firefox153: update to 153.2
Mozilla Foundation Security Advisory 2026-85
Security Vulnerabilities fixed in Firefox ESR 153.2
Announced
September 1, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 153.2
#CVE-2026-75874: Sandbox escape in the Remote Settings Client component
Reporter
crixer
[274 lines not shown]
[KnownFPClass] Refactor direct access to `KnownFPClass::SignBit` [NFC] (#218514)
Part of https://github.com/llvm/llvm-project/issues/217072
This PR is the first step in refactoring `KnownFPClass`. It replaces
direct access to the `SignBit` field with getters and setters.
The long-term goal is to eliminate the `SignBit` field so that
`KnownFPClass` can be represented by a single bitmask, rather than an
`FPClassTest` together with a `std::optional<bool>`.
```c++
struct KnownFPClass {
FPClassTest KnownFPClasses = fcAllFlags;
std::optional<bool> SignBit;
};
struct KnownFPClass {
// Also distinguishes positive/negative qNaN and sNaN.
KnownFPMask KnownFPClasses = kfcAllFlags;
[13 lines not shown]
firefox140: update to 140.15
Mozilla Foundation Security Advisory 2026-84
Security Vulnerabilities fixed in Firefox ESR 140.15
Announced
September 1, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 140.15
#CVE-2026-75874: Sandbox escape in the Remote Settings Client component
Reporter
crixer
[126 lines not shown]
[lld][MachO] Order objc stubs by caller priority (#218732)
__objc_stubs is synthetic, so the input section sorting never reaches
its entries. A stub is faulted in when its caller runs, so stubs called
from hot code end up scattered across pages that startup otherwise never
touches.
Record the sections that branch to each stub, give each stub the lowest
priority among its callers, and stable-sort the stubs before addresses
are assigned. Stubs with no prioritized caller keep their relative order
at the end.
This reduces page faults in __objc_stubs by 40% for a large app.
[flang][debug] Fix build after fir.global linkage became a typed enum (#220280)
#220243 replaced the string `linkName` on `fir.global` with a typed
`fir::LinkageAttr`, so `GlobalOp::getLinkName()` no longer exists.
It landed 46 minutes before #215369 was merged, and the two changes
touch
disjoint sets of files: #220243 never touched `AddDebugInfo.cpp`, and
#215369 added the only `getLinkName()` call in it. They merged cleanly
with
no textual conflict, and main is currently unable to build flang:
```
flang/lib/Optimizer/Transforms/AddDebugInfo.cpp:564:39: error:
'class fir::GlobalOp' has no member named 'getLinkName';
did you mean 'getLinkage'?
```
Use the typed accessor, matching what #220243 did for the same idiom in
[9 lines not shown]
[Clang][NVPTX] Add sm_107 to SM_Instantiate for NVPTX builtins (#220019)
Add sm_107 to the list of architectures instantiated for NVPTX builtins
in BuiltinsNVPTX.td.
Also add a test invocation with -target-cpu sm_107a to builtins-nvptx.c.
gvirstor: Modernize the I/O path
- Add unmapped I/O support. The only case when the code needs data
access is BIO_READ returning zeroes for unallocated space.
- Add BIO_FLUSH support. Just send it to all allocated components.
- Add BIO_DELETE support. While current design does not allow
freeing allocated blocks, at least pass it to underlying providers.
- Add direct I/O completion support.
- Add rotation rate reporting.
- Fix few minor issues.
[AMDGPU] Match the AsmParser's operand-side check and share its helper
In the upcoming PR AsmParser performs the same alignment check but differently:
it tests whether a concrete physreg, which carries no regclass, is in the
relaxed operand's regclass.
Change the verifier to work the same way, reusing
AMDGPUBaseInfo::getUnalignedEquivalentRC.
Co-Authored-By: Claude <noreply at anthropic.com>
[AMDGPU] Verify VGPR tuple alignment from the operand register class
The machine verifier decided VGPR tuple alignment with isProperlyAlignedRC(),
which inspects only the register's own class. Alignment is not really a property
of the register in isolation: whether a 64-bit tuple must be even-aligned depends
on the operand it feeds, and on mixed-alignment targets the same register class
can be required to be aligned in one operand and exempt in another. Inspecting
only the register also conflates alignment with unrelated problems - a register
that is simply the wrong bank or size for the operand came out as "requires even
aligned vector registers" as well.
Make the operand's register class the source of truth instead: a register is
misaligned only when it does not satisfy the operand's class but its even-aligned
same-bank/width equivalent (SIRegisterInfo::getAlignedEquivalentRC) would. A
register that fits neither is a genuine class or bank mismatch and is left to the
illegal-register and sub-register checks. So an AGPR in a VGPR|SGPR (VS_64)
operand is now reported as an illegal register, and a wrong-size register (e.g. a
64-bit VGPR in a 128-bit MFMA source) or an invalid sub-register index is
reported by those checks alone, no longer doubled up as an "even aligned" error.
[17 lines not shown]
[AMDGPU] Restructure VGPR-alignment verifier tests, NFC
Rewrite verify-gfx90a-aligned-vgprs.mir and verify-ds-gws-align.mir so each case
documents inline what makes it invalid, and match the verifier's fuller output -
the "*** Bad machine code ***" kind and the "- instruction:" line - instead of a
single message fragment. Pure test restructure with no functional change, so the
follow-up commit that derives alignment from the operand register class shows
only the change in diagnostic wording.
Co-Authored-By: Claude <noreply at anthropic.com>
[AMDGPU][DOC] Fix private address space in CFI documentation (#220274)
The CFI implementation has always used the private wave address space.
Update the documentation, which erroneously referred to the private lane
address space.
