- finalize += fill(
- """
- {
- JS::Value val = JS::GetReservedSlot(obj, ${slot});
- if (!val.isUndefined()) {
- JSObject* obj = &val.toObject();
- js::SetProxyReservedSlot(obj, OBSERVABLE_ARRAY_DOM_INTERFACE_SLOT, JS::UndefinedValue());
- }
- }
- """,
- slot=memberReservedSlot(m, descriptor),
- )
iface = getReflectedHTMLAttributesIface(descriptor)
if iface:
finalize += "%s::ReflectedHTMLAttributeSlots::Finalize(%s);\n" % (
diff -Nru thunderbird-140.11.0esr/dom/canvas/WebGL2Context.cpp thunderbird-140.12.0esr/dom/canvas/WebGL2Context.cpp
--- thunderbird-140.11.0esr/dom/canvas/WebGL2Context.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/WebGL2Context.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -118,6 +118,10 @@
gl->GetIntAs(LOCAL_GL_MIN_PROGRAM_TEXEL_OFFSET);
mGLMaxProgramTexelOffset =
gl->GetIntAs(LOCAL_GL_MAX_PROGRAM_TEXEL_OFFSET);
+ mGLMaxVertexUniformBlocks =
+ gl->GetIntAs(LOCAL_GL_MAX_VERTEX_UNIFORM_BLOCKS);
+ mGLMaxFragmentUniformBlocks =
+ gl->GetIntAs(LOCAL_GL_MAX_FRAGMENT_UNIFORM_BLOCKS);
mIndexedUniformBufferBindings.resize(mLimits->maxUniformBufferBindings);
diff -Nru thunderbird-140.11.0esr/dom/canvas/WebGL2ContextBuffers.cpp thunderbird-140.12.0esr/dom/canvas/WebGL2ContextBuffers.cpp
--- thunderbird-140.11.0esr/dom/canvas/WebGL2ContextBuffers.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/WebGL2ContextBuffers.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -75,6 +75,22 @@
gl->fCopyBufferSubData(readTarget, writeTarget, readOffset, writeOffset,
size);
+ // Update the destination index cache if needed.
+ if (writeBuffer->mIndexCache) {
+ MOZ_ASSERT(readBuffer->mIndexCache);
+ if (readBuffer->mIndexCache) {
+ // The read and write ranges have been validated above by fnValidateOffsetSize.
+ // If allocated, the size of mIndexCache is always mByteLength.
+ const auto* src =
+ static_cast(readBuffer->mIndexCache.get()) +
+ readOffset;
+ auto* dst =
+ static_cast(writeBuffer->mIndexCache.get()) + writeOffset;
+ memcpy(dst, src, size);
+ }
+ writeBuffer->InvalidateCacheRange(writeOffset, size);
+ }
+
writeBuffer->ResetLastUpdateFenceId();
}
diff -Nru thunderbird-140.11.0esr/dom/canvas/WebGLBuffer.cpp thunderbird-140.12.0esr/dom/canvas/WebGLBuffer.cpp
--- thunderbird-140.11.0esr/dom/canvas/WebGLBuffer.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/WebGLBuffer.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -118,7 +118,7 @@
UniqueBuffer newIndexCache;
const bool needsIndexCache = mContext->mNeedsIndexValidation ||
mContext->mMaybeNeedsLegacyVertexAttrib0Handling;
- if (target == LOCAL_GL_ELEMENT_ARRAY_BUFFER && needsIndexCache) {
+ if (mContent == WebGLBuffer::Kind::ElementArray && needsIndexCache) {
newIndexCache = UniqueBuffer::Take(malloc(AssertedCast(size)));
if (!newIndexCache) {
mContext->ErrorOutOfMemory("Failed to alloc index cache.");
diff -Nru thunderbird-140.11.0esr/dom/canvas/WebGLContext.h thunderbird-140.12.0esr/dom/canvas/WebGLContext.h
--- thunderbird-140.11.0esr/dom/canvas/WebGLContext.h 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/WebGLContext.h 2026-06-13 03:47:56.000000000 +0000
@@ -969,6 +969,8 @@
// ES3:
uint32_t mGLMinProgramTexelOffset = 0;
uint32_t mGLMaxProgramTexelOffset = 0;
+ uint32_t mGLMaxVertexUniformBlocks = 0;
+ uint32_t mGLMaxFragmentUniformBlocks = 0;
public:
auto GLMaxDrawBuffers() const { return mLimits->maxColorDrawBuffers; }
diff -Nru thunderbird-140.11.0esr/dom/canvas/WebGLContextValidate.cpp thunderbird-140.12.0esr/dom/canvas/WebGLContextValidate.cpp
--- thunderbird-140.11.0esr/dom/canvas/WebGLContextValidate.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/WebGLContextValidate.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -241,6 +241,12 @@
if (webgl.IsWebGL2() ||
limits.supportedExtensions[WebGLExtensionID::WEBGL_draw_buffers]) {
gl.GetUIntegerv(LOCAL_GL_MAX_DRAW_BUFFERS, &limits.maxColorDrawBuffers);
+ // The driver may report `MAX_DRAW_BUFFERS` larger than the compile-time
+ // `webgl::kMaxDrawBuffers` that sizes all per-color-buffer host state (e.g.
+ // `WebGLFramebuffer::mColorAttachments`). Clamp so attachment indices
+ // derived from this limit can never exceed those fixed-size arrays.
+ limits.maxColorDrawBuffers =
+ std::min(limits.maxColorDrawBuffers, uint32_t{webgl::kMaxDrawBuffers});
}
if (limits.supportedExtensions[WebGLExtensionID::EXT_disjoint_timer_query]) {
diff -Nru thunderbird-140.11.0esr/dom/canvas/WebGLShaderValidator.cpp thunderbird-140.12.0esr/dom/canvas/WebGLShaderValidator.cpp
--- thunderbird-140.11.0esr/dom/canvas/WebGLShaderValidator.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/WebGLShaderValidator.cpp 2026-06-13 03:47:55.000000000 +0000
@@ -150,6 +150,8 @@
if (IsWebGL2()) {
resources.MinProgramTexelOffset = mGLMinProgramTexelOffset;
resources.MaxProgramTexelOffset = mGLMaxProgramTexelOffset;
+ resources.MaxVertexUniformBlocks = mGLMaxVertexUniformBlocks;
+ resources.MaxFragmentUniformBlocks = mGLMaxFragmentUniformBlocks;
}
resources.MaxDrawBuffers = MaxValidDrawBuffers();
@@ -212,8 +214,12 @@
// -
- const auto compileOptions =
- webgl::ChooseValidatorCompileOptions(resources, gl);
+ auto compileOptions = webgl::ChooseValidatorCompileOptions(resources, gl);
+
+ if (IsWebGL2()) {
+ compileOptions.validatePerStageMaxUniformBlocks = true;
+ }
+
auto ret = webgl::ShaderValidator::Create(shaderType, spec, outputLanguage,
resources, compileOptions);
if (!ret) return ret;
diff -Nru thunderbird-140.11.0esr/dom/canvas/WebGLTransformFeedback.cpp thunderbird-140.12.0esr/dom/canvas/WebGLTransformFeedback.cpp
--- thunderbird-140.11.0esr/dom/canvas/WebGLTransformFeedback.cpp 2026-05-15 21:31:19.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/WebGLTransformFeedback.cpp 2026-06-13 03:47:55.000000000 +0000
@@ -30,33 +30,24 @@
////////////////////////////////////////
-void WebGLTransformFeedback::BeginTransformFeedback(GLenum primMode) {
- if (mIsActive) return mContext->ErrorInvalidOperation("Already active.");
-
- switch (primMode) {
- case LOCAL_GL_POINTS:
- case LOCAL_GL_LINES:
- case LOCAL_GL_TRIANGLES:
- break;
- default:
- mContext->ErrorInvalidEnum(
- "`primitiveMode` must be one of POINTS, LINES, or"
- " TRIANGLES.");
- return;
- }
-
+/// Do some validation when beginning/resuming the TF, and compute the
+/// vertex capacity.
+bool WebGLTransformFeedback::PrepareTransformFeedback() {
const auto& prog = mContext->mCurrentProgram;
+
if (!prog || !prog->IsLinked() ||
prog->LinkInfo()->componentsPerTFVert.empty()) {
mContext->ErrorInvalidOperation(
"Current program not valid for transform"
" feedback.");
- return;
+ return false;
}
const auto& linkInfo = prog->LinkInfo();
const auto& componentsPerTFVert = linkInfo->componentsPerTFVert;
+ mActive_VertCapacity = 0;
+
size_t minVertCapacity = SIZE_MAX;
for (size_t i = 0; i < componentsPerTFVert.size(); i++) {
const auto& indexedBinding = mIndexedBindings[i];
@@ -68,7 +59,7 @@
"No buffer attached to required transform"
" feedback index %u.",
(uint32_t)i);
- return;
+ return false;
}
for (const auto iBound : IntegerRange(mIndexedBindings.size())) {
@@ -77,7 +68,7 @@
mContext->GenErrorIllegalUse(
LOCAL_GL_TRANSFORM_FEEDBACK_BUFFER, static_cast(i),
LOCAL_GL_TRANSFORM_FEEDBACK_BUFFER, static_cast(iBound));
- return;
+ return false;
}
}
@@ -85,6 +76,30 @@
minVertCapacity = std::min(minVertCapacity, vertCapacity);
}
+ mActive_VertCapacity = minVertCapacity;
+
+ return true;
+}
+
+void WebGLTransformFeedback::BeginTransformFeedback(GLenum primMode) {
+ if (mIsActive) return mContext->ErrorInvalidOperation("Already active.");
+
+ switch (primMode) {
+ case LOCAL_GL_POINTS:
+ case LOCAL_GL_LINES:
+ case LOCAL_GL_TRIANGLES:
+ break;
+ default:
+ mContext->ErrorInvalidEnum(
+ "`primitiveMode` must be one of POINTS, LINES, or"
+ " TRIANGLES.");
+ return;
+ }
+
+ if (!PrepareTransformFeedback()) {
+ return;
+ }
+
////
const auto& gl = mContext->gl;
@@ -95,10 +110,9 @@
mIsActive = true;
MOZ_ASSERT(!mIsPaused);
- mActive_Program = prog;
+ mActive_Program = mContext->mCurrentProgram;
mActive_PrimMode = primMode;
mActive_VertPosition = 0;
- mActive_VertCapacity = minVertCapacity;
////
@@ -159,6 +173,12 @@
return;
}
+ // Re-run prepare in case some of the buffers have been modified
+ // while the TF was paused.
+ if (!PrepareTransformFeedback()) {
+ return;
+ }
+
////
const auto& gl = mContext->gl;
diff -Nru thunderbird-140.11.0esr/dom/canvas/WebGLTransformFeedback.h thunderbird-140.12.0esr/dom/canvas/WebGLTransformFeedback.h
--- thunderbird-140.11.0esr/dom/canvas/WebGLTransformFeedback.h 2026-05-15 21:31:19.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/WebGLTransformFeedback.h 2026-06-13 03:47:55.000000000 +0000
@@ -47,6 +47,7 @@
private:
~WebGLTransformFeedback() override;
+ bool PrepareTransformFeedback();
public:
bool IsActiveAndNotPaused() const { return mIsActive && !mIsPaused; }
diff -Nru thunderbird-140.11.0esr/dom/canvas/test/webgl-conf/generated-mochitest.toml thunderbird-140.12.0esr/dom/canvas/test/webgl-conf/generated-mochitest.toml
--- thunderbird-140.11.0esr/dom/canvas/test/webgl-conf/generated-mochitest.toml 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/test/webgl-conf/generated-mochitest.toml 2026-06-13 03:47:56.000000000 +0000
@@ -8406,6 +8406,8 @@
"win11_2009",
"os == 'win' && os_version == '11.26100' && processor == 'x86'",
"os == 'win' && os_version == '11.26100' && processor == 'x86_64'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86_64'",
]
["generated/test_2_conformance2__textures__misc__tex-3d-size-limit.html"]
@@ -8458,7 +8460,9 @@
"os == 'mac' && os_version == '15.30' && arch == 'aarch64'",
"win11_2009",
"os == 'win' && os_version == '11.26100' && processor == 'x86'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86'",
"os == 'win' && os_version == '11.26100' && processor == 'x86_64'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86_64'",
]
["generated/test_2_conformance2__textures__misc__tex-new-formats.html"]
diff -Nru thunderbird-140.11.0esr/dom/canvas/test/webgl-conf/mochitest-errata.toml thunderbird-140.12.0esr/dom/canvas/test/webgl-conf/mochitest-errata.toml
--- thunderbird-140.11.0esr/dom/canvas/test/webgl-conf/mochitest-errata.toml 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/test/webgl-conf/mochitest-errata.toml 2026-06-13 03:47:55.000000000 +0000
@@ -1957,14 +1957,18 @@
"os == 'mac' && os_version == '15.30' && arch == 'aarch64'",
"win11_2009",
"os == 'win' && os_version == '11.26100' && processor == 'x86'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86'",
"os == 'win' && os_version == '11.26100' && processor == 'x86_64'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86_64'",
]
["generated/test_2_conformance2__textures__misc__tex-3d-mipmap-levels-intel-bug.html"]
fail-if = [
"win11_2009",
"os == 'win' && os_version == '11.26100' && processor == 'x86'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86'",
"os == 'win' && os_version == '11.26100' && processor == 'x86_64'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86_64'",
]
["generated/test_2_conformance2__textures__video__tex-3d-r16f-red-float.html"]
diff -Nru thunderbird-140.11.0esr/dom/canvas/test/webgl-mochitest/mochitest.toml thunderbird-140.12.0esr/dom/canvas/test/webgl-mochitest/mochitest.toml
--- thunderbird-140.11.0esr/dom/canvas/test/webgl-mochitest/mochitest.toml 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/test/webgl-mochitest/mochitest.toml 2026-06-13 03:47:56.000000000 +0000
@@ -79,7 +79,9 @@
"win10_2009",
"win11_2009",
"os == 'win' && os_version == '11.26100' && processor == 'x86'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86'",
"os == 'win' && os_version == '11.26100' && processor == 'x86_64'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86_64'",
]
["ensure-exts/test_WEBGL_compressed_texture_etc.html"]
@@ -91,7 +93,9 @@
"win10_2009",
"win11_2009",
"os == 'win' && os_version == '11.26100' && processor == 'x86'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86'",
"os == 'win' && os_version == '11.26100' && processor == 'x86_64'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86_64'",
]
["ensure-exts/test_WEBGL_compressed_texture_etc1.html"]
@@ -106,7 +110,9 @@
"win10_2009",
"win11_2009",
"os == 'win' && os_version == '11.26100' && processor == 'x86'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86'",
"os == 'win' && os_version == '11.26100' && processor == 'x86_64'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86_64'",
]
["ensure-exts/test_WEBGL_compressed_texture_pvrtc.html"]
@@ -122,7 +128,9 @@
"win10_2009",
"win11_2009",
"os == 'win' && os_version == '11.26100' && processor == 'x86'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86'",
"os == 'win' && os_version == '11.26100' && processor == 'x86_64'",
+ "os == 'win' && os_version == '11.26200' && processor == 'x86_64'",
]
["ensure-exts/test_WEBGL_compressed_texture_s3tc.html"]
diff -Nru thunderbird-140.11.0esr/dom/canvas/test/webgl-mochitest/test_renderer_strings.html thunderbird-140.12.0esr/dom/canvas/test/webgl-mochitest/test_renderer_strings.html
--- thunderbird-140.11.0esr/dom/canvas/test/webgl-mochitest/test_renderer_strings.html 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/canvas/test/webgl-mochitest/test_renderer_strings.html 2026-06-13 03:47:56.000000000 +0000
@@ -78,6 +78,8 @@
'ANGLE (NVIDIA, NVIDIA Tesla M60 Direct3D11 vs_5_0 ps_5_0, D3D11-23.21.13.9181)', // Windows
'ANGLE (NVIDIA, NVIDIA Tesla M60 Direct3D11 vs_5_0 ps_5_0, D3D11-30.0.14.7239)', // Windows 11
'ANGLE (NVIDIA, NVIDIA Tesla M60 Direct3D11 vs_5_0 ps_5_0, D3D11-31.0.15.3815)', //Windows 11
+ 'ANGLE (NVIDIA, NVIDIA A10-8Q Direct3D11 vs_5_0 ps_5_0, D3D11-31.0.15.5362)', // Windows 11:Azure
+ 'ANGLE (NVIDIA, NVIDIA A10-8Q Direct3D11 vs_5_0 ps_5_0, D3D11-32.0.15.7396)', // Windows 11:Azure
],
unmasked_vendor: [
'Qualcomm', // Android
diff -Nru thunderbird-140.11.0esr/dom/cookiestore/CookieStoreNotifier.cpp thunderbird-140.12.0esr/dom/cookiestore/CookieStoreNotifier.cpp
--- thunderbird-140.11.0esr/dom/cookiestore/CookieStoreNotifier.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/cookiestore/CookieStoreNotifier.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -48,13 +48,18 @@
return nullptr;
}
+ nsCString host;
+ if (NS_WARN_IF(NS_FAILED(principal->GetAsciiHost(host))) || host.IsEmpty()) {
+ return nullptr;
+ }
+
nsCOMPtr os = mozilla::services::GetObserverService();
if (NS_WARN_IF(!os)) {
return nullptr;
}
RefPtr notifier = new CookieStoreNotifier(
- aCookieStore, baseDomain, principal->OriginAttributesRef());
+ aCookieStore, baseDomain, host, principal->OriginAttributesRef());
nsresult rv =
os->AddObserver(notifier,
@@ -69,9 +74,10 @@
CookieStoreNotifier::CookieStoreNotifier(
CookieStore* aCookieStore, const nsACString& aBaseDomain,
- const OriginAttributes& aOriginAttributes)
+ const nsACString& aHost, const OriginAttributes& aOriginAttributes)
: mCookieStore(aCookieStore),
mBaseDomain(aBaseDomain),
+ mHost(aHost),
mOriginAttributes(aOriginAttributes) {
MOZ_ASSERT(NS_IsMainThread());
MOZ_ASSERT(aCookieStore);
@@ -130,6 +136,10 @@
return NS_OK;
}
+ if (!net::CookieCommons::DomainMatches(net::Cookie::Cast(cookie), mHost)) {
+ return NS_OK;
+ }
+
bool isHttpOnly;
rv = cookie->GetIsHttpOnly(&isHttpOnly);
if (NS_WARN_IF(NS_FAILED(rv))) {
diff -Nru thunderbird-140.11.0esr/dom/cookiestore/CookieStoreNotifier.h thunderbird-140.12.0esr/dom/cookiestore/CookieStoreNotifier.h
--- thunderbird-140.11.0esr/dom/cookiestore/CookieStoreNotifier.h 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/cookiestore/CookieStoreNotifier.h 2026-06-13 03:47:56.000000000 +0000
@@ -33,6 +33,7 @@
private:
CookieStoreNotifier(CookieStore* aCookieStore, const nsACString& aBaseDomain,
+ const nsACString& aHost,
const OriginAttributes& aOriginAttributes);
~CookieStoreNotifier();
@@ -42,6 +43,7 @@
CookieStore* mCookieStore;
nsCString mBaseDomain;
+ nsCString mHost;
OriginAttributes mOriginAttributes;
nsTArray> mDelayedDOMEvents;
diff -Nru thunderbird-140.11.0esr/dom/events/EventStateManager.cpp thunderbird-140.12.0esr/dom/events/EventStateManager.cpp
--- thunderbird-140.11.0esr/dom/events/EventStateManager.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/events/EventStateManager.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -172,7 +172,7 @@
}
static UniquePtr CreateMouseOrPointerWidgetEvent(
- WidgetMouseEvent* aMouseEvent, EventMessage aMessage,
+ const WidgetMouseEvent* aMouseEvent, EventMessage aMessage,
EventTarget* aRelatedTarget);
/**
@@ -2650,7 +2650,8 @@
nsEventStatus status = nsEventStatus_eIgnore;
if (WidgetMouseEvent* aMouseEvent = aEvent->AsMouseEvent()) {
- WidgetPointerEvent event(*aMouseEvent);
+ WidgetPointerEvent event =
+ WidgetPointerEvent::MakeCopyFromMouseEvent(*aMouseEvent);
PointerEventHandler::InitPointerEventFromMouse(&event, aMouseEvent,
ePointerCancel);
@@ -5112,7 +5113,7 @@
};
static UniquePtr CreateMouseOrPointerWidgetEvent(
- WidgetMouseEvent* aMouseEvent, EventMessage aMessage,
+ const WidgetMouseEvent* aMouseEvent, EventMessage aMessage,
EventTarget* aRelatedTarget) {
// This method does not support creating a mouse/pointer button change event
// because of no data about the changing state.
@@ -5128,19 +5129,21 @@
aMessage == eMouseEnterIntoWidget ||
aMessage == eMouseExitFromWidget);
- WidgetPointerEvent* sourcePointer = aMouseEvent->AsPointerEvent();
UniquePtr newEvent;
- if (sourcePointer) {
+ if (IsPointerEventMessage(aMessage)) {
AUTO_PROFILER_LABEL("CreateMouseOrPointerWidgetEvent", OTHER);
- WidgetPointerEvent* newPointerEvent = new WidgetPointerEvent(
- aMouseEvent->IsTrusted(), aMessage, aMouseEvent->mWidget);
- newPointerEvent->mIsPrimary = sourcePointer->mIsPrimary;
- newPointerEvent->mWidth = sourcePointer->mWidth;
- newPointerEvent->mHeight = sourcePointer->mHeight;
- newPointerEvent->mInputSource = sourcePointer->mInputSource;
-
- newEvent = WrapUnique(newPointerEvent);
+ newEvent = MakeUnique(aMouseEvent->IsTrusted(),
+ aMessage, aMouseEvent->mWidget);
+ if (const WidgetPointerEvent* const sourcePointerEvent =
+ aMouseEvent->AsPointerEvent()) {
+ WidgetPointerEvent* const newPointerEvent =
+ static_cast(newEvent.get());
+ newPointerEvent->mIsPrimary = sourcePointerEvent->mIsPrimary;
+ newPointerEvent->mWidth = sourcePointerEvent->mWidth;
+ newPointerEvent->mHeight = sourcePointerEvent->mHeight;
+ // Not assigning mFromTouchEvent
+ }
} else {
newEvent = MakeUnique(aMouseEvent->IsTrusted(), aMessage,
aMouseEvent->mWidget,
@@ -5156,6 +5159,8 @@
newEvent->mRelatedTarget = aRelatedTarget;
newEvent->mRefPoint = aMouseEvent->mRefPoint;
newEvent->mModifiers = aMouseEvent->mModifiers;
+ newEvent->mInputSource = aMouseEvent->mInputSource;
+ newEvent->pointerId = aMouseEvent->pointerId;
// NOTE: If you need to change this if-expression, you need to update
// WidgetMouseEventBase::ComputeMouseButtonPressure() too.
if (!aMouseEvent->mFlags.mDispatchedAtLeastOnce &&
@@ -5167,8 +5172,9 @@
// Note that we don't need to do this if the input source does not support
// hover state because a WPT check the behavior (see below) and the other
// browsers pass the test even though this is inconsistent behavior.
- newEvent->mButton =
- sourcePointer ? MouseButton::eNotPressed : MouseButton::ePrimary;
+ newEvent->mButton = newEvent->mClass == ePointerEventClass
+ ? MouseButton::eNotPressed
+ : MouseButton::ePrimary;
if (aMouseEvent->IsPressingButton()) {
// If the source event has not been dispatched into the DOM yet, we
// need to remove the flag which is being pressed.
@@ -5207,10 +5213,6 @@
newEvent->mButtons = aMouseEvent->mButtons;
newEvent->mPressure = aMouseEvent->mPressure;
}
-
- newEvent->mInputSource = aMouseEvent->mInputSource;
- newEvent->pointerId = aMouseEvent->pointerId;
-
return newEvent;
}
@@ -5586,7 +5588,8 @@
void EventStateManager::GeneratePointerEnterExit(EventMessage aMessage,
WidgetMouseEvent* aEvent) {
- WidgetPointerEvent pointerEvent(*aEvent);
+ WidgetPointerEvent pointerEvent =
+ WidgetPointerEvent::MakeCopyFromMouseEvent(*aEvent);
pointerEvent.mMessage = aMessage;
GenerateMouseEnterExit(&pointerEvent);
}
@@ -6290,23 +6293,23 @@
}
nsresult EventStateManager::HandleMiddleClickPaste(
- PresShell* aPresShell, WidgetMouseEvent* aMouseEvent,
+ PresShell* aPresShell, WidgetMouseEvent* aMouseOrPointerEvent,
nsEventStatus* aStatus, EditorBase* aEditorBase) {
MOZ_ASSERT(aPresShell);
- MOZ_ASSERT(aMouseEvent);
- MOZ_ASSERT((aMouseEvent->mMessage == ePointerAuxClick &&
- aMouseEvent->mButton == MouseButton::eMiddle) ||
- EventCausesClickEvents(*aMouseEvent));
+ MOZ_ASSERT(aMouseOrPointerEvent);
+ MOZ_ASSERT((aMouseOrPointerEvent->mMessage == ePointerAuxClick &&
+ aMouseOrPointerEvent->mButton == MouseButton::eMiddle) ||
+ EventCausesClickEvents(*aMouseOrPointerEvent));
MOZ_ASSERT(aStatus);
MOZ_ASSERT(*aStatus != nsEventStatus_eConsumeNoDefault);
// Even if we're called twice or more for a mouse operation, we should
// handle only once. Although mMultipleActionsPrevented may be set to
// true by different event handler in the future, we can use it for now.
- if (aMouseEvent->mFlags.mMultipleActionsPrevented) {
+ if (aMouseOrPointerEvent->mFlags.mMultipleActionsPrevented) {
return NS_OK;
}
- aMouseEvent->mFlags.mMultipleActionsPrevented = true;
+ aMouseOrPointerEvent->mFlags.mMultipleActionsPrevented = true;
RefPtr selection;
if (aEditorBase) {
@@ -6392,16 +6395,30 @@
if (!range) {
return NS_OK;
}
- WidgetMouseEvent mouseEvent(*aMouseEvent);
- mouseEvent.mOriginalTarget = range->GetStartContainer();
- if (NS_WARN_IF(!mouseEvent.mOriginalTarget) ||
- !aEditorBase->IsAcceptableInputEvent(&mouseEvent)) {
- return NS_OK;
+ {
+ Maybe pointerEvent;
+ Maybe mouseEvent;
+ if (aMouseOrPointerEvent->mClass == ePointerEventClass) {
+ MOZ_ASSERT(aMouseOrPointerEvent->AsPointerEvent());
+ pointerEvent.emplace(
+ WidgetPointerEvent::MakeCopyFromMouseEvent(*aMouseOrPointerEvent));
+ } else {
+ MOZ_ASSERT(!aMouseOrPointerEvent->AsPointerEvent());
+ MOZ_ASSERT(!aMouseOrPointerEvent->AsDragEvent());
+ mouseEvent.emplace(*aMouseOrPointerEvent);
+ }
+ WidgetMouseEvent& eventCopyRef =
+ pointerEvent.isSome() ? pointerEvent.ref() : mouseEvent.ref();
+ eventCopyRef.mOriginalTarget = range->GetStartContainer();
+ if (NS_WARN_IF(!eventCopyRef.mOriginalTarget) ||
+ !aEditorBase->IsAcceptableInputEvent(&eventCopyRef)) {
+ return NS_OK;
+ }
}
// If Control key is pressed, we should paste clipboard content as
// quotation. Otherwise, paste it as is.
- if (aMouseEvent->IsControl()) {
+ if (aMouseOrPointerEvent->IsControl()) {
DebugOnly rv = aEditorBase->PasteAsQuotationAsAction(
clipboardType, EditorBase::DispatchPasteEvent::No, dataTransfer);
NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Failed to paste as quotation");
diff -Nru thunderbird-140.11.0esr/dom/events/EventStateManager.h thunderbird-140.12.0esr/dom/events/EventStateManager.h
--- thunderbird-140.11.0esr/dom/events/EventStateManager.h 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/events/EventStateManager.h 2026-06-13 03:47:56.000000000 +0000
@@ -496,17 +496,18 @@
*
* @param aPresShell The PresShell for the ESM. This lifetime
* should be guaranteed by the caller.
- * @param aMouseEvent The ePointerClick event which caused the
- * paste.
- * @param aStatus The event status of aMouseEvent.
+ * @param aMouseOrPointerEvent The eAuxPointerClick event which caused the
+ * paste or eMouseUp event which causes an
+ * ePointerAuxClick event.
+ * @param aStatus The event status of aMouseOrPointerEvent.
* @param aEditorBase EditorBase which may be pasted the
* clipboard text by the middle click.
- * If there is no editor for aMouseEvent,
- * set nullptr.
+ * If there is no editor for
+ * aMouseOrPointerEvent, set nullptr.
*/
MOZ_CAN_RUN_SCRIPT
nsresult HandleMiddleClickPaste(PresShell* aPresShell,
- WidgetMouseEvent* aMouseEvent,
+ WidgetMouseEvent* aMouseOrPointerEvent,
nsEventStatus* aStatus,
EditorBase* aEditorBase);
diff -Nru thunderbird-140.11.0esr/dom/events/InternalMutationEvent.h thunderbird-140.12.0esr/dom/events/InternalMutationEvent.h
--- thunderbird-140.11.0esr/dom/events/InternalMutationEvent.h 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/events/InternalMutationEvent.h 2026-06-13 03:47:56.000000000 +0000
@@ -16,7 +16,7 @@
class InternalMutationEvent : public WidgetEvent {
public:
- virtual InternalMutationEvent* AsMutationEvent() override { return this; }
+ NS_DEFINE_AS_EVENT_OVERRIDE(Internal, MutationEvent);
InternalMutationEvent(bool aIsTrusted, EventMessage aMessage,
const WidgetEventTime* aTime = nullptr)
@@ -25,6 +25,10 @@
mFlags.mCancelable = false;
}
+ NS_DEFINE_VIRTUAL_DESTRUCTOR_CHECKING_CLASS_VALUE(InternalMutationEvent,
+ eMutationEventClass,
+ eBasicEventClass);
+
virtual WidgetEvent* Duplicate() const override {
MOZ_ASSERT(mClass == eMutationEventClass,
"Duplicate() must be overridden by sub class");
diff -Nru thunderbird-140.11.0esr/dom/events/PointerEventHandler.cpp thunderbird-140.12.0esr/dom/events/PointerEventHandler.cpp
--- thunderbird-140.11.0esr/dom/events/PointerEventHandler.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/events/PointerEventHandler.cpp 2026-06-13 03:47:55.000000000 +0000
@@ -383,7 +383,8 @@
if (!info || info->mPendingElement == info->mOverrideElement) {
return;
}
- WidgetPointerEvent localEvent(*aEvent);
+ WidgetPointerEvent localEvent =
+ WidgetPointerEvent::MakeCopyFromMouseEvent(*aEvent);
InitPointerEventFromMouse(&localEvent, aEvent, eVoidEvent);
CheckPointerCaptureState(&localEvent);
}
@@ -955,7 +956,8 @@
}
}
#endif // #ifdef DEBUG
- WidgetPointerEvent event(*mouseEvent);
+ WidgetPointerEvent event =
+ WidgetPointerEvent::MakeCopyFromMouseEvent(*mouseEvent);
InitPointerEventFromMouse(&event, mouseEvent, pointerMessage);
event.convertToPointer = mouseEvent->convertToPointer = false;
RefPtr shell(aShell);
diff -Nru thunderbird-140.11.0esr/dom/fetch/FetchDriver.cpp thunderbird-140.12.0esr/dom/fetch/FetchDriver.cpp
--- thunderbird-140.11.0esr/dom/fetch/FetchDriver.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/fetch/FetchDriver.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -254,7 +254,8 @@
mStatus = AlternativeDataStreamListener::FALLBACK;
mAlternativeDataCacheEntryId = 0;
MOZ_ASSERT(mFetchDriver);
- return mFetchDriver->OnStartRequest(aRequest);
+ RefPtr fetchDriver = mFetchDriver;
+ return fetchDriver->OnStartRequest(aRequest);
}
NS_IMETHODIMP
@@ -272,8 +273,9 @@
}
if (mStatus == AlternativeDataStreamListener::FALLBACK) {
MOZ_ASSERT(mFetchDriver);
- return mFetchDriver->OnDataAvailable(aRequest, aInputStream, aOffset,
- aCount);
+ RefPtr fetchDriver = mFetchDriver;
+ return fetchDriver->OnDataAvailable(aRequest, aInputStream, aOffset,
+ aCount);
}
return NS_OK;
}
@@ -1412,7 +1414,8 @@
NS_IMETHOD
Run() override {
- mObserver->OnDataAvailable();
+ RefPtr observer = mObserver;
+ observer->OnDataAvailable();
mObserver = nullptr;
return NS_OK;
}
diff -Nru thunderbird-140.11.0esr/dom/file/MutableBlobStorage.cpp thunderbird-140.12.0esr/dom/file/MutableBlobStorage.cpp
--- thunderbird-140.11.0esr/dom/file/MutableBlobStorage.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/file/MutableBlobStorage.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -126,7 +126,7 @@
return NS_OK;
}
- int32_t written = PR_Write(fd, mData, mLength);
+ int32_t written = mLength <= INT32_MAX ? PR_Write(fd, mData, mLength) : -1;
if (NS_WARN_IF(written < 0 || uint32_t(written) != mLength)) {
mBlobStorage->CloseFD();
return mBlobStorage->EventTarget()->Dispatch(
diff -Nru thunderbird-140.11.0esr/dom/fs/parent/FileSystemAccessHandle.h thunderbird-140.12.0esr/dom/fs/parent/FileSystemAccessHandle.h
--- thunderbird-140.11.0esr/dom/fs/parent/FileSystemAccessHandle.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/fs/parent/FileSystemAccessHandle.h 2026-06-13 03:47:56.000000000 +0000
@@ -8,6 +8,7 @@
#define DOM_FS_PARENT_FILESYSTEMACCESSHANDLE_H_
#include "FileSystemStreamCallbacks.h"
+#include "mozilla/Atomics.h"
#include "mozilla/MozPromise.h"
#include "mozilla/NotNull.h"
#include "mozilla/RefPtr.h"
@@ -95,7 +96,7 @@
const NotNull> mIOTaskQueue;
FileSystemAccessHandleParent* mActor;
FileSystemAccessHandleControlParent* mControlActor;
- nsAutoRefCnt mRegCount;
+ Atomic mRegCount;
bool mLocked;
bool mRegistered;
bool mClosed;
diff -Nru thunderbird-140.11.0esr/dom/fs/parent/datamodel/FileSystemDataManager.h thunderbird-140.12.0esr/dom/fs/parent/datamodel/FileSystemDataManager.h
--- thunderbird-140.11.0esr/dom/fs/parent/datamodel/FileSystemDataManager.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/fs/parent/datamodel/FileSystemDataManager.h 2026-06-13 03:47:56.000000000 +0000
@@ -9,6 +9,7 @@
#include "FileSystemParentTypes.h"
#include "ResultConnection.h"
+#include "mozilla/Atomics.h"
#include "mozilla/NotNull.h"
#include "mozilla/TaskQueue.h"
#include "mozilla/ThreadBound.h"
@@ -184,7 +185,7 @@
MozPromiseHolder mOpenPromiseHolder;
MozPromiseHolder mClosePromiseHolder;
int64_t mDirectoryLockId;
- uint32_t mRegCount;
+ Atomic mRegCount;
DatabaseVersion mVersion;
State mState;
};
diff -Nru thunderbird-140.11.0esr/dom/geolocation/moz.build thunderbird-140.12.0esr/dom/geolocation/moz.build
--- thunderbird-140.11.0esr/dom/geolocation/moz.build 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/geolocation/moz.build 2026-06-13 03:47:56.000000000 +0000
@@ -40,6 +40,7 @@
CONFIG["OS_TARGET"] == "WINNT"
and (CONFIG["CC_TYPE"] == "clang-cl" or CONFIG["MOZ_ARTIFACT_BUILDS"])
and CONFIG["MOZ_BUILD_APP"] == "browser"
+ and CONFIG["NECKO_WIFI"]
):
UNIFIED_SOURCES += [
"GeolocationSystemWin.cpp",
diff -Nru thunderbird-140.11.0esr/dom/html/HTMLMediaElement.cpp thunderbird-140.12.0esr/dom/html/HTMLMediaElement.cpp
--- thunderbird-140.11.0esr/dom/html/HTMLMediaElement.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/html/HTMLMediaElement.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -1451,7 +1451,8 @@
NS_SUCCEEDED(rv = element->InitializeDecoderForChannel(
channel, getter_AddRefs(mNextListener))) &&
mNextListener) {
- rv = mNextListener->OnStartRequest(aRequest);
+ nsCOMPtr nextListener = mNextListener;
+ rv = nextListener->OnStartRequest(aRequest);
} else {
// If InitializeDecoderForChannel() returned an error, fire a network error.
if (NS_FAILED(rv) && !mNextListener) {
@@ -1471,8 +1472,8 @@
NS_IMETHODIMP
HTMLMediaElement::MediaLoadListener::OnStopRequest(nsIRequest* aRequest,
nsresult aStatus) {
- if (mNextListener) {
- return mNextListener->OnStopRequest(aRequest, aStatus);
+ if (nsCOMPtr nextListener = mNextListener) {
+ return nextListener->OnStopRequest(aRequest, aStatus);
}
return NS_OK;
}
@@ -1488,7 +1489,8 @@
"canceled this request");
return NS_BINDING_ABORTED;
}
- return mNextListener->OnDataAvailable(aRequest, aStream, aOffset, aCount);
+ nsCOMPtr nextListener = mNextListener;
+ return nextListener->OnDataAvailable(aRequest, aStream, aOffset, aCount);
}
NS_IMETHODIMP
diff -Nru thunderbird-140.11.0esr/dom/html/MediaDocument.cpp thunderbird-140.12.0esr/dom/html/MediaDocument.cpp
--- thunderbird-140.11.0esr/dom/html/MediaDocument.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/html/MediaDocument.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -47,8 +47,8 @@
mDocument->StartLayout();
- if (mNextStream) {
- return mNextStream->OnStartRequest(request);
+ if (nsCOMPtr nextStream = mNextStream) {
+ return nextStream->OnStartRequest(request);
}
return NS_ERROR_PARSED_DATA_CACHED;
@@ -58,8 +58,8 @@
MediaDocumentStreamListener::OnStopRequest(nsIRequest* request,
nsresult status) {
nsresult rv = NS_OK;
- if (mNextStream) {
- rv = mNextStream->OnStopRequest(request, status);
+ if (nsCOMPtr nextStream = mNextStream) {
+ rv = nextStream->OnStopRequest(request, status);
}
// Don't release mDocument here if we're in the middle of a multipart
@@ -81,8 +81,8 @@
nsIInputStream* inStr,
uint64_t sourceOffset,
uint32_t count) {
- if (mNextStream) {
- return mNextStream->OnDataAvailable(request, inStr, sourceOffset, count);
+ if (nsCOMPtr nextStream = mNextStream) {
+ return nextStream->OnDataAvailable(request, inStr, sourceOffset, count);
}
return NS_OK;
diff -Nru thunderbird-140.11.0esr/dom/indexedDB/ActorsParent.cpp thunderbird-140.12.0esr/dom/indexedDB/ActorsParent.cpp
--- thunderbird-140.11.0esr/dom/indexedDB/ActorsParent.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/indexedDB/ActorsParent.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -6550,7 +6550,8 @@
mLocale(aLocale),
mCloneReadInfo(aCloneReadInfo),
mUpdateInfoArray(aUpdateInfoArray),
- mStatus(NS_ERROR_FAILURE) {}
+ mStatus(NS_ERROR_FAILURE),
+ mDone{false} {}
nsresult DispatchAndWait() {
// FIXME(Bug 1637530) Re-enable optimization using a non-system-principaled
@@ -6582,7 +6583,10 @@
RefPtr self = this;
QM_TRY(MOZ_TO_RESULT(SchedulerGroup::Dispatch(self.forget())));
- lock.Wait();
+ while (!mDone) {
+ lock.Wait();
+ }
+
return mStatus;
}
@@ -6645,10 +6649,11 @@
mStatus = aStatus;
MonitorAutoLock lock(mMonitor);
+ mDone = true;
lock.Notify();
}
- Monitor mMonitor MOZ_UNANNOTATED;
+ Monitor mMonitor;
const int64_t mIndexID;
const KeyPath& mKeyPath;
@@ -6657,6 +6662,7 @@
StructuredCloneReadInfoParent& mCloneReadInfo;
nsTArray& mUpdateInfoArray;
nsresult mStatus;
+ bool mDone MOZ_GUARDED_BY(mMonitor);
};
auto DeserializeIndexValueToUpdateInfos(
diff -Nru thunderbird-140.11.0esr/dom/indexedDB/SchemaUpgrades.cpp thunderbird-140.12.0esr/dom/indexedDB/SchemaUpgrades.cpp
--- thunderbird-140.11.0esr/dom/indexedDB/SchemaUpgrades.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/indexedDB/SchemaUpgrades.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -2738,7 +2738,8 @@
: Runnable("DeserializeUpgradeValueHelper"),
mMonitor("DeserializeUpgradeValueHelper::mMonitor"),
mCloneReadInfo(aCloneReadInfo),
- mStatus(NS_ERROR_FAILURE) {}
+ mStatus(NS_ERROR_FAILURE),
+ mDone{false} {}
nsresult DispatchAndWait(nsAString& aFileIds) {
// We don't need to go to the main-thread and use the sandbox.
@@ -2759,7 +2760,9 @@
return rv;
}
- lock.Wait();
+ while (!mDone) {
+ lock.Wait();
+ }
if (NS_FAILED(mStatus)) {
return mStatus;
@@ -2838,12 +2841,14 @@
mStatus = aStatus;
MonitorAutoLock lock(mMonitor);
+ mDone = true;
lock.Notify();
}
- Monitor mMonitor MOZ_UNANNOTATED;
+ Monitor mMonitor;
StructuredCloneReadInfoParent& mCloneReadInfo;
nsresult mStatus;
+ bool mDone MOZ_GUARDED_BY(mMonitor);
};
nsresult DeserializeUpgradeValueToFileIds(
diff -Nru thunderbird-140.11.0esr/dom/ipc/BrowserChild.cpp thunderbird-140.12.0esr/dom/ipc/BrowserChild.cpp
--- thunderbird-140.11.0esr/dom/ipc/BrowserChild.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/ipc/BrowserChild.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -1498,20 +1498,25 @@
UniquePtr data(
static_cast(mToBeDispatchedMouseData.PopFront()));
- UniquePtr event = data->TakeCoalescedEvent();
- if (event) {
+ if (const UniquePtr mouseOrPointerEvent =
+ data->TakeCoalescedEvent()) {
+ MOZ_ASSERT_IF(mouseOrPointerEvent->AsPointerEvent(),
+ IsPointerEventMessage(mouseOrPointerEvent->mMessage));
+ MOZ_ASSERT_IF(!mouseOrPointerEvent->AsPointerEvent(),
+ !IsPointerEventMessage(mouseOrPointerEvent->mMessage));
// When the real mouse event receivers put the received event into the
// queue, they should dispatch eMouseRawUpdate event immediately (if and
// only if it's required). Therefore, unless the event is the last one
// of the queue, the pending events should've been marked as "Do not
// convert to "pointerrawupdate".
MOZ_ASSERT_IF(mToBeDispatchedMouseData.GetSize() > 0,
- !event->convertToPointerRawUpdate);
+ !mouseOrPointerEvent->convertToPointerRawUpdate);
// Dispatch the pending events. Using HandleRealMouseButtonEvent
// to bypass the coalesce handling in RecvRealMouseMoveEvent. Can't use
// RecvRealMouseButtonEvent because we may also put some mouse events
// other than mousemove.
- HandleRealMouseButtonEvent(*event, data->GetScrollableLayerGuid(),
+ HandleRealMouseButtonEvent(*mouseOrPointerEvent,
+ data->GetScrollableLayerGuid(),
data->GetInputBlockId());
}
}
@@ -1557,19 +1562,21 @@
}
mozilla::ipc::IPCResult BrowserChild::RecvRealMouseMoveEvent(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetMouseEvent& aMouseEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
+ MOZ_ASSERT(!aMouseEvent.AsPointerEvent());
+ MOZ_ASSERT(!aMouseEvent.AsDragEvent());
if (mCoalesceMouseMoveEvents && mCoalescedMouseEventFlusher) {
CoalescedMouseData* data =
- mCoalescedMouseData.GetOrInsertNew(aEvent.pointerId);
+ mCoalescedMouseData.GetOrInsertNew(aMouseEvent.pointerId);
MOZ_ASSERT(data);
- if (data->CanCoalesce(aEvent, aGuid, aInputBlockId,
+ if (data->CanCoalesce(aMouseEvent, aGuid, aInputBlockId,
mCoalescedMouseEventFlusher->GetRefreshDriver())) {
- // We don't need to dispatch aEvent immediately. However, we need to
+ // We don't need to dispatch aMouseEvent immediately. However, we need to
// dispatch eMouseRawUpdate immediately if there is a `pointerrawupdate`
// event listener. Therefore, the cloned event in the queue shouldn't
// cause eMouseRawUpdate later when it'll be dispatched.
- WidgetMouseEvent pendingMouseMoveEvent(aEvent);
+ WidgetMouseEvent pendingMouseMoveEvent(aMouseEvent);
pendingMouseMoveEvent.convertToPointerRawUpdate = false;
data->Coalesce(pendingMouseMoveEvent, aGuid, aInputBlockId);
mCoalescedMouseEventFlusher->StartObserver();
@@ -1589,13 +1596,14 @@
// Put new data to replace the old one in the hash table.
CoalescedMouseData* newData =
mCoalescedMouseData
- .InsertOrUpdate(aEvent.pointerId, MakeUnique())
+ .InsertOrUpdate(aMouseEvent.pointerId,
+ MakeUnique())
.get();
- // We don't want to dispatch aEvent immediately. However, we need to
+ // We don't want to dispatch aMouseEvent immediately. However, we need to
// dispatch eMouseRawUpdate immediately if there is a `pointerrawupdate`
// event listener. Therefore, the cloned event in the queue shouldn't
// cause eMouseRawUpdate later when it'll be dispatched.
- WidgetMouseEvent pendingMouseMoveEvent(aEvent);
+ WidgetMouseEvent pendingMouseMoveEvent(aMouseEvent);
pendingMouseMoveEvent.convertToPointerRawUpdate = false;
newData->Coalesce(pendingMouseMoveEvent, aGuid, aInputBlockId);
@@ -1608,7 +1616,7 @@
return IPC_OK();
}
- if (!RecvRealMouseButtonEvent(aEvent, aGuid, aInputBlockId)) {
+ if (!RecvRealMouseButtonEvent(aMouseEvent, aGuid, aInputBlockId)) {
return IPC_FAIL_NO_REASON(this);
}
return IPC_OK();
@@ -1617,6 +1625,8 @@
void BrowserChild::HandleMouseRawUpdateEvent(
const WidgetMouseEvent& aPendingMouseEvent,
const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId) {
+ MOZ_ASSERT(!aPendingMouseEvent.AsPointerEvent());
+ MOZ_ASSERT(!aPendingMouseEvent.AsDragEvent());
// If there is no window containing pointerrawupdate event listeners or the
// event is a synthesized mousemove, we don't need to dispatch eMouseRawUpdate
// event.
@@ -1636,44 +1646,45 @@
}
mozilla::ipc::IPCResult BrowserChild::RecvRealMouseMoveEventForTests(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetMouseEvent& aMouseEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
- return RecvRealMouseMoveEvent(aEvent, aGuid, aInputBlockId);
+ return RecvRealMouseMoveEvent(aMouseEvent, aGuid, aInputBlockId);
}
mozilla::ipc::IPCResult BrowserChild::RecvNormalPriorityRealMouseMoveEvent(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetMouseEvent& aMouseEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
- return RecvRealMouseMoveEvent(aEvent, aGuid, aInputBlockId);
+ return RecvRealMouseMoveEvent(aMouseEvent, aGuid, aInputBlockId);
}
mozilla::ipc::IPCResult
BrowserChild::RecvNormalPriorityRealMouseMoveEventForTests(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetMouseEvent& aMouseEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
- return RecvRealMouseMoveEvent(aEvent, aGuid, aInputBlockId);
+ return RecvRealMouseMoveEvent(aMouseEvent, aGuid, aInputBlockId);
}
mozilla::ipc::IPCResult BrowserChild::RecvSynthMouseMoveEvent(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetMouseEvent& aMouseEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
- if (!RecvRealMouseButtonEvent(aEvent, aGuid, aInputBlockId)) {
+ if (!RecvRealMouseButtonEvent(aMouseEvent, aGuid, aInputBlockId)) {
return IPC_FAIL_NO_REASON(this);
}
return IPC_OK();
}
mozilla::ipc::IPCResult BrowserChild::RecvNormalPrioritySynthMouseMoveEvent(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetMouseEvent& aMouseEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
- return RecvSynthMouseMoveEvent(aEvent, aGuid, aInputBlockId);
+ return RecvSynthMouseMoveEvent(aMouseEvent, aGuid, aInputBlockId);
}
mozilla::ipc::IPCResult BrowserChild::RecvRealMouseButtonEvent(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId) {
+ const WidgetMouseEvent& aMouseOrPointerEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId) {
+ MOZ_ASSERT(!aMouseOrPointerEvent.AsDragEvent());
if (mCoalesceMouseMoveEvents && mCoalescedMouseEventFlusher &&
- aEvent.mMessage != eMouseMove) {
+ aMouseOrPointerEvent.mMessage != eMouseMove) {
// When receiving a mouse event other than mousemove, we have to dispatch
// all coalesced events before it. However, we can't dispatch all pending
// coalesced events directly because we may reentry the event loop while
@@ -1692,32 +1703,35 @@
// handling aEvent if and only if there is a `pointerrawupdate` event
// listener. Therefore, let's assert the allowing flag to convert it to
// eMouseRawUpdate here.
- MOZ_ASSERT(aEvent.convertToPointerRawUpdate);
- dispatchData->Coalesce(aEvent, aGuid, aInputBlockId);
+ MOZ_ASSERT(aMouseOrPointerEvent.convertToPointerRawUpdate);
+ dispatchData->Coalesce(aMouseOrPointerEvent, aGuid, aInputBlockId);
mToBeDispatchedMouseData.Push(dispatchData.release());
ProcessPendingCoalescedMouseDataAndDispatchEvents();
return IPC_OK();
}
- HandleRealMouseButtonEvent(aEvent, aGuid, aInputBlockId);
+ HandleRealMouseButtonEvent(aMouseOrPointerEvent, aGuid, aInputBlockId);
return IPC_OK();
}
mozilla::ipc::IPCResult BrowserChild::RecvRealPointerButtonEvent(
- const WidgetPointerEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetPointerEvent& aPointerEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
- return RecvRealMouseButtonEvent(aEvent, aGuid, aInputBlockId);
+ return RecvRealMouseButtonEvent(aPointerEvent, aGuid, aInputBlockId);
}
-void BrowserChild::HandleRealMouseButtonEvent(const WidgetMouseEvent& aEvent,
- const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId) {
+void BrowserChild::HandleRealMouseButtonEvent(
+ const WidgetMouseEvent& aMouseOrPointerEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId) {
Maybe pointerEvent;
Maybe mouseEvent;
- if (aEvent.mClass == ePointerEventClass) {
- pointerEvent.emplace(aEvent);
+ if (aMouseOrPointerEvent.mClass == ePointerEventClass) {
+ pointerEvent.emplace(
+ WidgetPointerEvent::MakeCopyFromMouseEvent(aMouseOrPointerEvent));
} else {
- mouseEvent.emplace(aEvent);
+ MOZ_DIAGNOSTIC_ASSERT(!aMouseOrPointerEvent.AsPointerEvent());
+ MOZ_DIAGNOSTIC_ASSERT(!aMouseOrPointerEvent.AsDragEvent());
+ mouseEvent.emplace(aMouseOrPointerEvent);
}
WidgetMouseEvent& localEvent =
pointerEvent.isSome() ? pointerEvent.ref() : mouseEvent.ref();
@@ -1763,28 +1777,29 @@
}
mozilla::ipc::IPCResult BrowserChild::RecvNormalPriorityRealMouseButtonEvent(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId) {
- return RecvRealMouseButtonEvent(aEvent, aGuid, aInputBlockId);
+ const WidgetMouseEvent& aMouseOrPointerEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId) {
+ return RecvRealMouseButtonEvent(aMouseOrPointerEvent, aGuid, aInputBlockId);
}
mozilla::ipc::IPCResult BrowserChild::RecvNormalPriorityRealPointerButtonEvent(
- const WidgetPointerEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetPointerEvent& aPointerEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
- return RecvNormalPriorityRealMouseButtonEvent(aEvent, aGuid, aInputBlockId);
+ return RecvNormalPriorityRealMouseButtonEvent(aPointerEvent, aGuid,
+ aInputBlockId);
}
mozilla::ipc::IPCResult BrowserChild::RecvRealMouseEnterExitWidgetEvent(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetMouseEvent& aMouseEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
- return RecvRealMouseButtonEvent(aEvent, aGuid, aInputBlockId);
+ return RecvRealMouseButtonEvent(aMouseEvent, aGuid, aInputBlockId);
}
mozilla::ipc::IPCResult
BrowserChild::RecvNormalPriorityRealMouseEnterExitWidgetEvent(
- const WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
+ const WidgetMouseEvent& aMouseEvent, const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
- return RecvRealMouseButtonEvent(aEvent, aGuid, aInputBlockId);
+ return RecvRealMouseButtonEvent(aMouseEvent, aGuid, aInputBlockId);
}
nsEventStatus BrowserChild::DispatchWidgetEventViaAPZ(WidgetGUIEvent& aEvent) {
diff -Nru thunderbird-140.11.0esr/dom/ipc/BrowserChild.h thunderbird-140.12.0esr/dom/ipc/BrowserChild.h
--- thunderbird-140.11.0esr/dom/ipc/BrowserChild.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/ipc/BrowserChild.h 2026-06-13 03:47:56.000000000 +0000
@@ -291,45 +291,45 @@
mozilla::ipc::IPCResult RecvDeactivate(uint64_t aActionId);
mozilla::ipc::IPCResult RecvRealMouseMoveEvent(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvNormalPriorityRealMouseMoveEvent(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvRealMouseMoveEventForTests(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvNormalPriorityRealMouseMoveEventForTests(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvSynthMouseMoveEvent(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvNormalPrioritySynthMouseMoveEvent(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvRealMouseButtonEvent(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseOrPointerEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvNormalPriorityRealMouseButtonEvent(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseOrPointerEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvRealPointerButtonEvent(
- const mozilla::WidgetPointerEvent& aEvent,
+ const mozilla::WidgetPointerEvent& aPointerEvent,
const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvNormalPriorityRealPointerButtonEvent(
- const mozilla::WidgetPointerEvent& aEvent,
+ const mozilla::WidgetPointerEvent& aPointerEvent,
const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvRealMouseEnterExitWidgetEvent(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
mozilla::ipc::IPCResult RecvNormalPriorityRealMouseEnterExitWidgetEvent(
- const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
- const uint64_t& aInputBlockId);
+ const mozilla::WidgetMouseEvent& aMouseEvent,
+ const ScrollableLayerGuid& aGuid, const uint64_t& aInputBlockId);
MOZ_CAN_RUN_SCRIPT_BOUNDARY
mozilla::ipc::IPCResult RecvRealDragEvent(const WidgetDragEvent& aEvent,
@@ -656,7 +656,7 @@
const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId);
- void HandleRealMouseButtonEvent(const WidgetMouseEvent& aEvent,
+ void HandleRealMouseButtonEvent(const WidgetMouseEvent& aMouseOrPointerEvent,
const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId);
diff -Nru thunderbird-140.11.0esr/dom/ipc/BrowserParent.cpp thunderbird-140.12.0esr/dom/ipc/BrowserParent.cpp
--- thunderbird-140.11.0esr/dom/ipc/BrowserParent.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/ipc/BrowserParent.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -1466,7 +1466,7 @@
mIsMouseEnterIntoWidgetEventSuppressed = true;
}
-void BrowserParent::SendRealMouseEvent(WidgetMouseEvent& aEvent) {
+void BrowserParent::SendRealMouseEvent(WidgetMouseEvent& aMouseOrPointerEvent) {
if (mIsDestroyed) {
return;
}
@@ -1475,8 +1475,8 @@
// process directly (see
// https://bugzilla.mozilla.org/show_bug.cgi?id=1549355), we probably don't
// need to check mReason then.
- if (aEvent.mReason == WidgetMouseEvent::eReal) {
- if (aEvent.mMessage == eMouseExitFromWidget) {
+ if (aMouseOrPointerEvent.mReason == WidgetMouseEvent::eReal) {
+ if (aMouseOrPointerEvent.mMessage == eMouseExitFromWidget) {
// Since we are leaving this remote target, so don't need to update
// sLastMouseRemoteTarget, and if we are sLastMouseRemoteTarget, reset it
// to null.
@@ -1488,25 +1488,25 @@
}
}
- aEvent.mRefPoint = TransformParentToChild(aEvent);
+ aMouseOrPointerEvent.mRefPoint = TransformParentToChild(aMouseOrPointerEvent);
if (nsCOMPtr widget = GetWidget()) {
// When we mouseenter the remote target, the remote target's cursor should
// become the current cursor. When we mouseexit, we stop.
- if (eMouseEnterIntoWidget == aEvent.mMessage) {
+ if (eMouseEnterIntoWidget == aMouseOrPointerEvent.mMessage) {
mRemoteTargetSetsCursor = true;
if (!EventStateManager::CursorSettingManagerHasLockedCursor()) {
widget->SetCursor(mCursor);
EventStateManager::ClearCursorSettingManager();
}
- } else if (eMouseExitFromWidget == aEvent.mMessage) {
+ } else if (eMouseExitFromWidget == aMouseOrPointerEvent.mMessage) {
mRemoteTargetSetsCursor = false;
}
}
if (!mIsReadyToHandleInputEvents) {
- if (eMouseEnterIntoWidget == aEvent.mMessage) {
+ if (eMouseEnterIntoWidget == aMouseOrPointerEvent.mMessage) {
mIsMouseEnterIntoWidgetEventSuppressed = true;
- } else if (eMouseExitFromWidget == aEvent.mMessage) {
+ } else if (eMouseExitFromWidget == aMouseOrPointerEvent.mMessage) {
mIsMouseEnterIntoWidgetEventSuppressed = false;
}
return;
@@ -1523,72 +1523,77 @@
// due to its corresponding BrowserChild wasn't ready to handle it, we have
// to resend it when the BrowserChild is ready.
mIsMouseEnterIntoWidgetEventSuppressed = false;
- WidgetMouseEvent localEvent(aEvent);
- localEvent.mMessage = eMouseEnterIntoWidget;
- DebugOnly ret =
- isInputPriorityEventEnabled
- ? SendRealMouseEnterExitWidgetEvent(localEvent, guid, blockId)
- : SendNormalPriorityRealMouseEnterExitWidgetEvent(localEvent, guid,
- blockId);
+ WidgetMouseEvent mouseEnterIntoWidgetEvent =
+ WidgetMouseEvent::MakeLossyCopy(aMouseOrPointerEvent,
+ eMouseEnterIntoWidget);
+ DebugOnly ret = isInputPriorityEventEnabled
+ ? SendRealMouseEnterExitWidgetEvent(
+ mouseEnterIntoWidgetEvent, guid, blockId)
+ : SendNormalPriorityRealMouseEnterExitWidgetEvent(
+ mouseEnterIntoWidgetEvent, guid, blockId);
NS_WARNING_ASSERTION(ret, "SendRealMouseEnterExitWidgetEvent() failed");
- MOZ_ASSERT(!ret || localEvent.HasBeenPostedToRemoteProcess());
+ MOZ_ASSERT(!ret ||
+ mouseEnterIntoWidgetEvent.HasBeenPostedToRemoteProcess());
}
- if (eMouseMove == aEvent.mMessage) {
- if (aEvent.mReason == WidgetMouseEvent::eSynthesized) {
+ if (eMouseMove == aMouseOrPointerEvent.mMessage) {
+ if (aMouseOrPointerEvent.mReason == WidgetMouseEvent::eSynthesized) {
DebugOnly ret =
isInputPriorityEventEnabled
- ? SendSynthMouseMoveEvent(aEvent, guid, blockId)
- : SendNormalPrioritySynthMouseMoveEvent(aEvent, guid, blockId);
+ ? SendSynthMouseMoveEvent(aMouseOrPointerEvent, guid, blockId)
+ : SendNormalPrioritySynthMouseMoveEvent(aMouseOrPointerEvent,
+ guid, blockId);
NS_WARNING_ASSERTION(ret, "SendSynthMouseMoveEvent() failed");
- MOZ_ASSERT(!ret || aEvent.HasBeenPostedToRemoteProcess());
+ MOZ_ASSERT(!ret || aMouseOrPointerEvent.HasBeenPostedToRemoteProcess());
return;
}
- if (!aEvent.mFlags.mIsSynthesizedForTests) {
+ if (!aMouseOrPointerEvent.mFlags.mIsSynthesizedForTests) {
DebugOnly ret =
isInputPriorityEventEnabled
- ? SendRealMouseMoveEvent(aEvent, guid, blockId)
- : SendNormalPriorityRealMouseMoveEvent(aEvent, guid, blockId);
+ ? SendRealMouseMoveEvent(aMouseOrPointerEvent, guid, blockId)
+ : SendNormalPriorityRealMouseMoveEvent(aMouseOrPointerEvent, guid,
+ blockId);
NS_WARNING_ASSERTION(ret, "SendRealMouseMoveEvent() failed");
- MOZ_ASSERT(!ret || aEvent.HasBeenPostedToRemoteProcess());
+ MOZ_ASSERT(!ret || aMouseOrPointerEvent.HasBeenPostedToRemoteProcess());
return;
}
- DebugOnly ret =
- isInputPriorityEventEnabled
- ? SendRealMouseMoveEventForTests(aEvent, guid, blockId)
- : SendNormalPriorityRealMouseMoveEventForTests(aEvent, guid,
- blockId);
+ DebugOnly ret = isInputPriorityEventEnabled
+ ? SendRealMouseMoveEventForTests(
+ aMouseOrPointerEvent, guid, blockId)
+ : SendNormalPriorityRealMouseMoveEventForTests(
+ aMouseOrPointerEvent, guid, blockId);
NS_WARNING_ASSERTION(ret, "SendRealMouseMoveEventForTests() failed");
- MOZ_ASSERT(!ret || aEvent.HasBeenPostedToRemoteProcess());
+ MOZ_ASSERT(!ret || aMouseOrPointerEvent.HasBeenPostedToRemoteProcess());
return;
}
- if (eMouseEnterIntoWidget == aEvent.mMessage ||
- eMouseExitFromWidget == aEvent.mMessage) {
- DebugOnly ret =
- isInputPriorityEventEnabled
- ? SendRealMouseEnterExitWidgetEvent(aEvent, guid, blockId)
- : SendNormalPriorityRealMouseEnterExitWidgetEvent(aEvent, guid,
- blockId);
+ if (eMouseEnterIntoWidget == aMouseOrPointerEvent.mMessage ||
+ eMouseExitFromWidget == aMouseOrPointerEvent.mMessage) {
+ DebugOnly ret = isInputPriorityEventEnabled
+ ? SendRealMouseEnterExitWidgetEvent(
+ aMouseOrPointerEvent, guid, blockId)
+ : SendNormalPriorityRealMouseEnterExitWidgetEvent(
+ aMouseOrPointerEvent, guid, blockId);
NS_WARNING_ASSERTION(ret, "SendRealMouseEnterExitWidgetEvent() failed");
- MOZ_ASSERT(!ret || aEvent.HasBeenPostedToRemoteProcess());
+ MOZ_ASSERT(!ret || aMouseOrPointerEvent.HasBeenPostedToRemoteProcess());
return;
}
DebugOnly ret =
isInputPriorityEventEnabled
- ? aEvent.mClass == ePointerEventClass
- ? SendRealPointerButtonEvent(*aEvent.AsPointerEvent(), guid,
- blockId)
- : SendRealMouseButtonEvent(aEvent, guid, blockId)
- : aEvent.mClass == ePointerEventClass
- ? SendNormalPriorityRealPointerButtonEvent(*aEvent.AsPointerEvent(),
- guid, blockId)
- : SendNormalPriorityRealMouseButtonEvent(aEvent, guid, blockId);
+ ? aMouseOrPointerEvent.mClass == ePointerEventClass
+ ? SendRealPointerButtonEvent(
+ *aMouseOrPointerEvent.AsPointerEvent(), guid, blockId)
+ : SendRealMouseButtonEvent(aMouseOrPointerEvent, guid, blockId)
+ : aMouseOrPointerEvent.mClass == ePointerEventClass
+ ? SendNormalPriorityRealPointerButtonEvent(
+ *aMouseOrPointerEvent.AsPointerEvent(), guid, blockId)
+ : SendNormalPriorityRealMouseButtonEvent(aMouseOrPointerEvent, guid,
+ blockId);
NS_WARNING_ASSERTION(ret, "SendRealMouseButtonEvent() failed");
- MOZ_ASSERT(!ret || aEvent.HasBeenPostedToRemoteProcess());
+ MOZ_ASSERT(!ret || aMouseOrPointerEvent.HasBeenPostedToRemoteProcess());
}
LayoutDeviceToCSSScale BrowserParent::GetLayoutDeviceToCSSScale() {
diff -Nru thunderbird-140.11.0esr/dom/ipc/BrowserParent.h thunderbird-140.12.0esr/dom/ipc/BrowserParent.h
--- thunderbird-140.11.0esr/dom/ipc/BrowserParent.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/ipc/BrowserParent.h 2026-06-13 03:47:57.000000000 +0000
@@ -557,11 +557,11 @@
mozilla::ipc::IPCResult RecvUnlockNativePointer();
/**
- * The following Send*Event() marks aEvent as posted to remote process if
- * it succeeded. So, you can check the result with
- * aEvent.HasBeenPostedToRemoteProcess().
+ * The following Send*Event() marks aMouseOrPointerEvent as posted to remote
+ * process if it succeeded. So, you can check the result with
+ * aMouseOrPointerEvent.HasBeenPostedToRemoteProcess().
*/
- void SendRealMouseEvent(WidgetMouseEvent& aEvent);
+ void SendRealMouseEvent(WidgetMouseEvent& aMouseOrPointerEvent);
void SendRealDragEvent(WidgetDragEvent& aEvent, uint32_t aDragAction,
uint32_t aDropEffect, nsIPrincipal* aPrincipal,
diff -Nru thunderbird-140.11.0esr/dom/ipc/CoalescedMouseData.cpp thunderbird-140.12.0esr/dom/ipc/CoalescedMouseData.cpp
--- thunderbird-140.11.0esr/dom/ipc/CoalescedMouseData.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/ipc/CoalescedMouseData.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -15,29 +15,43 @@
using namespace mozilla;
using namespace mozilla::dom;
-void CoalescedMouseData::Coalesce(const WidgetMouseEvent& aEvent,
+void CoalescedMouseData::Coalesce(const WidgetMouseEvent& aMouseOrPointerEvent,
const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId) {
+ MOZ_ASSERT_IF(aMouseOrPointerEvent.AsPointerEvent(),
+ aMouseOrPointerEvent.mMessage == eContextMenu);
+ MOZ_ASSERT(!aMouseOrPointerEvent.AsDragEvent());
if (IsEmpty()) {
- mCoalescedInputEvent = MakeUnique(aEvent);
+ mCoalescedInputEvent = [&]() -> UniquePtr {
+ if (aMouseOrPointerEvent.mClass == ePointerEventClass) {
+ MOZ_DIAGNOSTIC_ASSERT(aMouseOrPointerEvent.AsPointerEvent());
+ return MakeUnique(
+ static_cast(
+ *aMouseOrPointerEvent.AsPointerEvent()));
+ }
+ MOZ_DIAGNOSTIC_ASSERT(!aMouseOrPointerEvent.AsPointerEvent());
+ return MakeUnique(aMouseOrPointerEvent);
+ }();
mGuid = aGuid;
mInputBlockId = aInputBlockId;
MOZ_ASSERT(!mCoalescedInputEvent->mCoalescedWidgetEvents);
} else {
MOZ_ASSERT(mGuid == aGuid);
MOZ_ASSERT(mInputBlockId == aInputBlockId);
- MOZ_ASSERT(mCoalescedInputEvent->mModifiers == aEvent.mModifiers);
- MOZ_ASSERT(mCoalescedInputEvent->mReason == aEvent.mReason);
- MOZ_ASSERT(mCoalescedInputEvent->mInputSource == aEvent.mInputSource);
- MOZ_ASSERT(mCoalescedInputEvent->mButton == aEvent.mButton);
- MOZ_ASSERT(mCoalescedInputEvent->mButtons == aEvent.mButtons);
- mCoalescedInputEvent->mTimeStamp = aEvent.mTimeStamp;
- mCoalescedInputEvent->mRefPoint = aEvent.mRefPoint;
- mCoalescedInputEvent->mPressure = aEvent.mPressure;
- mCoalescedInputEvent->AssignPointerHelperData(aEvent);
+ MOZ_ASSERT(mCoalescedInputEvent->mModifiers ==
+ aMouseOrPointerEvent.mModifiers);
+ MOZ_ASSERT(mCoalescedInputEvent->mReason == aMouseOrPointerEvent.mReason);
+ MOZ_ASSERT(mCoalescedInputEvent->mInputSource ==
+ aMouseOrPointerEvent.mInputSource);
+ MOZ_ASSERT(mCoalescedInputEvent->mButton == aMouseOrPointerEvent.mButton);
+ MOZ_ASSERT(mCoalescedInputEvent->mButtons == aMouseOrPointerEvent.mButtons);
+ mCoalescedInputEvent->mTimeStamp = aMouseOrPointerEvent.mTimeStamp;
+ mCoalescedInputEvent->mRefPoint = aMouseOrPointerEvent.mRefPoint;
+ mCoalescedInputEvent->mPressure = aMouseOrPointerEvent.mPressure;
+ mCoalescedInputEvent->AssignPointerHelperData(aMouseOrPointerEvent);
}
- if (aEvent.mMessage == eMouseMove) {
+ if (aMouseOrPointerEvent.mMessage == eMouseMove) {
// PointerEvent::getCoalescedEvents is only applied to pointermove events.
if (!mCoalescedInputEvent->mCoalescedWidgetEvents) {
mCoalescedInputEvent->mCoalescedWidgetEvents =
@@ -47,37 +61,37 @@
// DOM events when content calls PointerEvent::getCoalescedEvents.
WidgetPointerEvent* event =
mCoalescedInputEvent->mCoalescedWidgetEvents->mEvents.AppendElement(
- aEvent);
+ WidgetPointerEvent::MakeCopyFromMouseEvent(aMouseOrPointerEvent));
event->mMessage = ePointerMove;
- event->mPressure = aEvent.ComputeMouseButtonPressure();
+ event->mPressure = aMouseOrPointerEvent.ComputeMouseButtonPressure();
event->mFlags.mBubbles = false;
event->mFlags.mCancelable = false;
}
}
-bool CoalescedMouseData::CanCoalesce(const WidgetMouseEvent& aEvent,
+bool CoalescedMouseData::CanCoalesce(const WidgetMouseEvent& aMouseMoveEvent,
const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId,
const nsRefreshDriver* aRefreshDriver) {
- MOZ_ASSERT(aEvent.mMessage == eMouseMove);
+ MOZ_ASSERT(aMouseMoveEvent.mMessage == eMouseMove);
if (!mCoalescedInputEvent) {
return true;
}
if (mCoalescedInputEvent->mFlags.mIsSynthesizedForTests !=
- aEvent.mFlags.mIsSynthesizedForTests ||
- mCoalescedInputEvent->mModifiers != aEvent.mModifiers ||
- mCoalescedInputEvent->mInputSource != aEvent.mInputSource ||
- mCoalescedInputEvent->pointerId != aEvent.pointerId ||
- mCoalescedInputEvent->mButton != aEvent.mButton ||
- mCoalescedInputEvent->mButtons != aEvent.mButtons || mGuid != aGuid ||
- mInputBlockId != aInputBlockId) {
+ aMouseMoveEvent.mFlags.mIsSynthesizedForTests ||
+ mCoalescedInputEvent->mModifiers != aMouseMoveEvent.mModifiers ||
+ mCoalescedInputEvent->mInputSource != aMouseMoveEvent.mInputSource ||
+ mCoalescedInputEvent->pointerId != aMouseMoveEvent.pointerId ||
+ mCoalescedInputEvent->mButton != aMouseMoveEvent.mButton ||
+ mCoalescedInputEvent->mButtons != aMouseMoveEvent.mButtons ||
+ mGuid != aGuid || mInputBlockId != aInputBlockId) {
return false;
}
// Basically, tests do not want to coalesces the consecutive mouse events.
// However, if the test calls nsIDOMWindowUtils::AdvanceTimeAndRefresh(0),
// they must try to check coalesced mouse move events.
- if (!aEvent.mFlags.mIsSynthesizedForTests) {
+ if (!aMouseMoveEvent.mFlags.mIsSynthesizedForTests) {
return true;
}
return aRefreshDriver && aRefreshDriver->IsTestControllingRefreshesEnabled();
diff -Nru thunderbird-140.11.0esr/dom/ipc/CoalescedMouseData.h thunderbird-140.12.0esr/dom/ipc/CoalescedMouseData.h
--- thunderbird-140.11.0esr/dom/ipc/CoalescedMouseData.h 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/ipc/CoalescedMouseData.h 2026-06-13 03:47:56.000000000 +0000
@@ -21,11 +21,11 @@
~CoalescedMouseData() { MOZ_COUNT_DTOR(mozilla::dom::CoalescedMouseData); }
- void Coalesce(const WidgetMouseEvent& aEvent,
+ void Coalesce(const WidgetMouseEvent& aMouseOrPointerEvent,
const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId);
- bool CanCoalesce(const WidgetMouseEvent& aEvent,
+ bool CanCoalesce(const WidgetMouseEvent& aMouseMoveEvent,
const ScrollableLayerGuid& aGuid,
const uint64_t& aInputBlockId,
const nsRefreshDriver* aRefreshDriver);
diff -Nru thunderbird-140.11.0esr/dom/ipc/ContentChild.cpp thunderbird-140.12.0esr/dom/ipc/ContentChild.cpp
--- thunderbird-140.11.0esr/dom/ipc/ContentChild.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/ipc/ContentChild.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -1571,7 +1571,11 @@
Endpoint&& aVRBridge,
Endpoint&& aVideoManager,
nsTArray&& namespaces) {
- MOZ_ASSERT(namespaces.Length() == 3);
+ MOZ_ASSERT(namespaces.Length() == 4);
+ const uint32_t compositorManagerNamespace = namespaces[0];
+ const uint32_t compositorBridgeNamespace = namespaces[1];
+ const uint32_t imageBridgeNamespace = namespaces[2];
+ const uint32_t vrManagerNamespace = namespaces[3];
// Note that for all of the methods below, if it can fail, it should only
// return false if the failure is an IPDL error. In such situations,
@@ -1580,17 +1584,20 @@
// should crash itself (because we are actually talking to the UI process). If
// there are localized failures (e.g. failed to spawn a thread), then it
// should MOZ_RELEASE_ASSERT or MOZ_CRASH as necessary instead.
- if (!CompositorManagerChild::Init(std::move(aCompositor), namespaces[0])) {
+ if (!CompositorManagerChild::Init(std::move(aCompositor),
+ compositorManagerNamespace)) {
return GetResultForRenderingInitFailure(aCompositor.OtherChildID());
}
- if (!CompositorManagerChild::CreateContentCompositorBridge(namespaces[1])) {
+ if (!CompositorManagerChild::CreateContentCompositorBridge(
+ compositorBridgeNamespace)) {
return GetResultForRenderingInitFailure(aCompositor.OtherChildID());
}
if (!ImageBridgeChild::InitForContent(std::move(aImageBridge),
- namespaces[2])) {
+ imageBridgeNamespace)) {
return GetResultForRenderingInitFailure(aImageBridge.OtherChildID());
}
- if (!gfx::VRManagerChild::InitForContent(std::move(aVRBridge))) {
+ if (!gfx::VRManagerChild::InitForContent(std::move(aVRBridge),
+ vrManagerNamespace)) {
return GetResultForRenderingInitFailure(aVRBridge.OtherChildID());
}
RemoteDecoderManagerChild::InitForGPUProcess(std::move(aVideoManager));
@@ -1613,21 +1620,29 @@
Endpoint&& aVRBridge,
Endpoint&& aVideoManager,
nsTArray&& namespaces) {
- MOZ_ASSERT(namespaces.Length() == 3);
+ MOZ_ASSERT(namespaces.Length() == 4);
+ const uint32_t compositorManagerNamespace = namespaces[0];
+ const uint32_t compositorBridgeNamespace = namespaces[1];
+ const uint32_t imageBridgeNamespace = namespaces[2];
+ const uint32_t vrManagerNamespace = namespaces[3];
+
nsTArray> tabs = BrowserChild::GetAll();
// Re-establish singleton bridges to the compositor.
- if (!CompositorManagerChild::Init(std::move(aCompositor), namespaces[0])) {
+ if (!CompositorManagerChild::Init(std::move(aCompositor),
+ compositorManagerNamespace)) {
return GetResultForRenderingInitFailure(aCompositor.OtherChildID());
}
- if (!CompositorManagerChild::CreateContentCompositorBridge(namespaces[1])) {
+ if (!CompositorManagerChild::CreateContentCompositorBridge(
+ compositorBridgeNamespace)) {
return GetResultForRenderingInitFailure(aCompositor.OtherChildID());
}
if (!ImageBridgeChild::ReinitForContent(std::move(aImageBridge),
- namespaces[2])) {
+ imageBridgeNamespace)) {
return GetResultForRenderingInitFailure(aImageBridge.OtherChildID());
}
- if (!gfx::VRManagerChild::InitForContent(std::move(aVRBridge))) {
+ if (!gfx::VRManagerChild::InitForContent(std::move(aVRBridge),
+ vrManagerNamespace)) {
return GetResultForRenderingInitFailure(aVRBridge.OtherChildID());
}
gfxPlatform::GetPlatform()->CompositorUpdated();
diff -Nru thunderbird-140.11.0esr/dom/ipc/ContentParent.cpp thunderbird-140.12.0esr/dom/ipc/ContentParent.cpp
--- thunderbird-140.11.0esr/dom/ipc/ContentParent.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/ipc/ContentParent.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -2924,7 +2924,7 @@
Endpoint imageBridge;
Endpoint vrBridge;
Endpoint videoManager;
- AutoTArray namespaces;
+ AutoTArray namespaces;
if (!gpm->CreateContentBridges(OtherEndpointProcInfo(), &compositor,
&imageBridge, &vrBridge, &videoManager,
@@ -3110,7 +3110,7 @@
Endpoint imageBridge;
Endpoint vrBridge;
Endpoint videoManager;
- AutoTArray namespaces;
+ AutoTArray namespaces;
if (!gpm->CreateContentBridges(OtherEndpointProcInfo(), &compositor,
&imageBridge, &vrBridge, &videoManager,
@@ -4075,6 +4075,10 @@
return IPC_FAIL(this, "Illegal subframe clone");
}
+ if (aPrintData.remotePrintJob()) {
+ return IPC_FAIL(this, "Shouldn't pass print jobs around this IPC call");
+ }
+
ContentParent* cp = source->GetContentParent();
if (NS_WARN_IF(!cp)) {
return IPC_OK();
diff -Nru thunderbird-140.11.0esr/dom/jsurl/nsJSProtocolHandler.cpp thunderbird-140.12.0esr/dom/jsurl/nsJSProtocolHandler.cpp
--- thunderbird-140.11.0esr/dom/jsurl/nsJSProtocolHandler.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/jsurl/nsJSProtocolHandler.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -915,8 +915,9 @@
}
void nsJSChannel::NotifyListener() {
- mListener->OnStartRequest(this);
- mListener->OnStopRequest(this, mStatus);
+ nsCOMPtr listener = mListener;
+ listener->OnStartRequest(this);
+ listener->OnStopRequest(this, mStatus);
CleanupStrongRefs();
}
@@ -1124,7 +1125,8 @@
nsJSChannel::OnStartRequest(nsIRequest* aRequest) {
NS_ENSURE_TRUE(aRequest == mStreamChannel, NS_ERROR_UNEXPECTED);
- return mListener->OnStartRequest(this);
+ nsCOMPtr listener = mListener;
+ return listener->OnStartRequest(this);
}
NS_IMETHODIMP
@@ -1132,7 +1134,8 @@
uint64_t aOffset, uint32_t aCount) {
NS_ENSURE_TRUE(aRequest == mStreamChannel, NS_ERROR_UNEXPECTED);
- return mListener->OnDataAvailable(this, aInputStream, aOffset, aCount);
+ nsCOMPtr listener = mListener;
+ return listener->OnDataAvailable(this, aInputStream, aOffset, aCount);
}
NS_IMETHODIMP
diff -Nru thunderbird-140.11.0esr/dom/media/AsyncLogger.h thunderbird-140.12.0esr/dom/media/AsyncLogger.h
--- thunderbird-140.11.0esr/dom/media/AsyncLogger.h 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/AsyncLogger.h 2026-06-13 03:47:56.000000000 +0000
@@ -140,24 +140,35 @@
static_assert(sizeof(MPSCQueue::Message) == PAYLOAD_TOTAL_SIZE,
"MPSCQueue internal allocations has an unexpected size.");
- explicit AsyncLogger() : mThread(nullptr), mRunning(false) {}
+ explicit AsyncLogger() : mRunning(false) {}
+
+ ~AsyncLogger() { Stop(); }
void Start() {
- MOZ_ASSERT(!mRunning, "Double calls to AsyncLogger::Start");
- mRunning = true;
+ MOZ_ASSERT(!mRunning.load(std::memory_order_acquire),
+ "Double calls to AsyncLogger::Start");
+ MOZ_ASSERT(!mThread.joinable(),
+ "AsyncLogger thread must be joined before restart");
+ mRunning.store(true, std::memory_order_release);
Run();
}
void Stop() {
- if (mRunning) {
- mRunning = false;
+ mRunning.store(false, std::memory_order_release);
+ while (mActiveLogs.load(std::memory_order_acquire)) {
+ std::this_thread::yield();
+ }
+ if (mThread.joinable()) {
+ MOZ_ASSERT(std::this_thread::get_id() != mThread.get_id(),
+ "AsyncLogger cannot join its own thread");
+ mThread.join();
}
}
// Log something that has a beginning and an end
void Log(const char* aName, const char* aCategory, const char* aComment,
TracingPhase aPhase) {
- if (!Enabled()) {
+ if (!BeginLogging()) {
return;
}
@@ -182,33 +193,48 @@
msg->data.mCommentStart = 0;
}
mMessageQueueProfiler.Push(msg);
+ EndLogging();
}
// Log something that has a beginning and a duration
void LogDuration(const char* aName, const char* aCategory, uint64_t aDuration,
uint64_t aFrames, uint64_t aSampleRate) {
- if (Enabled()) {
- auto* msg = new MPSCQueue::Message();
- msg->data.mTID = profiler_current_thread_id();
- msg->data.mPhase = TracingPhase::COMPLETE;
- msg->data.mTimestamp = TimeStamp::Now();
- msg->data.mDurationUs =
- (static_cast(aFrames) / aSampleRate) * 1e6;
- StringWriter writer(msg->data.mName, std::size(msg->data.mName));
- size_t unused;
- // Unused since we don't need to know the location of the new index
- writer.AppendCString(aName, &unused);
- mMessageQueueProfiler.Push(msg);
+ if (!BeginLogging()) {
+ return;
}
+
+ auto* msg = new MPSCQueue::Message();
+ msg->data.mTID = profiler_current_thread_id();
+ msg->data.mPhase = TracingPhase::COMPLETE;
+ msg->data.mTimestamp = TimeStamp::Now();
+ msg->data.mDurationUs = (static_cast(aFrames) / aSampleRate) * 1e6;
+ StringWriter writer(msg->data.mName, std::size(msg->data.mName));
+ size_t unused;
+ writer.AppendCString(aName, &unused);
+ mMessageQueueProfiler.Push(msg);
+ EndLogging();
}
- bool Enabled() { return mRunning; }
+ bool Enabled() { return mRunning.load(std::memory_order_acquire); }
private:
+ bool BeginLogging() {
+ if (!mRunning.load(std::memory_order_acquire)) {
+ return false;
+ }
+ mActiveLogs.fetch_add(1, std::memory_order_acq_rel);
+ if (mRunning.load(std::memory_order_acquire)) {
+ return true;
+ }
+ mActiveLogs.fetch_sub(1, std::memory_order_acq_rel);
+ return false;
+ }
+
+ void EndLogging() { mActiveLogs.fetch_sub(1, std::memory_order_release); }
+
void Run() {
- mThread.reset(new std::thread([this]() {
- AUTO_PROFILER_REGISTER_THREAD("AsyncLogger");
- while (mRunning) {
+ mThread = std::thread([this]() {
+ for (;;) {
{
struct TracingMarkerWithComment {
static constexpr Span MarkerTypeName() {
@@ -246,7 +272,7 @@
};
TracePayload message;
- while (mMessageQueueProfiler.Pop(&message) && mRunning) {
+ while (mMessageQueueProfiler.Pop(&message)) {
if (message.mPhase != TracingPhase::COMPLETE) {
if (!message.mCommentStart) {
profiler_add_marker(
@@ -284,11 +310,12 @@
}
}
}
+ if (!mRunning.load(std::memory_order_acquire)) {
+ break;
+ }
Sleep();
}
- }));
- // cleanup is done via mRunning
- mThread->detach();
+ });
}
uint64_t NowInUs() {
@@ -298,8 +325,9 @@
void Sleep() { std::this_thread::sleep_for(std::chrono::milliseconds(10)); }
- std::unique_ptr mThread;
+ std::thread mThread;
MPSCQueue mMessageQueueProfiler;
+ std::atomic mActiveLogs{0};
std::atomic mRunning;
};
diff -Nru thunderbird-140.11.0esr/dom/media/ChannelMediaResource.cpp thunderbird-140.12.0esr/dom/media/ChannelMediaResource.cpp
--- thunderbird-140.11.0esr/dom/media/ChannelMediaResource.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/ChannelMediaResource.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -84,7 +84,8 @@
AssertIsOnMainThread();
mLock.NoteOnMainThread();
if (!mResource) return NS_OK;
- return mResource->OnStartRequest(aRequest, mOffset);
+ RefPtr resource = mResource;
+ return resource->OnStartRequest(aRequest, mOffset);
}
nsresult ChannelMediaResource::Listener::OnStopRequest(nsIRequest* aRequest,
@@ -92,7 +93,8 @@
AssertIsOnMainThread();
mLock.NoteOnMainThread();
if (!mResource) return NS_OK;
- return mResource->OnStopRequest(aRequest, aStatus);
+ RefPtr resource = mResource;
+ return resource->OnStopRequest(aRequest, aStatus);
}
nsresult ChannelMediaResource::Listener::OnDataAvailable(
diff -Nru thunderbird-140.11.0esr/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp thunderbird-140.12.0esr/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp
--- thunderbird-140.11.0esr/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -587,9 +587,13 @@
}
FFmpegVideoDecoder::~FFmpegVideoDecoder() {
-#ifdef CUSTOMIZED_BUFFER_ALLOCATION
- MOZ_DIAGNOSTIC_ASSERT(mAllocatedImages.IsEmpty(),
- "Should release all shmem buffers before destroy!");
+#ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+ // ffmpeg should have cleared all of its strong references to the decoded data
+ // buffers.
+ if (mImageTracker) {
+ MOZ_DIAGNOSTIC_ASSERT(mImageTracker->IsEmpty(),
+ "Should release all shmem buffers before destroy!");
+ }
#endif
}
@@ -676,9 +680,9 @@
static void ReleaseVideoBufferWrapper(void* opaque, uint8_t* data) {
if (opaque) {
- FFMPEGV_LOG("ReleaseVideoBufferWrapper: PlanarYCbCrImage=%p", opaque);
- RefPtr image = static_cast(opaque);
- image->ReleaseBuffer();
+ FFMPEGV_LOG("ReleaseVideoBufferWrapper: ImageBufferWrapper=%p", opaque);
+ RefPtr image = dont_AddRef(static_cast(opaque));
+ image->StopTracking();
}
}
@@ -906,9 +910,20 @@
# endif
MOZ_ASSERT(aFrame->data[0] && aFrame->data[1] && aFrame->data[2]);
- // This will hold a reference to image, and the reference would be dropped
- // when ffmpeg tells us that the buffer is no longer needed.
- auto imageWrapper = MakeRefPtr(image.get(), this);
+# ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+ if (!mImageTracker) {
+ mImageTracker = MakeRefPtr();
+ }
+ auto imageWrapper =
+ MakeRefPtr(std::move(image), mImageTracker);
+# else
+ auto imageWrapper = MakeRefPtr(std::move(image));
+# endif
+
+ // This will hold a strong reference to imageWrapper, and the reference will
+ // be dropped when ffmpeg tells us that the buffer is no longer needed. Since
+ // the wrapper keeps image alive, it will prevent recycling until ffmpeg is
+ // done with the buffer.
aFrame->buf[0] =
mLib->av_buffer_create(aFrame->data[0], dataSize.value(),
ReleaseVideoBufferWrapper, imageWrapper.get(), 0);
@@ -917,10 +932,12 @@
return AVERROR(EINVAL);
}
+ auto* imageWrapperPtr = imageWrapper.forget().take();
+ imageWrapperPtr->StartTracking();
+
FFMPEG_LOG("Created av buffer, buf=%p, data=%p, image=%p, sz=%d",
- aFrame->buf[0], aFrame->data[0], imageWrapper.get(),
+ aFrame->buf[0], aFrame->data[0], imageWrapperPtr,
dataSize.value());
- mAllocatedImages.Insert(imageWrapper.get());
mIsUsingShmemBufferForDecode = Some(true);
return 0;
}
@@ -1581,10 +1598,10 @@
# endif
if (mIsUsingShmemBufferForDecode && *mIsUsingShmemBufferForDecode &&
!requiresCopy) {
- RefPtr wrapper = static_cast(
+ auto* wrapper = static_cast(
mLib->av_buffer_get_opaque(mFrame->buf[0]));
MOZ_ASSERT(wrapper);
- FFMPEG_LOGV("Create a video data from a shmem image=%p", wrapper.get());
+ FFMPEG_LOGV("Create a video data from a shmem image=%p", wrapper);
v = VideoData::CreateFromImage(
mInfo.mDisplay, aOffset, TimeUnit::FromMicroseconds(aPts),
TimeUnit::FromMicroseconds(aDuration), wrapper->AsImage(),
diff -Nru thunderbird-140.11.0esr/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h thunderbird-140.12.0esr/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h
--- thunderbird-140.11.0esr/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h 2026-06-13 03:47:56.000000000 +0000
@@ -15,10 +15,6 @@
#include "PerformanceRecorder.h"
#include "SimpleMap.h"
#include "mozilla/ScopeExit.h"
-#include "nsTHashSet.h"
-#if LIBAVCODEC_VERSION_MAJOR >= 57 && LIBAVUTIL_VERSION_MAJOR >= 56
-# include "mozilla/layers/TextureClient.h"
-#endif
#if defined(MOZ_USE_HWDECODE) && defined(MOZ_WIDGET_GTK)
# include "FFmpegVideoFramePool.h"
#endif
@@ -27,12 +23,31 @@
# define AVPixelFormat PixelFormat
#endif
+#if LIBAVCODEC_VERSION_MAJOR >= 57 && LIBAVUTIL_VERSION_MAJOR >= 56
+# define CUSTOMIZED_BUFFER_ALLOCATION 1
+# ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+# define CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+# endif
+#endif
+
+#ifdef CUSTOMIZED_BUFFER_ALLOCATION
+# include "mozilla/layers/TextureClient.h"
+#endif
+
+#ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+# include "nsTHashSet.h"
+# include "mozilla/DataMutex.h"
+#endif
+
struct _VADRMPRIMESurfaceDescriptor;
typedef struct _VADRMPRIMESurfaceDescriptor VADRMPRIMESurfaceDescriptor;
namespace mozilla {
+#ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+class ImageBufferTracker;
class ImageBufferWrapper;
+#endif
#ifdef MOZ_ENABLE_D3D11VA
class DXVA2Manager;
@@ -86,7 +101,7 @@
static AVCodecID GetCodecId(const nsACString& aMimeType);
-#if LIBAVCODEC_VERSION_MAJOR >= 57 && LIBAVUTIL_VERSION_MAJOR >= 56
+#ifdef CUSTOMIZED_BUFFER_ALLOCATION
int GetVideoBuffer(struct AVCodecContext* aCodecContext, AVFrame* aFrame,
int aFlags);
int GetVideoBufferDefault(struct AVCodecContext* aCodecContext,
@@ -94,9 +109,6 @@
mIsUsingShmemBufferForDecode = Some(false);
return mLib->avcodec_default_get_buffer2(aCodecContext, aFrame, aFlags);
}
- void ReleaseAllocatedImage(ImageBufferWrapper* aImage) {
- mAllocatedImages.Remove(aImage);
- }
#endif
bool IsHardwareAccelerated() const {
nsAutoCString dummy;
@@ -131,7 +143,7 @@
bool IsHardwareAccelerated(nsACString& aFailureReason) const override;
-#if LIBAVCODEC_VERSION_MAJOR >= 57 && LIBAVUTIL_VERSION_MAJOR >= 56
+#ifdef CUSTOMIZED_BUFFER_ALLOCATION
layers::TextureClient* AllocateTextureClientForImage(
struct AVCodecContext* aCodecContext, layers::PlanarYCbCrImage* aImage);
@@ -260,47 +272,83 @@
// True if we're allocating shmem for ffmpeg decode buffer.
Maybe> mIsUsingShmemBufferForDecode;
-#if LIBAVCODEC_VERSION_MAJOR >= 57 && LIBAVUTIL_VERSION_MAJOR >= 56
- // These images are buffers for ffmpeg in order to store decoded data when
- // using custom allocator for decoding. We want to explictly track all images
- // we allocate to ensure that we won't leak any of them.
- //
- // All images tracked by mAllocatedImages are used by ffmpeg,
- // i.e. ffmpeg holds a reference to them and uses them in
- // its internal decoding queue.
- //
- // When an image is removed from mAllocatedImages it's recycled
- // for a new frame by AllocateTextureClientForImage() in
- // FFmpegVideoDecoder::GetVideoBuffer().
- nsTHashSet> mAllocatedImages;
+#ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+ // Used to explicitly track allocated images to ensure they are all released
+ // by ffmpeg after shutdown.
+ RefPtr mImageTracker;
#endif
};
-#if LIBAVCODEC_VERSION_MAJOR >= 57 && LIBAVUTIL_VERSION_MAJOR >= 56
+#ifdef CUSTOMIZED_BUFFER_ALLOCATION
+# ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+class ImageBufferTracker {
+ public:
+ NS_INLINE_DECL_THREADSAFE_REFCOUNTING(ImageBufferTracker)
+
+ ImageBufferTracker() = default;
+
+ void Insert(ImageBufferWrapper* aImage) {
+ auto lock = mAllocatedImages.Lock();
+ lock->Insert(aImage);
+ }
+
+ void Remove(ImageBufferWrapper* aImage) {
+ auto lock = mAllocatedImages.Lock();
+ lock->Remove(aImage);
+ }
+
+ bool IsEmpty() const {
+ auto lock = mAllocatedImages.Lock();
+ return lock->IsEmpty();
+ }
+
+ private:
+ ~ImageBufferTracker() = default;
+
+ mutable DataMutex> mAllocatedImages{
+ "ImageBufferTracker::mAllocatedImages"};
+};
+# endif
+
class ImageBufferWrapper final {
public:
typedef mozilla::layers::Image Image;
- typedef mozilla::layers::PlanarYCbCrImage PlanarYCbCrImage;
NS_INLINE_DECL_THREADSAFE_REFCOUNTING(ImageBufferWrapper)
- ImageBufferWrapper(Image* aImage, void* aDecoder)
- : mImage(aImage), mDecoder(aDecoder) {
- MOZ_ASSERT(aImage);
- MOZ_ASSERT(mDecoder);
+# ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+ ImageBufferWrapper(RefPtr&& aImage, ImageBufferTracker* aTracker)
+ : mImage(std::move(aImage)), mTracker(aTracker) {
+ MOZ_ASSERT(mImage);
+ MOZ_ASSERT(mTracker);
+ }
+# else
+ explicit ImageBufferWrapper(RefPtr&& aImage)
+ : mImage(std::move(aImage)) {
+ MOZ_ASSERT(mImage);
}
+# endif
Image* AsImage() { return mImage; }
- void ReleaseBuffer() {
- auto* decoder = static_cast*>(mDecoder);
- decoder->ReleaseAllocatedImage(this);
+ void StartTracking() {
+# ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+ mTracker->Insert(this);
+# endif
+ }
+
+ void StopTracking() {
+# ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+ mTracker->Remove(this);
+# endif
}
private:
~ImageBufferWrapper() = default;
const RefPtr mImage;
- void* const MOZ_NON_OWNING_REF mDecoder;
+# ifdef CUSTOMIZED_BUFFER_ALLOCATION_ASSERT_ENABLED
+ const RefPtr mTracker;
+# endif
};
#endif
diff -Nru thunderbird-140.11.0esr/dom/media/test/reftest/color_quads/reftest.list thunderbird-140.12.0esr/dom/media/test/reftest/color_quads/reftest.list
--- thunderbird-140.11.0esr/dom/media/test/reftest/color_quads/reftest.list 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/test/reftest/color_quads/reftest.list 2026-06-13 03:47:57.000000000 +0000
@@ -26,23 +26,23 @@
skip-if(Android) skip-if(winWidget&&swgl) fuzzy-if(Android,255-255,273726-273726) fuzzy-if(cocoaWidget,0-16,0-1718) fuzzy-if(cocoaWidget&&swgl,0-42,0-196694) fuzzy-if(cocoaWidget&&/^14\.70$/.test(os_version)&&!swgl,40-42,187328-196694) fuzzy-if(appleSilicon,0-16,0-1874) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.vp9.webm ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.av1.webm # Bug 1934894
skip-if(Android) skip-if(winWidget&&swgl) fuzzy-if(useDrawSnapshot,0-1,0-10) fuzzy-if(Android,255-255,273726-273726) fuzzy-if(cocoaWidget,2-36,184281-187407) fuzzy-if(cocoaWidget&&/^14\.70$/.test(os_version),39-40,187329-196695) fuzzy-if(cocoaWidget&&/^15\.30$/.test(os_version),0-1,0-6) fuzzy-if(cocoaWidget&&/^11\.20$/.test(os_version),36-49,187329-187407) fuzzy-if(winWidget,0-21,0-360000) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.h264.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.av1.webm # Bug 1934894
skip-if(Android) skip-if(winWidget&&swgl) fuzzy-if(Android,255-255,273726-273726) fuzzy-if(cocoaWidget,0-16,0-1718) fuzzy-if(cocoaWidget&&swgl,0-42,0-196694) fuzzy-if(cocoaWidget&&/^14\.70$/.test(os_version)&&!swgl,40-42,187328-196694) fuzzy-if(appleSilicon,0-16,0-1874) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.vp9.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.av1.webm # Bug 1934894
-skip-if(Android) skip-if(!(winWidget&&swgl)) fuzzy(0-35,0-8506) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.vp9.webm ../reftest_img.html?src=color_quads/720p.png
-skip-if(Android) skip-if(!(winWidget&&swgl)) fuzzy(0-35,0-8506) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.vp9.mp4 ../reftest_img.html?src=color_quads/720p.png
+skip-if(Android) skip-if(!(winWidget&&swgl)) fuzzy(0-38,0-181038) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.vp9.webm ../reftest_img.html?src=color_quads/720p.png
+skip-if(Android) skip-if(!(winWidget&&swgl)) fuzzy(0-38,0-181038) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p.vp9.mp4 ../reftest_img.html?src=color_quads/720p.png
# -
# yuv420p10
-skip-if(Android) fuzzy(33-49,1870-2579) fuzzy-if(swgl,34-52,180421-270528) fuzzy-if(useDrawSnapshot,16-16,183840-183840) fuzzy-if(cocoaWidget,60-74,270329-271024) fuzzy-if(cocoaWidget&&/^15\.30$/.test(os_version),67-70,273726-287412) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.webm ../reftest_img.html?src=color_quads/720p.png
-skip-if(Android) fuzzy-if(cocoaWidget,0-12,0-187770) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.vp9.webm ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.webm
-skip-if(Android) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.webm
+skip-if(Android) fuzzy(33-49,1870-2579) fuzzy-if(swgl,34-52,180421-270528) fuzzy-if(useDrawSnapshot,16-16,183840-183840) fuzzy-if(cocoaWidget,60-74,270329-271024) fuzzy-if(cocoaWidget&&/^15\.30$/.test(os_version),67-70,273726-287412) fuzzy-if(winWidget,0-255,0-294000) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.webm ../reftest_img.html?src=color_quads/720p.png # Bug 2024599, Bug 2041500
+skip-if(Android) fuzzy-if(cocoaWidget,0-12,0-187770) fuzzy-if(winWidget,0-1,0-253500) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.vp9.webm ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.webm # Bug 2024599, Bug 2041500
+skip-if(Android) fuzzy-if(winWidget,0-1,0-253500) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.webm # Bug 2024599, Bug 2041500
#[2] skip-if(Android) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.h264.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.webm
-skip-if(Android) fuzzy-if(cocoaWidget,0-12,0-187770) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.vp9.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.webm
+skip-if(Android) fuzzy-if(cocoaWidget,0-12,0-187770) fuzzy-if(winWidget,0-1,0-253500) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.vp9.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.tv.yuv420p10.av1.webm # Bug 2024599, Bug 2041500
-skip-if(Android) fuzzy(33-49,174620-270059) fuzzy-if(useDrawSnapshot,20-20,186800-186800) fuzzy-if(!winWidget&&swgl,36-52,11553-11555) fuzzy-if(swgl&&cocoaWidget,34-50,11465-270059) fuzzy-if(cocoaWidget&&/^15\.30$/.test(os_version),66-69,273726-287412) fuzzy-if(winWidget&&swgl,36-52,11554-187200) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.webm ../reftest_img.html?src=color_quads/720p.png
-skip-if(Android) fuzzy-if(cocoaWidget&&/^14\.70$/.test(os_version),0-42,0-196695) fuzzy-if(cocoaWidget&&/^15\.30$/.test(os_version),0-42,0-196695) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.vp9.webm ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.webm # Bug 1934894
-skip-if(Android) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.webm
+skip-if(Android) fuzzy(33-49,174620-270059) fuzzy-if(useDrawSnapshot,20-20,186800-186800) fuzzy-if(!winWidget&&swgl,36-52,11553-11555) fuzzy-if(swgl&&cocoaWidget,34-50,11465-270059) fuzzy-if(cocoaWidget&&/^15\.30$/.test(os_version),66-69,273726-287412) fuzzy-if(winWidget&&swgl,36-52,11554-187200) fuzzy-if(winWidget,0-255,0-294000) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.webm ../reftest_img.html?src=color_quads/720p.png # Bug 2024599, Bug 2041500
+skip-if(Android) fuzzy-if(cocoaWidget&&/^14\.70$/.test(os_version),0-42,0-196695) fuzzy-if(cocoaWidget&&/^15\.30$/.test(os_version),0-42,0-196695) fuzzy-if(winWidget,0-1,0-156500) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.vp9.webm ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.webm # Bug 1934894, Bug 2024599, Bug 2041500
+skip-if(Android) fuzzy-if(winWidget,0-1,0-156500) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.webm # Bug 2024599, Bug 2041500
#[2] skip-if(Android) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.h264.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.webm
-skip-if(Android) fuzzy-if(cocoaWidget&&/^14\.70$/.test(os_version),0-42,0-196695) fuzzy-if(cocoaWidget&&/^15\.30$/.test(os_version),0-42,0-196695) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.vp9.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.webm # Bug 1934894
+skip-if(Android) fuzzy-if(cocoaWidget&&/^14\.70$/.test(os_version),0-42,0-196695) fuzzy-if(cocoaWidget&&/^15\.30$/.test(os_version),0-42,0-196695) fuzzy-if(winWidget,0-1,0-156500) == ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.vp9.mp4 ../reftest_video.html?src=color_quads/720p.png.bt709.bt709.pc.yuv420p10.av1.webm # Bug 1934894, Bug 2024599, Bug 2041500
# Android is really broken in a variety of ways for p10.
#[2]: yuv420p10 broken in h264.mp4: https://bugzilla.mozilla.org/show_bug.cgi?id=1711812
diff -Nru thunderbird-140.11.0esr/dom/media/test/reftest/reftest.list thunderbird-140.12.0esr/dom/media/test/reftest/reftest.list
--- thunderbird-140.11.0esr/dom/media/test/reftest/reftest.list 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/test/reftest/reftest.list 2026-06-13 03:47:56.000000000 +0000
@@ -3,11 +3,11 @@
skip-if(Android) skip-if(cocoaWidget) skip-if(winWidget) fuzzy-if(gtkWidget,0-57,0-4282) fuzzy-if(cocoaWidget,55-80,4173-4417) HTTP(..) == bipbop_300_215kbps.mp4.lastframe.html bipbop_300_215kbps.mp4.lastframe-ref.html
skip-if(Android) fuzzy-if(cocoaWidget,0-25,0-175921) fuzzy-if(appleSilicon,0-34,0-40100) fuzzy-if(winWidget,0-71,0-179198) fuzzy-if(gtkWidget,0-46,0-173482) HTTP(..) == gizmo.mp4.seek.html gizmo.mp4.55thframe-ref.html
# Bug 1758718
-skip-if(Android) skip-if(cocoaWidget) fuzzy(0-10,0-778236) == image-10bits-rendering-video.html image-10bits-rendering-ref.html
-skip-if(Android) fuzzy(0-10,0-778536) fuzzy-if(appleSilicon,0-37,0-699614) == image-10bits-rendering-90-video.html image-10bits-rendering-90-ref.html
+skip-if(Android) skip-if(cocoaWidget) fuzzy(0-10,0-778236) fuzzy-if(winWidget,0-240,0-769689) == image-10bits-rendering-video.html image-10bits-rendering-ref.html # Bug 2024599
+skip-if(Android) fuzzy(0-10,0-778536) fuzzy-if(appleSilicon,0-37,0-699614) fuzzy-if(winWidget,0-12,0-769429) == image-10bits-rendering-90-video.html image-10bits-rendering-90-ref.html
# Bug 1758718
-skip-if(Android) fuzzy(0-27,0-573106) skip-if(cocoaWidget) == image-10bits-rendering-720-video.html image-10bits-rendering-720-ref.html
-skip-if(Android) fuzzy(0-31,0-573249) fuzzy-if(appleSilicon,0-37,0-543189) == image-10bits-rendering-720-90-video.html image-10bits-rendering-720-90-ref.html
+skip-if(Android) fuzzy(0-27,0-573106) fuzzy-if(winWidget,0-255,0-576000) skip-if(cocoaWidget) == image-10bits-rendering-720-video.html image-10bits-rendering-720-ref.html # Bug 2024599
+skip-if(Android) fuzzy(0-31,0-573249) fuzzy-if(appleSilicon,0-37,0-543189) fuzzy-if(winWidget,0-40,0-574146) == image-10bits-rendering-720-90-video.html image-10bits-rendering-720-90-ref.html
skip-if(Android) fuzzy(0-84,0-774213) fails-if(useDrawSnapshot) == uneven_frame_duration_video.html uneven_frame_duration_video-ref.html # Skip on Windows 7 as the resolution of the video is too high for test machines and will fail in the decoder.
# Set media.dormant-on-pause-timeout-ms to avoid decoders becoming dormant and busting test, skip on android as test is too noisy and unstable
skip-if(Android) pref(media.dormant-on-pause-timeout-ms,-1) fuzzy(0-20,0-500) == frame_order_mp4.html frame_order_mp4-ref.html
diff -Nru thunderbird-140.11.0esr/dom/media/webaudio/AudioNodeEngine.cpp thunderbird-140.12.0esr/dom/media/webaudio/AudioNodeEngine.cpp
--- thunderbird-140.11.0esr/dom/media/webaudio/AudioNodeEngine.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/webaudio/AudioNodeEngine.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -31,7 +31,7 @@
new ThreadSharedFloatArrayBufferList(aChannelCount);
for (uint32_t i = 0; i < aChannelCount; ++i) {
- float* channelData = js_pod_malloc(aLength);
+ float* channelData = js_pod_calloc(aLength);
if (!channelData) {
return nullptr;
}
diff -Nru thunderbird-140.11.0esr/dom/media/webaudio/AudioNodeEngine.h thunderbird-140.12.0esr/dom/media/webaudio/AudioNodeEngine.h
--- thunderbird-140.11.0esr/dom/media/webaudio/AudioNodeEngine.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/webaudio/AudioNodeEngine.h 2026-06-13 03:47:57.000000000 +0000
@@ -44,8 +44,8 @@
}
/**
* Create with buffers suitable for transfer to
- * JS::NewArrayBufferWithContents(). The buffer contents are uninitialized
- * and so should be set using GetDataForWrite().
+ * JS::NewArrayBufferWithContents(). The buffer contents are
+ * zero-initialised; callers should set them using GetDataForWrite().
*/
static already_AddRefed Create(
uint32_t aChannelCount, size_t aLength, const mozilla::fallible_t&);
diff -Nru thunderbird-140.11.0esr/dom/media/webrtc/CubebDeviceEnumerator.cpp thunderbird-140.12.0esr/dom/media/webrtc/CubebDeviceEnumerator.cpp
--- thunderbird-140.11.0esr/dom/media/webrtc/CubebDeviceEnumerator.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/webrtc/CubebDeviceEnumerator.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -26,7 +26,7 @@
static StaticMutex sInstanceMutex MOZ_UNANNOTATED;
/* static */
-CubebDeviceEnumerator* CubebDeviceEnumerator::GetInstance() {
+already_AddRefed CubebDeviceEnumerator::GetInstance() {
StaticMutexAutoLock lock(sInstanceMutex);
if (!sInstance) {
sInstance = new CubebDeviceEnumerator();
@@ -45,7 +45,7 @@
}();
Unused << clearOnShutdownSetup;
}
- return sInstance.get();
+ return do_AddRef(sInstance);
}
CubebDeviceEnumerator::CubebDeviceEnumerator()
diff -Nru thunderbird-140.11.0esr/dom/media/webrtc/CubebDeviceEnumerator.h thunderbird-140.12.0esr/dom/media/webrtc/CubebDeviceEnumerator.h
--- thunderbird-140.11.0esr/dom/media/webrtc/CubebDeviceEnumerator.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/webrtc/CubebDeviceEnumerator.h 2026-06-13 03:47:56.000000000 +0000
@@ -24,7 +24,7 @@
public:
NS_INLINE_DECL_THREADSAFE_REFCOUNTING(CubebDeviceEnumerator)
- static CubebDeviceEnumerator* GetInstance();
+ static already_AddRefed GetInstance();
static void Shutdown();
using AudioDeviceSet = media::Refcountable>>;
// This method returns a list of all the input audio devices
diff -Nru thunderbird-140.11.0esr/dom/media/webrtc/MediaEngineWebRTC.cpp thunderbird-140.12.0esr/dom/media/webrtc/MediaEngineWebRTC.cpp
--- thunderbird-140.11.0esr/dom/media/webrtc/MediaEngineWebRTC.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/media/webrtc/MediaEngineWebRTC.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -35,7 +35,7 @@
using camera::GetChildAndCall;
using dom::MediaSourceEnum;
-CubebDeviceEnumerator* GetEnumerator() {
+already_AddRefed GetEnumerator() {
return CubebDeviceEnumerator::GetInstance();
}
@@ -46,12 +46,13 @@
&CamerasChild::ConnectDeviceListChangeListener,
&mCameraListChangeListener, AbstractThread::MainThread(), this,
&MediaEngineWebRTC::DeviceListChanged);
+ RefPtr enumerator = GetEnumerator();
mMicrophoneListChangeListener =
- GetEnumerator()->OnAudioInputDeviceListChange().Connect(
+ enumerator->OnAudioInputDeviceListChange().Connect(
AbstractThread::MainThread(), this,
&MediaEngineWebRTC::DeviceListChanged);
mSpeakerListChangeListener =
- GetEnumerator()->OnAudioOutputDeviceListChange().Connect(
+ enumerator->OnAudioOutputDeviceListChange().Connect(
AbstractThread::MainThread(), this,
&MediaEngineWebRTC::DeviceListChanged);
}
@@ -165,8 +166,9 @@
nsTArray>* aDevices) {
AssertIsOnOwningThread();
+ RefPtr enumerator = GetEnumerator();
RefPtr devices =
- GetEnumerator()->EnumerateAudioInputDevices();
+ enumerator->EnumerateAudioInputDevices();
DebugOnly foundPreferredDevice = false;
@@ -210,8 +212,9 @@
nsTArray>* aDevices) {
AssertIsOnOwningThread();
+ RefPtr enumerator = GetEnumerator();
RefPtr devices =
- GetEnumerator()->EnumerateAudioOutputDevices();
+ enumerator->EnumerateAudioOutputDevices();
#ifndef XP_WIN
DebugOnly preferredDeviceFound = false;
diff -Nru thunderbird-140.11.0esr/dom/security/nsHTTPSOnlyStreamListener.cpp thunderbird-140.12.0esr/dom/security/nsHTTPSOnlyStreamListener.cpp
--- thunderbird-140.11.0esr/dom/security/nsHTTPSOnlyStreamListener.cpp 2026-05-15 21:31:20.000000000 +0000
+++ thunderbird-140.12.0esr/dom/security/nsHTTPSOnlyStreamListener.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -43,12 +43,14 @@
nsHTTPSOnlyStreamListener::OnDataAvailable(nsIRequest* aRequest,
nsIInputStream* aInputStream,
uint64_t aOffset, uint32_t aCount) {
- return mListener->OnDataAvailable(aRequest, aInputStream, aOffset, aCount);
+ nsCOMPtr listener = mListener;
+ return listener->OnDataAvailable(aRequest, aInputStream, aOffset, aCount);
}
NS_IMETHODIMP
nsHTTPSOnlyStreamListener::OnStartRequest(nsIRequest* request) {
- return mListener->OnStartRequest(request);
+ nsCOMPtr listener = mListener;
+ return listener->OnStartRequest(request);
}
NS_IMETHODIMP
@@ -79,7 +81,8 @@
}
}
- return mListener->OnStopRequest(request, aStatus);
+ nsCOMPtr listener = mListener;
+ return listener->OnStopRequest(request, aStatus);
}
void nsHTTPSOnlyStreamListener::RecordUpgradeTelemetry(nsIRequest* request,
diff -Nru thunderbird-140.11.0esr/dom/security/nsHTTPSOnlyUtils.cpp thunderbird-140.12.0esr/dom/security/nsHTTPSOnlyUtils.cpp
--- thunderbird-140.11.0esr/dom/security/nsHTTPSOnlyUtils.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/security/nsHTTPSOnlyUtils.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -1116,8 +1116,16 @@
new nsDNSPrefetch(mURI, originAttributes, origChannel->GetTRRMode());
nsCOMPtr internalChannel =
do_QueryInterface(origChannel);
+ // If the channel will be proxied and the proxy is responsible for DNS
+ // resolution, skip the HTTPS RR lookup to avoid leaking the host name
+ nsIHttpChannelInternal::ProxyDNSStrategy dnsStrategy =
+ nsIHttpChannelInternal::PROXY_DNS_STRATEGY_ORIGIN;
+ if (internalChannel) {
+ (void)internalChannel->GetProxyDNSStrategy(&dnsStrategy);
+ }
uint32_t caps;
- if (NS_SUCCEEDED(internalChannel->GetCaps(&caps))) {
+ if (dnsStrategy != nsIHttpChannelInternal::PROXY_DNS_STRATEGY_PROXY &&
+ internalChannel && NS_SUCCEEDED(internalChannel->GetCaps(&caps))) {
mozilla::Unused << resolver->FetchHTTPSSVC(
caps & NS_HTTP_REFRESH_DNS, false,
[self = RefPtr{this}](nsIDNSHTTPSSVCRecord* aRecord) {
diff -Nru thunderbird-140.11.0esr/dom/serviceworkers/ServiceWorkerPrivate.cpp thunderbird-140.12.0esr/dom/serviceworkers/ServiceWorkerPrivate.cpp
--- thunderbird-140.11.0esr/dom/serviceworkers/ServiceWorkerPrivate.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/serviceworkers/ServiceWorkerPrivate.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -723,7 +723,7 @@
}
auto remoteType = RemoteWorkerManager::GetRemoteType(
- principal, WorkerKind::WorkerKindService);
+ principal, WorkerKind::WorkerKindService, DEFAULT_REMOTE_TYPE);
if (NS_WARN_IF(remoteType.isErr())) {
return remoteType.unwrapErr();
}
diff -Nru thunderbird-140.11.0esr/dom/webidl/Document.webidl thunderbird-140.12.0esr/dom/webidl/Document.webidl
--- thunderbird-140.11.0esr/dom/webidl/Document.webidl 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/webidl/Document.webidl 2026-06-13 03:47:56.000000000 +0000
@@ -666,7 +666,7 @@
* tracking, fingerprinting, cryptomining and so on. This method is for
* testing only.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
readonly attribute NodeList blockedNodesByClassifier;
};
diff -Nru thunderbird-140.11.0esr/dom/webidl/Element.webidl thunderbird-140.12.0esr/dom/webidl/Element.webidl
--- thunderbird-140.11.0esr/dom/webidl/Element.webidl 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/dom/webidl/Element.webidl 2026-06-13 03:47:57.000000000 +0000
@@ -40,7 +40,6 @@
[SameObject]
readonly attribute NamedNodeMap attributes;
- [Pure]
sequence getAttributeNames();
[Pure]
DOMString? getAttribute(DOMString name);
@@ -332,7 +331,7 @@
* properties, as well as a property that exposes the flex lines
* in this container.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
Flex? getAsFlexContainer();
// Support reporting of Grid properties
@@ -341,13 +340,13 @@
* this property returns an object with computed values for grid
* tracks and lines.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
sequence getGridFragments();
/**
* Returns whether there are any grid fragments on this element.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
boolean hasGridFragments();
/**
@@ -355,7 +354,7 @@
* that have display:grid or display:inline-grid style and generate
* a frame.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
sequence getElementsWithGrid();
/**
diff -Nru thunderbird-140.11.0esr/dom/webidl/HTMLElement.webidl thunderbird-140.12.0esr/dom/webidl/HTMLElement.webidl
--- thunderbird-140.11.0esr/dom/webidl/HTMLElement.webidl 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/webidl/HTMLElement.webidl 2026-06-13 03:47:57.000000000 +0000
@@ -26,9 +26,9 @@
[CEReactions, SetterThrows, Pure]
attribute DOMString dir;
- [CEReactions, GetterThrows, Pure]
+ [CEReactions, GetterThrows]
attribute [LegacyNullToEmptyString] DOMString innerText;
- [CEReactions, GetterThrows, SetterThrows, Pure]
+ [CEReactions, GetterThrows, SetterThrows]
attribute [LegacyNullToEmptyString] DOMString outerText;
// user interaction
diff -Nru thunderbird-140.11.0esr/dom/webidl/HTMLInputElement.webidl thunderbird-140.12.0esr/dom/webidl/HTMLInputElement.webidl
--- thunderbird-140.11.0esr/dom/webidl/HTMLInputElement.webidl 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/webidl/HTMLInputElement.webidl 2026-06-13 03:47:57.000000000 +0000
@@ -55,7 +55,7 @@
attribute boolean formNoValidate;
[CEReactions, Pure, SetterThrows]
attribute DOMString formTarget;
- [CEReactions, Pure, SetterThrows]
+ [CEReactions, SetterThrows]
attribute unsigned long height;
[Pure]
attribute boolean indeterminate;
@@ -209,7 +209,7 @@
// Returns an nsIEditor instance which is associated with the element.
// If the element can be associated with an editor but not yet created,
// this creates new one automatically.
- [Pure, ChromeOnly, BinaryName="editorForBindings"]
+ [ChromeOnly, BinaryName="editorForBindings"]
readonly attribute nsIEditor? editor;
// Returns true if an nsIEditor instance has already been associated with
diff -Nru thunderbird-140.11.0esr/dom/workers/remoteworkers/RemoteWorkerManager.cpp thunderbird-140.12.0esr/dom/workers/remoteworkers/RemoteWorkerManager.cpp
--- thunderbird-140.11.0esr/dom/workers/remoteworkers/RemoteWorkerManager.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/workers/remoteworkers/RemoteWorkerManager.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -124,7 +124,8 @@
// static
Result RemoteWorkerManager::GetRemoteType(
- const nsCOMPtr& aPrincipal, WorkerKind aWorkerKind) {
+ const nsCOMPtr& aPrincipal, WorkerKind aWorkerKind,
+ const nsACString& aCurrentRemoteType) {
AssertIsOnMainThread();
MOZ_ASSERT_IF(aWorkerKind == WorkerKind::WorkerKindService,
@@ -137,19 +138,8 @@
return NOT_REMOTE_TYPE;
}
- nsCString preferredRemoteType = DEFAULT_REMOTE_TYPE;
- if (aWorkerKind == WorkerKind::WorkerKindShared) {
- if (auto* contentChild = ContentChild::GetSingleton()) {
- // For a shared worker set the preferred remote type to the content
- // child process remote type.
- preferredRemoteType = contentChild->GetRemoteType();
- } else if (aPrincipal->IsSystemPrincipal()) {
- preferredRemoteType = NOT_REMOTE_TYPE;
- }
- }
-
auto result = IsolationOptionsForWorker(
- aPrincipal, aWorkerKind, preferredRemoteType, FissionAutostart());
+ aPrincipal, aWorkerKind, aCurrentRemoteType, FissionAutostart());
if (NS_WARN_IF(result.isErr())) {
LOG(("GetRemoteType Abort: IsolationOptionsForWorker failed"));
return Err(NS_ERROR_DOM_ABORT_ERR);
@@ -164,7 +154,7 @@
("GetRemoteType workerType=%s, principal=%s, "
"preferredRemoteType=%s, selectedRemoteType=%s",
aWorkerKind == WorkerKind::WorkerKindService ? "service" : "shared",
- principalOrigin.get(), preferredRemoteType.get(),
+ principalOrigin.get(), PromiseFlatCString(aCurrentRemoteType).get(),
options.mRemoteType.get()));
}
diff -Nru thunderbird-140.11.0esr/dom/workers/remoteworkers/RemoteWorkerManager.h thunderbird-140.12.0esr/dom/workers/remoteworkers/RemoteWorkerManager.h
--- thunderbird-140.11.0esr/dom/workers/remoteworkers/RemoteWorkerManager.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/workers/remoteworkers/RemoteWorkerManager.h 2026-06-13 03:47:56.000000000 +0000
@@ -48,7 +48,8 @@
* launched.
*/
static Result GetRemoteType(
- const nsCOMPtr& aPrincipal, WorkerKind aWorkerKind);
+ const nsCOMPtr& aPrincipal, WorkerKind aWorkerKind,
+ const nsACString& aCurrentRemoteType);
static bool HasExtensionPrincipal(const RemoteWorkerData& aData);
diff -Nru thunderbird-140.11.0esr/dom/workers/sharedworkers/SharedWorker.cpp thunderbird-140.12.0esr/dom/workers/sharedworkers/SharedWorker.cpp
--- thunderbird-140.11.0esr/dom/workers/sharedworkers/SharedWorker.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/workers/sharedworkers/SharedWorker.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -84,6 +84,12 @@
do_QueryInterface(aGlobal.GetAsSupports());
MOZ_ASSERT(window);
+ if (!window->IsCurrentInnerWindow()) {
+ aRv.ThrowInvalidStateError(
+ "Cannot create worker for a going to be discarded document");
+ return nullptr;
+ }
+
// Our current idiom is that storage-related APIs specialize for the system
// principal themselves, which is consistent with StorageAllowedForwindow not
// specializing for the system principal. Without this specialization we
@@ -246,13 +252,6 @@
MOZ_ASSERT(loadInfo.mCookieJarSettings);
net::CookieJarSettings::Cast(loadInfo.mCookieJarSettings)->Serialize(cjsData);
- auto remoteType = RemoteWorkerManager::GetRemoteType(
- loadInfo.mPrincipal, WorkerKind::WorkerKindShared);
- if (NS_WARN_IF(remoteType.isErr())) {
- aRv.Throw(remoteType.unwrapErr());
- return nullptr;
- }
-
Maybe overriddenFingerprintingSettingsArg;
if (loadInfo.mOverriddenFingerprintingSettings.isSome()) {
overriddenFingerprintingSettingsArg.emplace(
@@ -269,7 +268,7 @@
loadInfo.mIsOn3PCBExceptionList,
OriginTrials::FromWindow(nsGlobalWindowInner::Cast(window)),
void_t() /* OptionalServiceWorkerData */, agentClusterId,
- remoteType.unwrap());
+ DEFAULT_REMOTE_TYPE /* ignored */);
PSharedWorkerChild* pActor = actorChild->SendPSharedWorkerConstructor(
remoteWorkerData, loadInfo.mWindowID, portIdentifier.release());
diff -Nru thunderbird-140.11.0esr/dom/workers/sharedworkers/SharedWorkerService.cpp thunderbird-140.12.0esr/dom/workers/sharedworkers/SharedWorkerService.cpp
--- thunderbird-140.11.0esr/dom/workers/sharedworkers/SharedWorkerService.cpp 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/dom/workers/sharedworkers/SharedWorkerService.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -5,6 +5,7 @@
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "SharedWorkerService.h"
+#include "mozilla/dom/ContentParent.h"
#include "mozilla/dom/MessagePort.h"
#include "mozilla/dom/RemoteWorkerManager.h" // RemoteWorkerManager::GetRemoteType
#include "mozilla/dom/RemoteWorkerTypes.h"
@@ -32,14 +33,15 @@
class GetOrCreateWorkerManagerRunnable final : public Runnable {
public:
- GetOrCreateWorkerManagerRunnable(SharedWorkerService* aService,
- SharedWorkerParent* aActor,
- const RemoteWorkerData& aData,
- uint64_t aWindowID,
- const MessagePortIdentifier& aPortIdentifier)
+ GetOrCreateWorkerManagerRunnable(
+ SharedWorkerService* aService,
+ ThreadsafeContentParentHandle* aContentParentHandle,
+ SharedWorkerParent* aActor, const RemoteWorkerData& aData,
+ uint64_t aWindowID, const MessagePortIdentifier& aPortIdentifier)
: Runnable("GetOrCreateWorkerManagerRunnable"),
mBackgroundEventTarget(GetCurrentSerialEventTarget()),
mService(aService),
+ mContentParentHandle(aContentParentHandle),
mActor(aActor),
mData(aData),
mWindowID(aWindowID),
@@ -48,7 +50,8 @@
NS_IMETHOD
Run() {
mService->GetOrCreateWorkerManagerOnMainThread(
- mBackgroundEventTarget, mActor, mData, mWindowID, mPortIdentifier);
+ mBackgroundEventTarget, mContentParentHandle, mActor, mData, mWindowID,
+ mPortIdentifier);
return NS_OK;
}
@@ -56,6 +59,7 @@
private:
nsCOMPtr mBackgroundEventTarget;
RefPtr mService;
+ RefPtr mContentParentHandle;
RefPtr mActor;
RemoteWorkerData mData;
uint64_t mWindowID;
@@ -155,19 +159,23 @@
uint64_t aWindowID, const MessagePortIdentifier& aPortIdentifier) {
AssertIsOnBackgroundThread();
+ RefPtr contentParentHandle =
+ BackgroundParent::GetContentParentHandle(aActor->Manager());
+
// The real check happens on main-thread.
RefPtr r =
- new GetOrCreateWorkerManagerRunnable(this, aActor, aData, aWindowID,
- aPortIdentifier);
+ new GetOrCreateWorkerManagerRunnable(this, contentParentHandle, aActor,
+ aData, aWindowID, aPortIdentifier);
nsresult rv = SchedulerGroup::Dispatch(r.forget());
Unused << NS_WARN_IF(NS_FAILED(rv));
}
void SharedWorkerService::GetOrCreateWorkerManagerOnMainThread(
- nsIEventTarget* aBackgroundEventTarget, SharedWorkerParent* aActor,
- const RemoteWorkerData& aData, uint64_t aWindowID,
- UniqueMessagePortId& aPortIdentifier) {
+ nsIEventTarget* aBackgroundEventTarget,
+ ThreadsafeContentParentHandle* aContentParentHandle,
+ SharedWorkerParent* aActor, const RemoteWorkerData& aData,
+ uint64_t aWindowID, UniqueMessagePortId& aPortIdentifier) {
MOZ_ASSERT(NS_IsMainThread());
MOZ_ASSERT(aBackgroundEventTarget);
MOZ_ASSERT(aActor);
@@ -181,17 +189,19 @@
}
nsCOMPtr principal = principalOrErr.unwrap();
+
+ nsCString currentRemoteType = aContentParentHandle
+ ? aContentParentHandle->GetRemoteType()
+ : NOT_REMOTE_TYPE;
auto remoteType = RemoteWorkerManager::GetRemoteType(
- principal, WorkerKind::WorkerKindShared);
+ principal, WorkerKind::WorkerKindShared, currentRemoteType);
if (NS_WARN_IF(remoteType.isErr())) {
ErrorPropagationOnMainThread(aBackgroundEventTarget, aActor,
remoteType.unwrapErr());
return;
}
- if (!remoteType.unwrap().Equals(copyData.remoteType())) {
- copyData.remoteType() = remoteType.unwrap();
- }
+ copyData.remoteType() = remoteType.unwrap();
auto partitionedPrincipalOrErr =
PrincipalInfoToPrincipal(copyData.partitionedPrincipalInfo());
diff -Nru thunderbird-140.11.0esr/dom/workers/sharedworkers/SharedWorkerService.h thunderbird-140.12.0esr/dom/workers/sharedworkers/SharedWorkerService.h
--- thunderbird-140.11.0esr/dom/workers/sharedworkers/SharedWorkerService.h 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/dom/workers/sharedworkers/SharedWorkerService.h 2026-06-13 03:47:57.000000000 +0000
@@ -25,6 +25,7 @@
class RemoteWorkerData;
class SharedWorkerManager;
class SharedWorkerParent;
+class ThreadsafeContentParentHandle;
class UniqueMessagePortId;
/**
@@ -50,9 +51,10 @@
const MessagePortIdentifier& aPortIdentifier);
void GetOrCreateWorkerManagerOnMainThread(
- nsIEventTarget* aBackgroundEventTarget, SharedWorkerParent* aActor,
- const RemoteWorkerData& aData, uint64_t aWindowID,
- UniqueMessagePortId& aPortIdentifier);
+ nsIEventTarget* aBackgroundEventTarget,
+ ThreadsafeContentParentHandle* aContentParentHandle,
+ SharedWorkerParent* aActor, const RemoteWorkerData& aData,
+ uint64_t aWindowID, UniqueMessagePortId& aPortIdentifier);
void RemoveWorkerManagerOnMainThread(SharedWorkerManager* aManager);
diff -Nru thunderbird-140.11.0esr/dom/xhr/XMLHttpRequestMainThread.cpp thunderbird-140.12.0esr/dom/xhr/XMLHttpRequestMainThread.cpp
--- thunderbird-140.11.0esr/dom/xhr/XMLHttpRequestMainThread.cpp 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/dom/xhr/XMLHttpRequestMainThread.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -1759,9 +1759,10 @@
if (NS_SUCCEEDED(rv) && xmlHttpRequest->mXMLParserStreamListener) {
NS_ASSERTION(copyStream, "NS_NewByteInputStream lied");
- nsresult parsingResult =
- xmlHttpRequest->mXMLParserStreamListener->OnDataAvailable(
- xmlHttpRequest->mChannel, copyStream, toOffset, count);
+ nsCOMPtr listener =
+ xmlHttpRequest->mXMLParserStreamListener;
+ nsresult parsingResult = listener->OnDataAvailable(
+ xmlHttpRequest->mChannel, copyStream, toOffset, count);
// No use to continue parsing if we failed here, but we
// should still finish reading the stream
@@ -2223,7 +2224,8 @@
mResponseXML->SetReferrerInfo(referrerInfo);
mXMLParserStreamListener = listener;
- rv = mXMLParserStreamListener->OnStartRequest(request);
+ nsCOMPtr parserListener = mXMLParserStreamListener;
+ rv = parserListener->OnStartRequest(request);
NS_ENSURE_SUCCESS(rv, rv);
}
@@ -2260,14 +2262,17 @@
// XXX in fact, why don't we do the cleanup below in this case??
// UNSENT is for abort calls. See OnStartRequest above.
if (mState == XMLHttpRequest_Binding::UNSENT || mFlagTimedOut) {
- if (mXMLParserStreamListener)
- (void)mXMLParserStreamListener->OnStopRequest(request, status);
+ if (mXMLParserStreamListener) {
+ nsCOMPtr parserListener = mXMLParserStreamListener;
+ (void)parserListener->OnStopRequest(request, status);
+ }
return NS_OK;
}
// Is this good enough here?
if (mXMLParserStreamListener && mFlagParseBody) {
- mXMLParserStreamListener->OnStopRequest(request, status);
+ nsCOMPtr parserListener = mXMLParserStreamListener;
+ parserListener->OnStopRequest(request, status);
}
mXMLParserStreamListener = nullptr;
diff -Nru thunderbird-140.11.0esr/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp thunderbird-140.12.0esr/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
--- thunderbird-140.11.0esr/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -211,7 +211,8 @@
}
}
- return mListener->OnDataAvailable(aRequest, aInputStream, aOffset, aCount);
+ nsCOMPtr listener = mListener;
+ return listener->OnDataAvailable(aRequest, aInputStream, aOffset, aCount);
}
NS_IMETHODIMP
@@ -266,7 +267,8 @@
}
}
- return mListener->OnStartRequest(aRequest);
+ nsCOMPtr listener = mListener;
+ return listener->OnStartRequest(aRequest);
}
NS_IMETHODIMP
@@ -298,7 +300,8 @@
mCompiler->cancel(result, nullptr, spec.get());
}
- nsresult rv = mListener->OnStopRequest(aRequest, aStatusCode);
+ nsCOMPtr listener = mListener;
+ nsresult rv = listener->OnStopRequest(aRequest, aStatusCode);
mListener = nullptr;
mParser = nullptr;
return rv;
diff -Nru thunderbird-140.11.0esr/gfx/angle/checkout/include/GLSLANG/ShaderLang.h thunderbird-140.12.0esr/gfx/angle/checkout/include/GLSLANG/ShaderLang.h
--- thunderbird-140.11.0esr/gfx/angle/checkout/include/GLSLANG/ShaderLang.h 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/checkout/include/GLSLANG/ShaderLang.h 2026-06-13 03:47:57.000000000 +0000
@@ -26,7 +26,7 @@
// Version number for shader translation API.
// It is incremented every time the API changes.
-#define ANGLE_SH_VERSION 308
+#define ANGLE_SH_VERSION 309
enum ShShaderSpec
{
@@ -414,6 +414,10 @@
// We may want to apply it generally.
uint64_t passHighpToPackUnormSnormBuiltins : 1;
+ // Validate that the count of uniform blocks is within the GL_MAX_*_UNIFORM_BLOCKS limits. These
+ // limits must be supplied in the BuiltinResources.
+ uint64_t validatePerStageMaxUniformBlocks : 1;
+
ShCompileOptionsMetal metal;
ShCompileOptionsPLS pls;
};
@@ -512,6 +516,12 @@
int MinProgramTexelOffset;
int MaxProgramTexelOffset;
+ // GL_MAX_FRAGMENT_UNIFORM_BLOCKS
+ int MaxFragmentUniformBlocks;
+
+ // GL_MAX_VERTEX_UNIFORM_BLOCKS
+ int MaxVertexUniformBlocks;
+
// Extension constants.
// Value of GL_MAX_DUAL_SOURCE_DRAW_BUFFERS_EXT for OpenGL ES output context.
@@ -618,6 +628,9 @@
// maximum point size (higher limit from ALIASED_POINT_SIZE_RANGE)
float MaxPointSize;
+ // GL_MAX_COMPUTE_UNIFORM_BLOCKS
+ int MaxComputeUniformBlocks;
+
// EXT_geometry_shader constants
int MaxGeometryUniformComponents;
int MaxGeometryUniformBlocks;
@@ -641,6 +654,7 @@
int MaxTessControlImageUniforms;
int MaxTessControlAtomicCounters;
int MaxTessControlAtomicCounterBuffers;
+ int MaxTessControlUniformBlocks;
int MaxTessPatchComponents;
int MaxPatchVertices;
@@ -653,6 +667,7 @@
int MaxTessEvaluationImageUniforms;
int MaxTessEvaluationAtomicCounters;
int MaxTessEvaluationAtomicCounterBuffers;
+ int MaxTessEvaluationUniformBlocks;
// Subpixel bits used in rasterization.
int SubPixelBits;
diff -Nru thunderbird-140.11.0esr/gfx/angle/checkout/include/platform/FeaturesGL_autogen.h thunderbird-140.12.0esr/gfx/angle/checkout/include/platform/FeaturesGL_autogen.h
--- thunderbird-140.11.0esr/gfx/angle/checkout/include/platform/FeaturesGL_autogen.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/checkout/include/platform/FeaturesGL_autogen.h 2026-06-13 03:47:56.000000000 +0000
@@ -491,6 +491,12 @@
"supportsShaderFramebufferFetchNonCoherentEXT", FeatureCategory::OpenGLFeatures,
"Backend GL context supports EXT_shader_framebuffer_fetch_non_coherent extension", &members,
"http://anglebug.com/7279"};
+
+ FeatureInfo validateMaxPerStageUniformBlocksAtCompileTime = {
+ "validateMaxPerStageUniformBlocksAtCompileTime", FeatureCategory::OpenGLWorkarounds,
+ "Validate GL_MAX_*_UNIFORM_BLOCKS at compile time instead of link time to work around "
+ "compiler bugs.",
+ &members, "http://crbug.com/475877320"};
};
inline FeaturesGL::FeaturesGL() = default;
diff -Nru thunderbird-140.11.0esr/gfx/angle/checkout/out/gen/angle/angle_commit.h thunderbird-140.12.0esr/gfx/angle/checkout/out/gen/angle/angle_commit.h
--- thunderbird-140.11.0esr/gfx/angle/checkout/out/gen/angle/angle_commit.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/checkout/out/gen/angle/angle_commit.h 2026-06-13 03:47:57.000000000 +0000
@@ -1,5 +1,5 @@
-#define ANGLE_COMMIT_HASH "b0098a1ebdb0"
+#define ANGLE_COMMIT_HASH "6eb59c58d21b"
#define ANGLE_COMMIT_HASH_SIZE 12
-#define ANGLE_COMMIT_DATE "2026-04-09 15:03:30 +0200"
-#define ANGLE_COMMIT_POSITION 19751
+#define ANGLE_COMMIT_DATE "2026-06-01 14:52:43 +0200"
+#define ANGLE_COMMIT_POSITION 19766
#define ANGLE_HAS_BINARY_LOADING
diff -Nru thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/Compiler.cpp thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/Compiler.cpp
--- thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/Compiler.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/Compiler.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -1336,6 +1336,8 @@
<< ":MaxFragmentInputVectors:" << mResources.MaxFragmentInputVectors
<< ":MinProgramTexelOffset:" << mResources.MinProgramTexelOffset
<< ":MaxProgramTexelOffset:" << mResources.MaxProgramTexelOffset
+ << ":MaxFragmentUniformBlocks:" << mResources.MaxFragmentUniformBlocks
+ << ":MaxVertexUniformBlocks:" << mResources.MaxVertexUniformBlocks
<< ":MaxDualSourceDrawBuffers:" << mResources.MaxDualSourceDrawBuffers
<< ":MaxViewsOVR:" << mResources.MaxViewsOVR
<< ":NV_draw_buffers:" << mResources.NV_draw_buffers
@@ -1379,6 +1381,7 @@
<< ":MaxFragmentAtomicCounterBuffers:" << mResources.MaxFragmentAtomicCounterBuffers
<< ":MaxCombinedAtomicCounterBuffers:" << mResources.MaxCombinedAtomicCounterBuffers
<< ":MaxAtomicCounterBufferSize:" << mResources.MaxAtomicCounterBufferSize
+ << ":MaxComputeUnformBlocks:" << mResources.MaxComputeUniformBlocks
<< ":MaxGeometryUniformComponents:" << mResources.MaxGeometryUniformComponents
<< ":MaxGeometryUniformBlocks:" << mResources.MaxGeometryUniformBlocks
<< ":MaxGeometryInputComponents:" << mResources.MaxGeometryInputComponents
@@ -1402,6 +1405,7 @@
<< ":MaxTessControlImageUniforms:" << mResources.MaxTessControlImageUniforms
<< ":MaxTessControlAtomicCounters:" << mResources.MaxTessControlAtomicCounters
<< ":MaxTessControlAtomicCounterBuffers:" << mResources.MaxTessControlAtomicCounterBuffers
+ << ":MaxTessControlUniformBlocks:" << mResources.MaxTessControlUniformBlocks
<< ":MaxTessPatchComponents:" << mResources.MaxTessPatchComponents
<< ":MaxPatchVertices:" << mResources.MaxPatchVertices
<< ":MaxTessGenLevel:" << mResources.MaxTessGenLevel
@@ -1411,7 +1415,9 @@
<< ":MaxTessEvaluationUniformComponents:" << mResources.MaxTessEvaluationUniformComponents
<< ":MaxTessEvaluationImageUniforms:" << mResources.MaxTessEvaluationImageUniforms
<< ":MaxTessEvaluationAtomicCounters:" << mResources.MaxTessEvaluationAtomicCounters
- << ":MaxTessEvaluationAtomicCounterBuffers:" << mResources.MaxTessEvaluationAtomicCounterBuffers;
+ << ":MaxTessEvaluationAtomicCounterBuffers:" << mResources.MaxTessEvaluationAtomicCounterBuffers
+ << ":MaxTessEvaluationUniformBlocks:" << mResources.MaxTessEvaluationUniformBlocks
+ ;
// clang-format on
mBuiltInResourcesString = strstream.str();
diff -Nru thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/ParseContext.cpp thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/ParseContext.cpp
--- thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/ParseContext.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/ParseContext.cpp 2026-06-13 03:47:56.000000000 +0000
@@ -167,6 +167,37 @@
return false;
}
}
+
+unsigned int GetMaxUniformBlocksForShaderType(sh::GLenum shaderType,
+ const ShCompileOptions &options,
+ const ShBuiltInResources &resources)
+{
+ // If the validatePerStageMaxUniformBlocks workaround is disabled. Set a limit that will not be
+ // hit.
+ if (!options.validatePerStageMaxUniformBlocks)
+ {
+ return std::numeric_limits::max();
+ }
+
+ switch (shaderType)
+ {
+ case GL_FRAGMENT_SHADER:
+ return resources.MaxFragmentUniformBlocks;
+ case GL_VERTEX_SHADER:
+ return resources.MaxVertexUniformBlocks;
+ case GL_COMPUTE_SHADER:
+ return resources.MaxComputeUniformBlocks;
+ case GL_GEOMETRY_SHADER:
+ return resources.MaxGeometryUniformBlocks;
+ case GL_TESS_CONTROL_SHADER:
+ return resources.MaxTessControlUniformBlocks;
+ case GL_TESS_EVALUATION_SHADER:
+ return resources.MaxTessEvaluationUniformBlocks;
+ default:
+ UNREACHABLE();
+ return 0;
+ }
+}
} // namespace
// This tracks each binding point's current default offset for inheritance of subsequent
@@ -242,6 +273,8 @@
mComputeShaderLocalSizeDeclared(false),
mComputeShaderLocalSize(-1),
mNumViews(-1),
+ mMaxUniformBlocks(GetMaxUniformBlocksForShaderType(mShaderType, options, resources)),
+ mNumUniformBlocks(0),
mMaxNumViews(resources.MaxViewsOVR),
mMaxImageUnits(resources.MaxImageUnits),
mMaxCombinedTextureImageUnits(resources.MaxCombinedTextureImageUnits),
@@ -806,19 +839,14 @@
static const char *reservedErrMsg = "reserved built-in name";
if (gl::IsBuiltInName(identifier.data()))
{
- error(line, reservedErrMsg, "gl_");
+ error(line, reservedErrMsg, identifier);
return false;
}
if (sh::IsWebGLBasedSpec(mShaderSpec))
{
- if (identifier.beginsWith("webgl_"))
+ if (identifier.beginsWith("webgl_") || identifier.beginsWith("_webgl_"))
{
- error(line, reservedErrMsg, "webgl_");
- return false;
- }
- if (identifier.beginsWith("_webgl_"))
- {
- error(line, reservedErrMsg, "_webgl_");
+ error(line, reservedErrMsg, identifier);
return false;
}
}
@@ -1381,92 +1409,108 @@
checkBindingIsValid(line, *type);
bool needsReservedCheck = true;
+ const TVariable *builtInSymbol =
+ static_cast(symbolTable.findBuiltIn(identifier, mShaderVersion));
- // gl_LastFragData may be redeclared with a new precision qualifier
- if (type->isArray() && identifier.beginsWith("gl_LastFragData"))
+ // Some built-ins may be redeclared with a new precision qualifier, but must otherwise match the
+ // built-in in type, array dimensions etc: gl_LastFragData, gl_ClipDistance, gl_CullDistance.
+ //
+ // For gl_ClipDistance and gl_CullDistance, the array size can be less than the built-in's.
+ if (builtInSymbol != nullptr)
{
- const TVariable *maxDrawBuffers = static_cast(
- symbolTable.findBuiltIn(ImmutableString("gl_MaxDrawBuffers"), mShaderVersion));
- if (type->isArrayOfArrays())
- {
- error(line, "redeclaration of gl_LastFragData as an array of arrays", identifier);
- return false;
- }
- else if (static_cast(type->getOutermostArraySize()) ==
- maxDrawBuffers->getConstPointer()->getIConst())
- {
- if (const TSymbol *builtInSymbol = symbolTable.findBuiltIn(identifier, mShaderVersion))
- {
+ const TType &expectedType = builtInSymbol->getType();
+
+ uint32_t expectedArraySize = 0;
+ bool canArraySizeBeLessThanBuiltIn = false;
+ const char *arraySizeCheckError = nullptr;
+
+ switch (expectedType.getQualifier())
+ {
+ case EvqLastFragData:
+ expectedArraySize = static_cast(
+ symbolTable.findBuiltIn(
+ ImmutableString("gl_MaxDrawBuffers"), mShaderVersion))
+ ->getConstPointer()
+ ->getIConst();
+ arraySizeCheckError =
+ "redeclaration of gl_LastFragData with size != gl_MaxDrawBuffers";
needsReservedCheck = !checkCanUseOneOfExtensions(line, builtInSymbol->extensions());
+ break;
+ case EvqClipDistance:
+ {
+ const TVariable *maxClipDistances =
+ static_cast(symbolTable.findBuiltIn(
+ ImmutableString("gl_MaxClipDistances"), mShaderVersion));
+ if (maxClipDistances != nullptr)
+ {
+ expectedArraySize = maxClipDistances->getConstPointer()->getIConst();
+ canArraySizeBeLessThanBuiltIn = true;
+ arraySizeCheckError =
+ "redeclaration of gl_ClipDistance with size > gl_MaxClipDistances";
+ needsReservedCheck =
+ !checkCanUseOneOfExtensions(line, builtInSymbol->extensions());
+ }
+ else
+ {
+ // Unsupported extension
+ error(line, "redeclaration of built-in is not allowed", identifier);
+ return false;
+ }
+ break;
}
- }
- else
- {
- error(line, "redeclaration of gl_LastFragData with size != gl_MaxDrawBuffers",
- identifier);
- return false;
- }
- }
- else if (type->isArray() && identifier == "gl_ClipDistance")
- {
- // gl_ClipDistance can be redeclared with smaller size than gl_MaxClipDistances
- const TVariable *maxClipDistances = static_cast(
- symbolTable.findBuiltIn(ImmutableString("gl_MaxClipDistances"), mShaderVersion));
- if (!maxClipDistances)
- {
- // Unsupported extension
- needsReservedCheck = true;
- }
- else if (type->isArrayOfArrays())
- {
- error(line, "redeclaration of gl_ClipDistance as an array of arrays", identifier);
- return false;
- }
- else if (static_cast(type->getOutermostArraySize()) <=
- maxClipDistances->getConstPointer()->getIConst())
- {
- const TSymbol *builtInSymbol = symbolTable.findBuiltIn(identifier, mShaderVersion);
- if (builtInSymbol)
+ case EvqCullDistance:
{
- needsReservedCheck = !checkCanUseOneOfExtensions(line, builtInSymbol->extensions());
+ const TVariable *maxCullDistances =
+ static_cast(symbolTable.findBuiltIn(
+ ImmutableString("gl_MaxCullDistances"), mShaderVersion));
+ if (maxCullDistances != nullptr)
+ {
+ expectedArraySize = maxCullDistances->getConstPointer()->getIConst();
+ canArraySizeBeLessThanBuiltIn = true;
+ arraySizeCheckError =
+ "redeclaration of gl_CullDistance with size > gl_MaxCullDistances";
+ needsReservedCheck =
+ !checkCanUseOneOfExtensions(line, builtInSymbol->extensions());
+ }
+ else
+ {
+ // Unsupported extension
+ error(line, "redeclaration of built-in is not allowed", identifier);
+ return false;
+ }
+ break;
}
+ default:
+ error(line, "reserved built-in name", identifier);
+ return false;
}
- else
+
+ // No built-in is an array of arrays.
+ if (type->isArrayOfArrays())
{
- error(line, "redeclaration of gl_ClipDistance with size > gl_MaxClipDistances",
- identifier);
+ error(line, "redeclaration of built-in as an array of arrays", identifier);
return false;
}
- }
- else if (type->isArray() && identifier == "gl_CullDistance")
- {
- // gl_CullDistance can be redeclared with smaller size than gl_MaxCullDistances
- const TVariable *maxCullDistances = static_cast(
- symbolTable.findBuiltIn(ImmutableString("gl_MaxCullDistances"), mShaderVersion));
- if (!maxCullDistances)
- {
- // Unsupported extension
- needsReservedCheck = true;
- }
- else if (type->isArrayOfArrays())
+
+ if (type->getBasicType() != expectedType.getBasicType() ||
+ type->getNominalSize() != expectedType.getNominalSize() ||
+ type->getSecondarySize() != expectedType.getSecondarySize() ||
+ type->isArray() != expectedType.isArray())
{
- error(line, "redeclaration of gl_CullDistance as an array of arrays", identifier);
+ error(line, "redeclaration of built-in with a different type", identifier);
return false;
}
- else if (static_cast(type->getOutermostArraySize()) <=
- maxCullDistances->getConstPointer()->getIConst())
+
+ if (type->isArray())
{
- if (const TSymbol *builtInSymbol = symbolTable.findBuiltIn(identifier, mShaderVersion))
+ unsigned int arraySize = type->getOutermostArraySize();
+ if (arraySize > expectedArraySize ||
+ (!canArraySizeBeLessThanBuiltIn && arraySize != expectedArraySize))
{
- needsReservedCheck = !checkCanUseOneOfExtensions(line, builtInSymbol->extensions());
+ error(line, arraySizeCheckError, identifier);
+ return false;
}
}
- else
- {
- error(line, "redeclaration of gl_CullDistance with size > gl_MaxCullDistances",
- identifier);
- return false;
- }
}
if (needsReservedCheck && !checkIsNotReserved(line, identifier))
@@ -4689,6 +4733,22 @@
error(arraySizesLine, "geometry shader input blocks must be an array", "");
}
+ // Validate max uniform block limits
+ if (typeQualifier.qualifier == EvqUniform)
+ {
+ unsigned int blockCount =
+ arraySizes == nullptr || arraySizes->empty() ? 1 : (*arraySizes)[0];
+ if (mNumUniformBlocks + blockCount > mMaxUniformBlocks)
+ {
+ error(arraySizesLine,
+ "uniform block count greater than per stage maximum uniform blocks", "");
+ }
+ else
+ {
+ mNumUniformBlocks += blockCount;
+ }
+ }
+
checkIndexIsNotSpecified(typeQualifier.line, typeQualifier.layoutQualifier.index);
if (mShaderVersion < 310)
diff -Nru thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/ParseContext.h thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/ParseContext.h
--- thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/ParseContext.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/ParseContext.h 2026-06-13 03:47:56.000000000 +0000
@@ -757,6 +757,13 @@
sh::WorkGroupSize mComputeShaderLocalSize;
// keep track of number of views declared in layout.
int mNumViews;
+
+ // Maximum number of uniform blocks allowed to be declared in this shader. Taken from the
+ // built-in resources and resolved to this shader type.
+ unsigned int mMaxUniformBlocks;
+ // Current count of declared uniform blocks.
+ unsigned int mNumUniformBlocks;
+
int mMaxNumViews;
int mMaxImageUnits;
int mMaxCombinedTextureImageUnits;
diff -Nru thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/ShaderLang.cpp thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/ShaderLang.cpp
--- thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/ShaderLang.cpp 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/ShaderLang.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -248,6 +248,8 @@
resources->MaxFragmentInputVectors = 15;
resources->MinProgramTexelOffset = -8;
resources->MaxProgramTexelOffset = 7;
+ resources->MaxFragmentUniformBlocks = 12;
+ resources->MaxVertexUniformBlocks = 12;
// Extensions constants.
resources->MaxDualSourceDrawBuffers = 0;
@@ -288,6 +290,7 @@
resources->MaxComputeWorkGroupSize[2] = 64;
resources->MaxComputeUniformComponents = 512;
resources->MaxComputeTextureImageUnits = 16;
+ resources->MaxComputeUniformBlocks = 12;
resources->MaxComputeAtomicCounters = 8;
resources->MaxComputeAtomicCounterBuffers = 1;
@@ -326,6 +329,7 @@
resources->MaxTessControlImageUniforms = 0;
resources->MaxTessControlAtomicCounters = 0;
resources->MaxTessControlAtomicCounterBuffers = 0;
+ resources->MaxTessControlUniformBlocks = 12;
resources->MaxTessPatchComponents = 120;
resources->MaxPatchVertices = 32;
@@ -338,6 +342,7 @@
resources->MaxTessEvaluationImageUniforms = 0;
resources->MaxTessEvaluationAtomicCounters = 0;
resources->MaxTessEvaluationAtomicCounterBuffers = 0;
+ resources->MaxTessEvaluationUniformBlocks = 12;
resources->SubPixelBits = 8;
diff -Nru thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp
--- thunderbird-140.11.0esr/gfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -26,6 +26,7 @@
{
constexpr const ImmutableString kGlFragDataString("gl_FragData");
+constexpr const ImmutableString kGlSecondaryFragDataString("gl_SecondaryFragDataEXT");
class GLFragColorBroadcastTraverser : public TIntermTraverser
{
@@ -42,6 +43,8 @@
bool isGLFragColorUsed() const { return mGLFragColorUsed; }
protected:
+ bool visitGlobalQualifierDeclaration(Visit visit,
+ TIntermGlobalQualifierDeclaration *node) override;
void visitSymbol(TIntermSymbol *node) override;
TIntermBinary *constructGLFragDataNode(int index) const;
@@ -71,6 +74,31 @@
return new TIntermBinary(EOpAssign, fragDataIndex, fragDataZero);
}
+bool GLFragColorBroadcastTraverser::visitGlobalQualifierDeclaration(
+ Visit visit,
+ TIntermGlobalQualifierDeclaration *node)
+{
+ TIntermSymbol *symbol = node->getSymbol();
+ if (symbol->variable().symbolType() == SymbolType::BuiltIn)
+ {
+ if (symbol->getName() == "gl_FragColor")
+ {
+ queueReplacementWithParent(
+ node, node->getSymbol(),
+ ReferenceBuiltInVariable(kGlFragDataString, *mSymbolTable, mShaderVersion),
+ OriginalNode::IS_DROPPED);
+ }
+ else if (symbol->getName() == "gl_SecondaryFragColorEXT")
+ {
+ queueReplacementWithParent(
+ node, node->getSymbol(),
+ ReferenceBuiltInVariable(kGlSecondaryFragDataString, *mSymbolTable, mShaderVersion),
+ OriginalNode::IS_DROPPED);
+ }
+ }
+ return false;
+}
+
void GLFragColorBroadcastTraverser::visitSymbol(TIntermSymbol *node)
{
if (node->variable().symbolType() == SymbolType::BuiltIn && node->getName() == "gl_FragColor")
diff -Nru thunderbird-140.11.0esr/gfx/angle/checkout/src/libANGLE/Compiler.cpp thunderbird-140.12.0esr/gfx/angle/checkout/src/libANGLE/Compiler.cpp
--- thunderbird-140.11.0esr/gfx/angle/checkout/src/libANGLE/Compiler.cpp 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/checkout/src/libANGLE/Compiler.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -134,6 +134,8 @@
mResources.MaxFragmentInputVectors = caps.maxFragmentInputComponents / 4;
mResources.MinProgramTexelOffset = caps.minProgramTexelOffset;
mResources.MaxProgramTexelOffset = caps.maxProgramTexelOffset;
+ mResources.MaxFragmentUniformBlocks = caps.maxShaderUniformBlocks[gl::ShaderType::Fragment];
+ mResources.MaxVertexUniformBlocks = caps.maxShaderUniformBlocks[gl::ShaderType::Vertex];
// EXT_blend_func_extended
mResources.EXT_blend_func_extended = extensions.blendFuncExtendedEXT;
@@ -180,6 +182,7 @@
mResources.MaxComputeUniformComponents = caps.maxShaderUniformComponents[ShaderType::Compute];
mResources.MaxComputeTextureImageUnits = caps.maxShaderTextureImageUnits[ShaderType::Compute];
+ mResources.MaxComputeUniformBlocks = caps.maxShaderUniformBlocks[gl::ShaderType::Compute];
mResources.MaxComputeAtomicCounters = caps.maxShaderAtomicCounters[ShaderType::Compute];
mResources.MaxComputeAtomicCounterBuffers =
@@ -238,6 +241,8 @@
mResources.MaxTessControlAtomicCounters = caps.maxShaderAtomicCounters[ShaderType::TessControl];
mResources.MaxTessControlAtomicCounterBuffers =
caps.maxShaderAtomicCounterBuffers[ShaderType::TessControl];
+ mResources.MaxTessControlUniformBlocks =
+ caps.maxShaderUniformBlocks[gl::ShaderType::TessControl];
mResources.MaxTessPatchComponents = caps.maxTessPatchComponents;
mResources.MaxPatchVertices = caps.maxPatchVertices;
@@ -255,6 +260,8 @@
caps.maxShaderAtomicCounters[ShaderType::TessEvaluation];
mResources.MaxTessEvaluationAtomicCounterBuffers =
caps.maxShaderAtomicCounterBuffers[ShaderType::TessEvaluation];
+ mResources.MaxTessEvaluationUniformBlocks =
+ caps.maxShaderUniformBlocks[gl::ShaderType::TessEvaluation];
// Subpixel bits.
mResources.SubPixelBits = static_cast(caps.subPixelBits);
diff -Nru thunderbird-140.11.0esr/gfx/angle/cherry_picks.txt thunderbird-140.12.0esr/gfx/angle/cherry_picks.txt
--- thunderbird-140.11.0esr/gfx/angle/cherry_picks.txt 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/angle/cherry_picks.txt 2026-06-13 03:47:57.000000000 +0000
@@ -1,3 +1,39 @@
+commit 6eb59c58d21b6148fe13c0374201cafd9464e32e
+Author: Shahbaz Youssefi
+Date: Tue Apr 7 15:51:37 2026 -0400
+
+ M148: Translator: Fix redeclared built-in type checks
+
+ When a built-in is redeclared, it's type must match the built-in. A
+ minor exception is that gl_ClipDistance and gl_CullDistance are allowed
+ to have a smaller array size.
+
+ The checks for various redeclared built-ins are consolidated in this
+ change, which automatically fixes missing validation for
+ gl_LastFragColor/Depth/StencilARM built-ins.
+
+ Bug: chromium:499131214
+ Change-Id: I33c3047852f04a11dbf9f880694c4d3ff8c2585e
+ Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7818777
+ Reviewed-by: Yuxin Hu
+
+commit b2a02e6a10589f2890ab8522bd00d3102834925d
+Author: Geoff Lang
+Date: Thu Mar 26 18:05:30 2026 -0500
+
+ M146: Optionally validate GL_MAX_*_UNIFORM_BLOCKS at compile time.
+
+ These were validated at link time but some drivers have compiler crashes
+ when compiling shaders with too many uniform blocks.
+
+ Bug: chromium:475877320
+ Change-Id: I4413ce06307b4fe9e27105d85f66f610c235a301
+ Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7568089
+ Commit-Queue: Geoff Lang
+ Reviewed-by: Shahbaz Youssefi
+ (cherry picked from commit bf6dd974238bceec7a0a27987e2e02e177f2b7f8)
+ Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7653195
+
commit b0098a1ebdb0400b515ff7a662685bda111e9e87
Author: Emilio Cobos Álvarez
Date: Thu Apr 9 15:03:30 2026 +0200
diff -Nru thunderbird-140.11.0esr/gfx/cairo/cairo/src/cairo-cff-subset.c thunderbird-140.12.0esr/gfx/cairo/cairo/src/cairo-cff-subset.c
--- thunderbird-140.11.0esr/gfx/cairo/cairo/src/cairo-cff-subset.c 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/cairo/cairo/src/cairo-cff-subset.c 2026-06-13 03:47:57.000000000 +0000
@@ -1082,6 +1082,10 @@
}
operand = decode_integer (operand, &size);
decode_integer (operand, &offset);
+ if (unlikely (offset < 0 || (unsigned long)offset > font->data_length)) {
+ status = CAIRO_INT_STATUS_UNSUPPORTED;
+ goto fail;
+ }
status = cff_dict_init (&font->fd_private_dict[i]);
if (unlikely (status))
goto fail;
@@ -1201,6 +1205,8 @@
operand = cff_dict_get_operands (font->top_dict, CHARSTRINGS_OP, &size);
decode_integer (operand, &offset);
p = font->data + offset;
+ if (unlikely (p < font->data || p > font->data_end))
+ return CAIRO_INT_STATUS_UNSUPPORTED;
status = cff_index_read (&font->charstrings_index, &p, font->data_end);
if (unlikely (status))
goto fail;
@@ -1213,7 +1219,7 @@
decode_integer (operand, &offset);
font->charset = font->data + offset;
- if (font->charset >= font->data_end)
+ if (unlikely (font->charset < font->data || font->charset >= font->data_end))
return CAIRO_INT_STATUS_UNSUPPORTED;
}
@@ -1223,27 +1229,36 @@
if (font->is_cid) {
operand = cff_dict_get_operands (font->top_dict, FDSELECT_OP, &size);
decode_integer (operand, &offset);
- status = cairo_cff_font_read_fdselect (font, font->data + offset);
+ p = font->data + offset;
+ if (unlikely (p < font->data || p > font->data_end))
+ return CAIRO_INT_STATUS_UNSUPPORTED;
+ status = cairo_cff_font_read_fdselect (font, p);
if (unlikely (status))
goto fail;
operand = cff_dict_get_operands (font->top_dict, FDARRAY_OP, &size);
decode_integer (operand, &offset);
- status = cairo_cff_font_read_cid_fontdict (font, font->data + offset);
+ p = font->data + offset;
+ if (unlikely (p < font->data || p > font->data_end))
+ return CAIRO_INT_STATUS_UNSUPPORTED;
+ status = cairo_cff_font_read_cid_fontdict (font, p);
if (unlikely (status))
goto fail;
} else {
operand = cff_dict_get_operands (font->top_dict, PRIVATE_OP, &size);
operand = decode_integer (operand, &size);
decode_integer (operand, &offset);
- status = cairo_cff_font_read_private_dict (font,
+ p = font->data + offset;
+ if (unlikely (p < font->data || p > font->data_end))
+ return CAIRO_INT_STATUS_UNSUPPORTED;
+ status = cairo_cff_font_read_private_dict (font,
font->private_dict,
&font->local_sub_index,
&font->local_sub_bias,
&font->local_subs_used,
&font->default_width,
&font->nominal_width,
- font->data + offset,
+ p,
size);
if (unlikely (status))
goto fail;
diff -Nru thunderbird-140.11.0esr/gfx/cairo/patches/0033-Bug-2037290-cff-subset-offset-checks.patch thunderbird-140.12.0esr/gfx/cairo/patches/0033-Bug-2037290-cff-subset-offset-checks.patch
--- thunderbird-140.11.0esr/gfx/cairo/patches/0033-Bug-2037290-cff-subset-offset-checks.patch 1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/cairo/patches/0033-Bug-2037290-cff-subset-offset-checks.patch 2026-06-13 03:47:58.000000000 +0000
@@ -0,0 +1,80 @@
+commit 10d78e49f5d39fe5ef4925a271e721bb7eef22d3
+Author: Jonathan Kew
+Date: Wed May 6 13:21:19 2026 +0100
+
+ Bug 2037290 - Check more offsets during cairo CFF subsetting.
+
+diff --git a/gfx/cairo/cairo/src/cairo-cff-subset.c b/gfx/cairo/cairo/src/cairo-cff-subset.c
+index 6c01ed4ef876..6e3a4340c4ec 100644
+--- a/gfx/cairo/cairo/src/cairo-cff-subset.c
++++ b/gfx/cairo/cairo/src/cairo-cff-subset.c
+@@ -1086,6 +1086,10 @@ cairo_cff_font_read_cid_fontdict (cairo_cff_font_t *font, unsigned char *ptr)
+ }
+ operand = decode_integer (operand, &size);
+ decode_integer (operand, &offset);
++ if (unlikely (offset < 0 || (unsigned long)offset > font->data_length)) {
++ status = CAIRO_INT_STATUS_UNSUPPORTED;
++ goto fail;
++ }
+ status = cff_dict_init (&font->fd_private_dict[i]);
+ if (unlikely (status))
+ goto fail;
+@@ -1205,6 +1209,8 @@ cairo_cff_font_read_top_dict (cairo_cff_font_t *font)
+ operand = cff_dict_get_operands (font->top_dict, CHARSTRINGS_OP, &size);
+ decode_integer (operand, &offset);
+ p = font->data + offset;
++ if (unlikely (p < font->data || p > font->data_end))
++ return CAIRO_INT_STATUS_UNSUPPORTED;
+ status = cff_index_read (&font->charstrings_index, &p, font->data_end);
+ if (unlikely (status))
+ goto fail;
+@@ -1217,7 +1223,7 @@ cairo_cff_font_read_top_dict (cairo_cff_font_t *font)
+
+ decode_integer (operand, &offset);
+ font->charset = font->data + offset;
+- if (font->charset >= font->data_end)
++ if (unlikely (font->charset < font->data || font->charset >= font->data_end))
+ return CAIRO_INT_STATUS_UNSUPPORTED;
+ }
+
+@@ -1227,27 +1233,36 @@ cairo_cff_font_read_top_dict (cairo_cff_font_t *font)
+ if (font->is_cid) {
+ operand = cff_dict_get_operands (font->top_dict, FDSELECT_OP, &size);
+ decode_integer (operand, &offset);
+- status = cairo_cff_font_read_fdselect (font, font->data + offset);
++ p = font->data + offset;
++ if (unlikely (p < font->data || p > font->data_end))
++ return CAIRO_INT_STATUS_UNSUPPORTED;
++ status = cairo_cff_font_read_fdselect (font, p);
+ if (unlikely (status))
+ goto fail;
+
+ operand = cff_dict_get_operands (font->top_dict, FDARRAY_OP, &size);
+ decode_integer (operand, &offset);
+- status = cairo_cff_font_read_cid_fontdict (font, font->data + offset);
++ p = font->data + offset;
++ if (unlikely (p < font->data || p > font->data_end))
++ return CAIRO_INT_STATUS_UNSUPPORTED;
++ status = cairo_cff_font_read_cid_fontdict (font, p);
+ if (unlikely (status))
+ goto fail;
+ } else {
+ operand = cff_dict_get_operands (font->top_dict, PRIVATE_OP, &size);
+ operand = decode_integer (operand, &size);
+ decode_integer (operand, &offset);
+- status = cairo_cff_font_read_private_dict (font,
++ p = font->data + offset;
++ if (unlikely (p < font->data || p > font->data_end))
++ return CAIRO_INT_STATUS_UNSUPPORTED;
++ status = cairo_cff_font_read_private_dict (font,
+ font->private_dict,
+ &font->local_sub_index,
+ &font->local_sub_bias,
+ &font->local_subs_used,
+ &font->default_width,
+ &font->nominal_width,
+- font->data + offset,
++ p,
+ size);
+ if (unlikely (status))
+ goto fail;
diff -Nru thunderbird-140.11.0esr/gfx/ipc/GPUParent.cpp thunderbird-140.12.0esr/gfx/ipc/GPUParent.cpp
--- thunderbird-140.11.0esr/gfx/ipc/GPUParent.cpp 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/ipc/GPUParent.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -468,8 +468,8 @@
}
mozilla::ipc::IPCResult GPUParent::RecvInitImageBridge(
- Endpoint&& aEndpoint) {
- ImageBridgeParent::CreateForGPUProcess(std::move(aEndpoint));
+ Endpoint&& aEndpoint, uint32_t aNamespace) {
+ ImageBridgeParent::CreateForGPUProcess(std::move(aEndpoint), aNamespace);
return IPC_OK();
}
@@ -485,8 +485,8 @@
}
mozilla::ipc::IPCResult GPUParent::RecvInitVRManager(
- Endpoint&& aEndpoint) {
- VRManagerParent::CreateForGPUProcess(std::move(aEndpoint));
+ Endpoint&& aEndpoint, uint32_t aNamespace) {
+ VRManagerParent::CreateForGPUProcess(std::move(aEndpoint), aNamespace);
return IPC_OK();
}
@@ -617,16 +617,20 @@
}
mozilla::ipc::IPCResult GPUParent::RecvNewContentImageBridge(
- Endpoint&& aEndpoint, const ContentParentId& aChildId) {
- if (!ImageBridgeParent::CreateForContent(std::move(aEndpoint), aChildId)) {
+ Endpoint&& aEndpoint, const ContentParentId& aChildId,
+ uint32_t aNamespace) {
+ if (!ImageBridgeParent::CreateForContent(std::move(aEndpoint), aChildId,
+ aNamespace)) {
return IPC_FAIL_NO_REASON(this);
}
return IPC_OK();
}
mozilla::ipc::IPCResult GPUParent::RecvNewContentVRManager(
- Endpoint&& aEndpoint, const ContentParentId& aChildId) {
- if (!VRManagerParent::CreateForContent(std::move(aEndpoint), aChildId)) {
+ Endpoint&& aEndpoint, const ContentParentId& aChildId,
+ uint32_t aNamespace) {
+ if (!VRManagerParent::CreateForContent(std::move(aEndpoint), aChildId,
+ aNamespace)) {
return IPC_FAIL_NO_REASON(this);
}
return IPC_OK();
diff -Nru thunderbird-140.11.0esr/gfx/ipc/GPUParent.h thunderbird-140.12.0esr/gfx/ipc/GPUParent.h
--- thunderbird-140.11.0esr/gfx/ipc/GPUParent.h 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/ipc/GPUParent.h 2026-06-13 03:47:57.000000000 +0000
@@ -58,12 +58,12 @@
mozilla::ipc::IPCResult RecvInitVsyncBridge(
Endpoint&& aVsyncEndpoint);
mozilla::ipc::IPCResult RecvInitImageBridge(
- Endpoint&& aEndpoint);
+ Endpoint&& aEndpoint, uint32_t aNamespace);
mozilla::ipc::IPCResult RecvInitVideoBridge(
Endpoint&& aEndpoint,
const layers::VideoBridgeSource& aSource);
mozilla::ipc::IPCResult RecvInitVRManager(
- Endpoint&& aEndpoint);
+ Endpoint&& aEndpoint, uint32_t aNamespace);
mozilla::ipc::IPCResult RecvInitVR(Endpoint&& aVRGPUChild);
mozilla::ipc::IPCResult RecvInitUiCompositorController(
const LayersId& aRootLayerTreeId,
@@ -82,10 +82,11 @@
Endpoint&& aEndpoint,
const ContentParentId& aChildId, uint32_t aNamespace);
mozilla::ipc::IPCResult RecvNewContentImageBridge(
- Endpoint&& aEndpoint,
- const ContentParentId& aChildId);
+ Endpoint&& aEndpoint, const ContentParentId& aChildId,
+ uint32_t aNamespace);
mozilla::ipc::IPCResult RecvNewContentVRManager(
- Endpoint&& aEndpoint, const ContentParentId& aChildId);
+ Endpoint&& aEndpoint, const ContentParentId& aChildId,
+ uint32_t aNamespace);
mozilla::ipc::IPCResult RecvNewContentRemoteDecoderManager(
Endpoint&& aEndpoint,
const ContentParentId& aChildId);
diff -Nru thunderbird-140.11.0esr/gfx/ipc/GPUProcessManager.cpp thunderbird-140.12.0esr/gfx/ipc/GPUProcessManager.cpp
--- thunderbird-140.11.0esr/gfx/ipc/GPUProcessManager.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/ipc/GPUProcessManager.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -501,9 +501,9 @@
return true;
}
- mGPUChild->SendInitImageBridge(std::move(parentPipe));
- ImageBridgeChild::InitWithGPUProcess(std::move(childPipe),
- AllocateNamespace());
+ uint32_t ibNamespace = AllocateNamespace();
+ mGPUChild->SendInitImageBridge(std::move(parentPipe), ibNamespace);
+ ImageBridgeChild::InitWithGPUProcess(std::move(childPipe), ibNamespace);
return true;
}
@@ -518,7 +518,7 @@
}
if (NS_FAILED(rv)) {
- VRManagerChild::InitSameProcess();
+ VRManagerChild::InitSameProcess(AllocateNamespace());
return true;
}
@@ -532,8 +532,9 @@
return true;
}
- mGPUChild->SendInitVRManager(std::move(parentPipe));
- VRManagerChild::InitWithGPUProcess(std::move(childPipe));
+ uint32_t vrNamespace = AllocateNamespace();
+ mGPUChild->SendInitVRManager(std::move(parentPipe), vrNamespace);
+ VRManagerChild::InitWithGPUProcess(std::move(childPipe), vrNamespace);
return true;
}
@@ -1324,21 +1325,29 @@
ipc::Endpoint* aOutVRBridge,
ipc::Endpoint* aOutVideoManager,
dom::ContentParentId aChildId, nsTArray* aNamespaces) {
- const uint32_t cmNamespace = AllocateNamespace();
- if (!CreateContentCompositorManager(aOtherProcess, aChildId, cmNamespace,
+ const uint32_t compositorManagerNamespace = AllocateNamespace();
+ const uint32_t compositorBridgeNamespace = AllocateNamespace();
+ const uint32_t imageBridgeNamespace = AllocateNamespace();
+ const uint32_t vrManagerNamespace = AllocateNamespace();
+ if (!CreateContentCompositorManager(aOtherProcess, aChildId,
+ compositorManagerNamespace,
aOutCompositor) ||
- !CreateContentImageBridge(aOtherProcess, aChildId, aOutImageBridge) ||
- !CreateContentVRManager(aOtherProcess, aChildId, aOutVRBridge)) {
+ !CreateContentImageBridge(aOtherProcess, aChildId, imageBridgeNamespace,
+ aOutImageBridge) ||
+ !CreateContentVRManager(aOtherProcess, aChildId, vrManagerNamespace,
+ aOutVRBridge)) {
return false;
}
// VideoDeocderManager is only supported in the GPU process, so we allow this
// to be fallible.
CreateContentRemoteDecoderManager(aOtherProcess, aChildId, aOutVideoManager);
- // Allocates 3 namespaces(for CompositorManagerChild, CompositorBridgeChild
- // and ImageBridgeChild)
- aNamespaces->AppendElement(cmNamespace);
- aNamespaces->AppendElement(AllocateNamespace());
- aNamespaces->AppendElement(AllocateNamespace());
+
+ // The order of the outparam namespaces must be kept in sync with
+ // ContentChild::RecvInitRendering and ContentChild::RecvReinitRendering.
+ aNamespaces->AppendElement(compositorManagerNamespace);
+ aNamespaces->AppendElement(compositorBridgeNamespace);
+ aNamespaces->AppendElement(imageBridgeNamespace);
+ aNamespaces->AppendElement(vrManagerNamespace);
return true;
}
@@ -1380,7 +1389,7 @@
bool GPUProcessManager::CreateContentImageBridge(
ipc::EndpointProcInfo aOtherProcess, dom::ContentParentId aChildId,
- ipc::Endpoint* aOutEndpoint) {
+ uint32_t aNamespace, ipc::Endpoint* aOutEndpoint) {
if (!EnsureImageBridgeChild()) {
return false;
}
@@ -1405,9 +1414,11 @@
}
if (mGPUChild) {
- mGPUChild->SendNewContentImageBridge(std::move(parentPipe), aChildId);
+ mGPUChild->SendNewContentImageBridge(std::move(parentPipe), aChildId,
+ aNamespace);
} else {
- if (!ImageBridgeParent::CreateForContent(std::move(parentPipe), aChildId)) {
+ if (!ImageBridgeParent::CreateForContent(std::move(parentPipe), aChildId,
+ aNamespace)) {
return false;
}
}
@@ -1429,7 +1440,7 @@
bool GPUProcessManager::CreateContentVRManager(
ipc::EndpointProcInfo aOtherProcess, dom::ContentParentId aChildId,
- ipc::Endpoint* aOutEndpoint) {
+ uint32_t aNamespace, ipc::Endpoint* aOutEndpoint) {
if (NS_WARN_IF(!EnsureVRManager())) {
return false;
}
@@ -1454,9 +1465,11 @@
}
if (mGPUChild) {
- mGPUChild->SendNewContentVRManager(std::move(parentPipe), aChildId);
+ mGPUChild->SendNewContentVRManager(std::move(parentPipe), aChildId,
+ aNamespace);
} else {
- if (!VRManagerParent::CreateForContent(std::move(parentPipe), aChildId)) {
+ if (!VRManagerParent::CreateForContent(std::move(parentPipe), aChildId,
+ aNamespace)) {
return false;
}
}
diff -Nru thunderbird-140.11.0esr/gfx/ipc/GPUProcessManager.h thunderbird-140.12.0esr/gfx/ipc/GPUProcessManager.h
--- thunderbird-140.11.0esr/gfx/ipc/GPUProcessManager.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/ipc/GPUProcessManager.h 2026-06-13 03:47:57.000000000 +0000
@@ -235,11 +235,11 @@
mozilla::ipc::Endpoint* aOutEndpoint);
bool CreateContentImageBridge(
mozilla::ipc::EndpointProcInfo aOtherProcess,
- dom::ContentParentId aChildId,
+ dom::ContentParentId aChildId, uint32_t aNamespace,
mozilla::ipc::Endpoint* aOutEndpoint);
bool CreateContentVRManager(
mozilla::ipc::EndpointProcInfo aOtherProcess,
- dom::ContentParentId aChildId,
+ dom::ContentParentId aChildId, uint32_t aNamespace,
mozilla::ipc::Endpoint* aOutEndpoint);
void CreateContentRemoteDecoderManager(
mozilla::ipc::EndpointProcInfo aOtherProcess,
diff -Nru thunderbird-140.11.0esr/gfx/ipc/PGPU.ipdl thunderbird-140.12.0esr/gfx/ipc/PGPU.ipdl
--- thunderbird-140.11.0esr/gfx/ipc/PGPU.ipdl 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/ipc/PGPU.ipdl 2026-06-13 03:47:57.000000000 +0000
@@ -70,9 +70,9 @@
async InitCompositorManager(Endpoint endpoint, uint32_t aNamespace);
async InitVsyncBridge(Endpoint endpoint);
- async InitImageBridge(Endpoint endpoint);
+ async InitImageBridge(Endpoint endpoint, uint32_t aNamespace);
async InitVideoBridge(Endpoint endpoint, VideoBridgeSource aSource);
- async InitVRManager(Endpoint endpoint);
+ async InitVRManager(Endpoint endpoint, uint32_t aNamespace);
async InitUiCompositorController(LayersId rootLayerTreeId, Endpoint endpoint);
async InitAPZInputBridge(LayersId layersId,
Endpoint endpoint);
@@ -88,8 +88,8 @@
// Create a new content-process compositor bridge.
async NewContentCompositorManager(Endpoint endpoint, ContentParentId childId, uint32_t aNamespace);
- async NewContentImageBridge(Endpoint endpoint, ContentParentId childId);
- async NewContentVRManager(Endpoint endpoint, ContentParentId childId);
+ async NewContentImageBridge(Endpoint endpoint, ContentParentId childId, uint32_t aNamespace);
+ async NewContentVRManager(Endpoint endpoint, ContentParentId childId, uint32_t aNamespace);
async NewContentRemoteDecoderManager(Endpoint endpoint, ContentParentId childId);
// Called to notify the GPU process of who owns a layersId.
diff -Nru thunderbird-140.11.0esr/gfx/layers/ipc/CanvasTranslator.cpp thunderbird-140.12.0esr/gfx/layers/ipc/CanvasTranslator.cpp
--- thunderbird-140.11.0esr/gfx/layers/ipc/CanvasTranslator.cpp 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/layers/ipc/CanvasTranslator.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -1668,7 +1668,6 @@
RefPtr parent =
VideoBridgeParent::GetSingleton(sdrd.source());
if (!parent) {
- MOZ_ASSERT_UNREACHABLE("unexpected to be called");
gfxCriticalNote << "TexUnpackSurface failed to get VideoBridgeParent";
return nullptr;
}
diff -Nru thunderbird-140.11.0esr/gfx/layers/ipc/CompositorBridgeParent.cpp thunderbird-140.12.0esr/gfx/layers/ipc/CompositorBridgeParent.cpp
--- thunderbird-140.11.0esr/gfx/layers/ipc/CompositorBridgeParent.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/layers/ipc/CompositorBridgeParent.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -109,8 +109,8 @@
CompositorBridgeParent::sIndirectLayerTreesLock);
CompositorBridgeParentBase::CompositorBridgeParentBase(
- CompositorManagerParent* aManager)
- : mCanSend(true), mCompositorManager(aManager) {}
+ CompositorManagerParent* aManager, uint32_t aNamespace)
+ : mCanSend(true), mCompositorManager(aManager), mNamespace(aNamespace) {}
CompositorBridgeParentBase::~CompositorBridgeParentBase() = default;
@@ -154,6 +154,11 @@
return PCompositorBridgeParent::DeallocShmem(aShmem);
}
+bool CompositorBridgeParentBase::OwnsExternalImageId(
+ const wr::ExternalImageId& aId) const {
+ return mNamespace == static_cast(wr::AsUint64(aId) >> 32);
+}
+
CompositorBridgeParent::LayerTreeState::LayerTreeState()
: mApzcTreeManagerParent(nullptr),
mApzInputBridgeParent(nullptr),
@@ -200,11 +205,11 @@
}
CompositorBridgeParent::CompositorBridgeParent(
- CompositorManagerParent* aManager, CSSToLayoutDeviceScale aScale,
- const TimeDuration& aVsyncRate, const CompositorOptions& aOptions,
- bool aUseExternalSurfaceSize, const gfx::IntSize& aSurfaceSize,
- uint64_t aInnerWindowId)
- : CompositorBridgeParentBase(aManager),
+ CompositorManagerParent* aManager, uint32_t aNamespace,
+ CSSToLayoutDeviceScale aScale, const TimeDuration& aVsyncRate,
+ const CompositorOptions& aOptions, bool aUseExternalSurfaceSize,
+ const gfx::IntSize& aSurfaceSize, uint64_t aInnerWindowId)
+ : CompositorBridgeParentBase(aManager, aNamespace),
mWidget(nullptr),
mScale(aScale),
mVsyncRate(aVsyncRate),
diff -Nru thunderbird-140.11.0esr/gfx/layers/ipc/CompositorBridgeParent.h thunderbird-140.12.0esr/gfx/layers/ipc/CompositorBridgeParent.h
--- thunderbird-140.11.0esr/gfx/layers/ipc/CompositorBridgeParent.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/layers/ipc/CompositorBridgeParent.h 2026-06-13 03:47:57.000000000 +0000
@@ -89,7 +89,8 @@
friend class PCompositorBridgeParent;
public:
- explicit CompositorBridgeParentBase(CompositorManagerParent* aManager);
+ explicit CompositorBridgeParentBase(CompositorManagerParent* aManager,
+ uint32_t aNamespace);
virtual bool SetTestSampleTime(const LayersId& aId, const TimeStamp& aTime) {
return true;
@@ -147,6 +148,16 @@
virtual void NotifyMemoryPressure() {}
virtual void AccumulateMemoryReport(wr::MemoryReport*) {}
+ bool OwnsExternalImageId(const wr::ExternalImageId& aId) const;
+
+ CompositorManagerParent* GetCompositorManager() const {
+ return mCompositorManager;
+ }
+
+ uint32_t GetNamespace() const { return mNamespace; }
+
+ void SetNamespace(uint32_t aNamespace) { mNamespace = aNamespace; }
+
protected:
virtual ~CompositorBridgeParentBase();
@@ -214,6 +225,7 @@
protected:
RefPtr mCompositorManager;
+ uint32_t mNamespace;
};
MOZ_MAKE_ENUM_CLASS_BITWISE_OPERATORS(
@@ -236,6 +248,7 @@
}
explicit CompositorBridgeParent(CompositorManagerParent* aManager,
+ uint32_t aNamespace,
CSSToLayoutDeviceScale aScale,
const TimeDuration& aVsyncRate,
const CompositorOptions& aOptions,
diff -Nru thunderbird-140.11.0esr/gfx/layers/ipc/CompositorManagerChild.cpp thunderbird-140.12.0esr/gfx/layers/ipc/CompositorManagerChild.cpp
--- thunderbird-140.11.0esr/gfx/layers/ipc/CompositorManagerChild.cpp 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/layers/ipc/CompositorManagerChild.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -139,8 +139,8 @@
CompositorBridgeOptions options = ContentCompositorOptions();
RefPtr bridge = new CompositorBridgeChild(sInstance);
- if (NS_WARN_IF(
- !sInstance->SendPCompositorBridgeConstructor(bridge, options))) {
+ if (NS_WARN_IF(!sInstance->SendPCompositorBridgeConstructor(bridge, options,
+ aNamespace))) {
return false;
}
@@ -169,8 +169,8 @@
aInnerWindowId);
RefPtr bridge = new CompositorBridgeChild(sInstance);
- if (NS_WARN_IF(
- !sInstance->SendPCompositorBridgeConstructor(bridge, options))) {
+ if (NS_WARN_IF(!sInstance->SendPCompositorBridgeConstructor(bridge, options,
+ aNamespace))) {
return nullptr;
}
@@ -191,8 +191,8 @@
CompositorBridgeOptions options = SameProcessWidgetCompositorOptions();
RefPtr bridge = new CompositorBridgeChild(sInstance);
- if (NS_WARN_IF(
- !sInstance->SendPCompositorBridgeConstructor(bridge, options))) {
+ if (NS_WARN_IF(!sInstance->SendPCompositorBridgeConstructor(bridge, options,
+ aNamespace))) {
return nullptr;
}
diff -Nru thunderbird-140.11.0esr/gfx/layers/ipc/CompositorManagerParent.cpp thunderbird-140.12.0esr/gfx/layers/ipc/CompositorManagerParent.cpp
--- thunderbird-140.11.0esr/gfx/layers/ipc/CompositorManagerParent.cpp 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/layers/ipc/CompositorManagerParent.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -109,8 +109,8 @@
gfxPlatform::GetPlatform()->GetGlobalVsyncDispatcher()->GetVsyncRate();
RefPtr bridge = new CompositorBridgeParent(
- sInstance, aScale, vsyncRate, aOptions, aUseExternalSurfaceSize,
- aSurfaceSize, aInnerWindowId);
+ sInstance, /* aNamespace */ 0, aScale, vsyncRate, aOptions,
+ aUseExternalSurfaceSize, aSurfaceSize, aInnerWindowId);
sInstance->mPendingCompositorBridges.AppendElement(bridge);
return bridge.forget();
@@ -227,11 +227,11 @@
already_AddRefed
CompositorManagerParent::AllocPCompositorBridgeParent(
- const CompositorBridgeOptions& aOpt) {
+ const CompositorBridgeOptions& aOpt, const uint32_t& aNamespace) {
switch (aOpt.type()) {
case CompositorBridgeOptions::TContentCompositorOptions: {
RefPtr bridge =
- new ContentCompositorBridgeParent(this);
+ new ContentCompositorBridgeParent(this, aNamespace);
return bridge.forget();
}
case CompositorBridgeOptions::TWidgetCompositorOptions: {
@@ -245,7 +245,7 @@
const WidgetCompositorOptions& opt = aOpt.get_WidgetCompositorOptions();
RefPtr bridge = new CompositorBridgeParent(
- this, opt.scale(), opt.vsyncRate(), opt.options(),
+ this, aNamespace, opt.scale(), opt.vsyncRate(), opt.options(),
opt.useExternalSurfaceSize(), opt.surfaceSize(), opt.innerWindowId());
return bridge.forget();
}
@@ -266,6 +266,7 @@
}
RefPtr bridge = mPendingCompositorBridges[0];
+ bridge->SetNamespace(aNamespace);
mPendingCompositorBridges.RemoveElementAt(0);
return bridge.forget();
}
diff -Nru thunderbird-140.11.0esr/gfx/layers/ipc/CompositorManagerParent.h thunderbird-140.12.0esr/gfx/layers/ipc/CompositorManagerParent.h
--- thunderbird-140.11.0esr/gfx/layers/ipc/CompositorManagerParent.h 2026-05-15 21:31:22.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/layers/ipc/CompositorManagerParent.h 2026-06-13 03:47:57.000000000 +0000
@@ -71,7 +71,7 @@
void ActorDestroy(ActorDestroyReason aReason) override;
already_AddRefed AllocPCompositorBridgeParent(
- const CompositorBridgeOptions& aOpt);
+ const CompositorBridgeOptions& aOpt, const uint32_t& aNamespace);
static void NotifyWebRenderError(wr::WebRenderError aError);
@@ -81,6 +81,8 @@
return mNamespace == static_cast(wr::AsUint64(aId) >> 32);
}
+ uint32_t GetNamespace() const { return mNamespace; }
+
private:
static StaticMonitor sMonitor;
static StaticRefPtr sInstance
diff -Nru thunderbird-140.11.0esr/gfx/layers/ipc/ContentCompositorBridgeParent.cpp thunderbird-140.12.0esr/gfx/layers/ipc/ContentCompositorBridgeParent.cpp
--- thunderbird-140.11.0esr/gfx/layers/ipc/ContentCompositorBridgeParent.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/layers/ipc/ContentCompositorBridgeParent.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -389,6 +389,11 @@
if (aSharedData.type() == SurfaceDescriptor::TSurfaceDescriptorDcompSurface) {
return nullptr;
}
+ if (aExternalImageId.isSome() &&
+ !OwnsExternalImageId(aExternalImageId.ref())) {
+ NS_ERROR("We do not own this external image id.");
+ return nullptr;
+ }
return TextureHost::CreateIPDLActor(
this, aSharedData, std::move(aReadLock), aLayersBackend, aFlags,
mCompositorManager->GetContentId(), aSerial, aExternalImageId);
diff -Nru thunderbird-140.11.0esr/gfx/layers/ipc/ContentCompositorBridgeParent.h thunderbird-140.12.0esr/gfx/layers/ipc/ContentCompositorBridgeParent.h
--- thunderbird-140.11.0esr/gfx/layers/ipc/ContentCompositorBridgeParent.h 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/layers/ipc/ContentCompositorBridgeParent.h 2026-06-13 03:47:57.000000000 +0000
@@ -26,8 +26,10 @@
friend class CompositorBridgeParent;
public:
- explicit ContentCompositorBridgeParent(CompositorManagerParent* aManager)
- : CompositorBridgeParentBase(aManager), mDestroyCalled(false) {}
+ explicit ContentCompositorBridgeParent(CompositorManagerParent* aManager,
+ uint32_t aNamespace)
+ : CompositorBridgeParentBase(aManager, aNamespace),
+ mDestroyCalled(false) {}
void ActorDestroy(ActorDestroyReason aWhy) override;
diff -Nru thunderbird-140.11.0esr/gfx/layers/ipc/ImageBridgeChild.cpp thunderbird-140.12.0esr/gfx/layers/ipc/ImageBridgeChild.cpp
--- thunderbird-140.11.0esr/gfx/layers/ipc/ImageBridgeChild.cpp 2026-05-15 21:31:21.000000000 +0000
+++ thunderbird-140.12.0esr/gfx/layers/ipc/ImageBridgeChild.cpp 2026-06-13 03:47:57.000000000 +0000
@@ -588,7 +588,8 @@
sImageBridgeChildThread = thread.forget();
RefPtr child = new ImageBridgeChild(aNamespace);
- RefPtr parent = ImageBridgeParent::CreateSameProcess();
+ RefPtr