d9d20a240044d71d47748ccd91bd65f8352ebb3b to 866d3373edf96a47c6281fb308e2fbdf1473f640 · The Tor Project / Applications / Mullvad Browser

Commits on Source 24

Bug 1536243 - Use av_mallocz to zero FFmpeg extradata padding. r=media-playback-reviewers,jolin · bb7a7237
Paul Adenot authored Mar 16, 2026 and ma1 committed Apr 20, 2026
```
Differential Revision: https://phabricator.services.mozilla.com/D287605
```
bb7a7237
Bug 1577576: return an error on an invalid frame ID in HTTP2 r=necko-reviewers,valentin · c7482c87
Randell Jesup authored Feb 21, 2026 and ma1 committed Apr 20, 2026
```
Differential Revision: https://phabricator.services.mozilla.com/D284287
```
c7482c87
Bug 1880429, clear source browsing context early, if possible, r=nika · c7543f03
Olli Pettay authored Mar 20, 2025 and ma1 committed Apr 20, 2026
```
Differential Revision: https://phabricator.services.mozilla.com/D242075
```
c7543f03
Bug 1992585 - Set AppLinks intent selector to null. a=diannaS DONTBUILD · 73c76ae2
Roger Yang authored Apr 10, 2026 and ma1 committed Apr 20, 2026
```
Original Revision: https://phabricator.services.mozilla.com/D290907

Differential Revision: https://phabricator.services.mozilla.com/D293455
```
73c76ae2
Bug 2010310 - Add CanNavigate() check in RecvLoadURI() and RecvInternalLoad(), r=smaug,tschuster · 7554aaab
Artur Iunusov authored Mar 05, 2026 and ma1 committed Apr 20, 2026
```
Differential Revision: https://phabricator.services.mozilla.com/D280216
```
7554aaab
Bug 2016901 - Fix potential race in NSSIOLayer. r=keeler · 39e118bc
Jens Stutte authored Feb 23, 2026 and ma1 committed Apr 20, 2026
```
Differential Revision: https://phabricator.services.mozilla.com/D283409
```
39e118bc

Bug 2021768: Use unsigned char for these. a=diannaS · 65f0864c

Byron Campen authored Mar 26, 2026 and

ma1 committed Apr 20, 2026

Original Revision: https://phabricator.services.mozilla.com/D287613

Differential Revision: https://phabricator.services.mozilla.com/D289861

65f0864c

Bug 2021788 - Guard against signed long overflow in... · 7da4069a

alastor0325 authored Mar 19, 2026 and

ma1 committed Apr 20, 2026

Bug 2021788 - Guard against signed long overflow in WMFVideoMFTManager::CreateBasicVideoFrame(). r=media-playback-reviewers,jolin

Guard CreateBasicVideoFrame() against invalid strides by rejecting
non-positive values early, widening the y_size and v_size multiplications
to int64_t, validating the results fit in uint32_t before narrowing, and
casting stride to int64_t before computing halfStride to avoid overflow
when stride == INT32_MAX.

IMF2DBuffer::Lock2D can return a negative stride for bottom-up images.
Multiplying a negative or large LONG stride by the frame height using
signed 32-bit arithmetic is undefined behaviour and produces a huge
uint32_t offset that is then used to index into the locked IMF buffer,
causing an OOB read.

Differential Revision: https://phabricator.services.mozilla.com/D288533

7da4069a

Bug 2022726 - Do not allow trrServer in DNS request issued by content process... · a484dcdd

valenting authored Mar 17, 2026 and

ma1 committed Apr 20, 2026

Bug 2022726 - Do not allow trrServer in DNS request issued by content process r=necko-reviewers,kershaw

Differential Revision: https://phabricator.services.mozilla.com/D288150

a484dcdd

Bug 2022746 Convert pointer to boolean instead of comparing with 0... · 60ad7085

Karl Tomlinson authored Mar 21, 2026 and

ma1 committed Apr 20, 2026

Bug 2022746 Convert pointer to boolean instead of comparing with 0 r=media-playback-reviewers,padenot

"When testing a pointer, use (!myPtr) or (myPtr)"
https://firefox-source-docs.mozilla.org/code-quality/coding-style/coding_style_cpp.html#c-c-practices

Differential Revision: https://phabricator.services.mozilla.com/D288804

60ad7085

Bug 2022746 move reftest-wait to html element r=media-playback-reviewers,padenot · 4f6d52a8

Karl Tomlinson authored Mar 23, 2026 and

ma1 committed Apr 20, 2026

The test did crash without this, but is more thorough with a functional
reftest-wait and saves the same bug being copied to other tests.

Also remove the play() and the await for its Promise.
With https://github.com/mozilla/nestegg/pull/77,
the demux error is detected before "canplay".
The test still crashes in builds without the code fixes.

Differential Revision: https://phabricator.services.mozilla.com/D288803

4f6d52a8

Bug 2023302 - null check mResponseHead when calling ClearHeaders r=necko-reviewers,jesup · a639d8a1
valenting authored Mar 18, 2026 and ma1 committed Apr 20, 2026
```
Differential Revision: https://phabricator.services.mozilla.com/D288411
```
a639d8a1

Bug 2024238. a=diannaS DONTBUILD · 60165727

Andrew Osmond authored Apr 08, 2026 and

ma1 committed Apr 20, 2026

Original Revision: https://phabricator.services.mozilla.com/D292321

Differential Revision: https://phabricator.services.mozilla.com/D292963

60165727

Bug 2024240 - Clean up LinuxGamepadService lifecycle interactions with event... · 03b8672a

Chris Martin authored Apr 02, 2026 and

ma1 committed Apr 20, 2026

Bug 2024240 - Clean up LinuxGamepadService lifecycle interactions with event dispatching. a=diannaS DONTBUILD

Original Revision: https://phabricator.services.mozilla.com/D290238

Differential Revision: https://phabricator.services.mozilla.com/D291596

03b8672a

Bug 2024265: Clean up locking in nsSocketTransport r=necko-reviewers,kershaw · ec5df56c
Randell Jesup authored Mar 20, 2026 and ma1 committed Apr 20, 2026
```
Differential Revision: https://phabricator.services.mozilla.com/D288563
```
ec5df56c
Bug 2024760 - Handle WebSocketChannel::IsPersistentFramePtr correctly a=diannaS DONTBUILD · 45fa8488
valenting authored Mar 30, 2026 and ma1 committed Apr 20, 2026
```
Original Revision: https://phabricator.services.mozilla.com/D288874

Differential Revision: https://phabricator.services.mozilla.com/D290871
```
45fa8488

Bug 2025281 - Cleanup MediaIPCUtils. a=diannaS · c6649016

Tom Schuster authored Mar 27, 2026 and

ma1 committed Apr 20, 2026

Original Revision: https://phabricator.services.mozilla.com/D289190

Differential Revision: https://phabricator.services.mozilla.com/D290479

c6649016

Bug 2026297. a=diannaS DONTBUILD · c664789f

Lee Salzman authored Mar 31, 2026 and

ma1 committed Apr 20, 2026

Original Revision: https://phabricator.services.mozilla.com/D290596

Differential Revision: https://phabricator.services.mozilla.com/D290953

c664789f

Bug 2026601. a=diannaS DONTBUILD · 6dc585b7

Lee Salzman authored Mar 30, 2026 and

ma1 committed Apr 20, 2026

Original Revision: https://phabricator.services.mozilla.com/D290285

Differential Revision: https://phabricator.services.mozilla.com/D290952

6dc585b7

Bug 2027287. a=diannaS DONTBUILD · fe138817
Timothy Nikkel authored Mar 31, 2026 and ma1 committed Apr 20, 2026
```
Differential Revision: https://phabricator.services.mozilla.com/D291073
```
fe138817
Bug 2029301 backport pending ffmpeg update. · 3b61cacc
ma1 authored Apr 20, 2026

3b61cacc

Bug 2029446 - Don't create frames for elements that are not allowed in an... · d5fffbf3

Jonathan Kew authored Apr 11, 2026 and

ma1 committed Apr 20, 2026

Bug 2029446 - Don't create frames for elements that are not allowed in an svg-glyphs document. a=RyanVM DONTBUILD

Original Revision: https://phabricator.services.mozilla.com/D293133

Differential Revision: https://phabricator.services.mozilla.com/D293514

d5fffbf3

Bug 2029446 - Don't hold on to EntryHandles while creating an svg-glyphs... · 93e971ca

Jonathan Kew authored Apr 11, 2026 and

ma1 committed Apr 20, 2026

Bug 2029446 - Don't hold on to EntryHandles while creating an svg-glyphs document.  a=RyanVM DONTBUILD

(clauditor-suggested fix)

Original Revision: https://phabricator.services.mozilla.com/D293134

Differential Revision: https://phabricator.services.mozilla.com/D293515

93e971ca

Bug 2029699 - Simplify InlineBackgroundData handling. a=diannaS DONTBUILD · 866d3373
Emilio Cobos Álvarez authored Apr 09, 2026 and ma1 committed Apr 20, 2026
```
Original Revision: https://phabricator.services.mozilla.com/D292380

Differential Revision: https://phabricator.services.mozilla.com/D293141
```
866d3373