This patch disables device sensors except orientation by default.
It implements per-sensor prefs to disable orientation, motion, proximity and ambient light
selectively. The patch also makes the pref checks happen at runtime (versus on process
start) using Preferences::AddBoolVarCache.
The patch also removes the related Event constructors also.
MozReview-Commit-ID: EA8ARjjtlkF
--HG--
rename : dom/events/test/test_bug742376.html => dom/events/test/test_deviceSensor.html
rename : dom/events/test/test_eventctors.html => dom/events/test/test_disabled_events.html
rename : dom/events/test/test_eventctors.html => dom/events/test/test_eventctors_sensors.html
extra : rebase_source : 39da98ac9226ac727f5197d28561b0b762da06f4
The change in browser_net_view-source-debugger.js is needed because we now use WebIDL callbacks for MessageListener, and they add async creation stack frames.
--HG--
extra : rebase_source : d7c026d8a77634ef2566feba78168beb8a66a552
This is particularly useful for knowing when it's safe to query for style and
layout information for a window without causing a synchronous style or layout
flush.
Note that promiseDocumentFlushed was chosen over promiseDidRefresh or promiseRefreshed
to avoid potential confusion with the actual network-level refresh of browsers or
documents.
MozReview-Commit-ID: Am3G9yvSgdN
--HG--
extra : rebase_source : 20bdd2d6f624767d919d95a6601fc1c890aadf10
This is particularly useful for knowing when it's safe to query for style and
layout information for a window without causing a synchronous style or layout
flush.
Note that promiseDocumentFlushed was chosen over promiseDidRefresh or promiseRefreshed
to avoid potential confusion with the actual network-level refresh of browsers or
documents.
MozReview-Commit-ID: Am3G9yvSgdN
--HG--
extra : rebase_source : 20bdd2d6f624767d919d95a6601fc1c890aadf10
When native key event is handled by IME, we should set keyCode to 0xE5 (229,
VK_PROCESS of virtual keycode of Windows) for behaving same as the other
browsers.
This patch declares it same as other keyCode values.
MozReview-Commit-ID: 666bB1qOEgv
--HG--
extra : rebase_source : 063df635c13a416a6d89050ac45c7803a163ede0
This is particularly useful for knowing when it's safe to query for style and
layout information for a window without causing a synchronous style or layout
flush.
Note that promiseDocumentFlushed was chosen over promiseDidRefresh or promiseRefreshed
to avoid potential confusion with the actual network-level refresh of browsers or
documents.
MozReview-Commit-ID: Am3G9yvSgdN
--HG--
extra : rebase_source : 5e502d5d077dd764ca1a43e7c3f06855858fe735
During a frame swap (using the `swapFrameLoaders` API on a frame loader owner),
we dispatch `pagehide` events before swapping and `pageshow` events after
swapping.
For some consumers that watch these events (such as DevTools), it would be
helpful to filter out the ones that sent because of frame swapping. This change
adds a chrome-only `inFrameSwap` property to such events so that we can tell
them apart.
MozReview-Commit-ID: QzIDuaF2zC
--HG--
extra : rebase_source : 3ac15e34c18b648c4cb060e69587e39e4ebaab60
KeyframeEffect and KeyframeEffectReadOnly constructors can run in the caller
compartment, which is okay because the current compartment is used in the
following places and all of them are safe:
1. GlobalObject::CallerType(), that is ultimately passed to
nsDocument::IsWebAnimationsEnabled in KeyframeEffectParamsFromUnion,
to decide whether to copy mIterationComposite/mComposite to
KeyframeEffectParams.
GlobalObject::CallerType() can now be different than the target window's one,
if the caller has the system principal and the target is web content, and
in that case nsDocument::IsWebAnimationsEnabled there always returns true
while Web Animations can be disabled on web content.
honoring the mIterationComposite/mComposite properties is OK, since it just
changes the animation behavior, and this is disabled by default until
remaining spec issues are resolved.
2. GlobalObject::Context(), that is ultimately passed to
KeyframeUtils::GetKeyframesFromObject and used while extracting information
from passed-in keyframe object, with iterable/iterator protocols.
Performing that operation in the caller side is okay, since the same thing
can be done on caller, and the operation doesn't perform any GCThing
allocation on the target window global.
KeyframeEffect and KeyframeEffectReadOnly constructors can run in the caller
compartment, which is okay because of the following reasons:
1. The target window global is used for most operation:
* KeyframeEffectReadOnly::ConstructKeyframeEffect uses the target window
global instead of current global.
* KeyframeEffectParamsFromUnion which receives `aGlobal.CallerType()`
In Xray case, Web Animations API can be disabled on web content
(currently disabled on beta/release by default), and in that case some API
won't work even it's triggered from WebExtensions, but it should be fine.
2. GetKeyframesFromObject is executed in the caller's compartment to access
the passed-in JSObject that is keyframe, with iterable/iterator protocols.
This operation doesn't perform any GCThing allocation on the target window
global.
This is the IDL added to the Web Animations specification:
5af5e276ba
Note that some of the changes in the above commit were reverted in the following
commit:
673f6fc126
A folded version of the changes:
https://gist.github.com/birtles/d147eb2e0e2d4d37fadf217abd709411
MozReview-Commit-ID: CJV7bzizXg4
--HG--
extra : rebase_source : 3b168e779883ba91c8f572478185b55013952d1a
These are cases that are implementing the "convert an exception to a Promise"
steps of the Web IDL spec. Typically the exception is thrown in the current
compartment; the Promise returned should simply match that. Otherwise we can
end up with a situation in which the promise doesn't actaully have access to
its rejection value, which will cause problems if someone uses then() on the
promise: the return value of the then() call will get a sanitized exception
instead of the real one.
We _could_ try to match the actual compartment of the exception, in theory.
But it's not clear why this would be preferable to using the current
compartment, even if there were cases in which the exception _doesn't_ match
the current compartment. Which there likely are not.
MozReview-Commit-ID: Ac2BHIHxfvY
--HG--
rename : dom/promise/tests/test_promise_argument.html => dom/promise/tests/test_promise_retval.html
rename : dom/promise/tests/test_promise_argument_xrays.html => dom/promise/tests/test_promise_retval_xrays.html
nsIDOMWindowUtils::sendKeyEvent() is already replaced with nsITextInputProcessor
for making callers set any attributes of KeyboardEvent and guaranteeing
consistency behavior with keyboard events caused by native key events. E.g.,
whether keypress event should be dispatched or not is automatically decided.
nsIFrameLoader::sendCrossProcessKeyEvent() is similart to
nsIDOMWindowUtils::sendKeyEvent() but it dispatches keyboard events in
child process directly. Currently, nsITextInputProcessor doesn't have this
feature but nobody wants/uses this feature. So, for removing actual
implementation of nsIDOMWindowUtils::sendKeyEvent(), i.e.,
nsContentUtils::SendKeyEvent(), which is shared by both
nsDOMWindowUtils::SendKeyEvent() and nsFrameLoader::SendCrossProcessKeyEvent(),
we should remove this unused API too. (FYI: it's implemented for old Fennec,
by bug 553149.)
MozReview-Commit-ID: 9n0UVo8Me8k
--HG--
extra : rebase_source : e9b117f5b9afec76e63d57ab8cd86dafb5873789
This is the IDL added to the Web Animations specification:
5af5e276ba
Note that some of the changes in the above commit were reverted in the following
commit:
673f6fc126
A folded version of the changes:
https://gist.github.com/birtles/d147eb2e0e2d4d37fadf217abd709411
MozReview-Commit-ID: CJV7bzizXg4
--HG--
extra : rebase_source : 6dc6819e158bcdd094962769096a17da6cd2026a
Summary:
This only adds the new WebIDL types but doesn't do any plumbing yet.
Bug 1406471 seems to be better suited for that.
Reviewers: jcj
Reviewed By: jcj
Bug #: 1406458
Differential Revision: https://phabricator.services.mozilla.com/D555
It's doing casts that are bogus. We can do the same thing (only needed for
tests anyway) via a chromeonly API on DOMRequest.
MozReview-Commit-ID: 1FUPGMhBU3k
componentId is a moz only field that will allow sorting by componentId
on the about:webrtc page.
MozReview-Commit-ID: HXEQl3JHmO3
--HG--
extra : rebase_source : 1629fc0fc34b4878e398753db933d0f10c83b67b
PeerConnectionImpl defines two versions of various fallible methods: a version
taking an ErrorResult argument, and a version returning nsresult. The methods
were not marked fallible in the webidl, so the bindings called the
nsresult-returning version, but ignored the returned value. As a result,
failures got swallowed instead of being propagated out.
The changes here annotate the relevant parts of the webidl as throwing, and
convert non-fallible methods to returning void to make infallibility clearer.
MozReview-Commit-ID: JU9NzmEf8FV
The "body" part of responsexml-document-properties.htm is not really per current
spec text, and fails in every non-Firefox browser, and in Firefox after this
change. https://github.com/w3c/web-platform-tests/issues/2668 tracks this issue
to some extent, but if all browsers are going to align here anyway, we should
just adjust the test and move on.
MozReview-Commit-ID: HTLfggvi5LL
dom/time contained the TimeService and TimeManager classes, used for
setting time via Gecko on FirefoxOS. Since FirefoxOS is no longer in
the code base, the directory can be removed.
MozReview-Commit-ID: 8PEk3e6HA67
The Web Authentication CollectedClientData is missing the type field, which
is just a simple string. (The editor's draft also removes hashAlgorithm, but
let's not get ahead of ourselves...)
Add in that simple string. This was found at interop testing.
MozReview-Commit-ID: DlawLyHTYhB
--HG--
extra : rebase_source : 6cdd8e14161dc4aea5bfd1baf60c7384219ba951
This is a short-term solution to our inability to apply CSP to
chrome-privileged documents.
Ideally, we should be preventing all inline script execution in
chrome-privileged documents, since the reprecussions of XSS in chrome
documents are much worse than in content documents. Unfortunately, that's not
possible in the near term because a) we don't support CSP in system principal
documents at all, and b) we rely heavily on inline JS in our static XUL.
This stop-gap solution at least prevents some of the most common vectors of
XSS attack, by automatically sanitizing any HTML fragment created for a
chrome-privileged document.
MozReview-Commit-ID: 5w17celRFr
--HG--
extra : rebase_source : 1c0a1448a06d5b65e548d9f5362d06cc6d865dbe
extra : amend_source : 7184593019f238b86fd1e261941d8e8286fa4006
This helper makes it easy to lazily import a JavaScript module the first time
one of its exports is required. It is intended to replace
XPCOMUtils.defineLazyModuleGetter, which has similar functionality but is much
less efficient.
MozReview-Commit-ID: 2zxXYwrn3Dr
--HG--
extra : rebase_source : 998de7388ee03fdec0a0949b4e43bd9169dbb592
extra : histedit_source : 414d0ed1842b2270146d37b2788a56c682d3d695
On the off chance exposing navigator.webdriver turns out
to be catastrophic, this patch introduces a new preference
dom.webdriver.enabled that controls its exposure. This lets us
flip a pref on release without releasing an update.
MozReview-Commit-ID: KisaqPb0Y4V
--HG--
extra : rebase_source : 4000a1d283e70eda988262efc70de801eec3586a
This patch adds an enumerable, configurable, readonly attribute
"webdriver" to the Navigator object. The attribute is true when the
-marionette flag has been passed to Firefox or the marionette.enabled
preference is true. Otherwise it is false.
The definition of the interface is found in the WebDriver standard:
https://w3c.github.io/webdriver/webdriver-spec.html#interface
The navigator.webdriver attribute is meant as an indication to web
authors that a document is visited by WebDriver. It is important
to stress that it is not meant as a fool-proof way to detect that
a website is being visited by a browser automation tool, but as a
tool for web documents to take alternate code paths.
MozReview-Commit-ID: D3qXVKqZG
--HG--
extra : rebase_source : ff6a1c5b281b5888f69aed6ffecee8b63ee81701
Late-breaking rename pre-CR in Web Authentication [1] renamed a dictionary. It's
not an interop issue, really, which must be why it was let through. This is a
WebIDL and Web Platform Tests-only issue. (The WPT updates are happening at
Github [2])
[1] https://github.com/w3c/webauthn/pull/779/files
[2] https://github.com/w3c/web-platform-tests/pull/9237
MozReview-Commit-ID: KEIlqIYbzKp
--HG--
extra : rebase_source : 4204ea62a41f374a6731a9367552af122d354145
The WebAuthn spec lets RPs ask to specifically get direct attestation certificates
during credential creation using the "Attestation Conveyance Preference" [1].
This change adds that field into the WebIDL and ignores it for now. This is
pre-work to Bug #1430150 which will make this useful (which in turn requires
Bug #1416056's support for anonymizing those attestation certificates).
[1] https://www.w3.org/TR/webauthn/#attestation-convey
MozReview-Commit-ID: 763vaAMv48z
--HG--
extra : rebase_source : 7fb7c64a0ee3167032485378af6074a7366295a4
The change in browser_net_view-source-debugger.js is needed because we now use WebIDL callbacks for MessageListener, and they add async creation stack frames.
--HG--
extra : rebase_source : 77672a73a6e1447c763930143116a261f2369e67
There are no consumers of nsITreeBoxObject::SetView, so this fix removes that
setter. There are consumers of GetView, though.
MozReview-Commit-ID: FBEGEFRM9Us
It was neglected to mark navigator.credentials as [SecureContext], yet it
must be for spec compliance and powerful-features compliance.
MozReview-Commit-ID: BYKGqqhoS2L
--HG--
extra : rebase_source : 441be2ae91d51cfff1ed5a8d1e96db4f9a3c917c
Most of the Shadow DOM related code are behind "dom.webcomponents.enabled" and
this pref is only used by Shadow DOM right now, so we should rename it to
"dom.webcomponents.shadowdom.enabled"
MozReview-Commit-ID: er1c7AsSSW
In order to write tests, I would like to create an method that allows chorome js can directly set the user-activation flag.
Therefore, I need to move all these details into nsDocument, then we could easily simulate the user activation.
MozReview-Commit-ID: 5JrCoQc0vF7
--HG--
extra : rebase_source : 256ff2993ef754dc51409e7e444b868a3302bd65
This patch reflects the following change to the Web Animations spec:
abf76745b5
MozReview-Commit-ID: A2GD1igUf5f
--HG--
extra : rebase_source : 8129f6386b144adebc3bf0320ca7d6bfbba7a2e9
This patch makes Firefox to spoof keyboardEvent.code, keyboardEvent.keycode and
modifier states, for 'Shift', 'Alt', 'Control' and 'AltGraph', when 'privacy.resistFingerprinting'
is true. Firefox will spoof keyboard events as a certain keyboard layout according
to the content language of the document, for example, we use US English keyboard for
English content. Right now, it only supports English contents, we will add more
support for more languages later. The spoofing only affects content, chrome
can still see real keyboard events.
MozReview-Commit-ID: 40JPvwLmMMB
--HG--
extra : rebase_source : 870224ba4f87b3e336c5b061ac6859dd1c48c4f2
Henri Sivonen
Jonathan Kingston
Peter Van der Beken
Boris Zbarsky
Mike Conley
Andreea Pavel
Masayuki Nakano
Kyle Machulis
Cosmin Sabou
Ciure Andrei
Tim Taubert
Dorel Luca
Daniel Stenberg
Arthur Edelstein
J. Ryan Stinnett
Tooru Fujisawa
Olli Pettay
Narcis Beleuzu
Jonathan Kew
Brian Birtles
Phil Ringnalda
Xidorn Quan
Andrea Marchesini
Sebastian Hengst
Nils Ohlmeier [:drno]
Byron Campen [:bwc]
Adrian Wielgosik
arthur.iakab
Emilio Cobos Álvarez
Tiberius Oros
shindli
Jonathan Watt
Cameron McCormack
Robert Longson
Michael Froman
J.C. Jones
Ben Kelly
Kris Maglione
Andreas Tolfsen
Brindusan Cristian
Johann Hofmann
Bogdan Tara
Gurzau Raul
Tim Nguyen
Brad Werth
Nico Grunbaum
Jessica Jong
Alastor Wu
Coroiu Cristina
Nika Layzell
Tim Huang