This commit is contained in:
L. David Baron 2012-12-21 16:39:05 -08:00
Родитель a84a0f2f12 2a4082ac76
Коммит bd6c048a81
21 изменённых файлов: 160 добавлений и 176 удалений

Просмотреть файл

@ -410,14 +410,17 @@ nsresult nsOggReader::DecodeVorbis(ogg_packet* aPacket) {
nsresult nsOggReader::DecodeOpus(ogg_packet* aPacket) {
NS_ASSERTION(aPacket->granulepos != -1, "Must know opus granulepos!");
// Maximum value is 63*2880.
// Maximum value is 63*2880, so there's no chance of overflow.
int32_t frames_number = opus_packet_get_nb_frames(aPacket->packet,
aPacket->bytes);
if (frames_number <= 0)
return NS_ERROR_FAILURE; // Invalid packet header.
int32_t samples = opus_packet_get_samples_per_frame(aPacket->packet,
(opus_int32) mOpusState->mRate);
int32_t frames = frames_number*samples;
if (frames <= 0)
// A valid Opus packet must be between 2.5 and 120 ms long.
if (frames < 120 || frames > 5760)
return NS_ERROR_FAILURE;
uint32_t channels = mOpusState->mChannels;
nsAutoArrayPtr<AudioDataValue> buffer(new AudioDataValue[frames * channels]);

Просмотреть файл

@ -351,7 +351,10 @@ XBLEnumerate(JSContext *cx, JS::Handle<JSObject*> obj)
return protoBinding->ResolveAllFields(cx, obj);
}
nsXBLJSClass::nsXBLJSClass(const nsAFlatCString& aClassName)
uint64_t nsXBLJSClass::sIdCount = 0;
nsXBLJSClass::nsXBLJSClass(const nsAFlatCString& aClassName,
const nsCString& aKey)
{
memset(this, 0, sizeof(nsXBLJSClass));
next = prev = static_cast<JSCList*>(this);
@ -367,6 +370,7 @@ nsXBLJSClass::nsXBLJSClass(const nsAFlatCString& aClassName)
resolve = (JSResolveOp)XBLResolve;
convert = ::JS_ConvertStub;
finalize = XBLFinalize;
mKey = aKey;
}
nsrefcnt
@ -376,8 +380,9 @@ nsXBLJSClass::Destroy()
"referenced nsXBLJSClass is on LRU list already!?");
if (nsXBLService::gClassTable) {
nsCStringKey key(name);
nsCStringKey key(mKey);
(nsXBLService::gClassTable)->Remove(&key);
mKey.Truncate();
}
if (nsXBLService::gClassLRUListLength >= nsXBLService::gClassLRUListQuota) {
@ -1358,11 +1363,12 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
{
// First ensure our JS class is initialized.
nsAutoCString className(aClassName);
nsAutoCString xblKey(aClassName);
JSObject* parent_proto = nullptr; // If we have an "obj" we can set this
JSAutoRequest ar(cx);
JSAutoCompartment ac(cx, global);
nsXBLJSClass* c = nullptr;
if (obj) {
// Retrieve the current prototype of obj.
if (!JS_GetPrototype(cx, obj, &parent_proto)) {
@ -1370,7 +1376,7 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
}
if (parent_proto) {
// We need to create a unique classname based on aClassName and
// parent_proto. Append a space (an invalid URI character) to ensure that
// id. Append a space (an invalid URI character) to ensure that
// we don't have accidental collisions with the case when parent_proto is
// null and aClassName ends in some bizarre numbers (yeah, it's unlikely).
jsid parent_proto_id;
@ -1384,8 +1390,23 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
// string representation of what we're printing does not fit in the buffer
// provided).
char buf[20];
PR_snprintf(buf, sizeof(buf), " %lx", parent_proto_id);
className.Append(buf);
if (sizeof(jsid) == 4) {
PR_snprintf(buf, sizeof(buf), " %lx", parent_proto_id);
} else {
MOZ_ASSERT(sizeof(jsid) == 8);
PR_snprintf(buf, sizeof(buf), " %llx", parent_proto_id);
}
xblKey.Append(buf);
nsCStringKey key(xblKey);
c = static_cast<nsXBLJSClass*>(nsXBLService::gClassTable->Get(&key));
if (c) {
className.Assign(c->name);
} else {
char buf[20];
PR_snprintf(buf, sizeof(buf), " %llx", nsXBLJSClass::NewId());
className.Append(buf);
}
}
}
@ -1395,14 +1416,11 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
JSVAL_IS_PRIMITIVE(val)) {
// We need to initialize the class.
nsXBLJSClass* c;
void* classObject;
nsCStringKey key(className);
classObject = (nsXBLService::gClassTable)->Get(&key);
if (classObject) {
c = static_cast<nsXBLJSClass*>(classObject);
nsCStringKey key(xblKey);
if (!c) {
c = static_cast<nsXBLJSClass*>(nsXBLService::gClassTable->Get(&key));
}
if (c) {
// If c is on the LRU list (i.e., not linked to itself), remove it now!
JSCList* link = static_cast<JSCList*>(c);
if (c->next != link) {
@ -1412,7 +1430,7 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
} else {
if (JS_CLIST_IS_EMPTY(&nsXBLService::gClassLRUList)) {
// We need to create a struct for this class.
c = new nsXBLJSClass(className);
c = new nsXBLJSClass(className, xblKey);
if (!c)
return NS_ERROR_OUT_OF_MEMORY;
@ -1424,12 +1442,13 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
// Remove any mapping from the old name to the class struct.
c = static_cast<nsXBLJSClass*>(lru);
nsCStringKey oldKey(c->name);
nsCStringKey oldKey(c->Key());
(nsXBLService::gClassTable)->Remove(&oldKey);
// Change the class name and we're done.
nsMemory::Free((void*) c->name);
c->name = ToNewCString(className);
c->SetKey(xblKey);
}
// Add c to our table.

Просмотреть файл

@ -131,12 +131,19 @@ class nsXBLJSClass : public JSCList, public JSClass
{
private:
nsrefcnt mRefCnt;
nsCString mKey;
static uint64_t sIdCount;
nsrefcnt Destroy();
public:
nsXBLJSClass(const nsAFlatCString& aClassName);
nsXBLJSClass(const nsAFlatCString& aClassName, const nsCString& aKey);
~nsXBLJSClass() { nsMemory::Free((void*) name); }
static uint64_t NewId() { return ++sIdCount; }
nsCString& Key() { return mKey; }
void SetKey(const nsCString& aKey) { mKey = aKey; }
nsrefcnt Hold() { return ++mRefCnt; }
nsrefcnt Drop() { return --mRefCnt ? mRefCnt : Destroy(); }
};

Просмотреть файл

@ -0,0 +1,11 @@
<!DOCTYPE html>
<script>
var xhr = new XMLHttpRequest;
function f() {
var x = xhr.getResponseHeader;
x("abc");
}
for (var i = 0; i < 20000; ++i) {
try { f(); } catch (e) {}
}
</script>

Просмотреть файл

@ -0,0 +1,8 @@
<!DOCTYPE html>
<script>
var l = document.getElementsByTagName("*");
var count = 20000;
for (var i = 0; i < count; ++i) {
l.item(0);
}
</script>

Просмотреть файл

@ -1 +1,3 @@
asserts-if(cocoaWidget,0-1) load 769464.html
load 822340-1.html
load 822340-2.html

Просмотреть файл

@ -2919,10 +2919,18 @@ nsPluginHost::ReadPluginInfo()
if (!reader.NextLine())
return rv;
const char *description = reader.LinePtr();
char *description = reader.LinePtr();
if (!reader.NextLine())
return rv;
#if MOZ_WIDGET_ANDROID
// Flash on Android does not populate the version field, but it is tacked on to the description.
// For example, "Shockwave Flash 11.1 r115"
if (PL_strncmp("Shockwave Flash ", description, 16) == 0 && description[16]) {
version = &description[16];
}
#endif
const char *name = reader.LinePtr();
if (!reader.NextLine())
return rv;

Просмотреть файл

@ -9,6 +9,7 @@
#include "jsfriendapi.h"
#include "js/Vector.h"
#include "mozilla/Util.h"
#include "nsAutoJSValHolder.h"
#include "Events.h"
#include "EventTarget.h"
@ -331,7 +332,12 @@ EventListenerManager::DispatchEvent(JSContext* aCx, const EventTarget& aTarget,
}
ContextAllocPolicy ap(aCx);
js::Vector<JSObject*, 10, ContextAllocPolicy> listeners(ap);
// XXXbent There is no reason to use nsAutoJSValHolder here as we should be
// able to use js::AutoValueVector. Worse, nsAutoJSValHolder is much
// slower. However, js::AutoValueVector causes crashes on Android at
// the moment so we don't have much choice.
js::Vector<nsAutoJSValHolder, 10, ContextAllocPolicy> listeners(ap);
for (PRCList* elem = PR_NEXT_LINK(&collection->mListenerHead);
elem != &collection->mListenerHead;
@ -340,10 +346,19 @@ EventListenerManager::DispatchEvent(JSContext* aCx, const EventTarget& aTarget,
// Listeners that don't want untrusted events will be skipped if this is an
// untrusted event.
if ((eventIsTrusted || listenerData->mWantsUntrusted) &&
!listeners.append(listenerData->mListener)) {
aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
return false;
if (eventIsTrusted || listenerData->mWantsUntrusted) {
nsAutoJSValHolder holder;
if (!holder.Hold(aCx)) {
aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
return false;
}
holder = listenerData->mListener;
if (!listeners.append(holder)) {
aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
return false;
}
}
}
@ -364,7 +379,7 @@ EventListenerManager::DispatchEvent(JSContext* aCx, const EventTarget& aTarget,
// out of memory or the operation callback has indicated that we should
// stop running.
jsval listenerVal = OBJECT_TO_JSVAL(listeners[index]);
jsval listenerVal = listeners[index];
JSObject* listenerObj;
if (!JS_ValueToObject(aCx, listenerVal, &listenerObj)) {

Просмотреть файл

@ -731,13 +731,23 @@ void nsCARenderer::SetBounds(int aWidth, int aHeight) {
affineTransform.ty = ((double)aHeight)/mContentsScaleFactor;
[layer setAffineTransform:affineTransform];
if ([layer respondsToSelector:@selector(setContentsScale:)]) {
// For reasons that aren't clear (perhaps one or more OS bugs), OOP
// Core Graphics plugins (ones that use CGBridgeLayer) can only use
// HiDPI mode if the tree is built with the 10.7 SDK or up.
// For reasons that aren't clear (perhaps one or more OS bugs), if layer
// belongs to a subclass of CALayer we can only use full HiDPI resolution
// here if the tree is built with the 10.7 SDK or up: If we change
// layer.contentsScale (even to the same value), layer simply stops
// working (goes blank). And even if we're building with the 10.7 SDK,
// we can't use full HiDPI resolution if layer belongs to CAOpenGLLayer
// or a subclass: Changing layer.contentsScale to values higher than
// 1.0 makes it display only in the lower left part of its "box".
// We use CGBridgeLayer (a subclass of CALayer) to implement CoreGraphics
// mode for OOP plugins. Shockwave uses a subclass of CAOpenGLLayer
// (SWRenderer) to implement CoreAnimation mode. The SlingPlayer plugin
// uses another subclass of CAOpenGLLayer (CoreAnimationLayer).
#if !defined(MAC_OS_X_VERSION_10_7) || \
MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7
Class CGBridgeLayerClass = ::NSClassFromString(@"CGBridgeLayer");
if (!CGBridgeLayerClass || ![layer isKindOfClass:CGBridgeLayerClass])
if ([layer isMemberOfClass:[CALayer class]])
#else
if (![layer isKindOfClass:[CAOpenGLLayer class]])
#endif
{
layer.contentsScale = mContentsScaleFactor;
@ -751,8 +761,9 @@ void nsCARenderer::SetBounds(int aWidth, int aHeight) {
if ([layer respondsToSelector:@selector(setContentsScale:)]) {
#if !defined(MAC_OS_X_VERSION_10_7) || \
MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7
Class CGBridgeLayerClass = ::NSClassFromString(@"CGBridgeLayer");
if (!CGBridgeLayerClass || ![layer isKindOfClass:CGBridgeLayerClass])
if ([layer isMemberOfClass:[CALayer class]])
#else
if (![layer isKindOfClass:[CAOpenGLLayer class]])
#endif
{
layer.contentsScale = 1.0;

Просмотреть файл

@ -5567,66 +5567,6 @@ TestShouldDOMCall(JSContext *cx, types::TypeSet *inTypes, HandleFunction func,
return true;
}
static bool
TestAreKnownDOMTypes(JSContext *cx, types::TypeSet *inTypes)
{
if (inTypes->unknown())
return false;
// First iterate to make sure they all are DOM objects, then freeze all of
// them as such if they are.
for (unsigned i = 0; i < inTypes->getObjectCount(); i++) {
types::TypeObject *curType = inTypes->getTypeObject(i);
if (!curType) {
JSObject *curObj = inTypes->getSingleObject(i);
// Skip holes in TypeSets.
if (!curObj)
continue;
curType = curObj->getType(cx);
}
if (curType->unknownProperties())
return false;
// Unlike TypeSet::HasObjectFlags, TypeObject::hasAnyFlags doesn't add a
// freeze.
if (curType->hasAnyFlags(types::OBJECT_FLAG_NON_DOM))
return false;
}
// If we didn't check anything, no reason to say yes.
if (inTypes->getObjectCount() > 0)
return true;
return false;
}
static void
FreezeDOMTypes(JSContext *cx, types::StackTypeSet *inTypes)
{
for (unsigned i = 0; i < inTypes->getObjectCount(); i++) {
types::TypeObject *curType = inTypes->getTypeObject(i);
if (!curType) {
JSObject *curObj = inTypes->getSingleObject(i);
// Skip holes in TypeSets.
if (!curObj)
continue;
curType = curObj->getType(cx);
}
// Add freeze by asking the question.
DebugOnly<bool> wasntDOM =
types::HeapTypeSet::HasObjectFlags(cx, curType, types::OBJECT_FLAG_NON_DOM);
JS_ASSERT(!wasntDOM);
}
}
bool
IonBuilder::annotateGetPropertyCache(JSContext *cx, MDefinition *obj, MGetPropertyCache *getPropCache,
types::StackTypeSet *objTypes, types::StackTypeSet *pushedTypes)
@ -5835,15 +5775,6 @@ IonBuilder::jsop_getprop(HandlePropertyName name)
MConstant *known = MConstant::New(ObjectValue(*singleton));
current->add(known);
current->push(known);
if (singleton->isFunction()) {
RootedFunction singletonFunc(cx, singleton->toFunction());
if (TestAreKnownDOMTypes(cx, unaryTypes.inTypes) &&
TestShouldDOMCall(cx, unaryTypes.inTypes, singletonFunc, JSJitInfo::Method))
{
FreezeDOMTypes(cx, unaryTypes.inTypes);
known->setDOMFunction();
}
}
return true;
}
}

Просмотреть файл

@ -18,7 +18,8 @@
class nsAutoJSValHolder
{
public:
nsAutoJSValHolder() : mVal(JSVAL_NULL), mRt(nullptr)
nsAutoJSValHolder()
: mVal(JSVAL_NULL), mRt(nullptr)
{
// nothing to do
}
@ -30,7 +31,9 @@ public:
Release();
}
nsAutoJSValHolder(const nsAutoJSValHolder& aOther) {
nsAutoJSValHolder(const nsAutoJSValHolder& aOther)
: mVal(JSVAL_NULL), mRt(nullptr)
{
*this = aOther;
}

Просмотреть файл

@ -1,14 +0,0 @@
<!DOCTYPE HTML>
<title>Distributing widths from spanning cells to empty columns</title>
<table cellpadding="0" cellspacing="0" width="75">
<tr>
<td width="25" bgcolor="yellow" >&nbsp;</td>
<td width="25" bgcolor="aqua" >&nbsp;</td>
<td width="25" bgcolor="aqua" >&nbsp;</td>
</tr>
<tr>
<td width="25" bgcolor="fuchsia">&nbsp;</td>
<td width="25" bgcolor="fuchsia">&nbsp;</td>
<td width="25" bgcolor="yellow" >&nbsp;</td>
</tr>
</table>

Просмотреть файл

@ -1,12 +0,0 @@
<!DOCTYPE HTML>
<title>Distributing widths from spanning cells to empty columns</title>
<table cellpadding="0" cellspacing="0">
<tr>
<td width="25" bgcolor="yellow" >&nbsp;</td>
<td width="50" colspan="2" bgcolor="aqua" >&nbsp;</td>
</tr>
<tr>
<td width="50" colspan="2" bgcolor="fuchsia">&nbsp;</td>
<td width="25" bgcolor="yellow" >&nbsp;</td>
</tr>
</table>

Просмотреть файл

@ -1,12 +0,0 @@
<!DOCTYPE HTML>
<title>Distributing widths from spanning cells to empty columns</title>
<table cellpadding="0" cellspacing="0" width="75">
<tr>
<td width="25" bgcolor="yellow" >&nbsp;</td>
<td width="50" colspan="2" bgcolor="aqua" >&nbsp;</td>
</tr>
<tr>
<td width="50" colspan="2" bgcolor="fuchsia">&nbsp;</td>
<td width="25" bgcolor="yellow" >&nbsp;</td>
</tr>
</table>

Просмотреть файл

@ -1,13 +0,0 @@
<!DOCTYPE html>
<table width="250" cellpadding="0" border="0" cellspacing="0">
<tr>
<td width="50" bgcolor=yellow>50
<td width="180" bgcolor=aqua>This is a cell with enough text in it to wrap.
<td width="20" bgcolor=lime><span style="display:inline-block"></span>
</table>
<table width="250" cellpadding="0" border="0" cellspacing="0">
<tr>
<td width="180" bgcolor=fuchsia>This is a cell with enough text in it to wrap.
<td width="50" bgcolor=yellow>50
<td width="20" bgcolor=lime><span style="display:inline-block"></span>
</table>

Просмотреть файл

@ -1,11 +0,0 @@
<!DOCTYPE html>
<table width="250" cellpadding="0" border="0" cellspacing="0">
<tr>
<td width="50" bgcolor=yellow>50
<td colspan="2" bgcolor=aqua>This is a cell with enough text in it to wrap.
<td bgcolor=lime><span style="display:inline-block; width: 20px"></span>
<tr>
<td colspan="2" bgcolor=fuchsia>This is a cell with enough text in it to wrap.
<td width="50" bgcolor=yellow>50
<td bgcolor=lime><span style="display:inline-block; width: 20px"></span>
</table>

Просмотреть файл

@ -60,6 +60,3 @@ fails == default-box-sizing-collapse-quirks.html default-box-sizing-collapse-qui
== colgroup-vs-column-4.html colgroup-vs-column-4-ref.html
== dynamic-fixed-layout-1.html dynamic-fixed-layout-1-ref.html
== cell-pref-width-border-box.html cell-pref-width-border-box-ref.html
== colspan-distribute-to-empty-1a.html colspan-distribute-to-empty-1-ref.html
== colspan-distribute-to-empty-1b.html colspan-distribute-to-empty-1-ref.html
== colspan-distribute-to-empty-2.html colspan-distribute-to-empty-2-ref.html

Просмотреть файл

@ -700,10 +700,10 @@ BasicTableLayoutStrategy::DistributeWidthToColumns(nscoord aWidth,
* percent width have nonzero pref width, in proportion to pref
* width [total_flex_pref]
*
* b. otherwise, if any columns without a specified coordinate
* width or percent width, but with cells originating in them,
* have zero pref width, equally between these
* [numNonSpecZeroWidthCols]
* b. (NOTE: this case is for BTLS_FINAL_WIDTH only) otherwise, if
* any columns without a specified coordinate width or percent
* width, but with cells originating in them have zero pref width,
* equally between these [numNonSpecZeroWidthCols]
*
* c. otherwise, if any columns without percent width have nonzero
* pref width, in proportion to pref width [total_fixed_pref]
@ -761,7 +761,8 @@ BasicTableLayoutStrategy::DistributeWidthToColumns(nscoord aWidth,
total_fixed_pref = NSCoordSaturatingAdd(total_fixed_pref,
pref_width);
} else if (pref_width == 0) {
if (cellMap->GetNumCellsOriginatingInCol(col) > 0) {
if (aWidthType == BTLS_FINAL_WIDTH &&
cellMap->GetNumCellsOriginatingInCol(col) > 0) {
++numNonSpecZeroWidthCols;
}
} else {
@ -822,6 +823,9 @@ BasicTableLayoutStrategy::DistributeWidthToColumns(nscoord aWidth,
l2t = FLEX_FLEX_LARGE;
basis.c = total_flex_pref;
} else if (numNonSpecZeroWidthCols > 0) {
NS_ASSERTION(aWidthType == BTLS_FINAL_WIDTH,
"numNonSpecZeroWidthCols should only "
"be set when we're setting final width.");
l2t = FLEX_FLEX_LARGE_ZERO;
basis.c = numNonSpecZeroWidthCols;
} else if (total_fixed_pref > 0) {
@ -951,6 +955,9 @@ BasicTableLayoutStrategy::DistributeWidthToColumns(nscoord aWidth,
}
break;
case FLEX_FLEX_LARGE_ZERO:
NS_ASSERTION(aWidthType == BTLS_FINAL_WIDTH,
"FLEX_FLEX_LARGE_ZERO only should be hit "
"when we're setting final width.");
if (pct == 0.0f &&
!colFrame->GetHasSpecifiedCoord() &&
cellMap->GetNumCellsOriginatingInCol(col) > 0) {

Просмотреть файл

@ -147,8 +147,8 @@ abstract public class BrowserApp extends GeckoApp
@Override
void handleClearHistory() {
updateAboutHomeTopSites();
super.handleClearHistory();
updateAboutHomeTopSites();
}
@Override

Просмотреть файл

@ -10,7 +10,7 @@ import android.app.AlarmManager;
public class AnnouncementsConstants {
// Not `final` so we have the option to turn this on at runtime with a magic addon.
public static boolean DISABLED = true;
public static boolean DISABLED = false;
public static final String GLOBAL_LOG_TAG = "GeckoAnnounce";
public static final String ACTION_ANNOUNCEMENTS_PREF = "org.mozilla.gecko.ANNOUNCEMENTS_PREF";

Просмотреть файл

@ -495,6 +495,29 @@ nsPACMan::ProcessPendingQ()
mPAC.Shutdown();
}
// this is to workaround bug 815783 and is not a general
// purpose solution. It is intended to only be applied to gecko 18
static nsresult
WorkaroundFileLocalhostURL(nsACString &aURI)
{
// only deal with file://
if (!StringBeginsWith(aURI, NS_LITERAL_CSTRING("file://")))
return NS_OK;
// file://localhost/foo -> file:///foo
if (StringBeginsWith(aURI, NS_LITERAL_CSTRING("file://localhost/"))) {
aURI.Replace(0, 17, NS_LITERAL_CSTRING("file:///"));
return NS_OK;
}
// file://?:/foo -> file:///foo
if (aURI.Length() >= 10 && aURI.CharAt(8) == ':' && aURI.CharAt(9) == '/') {
aURI.Replace(0, 10, NS_LITERAL_CSTRING("file:///"));
}
return NS_OK;
}
// returns true if progress was made by shortening the queue
bool
nsPACMan::ProcessPending()
@ -523,6 +546,7 @@ nsPACMan::ProcessPending()
if (mSystemProxySettings &&
NS_SUCCEEDED(mSystemProxySettings->GetPACURI(PACURI)) &&
!PACURI.IsEmpty() &&
NS_SUCCEEDED(WorkaroundFileLocalhostURL(PACURI)) && // bug 815783 for Gecko 18 only
!PACURI.Equals(mPACURISpec)) {
query->UseAlternatePACFile(PACURI);
completed = true;