Security and patch rollup for FPR9 from ESR60

[classilla]

First backport a variation on https://hg.mozilla.org/mozilla-central/rev/ec15d17d85cb from M122294 but still allow FTP. This meta-bug also will encompass #502 which already landed.

[classilla]

Starting from 7b0391a25a29
Through c205c55c641d

Not relevant:
M1453061 (MSVC-specific)
M1452740 (Windows admin policy specific)
M1453350 (ditto)
M1463895 (ditto)
M1441821 (Windows-specific)
M1466484 (Windows admin policy specific)
M1467062 (ditto)
M1456101 (X11 specific)
M1469257 (H.264 specific)
M1469603 (we don't ship a working CrashReporter)
M1439323 (Tbird-specific)
M1376756 (gtk-specific)
M1470993 (MinGW-specific)
M1471177 (ditto)
M1471293 (LLVM specific)
M1470973 (Windows-specific)
M1471352 (MinGW-specific)
M1461421 (ditto)
M1471643 (ditto)
M1468909 (we don't support WebAuthentication)
M1468845 (Windows-specific)
M1465458 (ditto)
M1472611 (Linux-specific)
M1468738 (not in 45)
M1472137 (Windows-specific)
M1474007 (ditto)
M1471556 (MinGW-specific)
M1470977 (ditto)
M1443471 (ditto)
M1474814 (not in 45)
M1475868 (Tbird-specific)
M1456988 (our dictionaries are fine)
M1455888 (Windows admin policy specific)
M1471932 (not in 45)

Not taking:
M1467870 (patch is risky, no known exploit pathway, no Xray ICs in our JIT)
M1466991 (can't fix without M1467870, testcases do not compromise 45)
M1423895 (this appears to be a Stylo-related quirk)
M1454610 (don't care)
M1471095 (regression caused by M1466991)
M1469914 (VERY HIGH RISK on 45, needs a compromised content process with IPC)
M468497 (Firefox didn't take this either)

Deferred:

Candidates:
M1472018 (unlikely to be caused but nice to have if we implement WebCrypto)
https://hg.mozilla.org/releases/mozilla-esr60/rev/5ece581f9c7b
M1469309 (unclear if this can be exploited without IPC, but can't hurt)
https://hg.mozilla.org/releases/mozilla-esr60/rev/0e6190b701db
M1470260
https://hg.mozilla.org/releases/mozilla-esr60/rev/dbcd9b40290f
https://hg.mozilla.org/releases/mozilla-esr60/rev/47af518fe028 (or at least part)
M1472925 https://hg.mozilla.org/releases/mozilla-esr60/rev/511fca97fb60

[classilla]

M1470260 doesn't apply properly due to differences in StaticRefPtr and I suspect the actual culprit was M1332226, so we'll just take the first part.

[classilla]

Through 0b6c3ccd94c4

Not relevant:
M1456294 (plugin-specific)
M1469657 (regression not in 45)
M1468523 (test case fixed by other changes)
M1478679 (45 unaffected)
M1429859 (we don't implement early data)
M1467889 (IPC only)
M1474883 (Windows only)
M1452666 (no WebExtensions)
M1467363 (Windows only)

Not taking:
M1473161 (IPC only)
M1473840 (no WebRTC)
M1452533 (of no value to us)
M1471651 (ditto)
M1468053 (no need on 10.13 and earlier)
M1404274 (possible performance impact, not a security issue)
M1473113 (we don't use the updater machinery)

Deferred:
M1412081 (not needed for 10.4 but 10.5 may be affected; needs porting)
M1450989 (investigate this further, but doesn't seem affected)

Candidates:
none in this group

[classilla]

I can't seem to trigger any of the assertions in M1450989 or its ancestor M1450171, so concluding not exploitable.

[classilla]

Through a77a58eaf8f2

Not relevant:
M1480517 (Linux)
M1483377 (our fix for Mac OS is different)
M1480640 (different code, no WasmModule support)
M1483042 (different code, doesn't seem hazardous)
M1481093 (not affected)
M1471415 (not affected)
M1461307 (not Gtk)
M1482694 (not affected)
M1477817 (no ANGLE)

Not taking:
M1482289 (no WebGL)
M947838 (we don't support this)

Candidates:
M1480092 https://hg.mozilla.org/releases/mozilla-esr60/rev/01a8adcbeab6
M1466577 https://hg.mozilla.org/releases/mozilla-esr60/rev/8857505321fd (exploitability is doubtful however)

[classilla]

Through b96165b9bac6

Not relevant:
M1445444 (Windows)
M1477684 (no RCWN)
M1483134 (unaffected)
M1481544 (Windows)
M1480521 (unaffected)
M1478849 (unaffected)
M1479071 (unaffected; our print dialogue is the old one)
M1483120 (no Skia)
M1443561 (no WebExtensions)
M1480374 (unaffected)
M1476570 (unaffected)
M1480354 (unaffected)
M1486018 (unaffected)
M1423261 (no IPC)
M1481907 (Windows)
M1487126 (MinGW)
M1487133 (MinGW)
M1400484 (MinGW)

Not talking:
M1469943 (Enterprise only)
M1479533 (don't care)
M1480431 (don't care)
M1484790 (don't care)
M1461777 (don't care)
M1484012 (don't care)
M1481121 (don't care)

Deferred:
M1485087. We might need this later, but it's not critical.

Candidates:
M1469348 https://hg.mozilla.org/releases/mozilla-esr60/rev/b7142243310c
M1478575 https://hg.mozilla.org/releases/mozilla-esr60/rev/12213cfa93d9 (although WebRTC this fault may be observable in DEBUG builds)
M1461706 https://hg.mozilla.org/releases/mozilla-esr60/rev/2d1beffe431d