From c340af1eb0c7d643b7e24de3474f21bfa668e887 Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Sat, 21 Aug 2021 14:23:09 +0000
Subject: [PATCH 1/3] Bug 1721107 - block mk protocol

---
 modules/libpref/init/all.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 7ad0dfb81295..cc53de4d1e85 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1554,6 +1554,7 @@ pref("network.protocol-handler.external.hcp", false);
 pref("network.protocol-handler.external.vbscript", false);
 pref("network.protocol-handler.external.javascript", false);
 pref("network.protocol-handler.external.data", false);
+pref("network.protocol-handler.external.mk", false);
 pref("network.protocol-handler.external.ms-help", false);
 pref("network.protocol-handler.external.shell", false);
 pref("network.protocol-handler.external.vnd.ms.radio", false);

From db1341aa742c55b8ad89323d3369f2695f16bd51 Mon Sep 17 00:00:00 2001
From: Andrew McCreight <continuation@gmail.com>
Date: Fri, 13 Aug 2021 13:41:16 +0000
Subject: [PATCH 2/3] Bug 1723391 - Use RefPtr in
 ContentChild::RecvGetFilesResponse

---
 dom/ipc/ContentChild.cpp | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index e857af3e6400..a155f0c22b96 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -3256,10 +3256,11 @@ mozilla::ipc::IPCResult
 ContentChild::RecvGetFilesResponse(const nsID& aUUID,
                                    const GetFilesResponseResult& aResult)
 {
-  GetFilesHelperChild* child = mGetFilesPendingRequests.GetWeak(aUUID);
+  RefPtr<GetFilesHelperChild> child;
+
   // This object can already been deleted in case DeleteGetFilesRequest has
   // been called when the response was sending by the parent.
-  if (!child) {
+  if (!mGetFilesPendingRequests.Remove(aUUID, getter_AddRefs(child))) {
     return IPC_OK();
   }
 
@@ -3279,8 +3280,6 @@ ContentChild::RecvGetFilesResponse(const nsID& aUUID,
 
     child->Finished(succeeded ? NS_OK : NS_ERROR_OUT_OF_MEMORY);
   }
-
-  mGetFilesPendingRequests.Remove(aUUID);
   return IPC_OK();
 }
 

From cf9855e45b708886bd843c8acaeb62f4ae7ea5c5 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Thu, 5 Aug 2021 19:36:32 +0000
Subject: [PATCH 3/3] Bug 1724107, be more precise when counting the number of 
 allocator users

The patch is based on code inspection.

One could move sAllocatorUsers also to Free(), but shouldn't matter in practise.
---
 xpcom/threads/TimerThread.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xpcom/threads/TimerThread.cpp b/xpcom/threads/TimerThread.cpp
index 99a40d91b3c0..86ed65d9cd61 100644
--- a/xpcom/threads/TimerThread.cpp
+++ b/xpcom/threads/TimerThread.cpp
@@ -170,6 +170,7 @@ class nsTimerEvent final : public CancelableRunnable
   void operator delete(void* aPtr)
   {
     sAllocator->Free(aPtr);
+    sAllocatorUsers--;
     DeleteAllocatorIfNeeded();
   }
 
@@ -193,7 +194,6 @@ class nsTimerEvent final : public CancelableRunnable
   {
     MOZ_ASSERT(!sCanDeleteAllocator || sAllocatorUsers > 0,
                "This will result in us attempting to deallocate the nsTimerEvent allocator twice");
-    sAllocatorUsers--;
   }
 
   RefPtr<nsTimerImpl> mTimer;