Skip to content

Commit 680b436

Browse files
committed
Backed out 13 changesets (bug 1690111) for causing fetch related crashes.
Backed out changeset 5f2c25d194ad (bug 1690111) Backed out changeset 76c408bcd053 (bug 1690111) Backed out changeset 6d0649fdafff (bug 1690111) Backed out changeset c1330b5e8c43 (bug 1690111) Backed out changeset 5fa36d8fd2a5 (bug 1690111) Backed out changeset daf7d747853a (bug 1690111) Backed out changeset f70e09a7f5c6 (bug 1690111) Backed out changeset 40c6d6eed7f8 (bug 1690111) Backed out changeset 692f2a759573 (bug 1690111) Backed out changeset 7140866dd9f6 (bug 1690111) Backed out changeset 2865fe682139 (bug 1690111) Backed out changeset 9dcd2416f8a5 (bug 1690111) Backed out changeset 9c411bf84079 (bug 1690111)
1 parent 48be8d1 commit 680b436

File tree

102 files changed

+1689
-2847
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

102 files changed

+1689
-2847
lines changed

dom/base/ChromeUtils.cpp

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -117,17 +117,29 @@ void ChromeUtils::Base64URLEncode(GlobalObject& aGlobal,
117117
const ArrayBufferViewOrArrayBuffer& aSource,
118118
const Base64URLEncodeOptions& aOptions,
119119
nsACString& aResult, ErrorResult& aRv) {
120+
size_t length = 0;
121+
uint8_t* data = nullptr;
122+
if (aSource.IsArrayBuffer()) {
123+
const ArrayBuffer& buffer = aSource.GetAsArrayBuffer();
124+
buffer.ComputeState();
125+
length = buffer.Length();
126+
data = buffer.Data();
127+
} else if (aSource.IsArrayBufferView()) {
128+
const ArrayBufferView& view = aSource.GetAsArrayBufferView();
129+
view.ComputeState();
130+
length = view.Length();
131+
data = view.Data();
132+
} else {
133+
MOZ_CRASH("Uninitialized union: expected buffer or view");
134+
}
135+
120136
auto paddingPolicy = aOptions.mPad ? Base64URLEncodePaddingPolicy::Include
121137
: Base64URLEncodePaddingPolicy::Omit;
122-
ProcessTypedArrays(
123-
aSource, [&](const Span<uint8_t>& aData, JS::AutoCheckCannotGC&&) {
124-
nsresult rv = mozilla::Base64URLEncode(aData.Length(), aData.Elements(),
125-
paddingPolicy, aResult);
126-
if (NS_WARN_IF(NS_FAILED(rv))) {
127-
aResult.Truncate();
128-
aRv.Throw(rv);
129-
}
130-
});
138+
nsresult rv = mozilla::Base64URLEncode(length, data, paddingPolicy, aResult);
139+
if (NS_WARN_IF(NS_FAILED(rv))) {
140+
aResult.Truncate();
141+
aRv.Throw(rv);
142+
}
131143
}
132144

133145
/* static */

dom/base/CompressionStream.cpp

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88

99
#include "js/TypeDecls.h"
1010
#include "mozilla/Assertions.h"
11-
#include "mozilla/Attributes.h"
1211
#include "mozilla/dom/CompressionStreamBinding.h"
1312
#include "mozilla/dom/ReadableStream.h"
1413
#include "mozilla/dom/WritableStream.h"
@@ -58,21 +57,16 @@ class CompressionStreamAlgorithms : public TransformerAlgorithmsWrapper {
5857
// https://wicg.github.io/compression/#compress-and-enqueue-a-chunk
5958

6059
// Step 1: If chunk is not a BufferSource type, then throw a TypeError.
61-
RootedUnion<OwningArrayBufferViewOrArrayBuffer> bufferSource(cx);
62-
if (!bufferSource.Init(cx, aChunk)) {
63-
aRv.MightThrowJSException();
64-
aRv.StealExceptionFromJSContext(cx);
60+
// (ExtractSpanFromBufferSource does it)
61+
Span<const uint8_t> input = ExtractSpanFromBufferSource(cx, aChunk, aRv);
62+
if (aRv.Failed()) {
6563
return;
6664
}
6765

6866
// Step 2: Let buffer be the result of compressing chunk with cs's format
6967
// and context.
7068
// Step 3 - 5: (Done in CompressAndEnqueue)
71-
ProcessTypedArraysFixed(
72-
bufferSource,
73-
[&](const Span<uint8_t>& aData) MOZ_CAN_RUN_SCRIPT_BOUNDARY {
74-
CompressAndEnqueue(cx, aData, ZLibFlush::No, aController, aRv);
75-
});
69+
CompressAndEnqueue(cx, input, ZLibFlush::No, aController, aRv);
7670
}
7771

7872
// Step 4 of

dom/base/Crypto.cpp

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,11 @@ JSObject* Crypto::WrapObject(JSContext* aCx,
4040
void Crypto::GetRandomValues(JSContext* aCx, const ArrayBufferView& aArray,
4141
JS::MutableHandle<JSObject*> aRetval,
4242
ErrorResult& aRv) {
43+
JS::Rooted<JSObject*> view(aCx, aArray.Obj());
44+
4345
// Throw if the wrong type of ArrayBufferView is passed in
4446
// (Part of the Web Crypto API spec)
45-
switch (aArray.Type()) {
47+
switch (JS_GetArrayBufferViewType(view)) {
4648
case js::Scalar::Int8:
4749
case js::Scalar::Uint8:
4850
case js::Scalar::Uint8Clamped:
@@ -58,34 +60,36 @@ void Crypto::GetRandomValues(JSContext* aCx, const ArrayBufferView& aArray,
5860
return;
5961
}
6062

63+
aArray.ComputeState();
64+
uint32_t dataLen = aArray.Length();
65+
if (dataLen == 0) {
66+
NS_WARNING("ArrayBufferView length is 0, cannot continue");
67+
aRetval.set(view);
68+
return;
69+
} else if (dataLen > 65536) {
70+
aRv.Throw(NS_ERROR_DOM_QUOTA_EXCEEDED_ERR);
71+
return;
72+
}
73+
6174
nsCOMPtr<nsIRandomGenerator> randomGenerator =
6275
do_GetService("@mozilla.org/security/random-generator;1");
6376
if (!randomGenerator) {
6477
aRv.Throw(NS_ERROR_DOM_OPERATION_ERR);
6578
return;
6679
}
6780

68-
aArray.ProcessFixedData([&](const Span<uint8_t>& aData) {
69-
if (aData.Length() == 0) {
70-
NS_WARNING("ArrayBufferView length is 0, cannot continue");
71-
aRetval.set(aArray.Obj());
72-
return;
73-
}
74-
75-
if (aData.Length() > 65536) {
76-
aRv.Throw(NS_ERROR_DOM_QUOTA_EXCEEDED_ERR);
77-
return;
78-
}
81+
uint8_t* buf;
82+
nsresult rv = randomGenerator->GenerateRandomBytes(dataLen, &buf);
83+
if (NS_FAILED(rv) || !buf) {
84+
aRv.Throw(NS_ERROR_DOM_OPERATION_ERR);
85+
return;
86+
}
7987

80-
nsresult rv = randomGenerator->GenerateRandomBytesInto(aData.Elements(),
81-
aData.Length());
82-
if (NS_FAILED(rv)) {
83-
aRv.Throw(NS_ERROR_DOM_OPERATION_ERR);
84-
return;
85-
}
88+
// Copy random bytes to ABV.
89+
memcpy(aArray.Data(), buf, dataLen);
90+
free(buf);
8691

87-
aRetval.set(aArray.Obj());
88-
});
92+
aRetval.set(view);
8993
}
9094

9195
void Crypto::RandomUUID(nsACString& aRetVal) {

dom/base/DOMMatrix.cpp

Lines changed: 34 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -199,31 +199,29 @@ already_AddRefed<DOMMatrixReadOnly> DOMMatrixReadOnly::FromMatrix(
199199
already_AddRefed<DOMMatrixReadOnly> DOMMatrixReadOnly::FromFloat32Array(
200200
const GlobalObject& aGlobal, const Float32Array& aArray32,
201201
ErrorResult& aRv) {
202-
return aArray32.ProcessData(
203-
[&](const Span<float>& aData, JS::AutoCheckCannotGC&& nogc) {
204-
const int length = aData.Length();
205-
const bool is2D = length == 6;
206-
RefPtr<DOMMatrixReadOnly> obj =
207-
new DOMMatrixReadOnly(aGlobal.GetAsSupports(), is2D);
208-
SetDataInMatrix(obj, aData.Elements(), length, aRv);
209-
nogc.reset(); // Done with aData
210-
return obj.forget();
211-
});
202+
aArray32.ComputeState();
203+
204+
const int length = aArray32.Length();
205+
const bool is2D = length == 6;
206+
RefPtr<DOMMatrixReadOnly> obj =
207+
new DOMMatrixReadOnly(aGlobal.GetAsSupports(), is2D);
208+
SetDataInMatrix(obj, aArray32.Data(), length, aRv);
209+
210+
return obj.forget();
212211
}
213212

214213
already_AddRefed<DOMMatrixReadOnly> DOMMatrixReadOnly::FromFloat64Array(
215214
const GlobalObject& aGlobal, const Float64Array& aArray64,
216215
ErrorResult& aRv) {
217-
return aArray64.ProcessData(
218-
[&](const Span<double>& aData, JS::AutoCheckCannotGC&& nogc) {
219-
const int length = aData.Length();
220-
const bool is2D = length == 6;
221-
RefPtr<DOMMatrixReadOnly> obj =
222-
new DOMMatrixReadOnly(aGlobal.GetAsSupports(), is2D);
223-
SetDataInMatrix(obj, aData.Elements(), length, aRv);
224-
nogc.reset(); // Done with aData
225-
return obj.forget();
226-
});
216+
aArray64.ComputeState();
217+
218+
const int length = aArray64.Length();
219+
const bool is2D = length == 6;
220+
RefPtr<DOMMatrixReadOnly> obj =
221+
new DOMMatrixReadOnly(aGlobal.GetAsSupports(), is2D);
222+
SetDataInMatrix(obj, aArray64.Data(), length, aRv);
223+
224+
return obj.forget();
227225
}
228226

229227
already_AddRefed<DOMMatrixReadOnly> DOMMatrixReadOnly::Constructor(
@@ -644,29 +642,27 @@ already_AddRefed<DOMMatrix> DOMMatrix::FromMatrix(
644642
already_AddRefed<DOMMatrix> DOMMatrix::FromFloat32Array(
645643
const GlobalObject& aGlobal, const Float32Array& aArray32,
646644
ErrorResult& aRv) {
647-
return aArray32.ProcessData(
648-
[&](const Span<float>& aData, JS::AutoCheckCannotGC&& nogc) {
649-
const int length = aData.Length();
650-
const bool is2D = length == 6;
651-
RefPtr<DOMMatrix> obj = new DOMMatrix(aGlobal.GetAsSupports(), is2D);
652-
SetDataInMatrix(obj, aData.Elements(), length, aRv);
653-
nogc.reset(); // Done with aData
654-
return obj.forget();
655-
});
645+
aArray32.ComputeState();
646+
647+
const int length = aArray32.Length();
648+
const bool is2D = length == 6;
649+
RefPtr<DOMMatrix> obj = new DOMMatrix(aGlobal.GetAsSupports(), is2D);
650+
SetDataInMatrix(obj, aArray32.Data(), length, aRv);
651+
652+
return obj.forget();
656653
}
657654

658655
already_AddRefed<DOMMatrix> DOMMatrix::FromFloat64Array(
659656
const GlobalObject& aGlobal, const Float64Array& aArray64,
660657
ErrorResult& aRv) {
661-
return aArray64.ProcessData(
662-
[&](const Span<double>& aData, JS::AutoCheckCannotGC&& nogc) {
663-
const int length = aData.Length();
664-
const bool is2D = length == 6;
665-
RefPtr<DOMMatrix> obj = new DOMMatrix(aGlobal.GetAsSupports(), is2D);
666-
SetDataInMatrix(obj, aData.Elements(), length, aRv);
667-
nogc.reset(); // Done with aData
668-
return obj.forget();
669-
});
658+
aArray64.ComputeState();
659+
660+
const int length = aArray64.Length();
661+
const bool is2D = length == 6;
662+
RefPtr<DOMMatrix> obj = new DOMMatrix(aGlobal.GetAsSupports(), is2D);
663+
SetDataInMatrix(obj, aArray64.Data(), length, aRv);
664+
665+
return obj.forget();
670666
}
671667

672668
already_AddRefed<DOMMatrix> DOMMatrix::Constructor(

dom/base/DOMParser.cpp

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -120,9 +120,8 @@ already_AddRefed<Document> DOMParser::ParseFromSafeString(const nsAString& aStr,
120120
already_AddRefed<Document> DOMParser::ParseFromBuffer(const Uint8Array& aBuf,
121121
SupportedType aType,
122122
ErrorResult& aRv) {
123-
return aBuf.ProcessFixedData([&](const Span<uint8_t>& aData) {
124-
return ParseFromBuffer(aData, aType, aRv);
125-
});
123+
aBuf.ComputeState();
124+
return ParseFromBuffer(Span(aBuf.Data(), aBuf.Length()), aType, aRv);
126125
}
127126

128127
already_AddRefed<Document> DOMParser::ParseFromBuffer(Span<const uint8_t> aBuf,

dom/base/DecompressionStream.cpp

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
#include "mozilla/dom/TextDecoderStream.h"
1515
#include "mozilla/dom/TransformStream.h"
1616
#include "mozilla/dom/TransformerCallbackHelpers.h"
17-
#include "mozilla/dom/UnionTypes.h"
1817

1918
#include "ZLibHelper.h"
2019

@@ -55,21 +54,16 @@ class DecompressionStreamAlgorithms : public TransformerAlgorithmsWrapper {
5554
// https://wicg.github.io/compression/#compress-and-enqueue-a-chunk
5655

5756
// Step 1: If chunk is not a BufferSource type, then throw a TypeError.
58-
RootedUnion<OwningArrayBufferViewOrArrayBuffer> bufferSource(cx);
59-
if (!bufferSource.Init(cx, aChunk)) {
60-
aRv.MightThrowJSException();
61-
aRv.StealExceptionFromJSContext(cx);
57+
// (ExtractSpanFromBufferSource does it)
58+
Span<const uint8_t> input = ExtractSpanFromBufferSource(cx, aChunk, aRv);
59+
if (aRv.Failed()) {
6260
return;
6361
}
6462

6563
// Step 2: Let buffer be the result of decompressing chunk with ds's format
6664
// and context. If this results in an error, then throw a TypeError.
6765
// Step 3 - 5: (Done in CompressAndEnqueue)
68-
ProcessTypedArraysFixed(
69-
bufferSource,
70-
[&](const Span<uint8_t>& aData) MOZ_CAN_RUN_SCRIPT_BOUNDARY {
71-
DecompressAndEnqueue(cx, aData, ZLibFlush::No, aController, aRv);
72-
});
66+
DecompressAndEnqueue(cx, input, ZLibFlush::No, aController, aRv);
7367
}
7468

7569
// Step 4 of

0 commit comments

Comments
 (0)