Security and patch rollup for FPR10 from ESR60

[classilla]

Through 6cdd6d88eca9

Not relevant:
M1496094 (Windows only)
M1409570 (not in code)
M1465787 (Windows only)
M1445528 (not in code)
M1469159 (not in code)
M1465388 (not in code)
M1495404 (Linux only)
M1483905 (not in code)
M1493590 (Windows only)
M1492484 (not in code)
M1443748 (not in code)
M1492915 (not in code)
M1492897 (MIPS only)
M1489757 (not in code)
M1492064 (x86 only)
M1492065 (x86 only)
M1490234 (Windows only)
M1490264 (Windows only)
M1416085 (not in code)
M1488061 (not vulnerable, nor to M1460538)
M1484783 (Windows only)
M1484905 (not in code)
M1477268 (Linux only)
M1442010 (not in code)
M1486080 (no ffmpeg)
M1478685 (not in code)
M1494405 (not in code)
M1489605 (not needed)
M1489744 (not in code)
M1475775 (unaffected)
M1490585 (not in code)

Not taking:
M1490561, M1484559 (probably not vulnerable, no async scroll support)
M1472538 (not needed)
M1464751 (author is a total jerk)
M1489785 (breaks our Cocoa implementation)
M1479540 (not needed)

Deferred:
M1410545 (we use hybrid endianness)
M1434963 (from M1418930), M1418470 (needs further investigation)
M1481844 (waiting for additional investigation) (see also M1483487)

Candidates:
M1493347 (WebRTC but worth doing) https://hg.mozilla.org/releases/mozilla-esr60/rev/20c59797e994
M1487098 https://hg.mozilla.org/releases/mozilla-esr60/rev/f25ce451a492
M1423278 https://hg.mozilla.org/releases/mozilla-esr60/rev/878ceaee5634

[classilla]

Through 9fb8aee79ca6

Not relevant:
M1495245 (not in code)
M1496322 (Windows only)
M1469486 (Windows only)
M1474265 (Linux)
M1467523 (no WX)
M1483602 (no WX)
M1497169 (FreeBSD)
M1487478 (no WX)
M1494328 (no WX)
M1488803 (Windows)
M1462162 (no IPC)
M1478843 (Android)

Not taking:
M1498701, M1498482, M1498460 (no Skia no cry)
M1492737 (don't care)
M1498433, M1471873 (don't use Crash Reporter)

Deferred:
M1481844. I don't think we go wrong in the same way, but some similar code is present.
M1495011. Affected code is not present but we could consider CheckedInts here.

Candidates:
M1499198 for our Intel brethren and sistren https://hg.mozilla.org/releases/mozilla-esr60/rev/ea9412b18ca8
M1492823 https://hg.mozilla.org/releases/mozilla-esr60/rev/f6bb138ad0ab (all to GlobalWindow)
M1483699 (to xpcom/glue) https://hg.mozilla.org/releases/mozilla-esr60/rev/b3359becd7b1 https://hg.mozilla.org/releases/mozilla-esr60/rev/791c8ecf252d
M1492524 https://hg.mozilla.org/releases/mozilla-esr60/rev/efc0596dd381
M1496340 https://hg.mozilla.org/releases/mozilla-esr60/rev/9d51e65c797a

[classilla]

Can't do M1499198 as written. Leaving #error in code for the Intel folks to check if we are actually vulnerable.

[kencu]

I am trying to decide just what to do with that. @rmottola and I will need to come up with a plan. I wonder, though, how many of these have gone by already?

I see that mozjs60 builds now on MacPorts. I wonder if I should look at importing some of that to bring the x86 parts of this up to date?

[rmottola]

@kencu, @classilla I can look at it, but how to test if we are vulnerable? if there is a test case to add and/or a specific webpage to test, I can look at it. Strangely, I cannot see the original bug.

[classilla]

@rmottola unfortunately I can't give you the test case until the bug opens (which should be when the advisories get published tomorrow). However, I'm fairly confident the bug is exploitable on 45 even if the actual test case itself doesn't work because of the actual nature of the flaw.

@kencu The number is non-zero probably, but not many. Most of the security problems come from the higher levels of the JIT rather than code generation. If I missed any, they would be in the 52ESR tree because those are the ones I transcribed by hand (or see prior security rollups and look for x86 only flaws).

I'll close this for the purposes of documentation but I'll still reply to queries about this specific issue.

[rmottola]

Just worked on M1499198 on my tree... patch did not apply automatically, but easy to port manually. Will be included in the next pull.

[classilla]

OK. Just PR it when you're ready. As long as the changes are restricted to the x86 JIT, I'll just rubber stamp it.

[roytam1]

Just worked on M1499198 on my tree... patch did not apply automatically, but easy to port manually. Will be included in the next pull.

@rmottola loadConstantSimd128Int is missing in tff:
https://github.com/mozilla/positron/blob/master/js/src/jit/x86/MacroAssembler-x86.cpp#L150

[rmottola]

@roytam1 - I know . I tried hard to backport those function, but was unable to. I used FF49 as a reference and the differences were enormous, I worked for hours, but couldn't get it to compile

I ended up with this:
rmottola@eb9e474

I'm confident ti is right.

You mention a FF45 tree with the Simd28 functions. I wonder if in this case TFF is not up to 45 or instead you backported stuff?

[roytam1]

You mention a FF45 tree with the Simd28 functions. I wonder if in this case TFF is not up to 45 or instead you backported stuff?

nope, the link I mentioned doesn't contain ESR45, but a fork of 53.0a1.