3 files changed, 138 insertions, 1 deletions

diff --git a/www/firefox/Makefile b/www/firefox/Makefile
index 69f1b8ebf085..d8d9982ac569 100644
--- a/www/firefox/Makefile
+++ b/www/firefox/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	firefox
 DISTVERSION=	86.0
-PORTREVISION=	2
+PORTREVISION=	3
 PORTEPOCH=	2
 CATEGORIES=	www
 MASTER_SITES=	MOZILLA/${PORTNAME}/releases/${DISTVERSION}/source \
diff --git a/www/firefox/files/patch-bug1694670 b/www/firefox/files/patch-bug1694670
new file mode 100644
index 000000000000..7f5773b38b0e
--- /dev/null
+++ b/www/firefox/files/patch-bug1694670
@@ -0,0 +1,22 @@
+diff --git gfx/qcms/src/iccread.rs gfx/qcms/src/iccread.rs
+--- gfx/qcms/src/iccread.rs
++++ gfx/qcms/src/iccread.rs
+@@ -229,7 +229,7 @@
+     read_u16(mem, offset)
+ }
+ pub fn write_u32(mem: &mut [u8], offset: usize, value: u32) {
+-    if offset <= mem.len() - std::mem::size_of_val(&value) {
++    if offset > mem.len() - std::mem::size_of_val(&value) {
+         panic!("OOB");
+     }
+     let mem = mem.as_mut_ptr();
+@@ -238,7 +238,7 @@
+     }
+ }
+ pub fn write_u16(mem: &mut [u8], offset: usize, value: u16) {
+-    if offset <= mem.len() - std::mem::size_of_val(&value) {
++    if offset > mem.len() - std::mem::size_of_val(&value) {
+         panic!("OOB");
+     }
+     let mem = mem.as_mut_ptr();
+
diff --git a/www/firefox/files/patch-bug1694699 b/www/firefox/files/patch-bug1694699
new file mode 100644
index 000000000000..b7ff6a00cd81
--- /dev/null
+++ b/www/firefox/files/patch-bug1694699
@@ -0,0 +1,115 @@
+diff --git browser/components/extensions/parent/ext-tabs.js browser/components/extensions/parent/ext-tabs.js
+--- browser/components/extensions/parent/ext-tabs.js
++++ browser/components/extensions/parent/ext-tabs.js
+@@ -217,9 +217,13 @@
+       function sanitize(tab, changeInfo) {
+         let result = {};
+         let nonempty = false;
+-        const hasTabs = tab.hasTabPermission;
+         for (let prop in changeInfo) {
+-          if (hasTabs || !restricted.has(prop)) {
++          // In practice, changeInfo contains at most one property from
++          // restricted. Therefore it is not necessary to cache the value
++          // of tab.hasTabPermission outside the loop.
++          // Unnecessarily accessing tab.hasTabPermission can cause bugs, see
++          // https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
++          if (!restricted.has(prop) || tab.hasTabPermission) {
+             nonempty = true;
+             result[prop] = changeInfo[prop];
+           }
+diff --git browser/components/extensions/test/browser/browser_ext_tabs_hide.js browser/components/extensions/test/browser/browser_ext_tabs_hide.js
+--- browser/components/extensions/test/browser/browser_ext_tabs_hide.js
++++ browser/components/extensions/test/browser/browser_ext_tabs_hide.js
+@@ -349,6 +349,7 @@
+       if ("hidden" in changeInfo) {
+         browser.test.assertEq(tabId, testTab.id, "correct tab was hidden");
+         browser.test.assertTrue(changeInfo.hidden, "tab is hidden");
++        browser.test.assertEq(tab.url, testTab.url, "tab has correct URL");
+         browser.test.sendMessage("changeInfo");
+       }
+     });
+diff --git browser/components/extensions/test/browser/browser_ext_tabs_move_discarded.js browser/components/extensions/test/browser/browser_ext_tabs_move_discarded.js
+--- browser/components/extensions/test/browser/browser_ext_tabs_move_discarded.js
++++ browser/components/extensions/test/browser/browser_ext_tabs_move_discarded.js
+@@ -2,7 +2,7 @@
+ /* vim: set sts=2 sw=2 et tw=80: */
+ "use strict";
+ 
+-add_task(async function() {
++add_task(async function move_discarded_to_window() {
+   let extension = ExtensionTestUtils.loadExtension({
+     manifest: { permissions: ["tabs"] },
+     background: async function() {
+@@ -29,3 +29,54 @@
+   await extension.awaitFinish("tabs.move");
+   await extension.unload();
+ });
++
++add_task(async function move_hidden_discarded_to_window() {
++  let extensionWithoutTabsPermission = ExtensionTestUtils.loadExtension({
++    manifest: {
++      permissions: ["http://example.com/"],
++    },
++    background() {
++      browser.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {
++        if (changeInfo.hidden) {
++          browser.test.assertEq(
++            tab.url,
++            "http://example.com/?hideme",
++            "tab.url is correctly observed without tabs permission"
++          );
++          browser.test.sendMessage("onUpdated_checked");
++        }
++      });
++    },
++  });
++  await extensionWithoutTabsPermission.startup();
++
++  let extension = ExtensionTestUtils.loadExtension({
++    manifest: { permissions: ["tabs", "tabHide"] },
++    // ExtensionControlledPopup's populateDescription method requires an addon:
++    useAddonManager: "temporary",
++    async background() {
++      let url = "http://example.com/?hideme";
++      let tab = await browser.tabs.create({ url, discarded: true });
++      await browser.tabs.hide(tab.id);
++
++      let { id: windowId } = await browser.windows.create();
++
++      // Move the tab into that window
++      [tab] = await browser.tabs.move(tab.id, { windowId, index: -1 });
++      browser.test.assertTrue(tab.discarded, "Tab should still be discarded");
++      browser.test.assertTrue(tab.hidden, "Tab should still be hidden");
++      browser.test.assertEq(url, tab.url, "Tab URL should still be correct");
++
++      await browser.windows.remove(windowId);
++      browser.test.notifyPass("move_hidden_discarded_to_window");
++    },
++  });
++
++  await extension.startup();
++  await extension.awaitFinish("move_hidden_discarded_to_window");
++  await extension.unload();
++
++  await extensionWithoutTabsPermission.awaitMessage("onUpdated_checked");
++  await extensionWithoutTabsPermission.awaitMessage("onUpdated_checked");
++  await extensionWithoutTabsPermission.unload();
++});
+diff --git mobile/android/components/extensions/ext-tabs.js mobile/android/components/extensions/ext-tabs.js
+--- mobile/android/components/extensions/ext-tabs.js
++++ mobile/android/components/extensions/ext-tabs.js
+@@ -233,9 +233,11 @@
+             function sanitize(tab, changeInfo) {
+               const result = {};
+               let nonempty = false;
+-              const hasTabs = tab.hasTabPermission;
+               for (const prop in changeInfo) {
+-                if (hasTabs || !restricted.includes(prop)) {
++                // In practice, changeInfo contains at most one property from
++                // restricted. Therefore it is not necessary to cache the value
++                // of tab.hasTabPermission outside the loop.
++                if (!restricted.includes(prop) || tab.hasTabPermission) {
+                   nonempty = true;
+                   result[prop] = changeInfo[prop];
+                 }
+