Merging upstream version 115.8.0esr.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

19 files changed, 244 insertions, 96 deletions

diff --git a/netwerk/dns/DNSRequestChild.cpp b/netwerk/dns/DNSRequestChild.cpp
index d8ee335b6f..4d9d7e271e 100644
--- a/netwerk/dns/DNSRequestChild.cpp
+++ b/netwerk/dns/DNSRequestChild.cpp
@@ -395,32 +395,30 @@ DNSRequestSender::Cancel(nsresult reason) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  if (mIPCActor->CanSend()) {
-    // We can only do IPDL on the main thread
-    nsCOMPtr<nsIRunnable> runnable = NS_NewRunnableFunction(
-        "net::CancelDNSRequestEvent",
-        [actor(mIPCActor), host(mHost), trrServer(mTrrServer), port(mPort),
-         type(mType), originAttributes(mOriginAttributes), flags(mFlags),
-         reason]() {
-          if (!actor->CanSend()) {
-            return;
-          }
-
-          if (DNSRequestChild* child = actor->AsDNSRequestChild()) {
-            Unused << child->SendCancelDNSRequest(
-                host, trrServer, port, type, originAttributes, flags, reason);
-          } else if (DNSRequestParent* parent = actor->AsDNSRequestParent()) {
-            Unused << parent->SendCancelDNSRequest(
-                host, trrServer, port, type, originAttributes, flags, reason);
-          }
-        });
-    SchedulerGroup::Dispatch(TaskCategory::Other, runnable.forget());
-  }
+  // We can only do IPC on the MainThread
+  nsCOMPtr<nsIRunnable> runnable = NS_NewRunnableFunction(
+      "net::CancelDNSRequestEvent",
+      [actor(mIPCActor), host(mHost), trrServer(mTrrServer), port(mPort),
+       type(mType), originAttributes(mOriginAttributes), flags(mFlags),
+       reason]() {
+        if (!actor->CanSend()) {
+          return;
+        }
+
+        if (DNSRequestChild* child = actor->AsDNSRequestChild()) {
+          Unused << child->SendCancelDNSRequest(
+              host, trrServer, port, type, originAttributes, flags, reason);
+        } else if (DNSRequestParent* parent = actor->AsDNSRequestParent()) {
+          Unused << parent->SendCancelDNSRequest(
+              host, trrServer, port, type, originAttributes, flags, reason);
+        }
+      });
+  SchedulerGroup::Dispatch(TaskCategory::Other, runnable.forget());
   return NS_OK;
 }
 
 void DNSRequestSender::StartRequest() {
-  // we can only do IPDL on the main thread
+  // we can only do IPC on the MainThread
   if (!NS_IsMainThread()) {
     SchedulerGroup::Dispatch(
         TaskCategory::Other,
diff --git a/netwerk/dns/effective_tld_names.dat b/netwerk/dns/effective_tld_names.dat
index 6d6af67dd0..be79353f30 100644
--- a/netwerk/dns/effective_tld_names.dat
+++ b/netwerk/dns/effective_tld_names.dat
@@ -6710,7 +6710,7 @@ org.zw
 
 // newGTLDs
 
-// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2024-01-06T15:12:04Z
+// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2024-01-24T15:14:29Z
 // This list is auto-generated, don't edit it manually.
 // aaa : American Automobile Association, Inc.
 // https://www.iana.org/domains/root/db/aaa.html
@@ -7016,10 +7016,6 @@ baidu
 // https://www.iana.org/domains/root/db/banamex.html
 banamex
 
-// bananarepublic : The Gap, Inc.
-// https://www.iana.org/domains/root/db/bananarepublic.html
-bananarepublic
-
 // band : Dog Beach, LLC
 // https://www.iana.org/domains/root/db/band.html
 band
@@ -8164,7 +8160,7 @@ ftr
 // https://www.iana.org/domains/root/db/fujitsu.html
 fujitsu
 
-// fun : Radix FZC DMCC
+// fun : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/fun.html
 fun
 
@@ -8500,7 +8496,7 @@ horse
 // https://www.iana.org/domains/root/db/hospital.html
 hospital
 
-// host : Radix FZC DMCC
+// host : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/host.html
 host
 
@@ -9392,10 +9388,6 @@ olayan
 // https://www.iana.org/domains/root/db/olayangroup.html
 olayangroup
 
-// oldnavy : The Gap, Inc.
-// https://www.iana.org/domains/root/db/oldnavy.html
-oldnavy
-
 // ollo : Dish DBS Corporation
 // https://www.iana.org/domains/root/db/ollo.html
 ollo
@@ -9416,7 +9408,7 @@ ong
 // https://www.iana.org/domains/root/db/onl.html
 onl
 
-// online : Radix FZC DMCC
+// online : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/online.html
 online
 
@@ -9620,7 +9612,7 @@ pramerica
 // https://www.iana.org/domains/root/db/praxi.html
 praxi
 
-// press : Radix FZC DMCC
+// press : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/press.html
 press
 
@@ -10072,7 +10064,7 @@ sina
 // https://www.iana.org/domains/root/db/singles.html
 singles
 
-// site : Radix FZC DMCC
+// site : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/site.html
 site
 
@@ -10152,7 +10144,7 @@ soy
 // https://www.iana.org/domains/root/db/spa.html
 spa
 
-// space : Radix FZC DMCC
+// space : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/space.html
 space
 
@@ -10204,7 +10196,7 @@ stockholm
 // https://www.iana.org/domains/root/db/storage.html
 storage
 
-// store : Radix FZC DMCC
+// store : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/store.html
 store
 
@@ -10320,7 +10312,7 @@ tdk
 // https://www.iana.org/domains/root/db/team.html
 team
 
-// tech : Radix FZC DMCC
+// tech : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/tech.html
 tech
 
@@ -10504,7 +10496,7 @@ unicom
 // https://www.iana.org/domains/root/db/university.html
 university
 
-// uno : Radix FZC DMCC
+// uno : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/uno.html
 uno
 
@@ -10668,7 +10660,7 @@ webcam
 // https://www.iana.org/domains/root/db/weber.html
 weber
 
-// website : Radix FZC DMCC
+// website : Radix Technologies Inc.
 // https://www.iana.org/domains/root/db/website.html
 website
 
@@ -11209,6 +11201,12 @@ zuerich
 // ===BEGIN PRIVATE DOMAINS===
 // (Note: these are in alphabetical order by company name)
 
+// 12CHARS: https://12chars.com
+// Submitted by Kenny Niehage <psl@12chars.com>
+12chars.dev
+12chars.it
+12chars.pro
+
 // 1GB LLC : https://www.1gb.ua/
 // Submitted by 1GB LLC <noc@1gb.com.ua>
 cc.ua
@@ -11218,6 +11216,11 @@ ltd.ua
 // 611coin : https://611project.org/
 611.to
 
+// A2 Hosting
+// Submitted by Tyler Hall <sysadmin@a2hosting.com>
+a2hosted.com
+cpserver.com
+
 // Aaron Marais' Gitlab pages: https://lab.aaronleem.co.za
 // Submitted by Aaron Marais <its_me@aaronleem.co.za>
 graphox.us
@@ -11238,8 +11241,10 @@ activetrail.biz
 // Submitted by Ian Boston <boston@adobe.com> and Lars Trieloff <trieloff@adobe.com>
 adobeaemcloud.com
 *.dev.adobeaemcloud.com
+aem.live
 hlx.live
 adobeaemcloud.net
+aem.page
 hlx.page
 hlx3.page
 
@@ -11311,7 +11316,7 @@ myamaze.net
 
 // Amazon API Gateway
 // Submitted by AWS Security <psl-maintainers@amazon.com>
-// Reference: 4d863337-ff98-4501-a6f2-361eba8445d6
+// Reference: 9e37648f-a66c-4655-9ab1-5981f8737197
 execute-api.cn-north-1.amazonaws.com.cn
 execute-api.cn-northwest-1.amazonaws.com.cn
 execute-api.af-south-1.amazonaws.com
@@ -11326,6 +11331,7 @@ execute-api.ap-southeast-2.amazonaws.com
 execute-api.ap-southeast-3.amazonaws.com
 execute-api.ap-southeast-4.amazonaws.com
 execute-api.ca-central-1.amazonaws.com
+execute-api.ca-west-1.amazonaws.com
 execute-api.eu-central-1.amazonaws.com
 execute-api.eu-central-2.amazonaws.com
 execute-api.eu-north-1.amazonaws.com
@@ -11497,7 +11503,7 @@ emrstudio-prod.us-west-2.amazonaws.com
 
 // Amazon S3
 // Submitted by AWS Security <psl-maintainers@amazon.com>
-// Reference: 0e801048-08f2-4064-9cb8-e7373e0b57f4
+// Reference: cd5c8b3a-67b7-4b40-9236-c87ce81a3d10
 s3.dualstack.cn-north-1.amazonaws.com.cn
 s3-accesspoint.dualstack.cn-north-1.amazonaws.com.cn
 s3-website.dualstack.cn-north-1.amazonaws.com.cn
@@ -11596,6 +11602,16 @@ s3-accesspoint-fips.ca-central-1.amazonaws.com
 s3-fips.ca-central-1.amazonaws.com
 s3-object-lambda.ca-central-1.amazonaws.com
 s3-website.ca-central-1.amazonaws.com
+s3.dualstack.ca-west-1.amazonaws.com
+s3-accesspoint.dualstack.ca-west-1.amazonaws.com
+s3-accesspoint-fips.dualstack.ca-west-1.amazonaws.com
+s3-fips.dualstack.ca-west-1.amazonaws.com
+s3-website.dualstack.ca-west-1.amazonaws.com
+s3.ca-west-1.amazonaws.com
+s3-accesspoint.ca-west-1.amazonaws.com
+s3-accesspoint-fips.ca-west-1.amazonaws.com
+s3-fips.ca-west-1.amazonaws.com
+s3-website.ca-west-1.amazonaws.com
 s3.dualstack.eu-central-1.amazonaws.com
 s3-accesspoint.dualstack.eu-central-1.amazonaws.com
 s3-website.dualstack.eu-central-1.amazonaws.com
@@ -11778,7 +11794,7 @@ s3-website.us-west-2.amazonaws.com
 
 // Amazon SageMaker Notebook Instances
 // Submitted by AWS Security <psl-maintainers@amazon.com>
-// Reference: fe8c9e94-5a22-486d-8750-991a3a9b13c6
+// Reference: ce8ae0b1-0070-496d-be88-37c31837af9d
 notebook.af-south-1.sagemaker.aws
 notebook.ap-east-1.sagemaker.aws
 notebook.ap-northeast-1.sagemaker.aws
@@ -11791,6 +11807,9 @@ notebook.ap-southeast-2.sagemaker.aws
 notebook.ap-southeast-3.sagemaker.aws
 notebook.ap-southeast-4.sagemaker.aws
 notebook.ca-central-1.sagemaker.aws
+notebook-fips.ca-central-1.sagemaker.aws
+notebook.ca-west-1.sagemaker.aws
+notebook-fips.ca-west-1.sagemaker.aws
 notebook.eu-central-1.sagemaker.aws
 notebook.eu-central-2.sagemaker.aws
 notebook.eu-north-1.sagemaker.aws
@@ -11877,7 +11896,7 @@ analytics-gateway.us-west-2.amazonaws.com
 
 // AWS Cloud9
 // Submitted by: AWS Security <psl-maintainers@amazon.com>
-// Reference: 05c44955-977c-4b57-938a-f2af92733f9f
+// Reference: 30717f72-4007-4f0f-8ed4-864c6f2efec9
 webview-assets.aws-cloud9.af-south-1.amazonaws.com
 vfs.cloud9.af-south-1.amazonaws.com
 webview-assets.cloud9.af-south-1.amazonaws.com
@@ -11923,6 +11942,8 @@ webview-assets.cloud9.eu-west-2.amazonaws.com
 webview-assets.aws-cloud9.eu-west-3.amazonaws.com
 vfs.cloud9.eu-west-3.amazonaws.com
 webview-assets.cloud9.eu-west-3.amazonaws.com
+webview-assets.aws-cloud9.il-central-1.amazonaws.com
+vfs.cloud9.il-central-1.amazonaws.com
 webview-assets.aws-cloud9.me-south-1.amazonaws.com
 vfs.cloud9.me-south-1.amazonaws.com
 webview-assets.cloud9.me-south-1.amazonaws.com
@@ -11985,6 +12006,11 @@ us-west-2.elasticbeanstalk.com
 // Reference: d916759d-a08b-4241-b536-4db887383a6a
 awsglobalaccelerator.com
 
+// AWS re:Post Private
+// Submitted by AWS Security <psl-maintainers@amazon.com>
+// Reference: 83385945-225f-416e-9aa0-ad0632bfdcee
+*.private.repost.aws
+
 // eero
 // Submitted by Yue Kang <eero-dynamic-dns@amazon.com>
 // Reference: 264afe70-f62c-4c02-8ab9-b5281ed24461
@@ -12002,6 +12028,10 @@ tele.amune.org
 // Submitted by Apigee Security Team <security@apigee.com>
 apigee.io
 
+// Apis Networks: https://apisnetworks.com
+// Submitted by Matt Saladna <matt@apisnetworks.com>
+panel.dev
+
 // Apphud : https://apphud.com
 // Submitted by Alexander Selivanov <alex@apphud.com>
 siiites.com
@@ -12113,6 +12143,10 @@ beagleboard.io
 // Submitted by Lev Nekrasov <lnekrasov@beget.com>
 *.beget.app
 
+// Besties : https://besties.house
+// Submitted by Hazel Cora <hazy@besties.house>
+pages.gay
+
 // BetaInABox
 // Submitted by Adrian <adrian@betainabox.com>
 betainabox.com
@@ -12158,6 +12192,10 @@ square7.de
 bplaced.net
 square7.net
 
+// Brave : https://brave.com
+// Submitted by Andrea Brancaleoni <abrancaleoni@brave.com>
+*.s.brave.io
+
 // Brendly : https://brendly.rs
 // Submitted by Dusan Radovanovic <dusan.radovanovic@brendly.rs>
 shop.brendly.rs
@@ -12420,6 +12458,13 @@ curv.dev
 *.ocp.customer-oci.com
 *.ocs.customer-oci.com
 
+// Cyclic Software : https://www.cyclic.sh
+// Submitted by Kam Lasater <dns-admin@cyclic.sh>
+cyclic.app
+cyclic.cloud
+cyclic-app.com
+cyclic.co.in
+
 // cyon GmbH : https://www.cyon.ch/
 // Submitted by Dominic Luechinger <dol@cyon.ch>
 cyon.link
@@ -13014,10 +13059,6 @@ url.tw
 // Submitted by Eric Jiang <eric@fabrica.dev>
 onfabrica.com
 
-// Facebook, Inc.
-// Submitted by Peter Ruibal <public-suffix@fb.com>
-apps.fbsbx.com
-
 // FAITID : https://faitid.org/
 // Submitted by Maxim Alzoba <tech.contact@faitid.org>
 // https://www.flexireg.net/stat_info
@@ -13175,6 +13216,10 @@ flap.id
 onflashdrive.app
 fldrv.com
 
+// FlutterFlow : https://flutterflow.io
+// Submitted by Anton Emelyanov <anton@flutterflow.io>
+flutterflow.app
+
 // fly.io: https://fly.io
 // Submitted by Kurt Mackey <kurt@fly.io>
 fly.dev
@@ -13243,6 +13288,10 @@ futuremailing.at
 *.kunden.ortsinfo.at
 *.statics.cloud
 
+// GCom Internet : https://www.gcom.net.au
+// Submitted by Leo Julius <support@gcom.net.au>
+aliases121.com
+
 // GDS : https://www.gov.uk/service-manual/technology/managing-domain-names
 // Submitted by Stephen Ford <hostmaster@digital.cabinet-office.gov.uk>
 independent-commission.uk
@@ -13436,8 +13485,7 @@ goip.de
 
 // Google, Inc.
 // Submitted by Eduardo Vela <evn@google.com>
-run.app
-a.run.app
+*.run.app
 web.app
 *.0emm.com
 appspot.com
@@ -13592,6 +13640,12 @@ ravendb.run
 // Submitted by Krzysztof Wolski <krzysztof.wolski@home.eu>
 homesklep.pl
 
+// Homebase : https://homebase.id/
+// Submitted by Jason Babo <info@homebase.id>
+*.kin.one
+*.id.pub
+*.kin.pub
+
 // Hong Kong Productivity Council: https://www.hkpc.org/
 // Submitted by SECaaS Team <summchan@hkpc.org>
 secaas.hk
@@ -14045,6 +14099,11 @@ memset.net
 // Submitted by Ruben Schmidmeister <psl-maintainers@messerli.ch>
 messerli.app
 
+// Meta Platforms, Inc. : https://meta.com/
+// Submitted by Jacob Cordero <public-suffix@meta.com>
+atmeta.com
+apps.fbsbx.com
+
 // MetaCentrum, CESNET z.s.p.o. : https://www.metacentrum.cz/en/
 // Submitted by Zdeněk Šustr <zdenek.sustr@cesnet.cz>
 *.cloud.metacentrum.cz
@@ -14065,10 +14124,15 @@ co.pl
 
 // Microsoft Corporation : http://microsoft.com
 // Submitted by Public Suffix List Admin <msftpsladmin@microsoft.com>
+// Managed by Corporate Domains
+// Microsoft Azure : https://home.azure
 *.azurecontainer.io
+*.cloudapp.azure.com
+azure-api.net
+azureedge.net
+azurefd.net
 azurewebsites.net
 azure-mobile.net
-cloudapp.net
 azurestaticapps.net
 1.azurestaticapps.net
 2.azurestaticapps.net
@@ -14082,6 +14146,10 @@ eastasia.azurestaticapps.net
 eastus2.azurestaticapps.net
 westeurope.azurestaticapps.net
 westus2.azurestaticapps.net
+cloudapp.net
+trafficmanager.net
+blob.core.windows.net
+servicebus.windows.net
 
 // minion.systems : http://minion.systems
 // Submitted by Robert Böttinger <r@minion.systems>
@@ -14471,7 +14539,8 @@ on-web.fr
 
 // Platform.sh : https://platform.sh
 // Submitted by Nikola Kotur <nikola@platform.sh>
-bc.platform.sh
+*.upsun.app
+upsunapp.com
 ent.platform.sh
 eu.platform.sh
 us.platform.sh
@@ -14490,6 +14559,10 @@ pdns.page
 plesk.page
 pleskns.com
 
+// Pley AB : https://www.pley.com/
+// Submitted by Henning Pohl <infra@pley.com>
+pley.games
+
 // Port53 : https://port53.io/
 // Submitted by Maximilian Schieder <maxi@zeug.co>
 dyn53.io
@@ -14733,10 +14806,11 @@ from.tv
 sakura.tv
 
 // Salesforce.com, Inc. https://salesforce.com/
-// Submitted by Michael Biven <mbiven@salesforce.com>
+// Submitted by Michael Biven <mbiven@salesforce.com> and Aaron Romeo <aaron.romeo@salesforce.com>
 *.builder.code.com
 *.dev-builder.code.com
 *.stg-builder.code.com
+*.001.test.code-builder-stg.platform.salesforce.com
 
 // Sandstorm Development Group, Inc. : https://sandcats.io/
 // Submitted by Asheesh Laroia <asheesh@sandstorm.io>
@@ -14752,6 +14826,7 @@ logoip.com
 fr-par-1.baremetal.scw.cloud
 fr-par-2.baremetal.scw.cloud
 nl-ams-1.baremetal.scw.cloud
+cockpit.fr-par.scw.cloud
 fnc.fr-par.scw.cloud
 functions.fnc.fr-par.scw.cloud
 k8s.fr-par.scw.cloud
@@ -14762,11 +14837,13 @@ whm.fr-par.scw.cloud
 priv.instances.scw.cloud
 pub.instances.scw.cloud
 k8s.scw.cloud
+cockpit.nl-ams.scw.cloud
 k8s.nl-ams.scw.cloud
 nodes.k8s.nl-ams.scw.cloud
 s3.nl-ams.scw.cloud
 s3-website.nl-ams.scw.cloud
 whm.nl-ams.scw.cloud
+cockpit.pl-waw.scw.cloud
 k8s.pl-waw.scw.cloud
 nodes.k8s.pl-waw.scw.cloud
 s3.pl-waw.scw.cloud
@@ -15253,7 +15330,6 @@ de.gt
 to.gt
 be.gy
 cc.hn
-blog.kg
 io.kg
 jp.kg
 tv.kg
@@ -15406,6 +15482,10 @@ noho.st
 za.net
 za.org
 
+// ZAP-Hosting GmbH & Co. KG : https://zap-hosting.com
+// Submitted by Julian Alker <security@zap-hosting.com>
+zap.cloud
+
 // Zine EOOD : https://zine.bg/
 // Submitted by Martin Angelov <martin@zine.bg>
 bss.design
diff --git a/netwerk/dns/prepare_tlds.py b/netwerk/dns/prepare_tlds.py
index 53d0bf526d..adebcec487 100644
--- a/netwerk/dns/prepare_tlds.py
+++ b/netwerk/dns/prepare_tlds.py
@@ -4,11 +4,10 @@
 
 import codecs
 import encodings.idna
-import imp
-import os
 import re
 import sys
-from make_dafsa import words_to_cxx, words_to_bin
+
+from make_dafsa import words_to_bin, words_to_cxx
 
 """
 Processes a file containing effective TLD data.  See the following URL for a
@@ -22,7 +21,6 @@ http://wiki.mozilla.org/Gecko:Effective_TLD_Service
 
 def getEffectiveTLDs(path):
     file = codecs.open(path, "r", "UTF-8")
-    entries = []
     domains = set()
     for line in file:
         # line always contains a line terminator unless the file is empty
diff --git a/netwerk/ipc/DocumentLoadListener.cpp b/netwerk/ipc/DocumentLoadListener.cpp
index 715e00c056..54c9a53e65 100644
--- a/netwerk/ipc/DocumentLoadListener.cpp
+++ b/netwerk/ipc/DocumentLoadListener.cpp
@@ -1439,7 +1439,7 @@ bool DocumentLoadListener::ResumeSuspendedChannel(
     streamListenerFunctions.Clear();
   }
 
-  ForwardStreamListenerFunctions(streamListenerFunctions, aListener);
+  ForwardStreamListenerFunctions(std::move(streamListenerFunctions), aListener);
 
   // We don't expect to get new stream listener functions added
   // via re-entrancy. If this ever happens, we should understand
@@ -2642,7 +2642,7 @@ DocumentLoadListener::OnDataAvailable(nsIRequest* aRequest,
 
   mStreamListenerFunctions.AppendElement(StreamListenerFunction{
       VariantIndex<1>{},
-      OnDataAvailableParams{aRequest, data, aOffset, aCount}});
+      OnDataAvailableParams{aRequest, std::move(data), aOffset, aCount}});
 
   return NS_OK;
 }
diff --git a/netwerk/ipc/NeckoCommon.cpp b/netwerk/ipc/NeckoCommon.cpp
index c08faa5747..9ad4483d32 100644
--- a/netwerk/ipc/NeckoCommon.cpp
+++ b/netwerk/ipc/NeckoCommon.cpp
@@ -14,28 +14,26 @@
 
 namespace mozilla::net {
 
-nsresult ForwardStreamListenerFunctions(
-    nsTArray<StreamListenerFunction>& aCalls, nsIStreamListener* aParent) {
+nsresult ForwardStreamListenerFunctions(nsTArray<StreamListenerFunction> aCalls,
+                                        nsIStreamListener* aParent) {
   nsresult rv = NS_OK;
   for (auto& variant : aCalls) {
     variant.match(
-        [&](const OnStartRequestParams& aParams) {
+        [&](OnStartRequestParams& aParams) {
           rv = aParent->OnStartRequest(aParams.request);
           if (NS_FAILED(rv)) {
             aParams.request->Cancel(rv);
           }
         },
-        [&](const OnDataAvailableParams& aParams) {
+        [&](OnDataAvailableParams& aParams) {
           // Don't deliver OnDataAvailable if we've
           // already failed.
           if (NS_FAILED(rv)) {
             return;
           }
           nsCOMPtr<nsIInputStream> stringStream;
-          rv = NS_NewByteInputStream(
-              getter_AddRefs(stringStream),
-              Span<const char>(aParams.data.get(), aParams.count),
-              NS_ASSIGNMENT_DEPEND);
+          rv = NS_NewCStringInputStream(getter_AddRefs(stringStream),
+                                        std::move(aParams.data));
           if (NS_SUCCEEDED(rv)) {
             rv = aParent->OnDataAvailable(aParams.request, stringStream,
                                           aParams.offset, aParams.count);
@@ -44,7 +42,7 @@ nsresult ForwardStreamListenerFunctions(
             aParams.request->Cancel(rv);
           }
         },
-        [&](const OnStopRequestParams& aParams) {
+        [&](OnStopRequestParams& aParams) {
           if (NS_SUCCEEDED(rv)) {
             aParent->OnStopRequest(aParams.request, aParams.status);
           } else {
@@ -52,7 +50,7 @@ nsresult ForwardStreamListenerFunctions(
           }
           rv = NS_OK;
         },
-        [&](const OnAfterLastPartParams& aParams) {
+        [&](OnAfterLastPartParams& aParams) {
           nsCOMPtr<nsIMultiPartChannelListener> multiListener =
               do_QueryInterface(aParent);
           if (multiListener) {
diff --git a/netwerk/ipc/NeckoCommon.h b/netwerk/ipc/NeckoCommon.h
index 6f63ef1b2a..57f770db68 100644
--- a/netwerk/ipc/NeckoCommon.h
+++ b/netwerk/ipc/NeckoCommon.h
@@ -135,8 +135,8 @@ using StreamListenerFunction =
     mozilla::Variant<OnStartRequestParams, OnDataAvailableParams,
                      OnStopRequestParams, OnAfterLastPartParams>;
 
-nsresult ForwardStreamListenerFunctions(
-    nsTArray<StreamListenerFunction>& aCalls, nsIStreamListener* aParent);
+nsresult ForwardStreamListenerFunctions(nsTArray<StreamListenerFunction> aCalls,
+                                        nsIStreamListener* aParent);
 
 }  // namespace net
 }  // namespace mozilla
diff --git a/netwerk/protocol/http/EarlyHintPreloader.cpp b/netwerk/protocol/http/EarlyHintPreloader.cpp
index 4f06917c44..d21c65aaee 100644
--- a/netwerk/protocol/http/EarlyHintPreloader.cpp
+++ b/netwerk/protocol/http/EarlyHintPreloader.cpp
@@ -542,7 +542,7 @@ void EarlyHintPreloader::InvokeStreamListenerFunctions() {
   nsTArray<StreamListenerFunction> streamListenerFunctions =
       std::move(mStreamListenerFunctions);
 
-  ForwardStreamListenerFunctions(streamListenerFunctions, mParent);
+  ForwardStreamListenerFunctions(std::move(streamListenerFunctions), mParent);
 
   // We don't expect to get new stream listener functions added
   // via re-entrancy. If this ever happens, we should understand
@@ -656,8 +656,8 @@ EarlyHintPreloader::OnDataAvailable(nsIRequest* aRequest,
   nsresult rv = NS_ReadInputStreamToString(aInputStream, data, aCount);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  mStreamListenerFunctions.AppendElement(
-      AsVariant(OnDataAvailableParams{aRequest, data, aOffset, aCount}));
+  mStreamListenerFunctions.AppendElement(AsVariant(
+      OnDataAvailableParams{aRequest, std::move(data), aOffset, aCount}));
 
   return NS_OK;
 }
diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp
index b9118d1898..d2236ab3ad 100644
--- a/netwerk/protocol/http/Http2Session.cpp
+++ b/netwerk/protocol/http/Http2Session.cpp
@@ -574,8 +574,8 @@ already_AddRefed<nsHttpConnection> Http2Session::CreateTunnelStream(
       this, mCurrentBrowserId, aHttpTransaction->ConnectionInfo(),
       aIsWebSocket);
 
-  RefPtr<nsHttpConnection> newConn =
-      refStream->CreateHttpConnection(aHttpTransaction, aCallbacks, aRtt);
+  RefPtr<nsHttpConnection> newConn = refStream->CreateHttpConnection(
+      aHttpTransaction, aCallbacks, aRtt, aIsWebSocket);
 
   mTunnelStreams.AppendElement(std::move(refStream));
   return newConn.forget();
diff --git a/netwerk/protocol/http/Http2StreamTunnel.cpp b/netwerk/protocol/http/Http2StreamTunnel.cpp
index b3147fb732..4e0f05d58b 100644
--- a/netwerk/protocol/http/Http2StreamTunnel.cpp
+++ b/netwerk/protocol/http/Http2StreamTunnel.cpp
@@ -302,7 +302,7 @@ Http2StreamTunnel::GetStatus(nsresult* aStatus) {
 
 already_AddRefed<nsHttpConnection> Http2StreamTunnel::CreateHttpConnection(
     nsAHttpTransaction* httpTransaction, nsIInterfaceRequestor* aCallbacks,
-    PRIntervalTime aRtt) {
+    PRIntervalTime aRtt, bool aIsWebSocket) {
   mInput = new InputStreamTunnel(this);
   mOutput = new OutputStreamTunnel(this);
   RefPtr<nsHttpConnection> conn = new nsHttpConnection();
@@ -311,7 +311,7 @@ already_AddRefed<nsHttpConnection> Http2StreamTunnel::CreateHttpConnection(
   nsresult rv =
       conn->Init(httpTransaction->ConnectionInfo(),
                  gHttpHandler->ConnMgr()->MaxRequestDelay(), this, mInput,
-                 mOutput, true, NS_OK, aCallbacks, aRtt, false);
+                 mOutput, true, NS_OK, aCallbacks, aRtt, aIsWebSocket);
   MOZ_RELEASE_ASSERT(NS_SUCCEEDED(rv));
   mTransaction = httpTransaction;
   return conn.forget();
diff --git a/netwerk/protocol/http/Http2StreamTunnel.h b/netwerk/protocol/http/Http2StreamTunnel.h
index 6ad180c13b..78f0300f4c 100644
--- a/netwerk/protocol/http/Http2StreamTunnel.h
+++ b/netwerk/protocol/http/Http2StreamTunnel.h
@@ -39,7 +39,7 @@ class Http2StreamTunnel : public Http2StreamBase,
 
   already_AddRefed<nsHttpConnection> CreateHttpConnection(
       nsAHttpTransaction* httpTransaction, nsIInterfaceRequestor* aCallbacks,
-      PRIntervalTime aRtt);
+      PRIntervalTime aRtt, bool aIsWebSocket);
 
   nsHttpConnectionInfo* ConnectionInfo() override { return mConnectionInfo; }
 
diff --git a/netwerk/protocol/http/nsHttpAtomList.h b/netwerk/protocol/http/nsHttpAtomList.h
index af8882af0b..c80dfe6057 100644
--- a/netwerk/protocol/http/nsHttpAtomList.h
+++ b/netwerk/protocol/http/nsHttpAtomList.h
@@ -80,6 +80,9 @@ HTTP_ATOM(Range, "Range")
 HTTP_ATOM(Referer, "Referer")
 HTTP_ATOM(Referrer_Policy, "Referrer-Policy")
 HTTP_ATOM(Retry_After, "Retry-After")
+HTTP_ATOM(Sec_WebSocket_Extensions, "Sec-WebSocket-Extensions")
+HTTP_ATOM(Sec_WebSocket_Protocol, "Sec-WebSocket-Protocol")
+HTTP_ATOM(Sec_WebSocket_Version, "Sec-WebSocket-Version")
 HTTP_ATOM(Server, "Server")
 HTTP_ATOM(Server_Timing, "Server-Timing")
 HTTP_ATOM(Service_Worker_Allowed, "Service-Worker-Allowed")
diff --git a/netwerk/protocol/http/nsHttpConnection.cpp b/netwerk/protocol/http/nsHttpConnection.cpp
index 07ca208acd..152a8348b4 100644
--- a/netwerk/protocol/http/nsHttpConnection.cpp
+++ b/netwerk/protocol/http/nsHttpConnection.cpp
@@ -989,8 +989,11 @@ nsresult nsHttpConnection::OnHeadersAvailable(nsAHttpTransaction* trans,
     case HttpConnectionState::SETTING_UP_TUNNEL: {
       nsHttpTransaction* trans = mTransaction->QueryHttpTransaction();
       // Distinguish SETTING_UP_TUNNEL for proxy or websocket via proxy
+      // See bug 1848013. Do not call HandleTunnelResponse for a tunnel
+      // connection created for WebSocket.
       if (trans && trans->IsWebsocketUpgrade() &&
-          trans->GetProxyConnectResponseCode() == 200) {
+          (trans->GetProxyConnectResponseCode() == 200 ||
+           (mForWebSocket && mInSpdyTunnel))) {
         HandleWebSocketResponse(requestHead, responseHead, responseStatus);
       } else {
         HandleTunnelResponse(responseStatus, reset);
@@ -1894,6 +1897,23 @@ nsresult nsHttpConnection::MakeConnectString(nsAHttpTransaction* trans,
     request->SetRequestURI(requestURI);
 
     request->SetHTTPS(trans->RequestHead()->IsHTTPS());
+
+    nsAutoCString val;
+    if (NS_SUCCEEDED(trans->RequestHead()->GetHeader(
+            nsHttp::Sec_WebSocket_Extensions, val))) {
+      rv = request->SetHeader(nsHttp::Sec_WebSocket_Extensions, val);
+      MOZ_ASSERT(NS_SUCCEEDED(rv));
+    }
+    if (NS_SUCCEEDED(trans->RequestHead()->GetHeader(
+            nsHttp::Sec_WebSocket_Protocol, val))) {
+      rv = request->SetHeader(nsHttp::Sec_WebSocket_Protocol, val);
+      MOZ_ASSERT(NS_SUCCEEDED(rv));
+    }
+    if (NS_SUCCEEDED(trans->RequestHead()->GetHeader(
+            nsHttp::Sec_WebSocket_Version, val))) {
+      rv = request->SetHeader(nsHttp::Sec_WebSocket_Version, val);
+      MOZ_ASSERT(NS_SUCCEEDED(rv));
+    }
   } else {
     request->SetRequestURI(result);
   }
@@ -1934,8 +1954,8 @@ nsresult nsHttpConnection::MakeConnectString(nsAHttpTransaction* trans,
   request->Flatten(result, false);
 
   if (LOG1_ENABLED()) {
-    LOG(("nsHttpConnection::MakeConnectString for transaction=%p [",
-         trans->QueryHttpTransaction()));
+    LOG(("nsHttpConnection::MakeConnectString for transaction=%p h2ws=%d[",
+         trans->QueryHttpTransaction(), h2ws));
     LogHeaders(result.BeginReading());
     LOG(("]"));
   }
@@ -2522,7 +2542,8 @@ nsresult nsHttpConnection::SetupProxyConnectStream() {
 
   nsAutoCString buf;
   nsHttpRequestHead request;
-  nsresult rv = MakeConnectString(mTransaction, &request, buf, false,
+  nsresult rv = MakeConnectString(mTransaction, &request, buf,
+                                  mForWebSocket && mInSpdyTunnel,
                                   mTransactionCaps & NS_HTTP_USE_RFP);
   if (NS_FAILED(rv)) {
     return rv;
diff --git a/netwerk/protocol/http/nsHttpConnection.h b/netwerk/protocol/http/nsHttpConnection.h
index 401753f52c..6f00591a2e 100644
--- a/netwerk/protocol/http/nsHttpConnection.h
+++ b/netwerk/protocol/http/nsHttpConnection.h
@@ -362,6 +362,9 @@ class nsHttpConnection final : public HttpConnectionBase,
 
   nsCOMPtr<nsISocketTransport> mSocketTransport;
 
+  // This flag indicates if the connection is used for WebSocket.
+  // - When true and mInSpdyTunnel is also true: WebSocket over HTTP/2.
+  // - When true and mInSpdyTunnel is false: WebSocket over HTTP/1.1.
   bool mForWebSocket{false};
 
   std::function<void()> mContinueHandshakeDone{nullptr};
diff --git a/netwerk/streamconv/converters/nsMultiMixedConv.cpp b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
index 54e57e41b4..6b2ec51be4 100644
--- a/netwerk/streamconv/converters/nsMultiMixedConv.cpp
+++ b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
@@ -21,6 +21,7 @@
 #include "mozilla/AutoRestore.h"
 #include "mozilla/Tokenizer.h"
 #include "nsComponentManagerUtils.h"
+#include "mozilla/StaticPrefs_network.h"
 
 using namespace mozilla;
 
@@ -977,7 +978,8 @@ nsresult nsMultiMixedConv::ProcessHeader() {
       nsCOMPtr<nsIHttpChannelInternal> httpInternal =
           do_QueryInterface(mChannel);
       mResponseHeaderValue.CompressWhitespace();
-      if (httpInternal) {
+      if (!StaticPrefs::network_cookie_prevent_set_cookie_from_multipart() &&
+          httpInternal) {
         DebugOnly<nsresult> rv = httpInternal->SetCookie(mResponseHeaderValue);
         MOZ_ASSERT(NS_SUCCEEDED(rv));
       }
diff --git a/netwerk/test/unit/client-cert.p12 b/netwerk/test/unit/client-cert.p12
index 80c8dad8a0..0f0fd43eba 100644
--- a/netwerk/test/unit/client-cert.p12
+++ b/netwerk/test/unit/client-cert.p12
diff --git a/netwerk/test/unit/test_websocket_server.js b/netwerk/test/unit/test_websocket_server.js
index 8d760cb65a..a33413a02f 100644
--- a/netwerk/test/unit/test_websocket_server.js
+++ b/netwerk/test/unit/test_websocket_server.js
@@ -25,6 +25,24 @@ add_setup(async function setup() {
   });
 });
 
+function makeChan(uri) {
+  let chan = NetUtil.newChannel({
+    uri,
+    loadUsingSystemPrincipal: true,
+  }).QueryInterface(Ci.nsIHttpChannel);
+  chan.loadFlags = Ci.nsIChannel.LOAD_INITIAL_DOCUMENT_URI;
+  return chan;
+}
+
+function httpChannelOpenPromise(chan, flags) {
+  return new Promise(resolve => {
+    function finish(req, buffer) {
+      resolve([req, buffer]);
+    }
+    chan.asyncOpen(new ChannelListener(finish, null, flags));
+  });
+}
+
 async function channelOpenPromise(url, msg) {
   let conn = new WebSocketConnection();
   await conn.open(url);
@@ -257,6 +275,37 @@ async function test_h2_ws_with_h2_proxy() {
   await proxy.stop();
 }
 
+async function test_bug_1848013() {
+  Services.prefs.setBoolPref("network.http.http2.websockets", true);
+
+  let proxy = new NodeHTTPProxyServer();
+  await proxy.start();
+
+  registerCleanupFunction(async () => {
+    await wss.stop();
+    await proxy.stop();
+  });
+
+  let wss = new NodeWebSocketHttp2Server();
+  await wss.start();
+  Assert.notEqual(wss.port(), null);
+  await wss.registerMessageHandler((data, ws) => {
+    ws.send(data);
+  });
+
+  // To create a h2 connection before the websocket one.
+  let chan = makeChan(`https://localhost:${wss.port()}/`);
+  await httpChannelOpenPromise(chan, CL_ALLOW_UNKNOWN_CL);
+
+  let url = `wss://localhost:${wss.port()}`;
+  const msg = "test h2 websocket with h1 insecure proxy";
+  let [status, res] = await channelOpenPromise(url, msg);
+  Assert.equal(status, Cr.NS_OK);
+  Assert.deepEqual(res, [msg]);
+
+  await proxy.stop();
+}
+
 add_task(test_h1_websocket_direct);
 add_task(test_h2_websocket_direct);
 add_task(test_h1_ws_with_secure_h1_proxy);
@@ -265,3 +314,4 @@ add_task(test_h1_ws_with_h2_proxy);
 add_task(test_h2_ws_with_h1_insecure_proxy);
 add_task(test_h2_ws_with_h1_secure_proxy);
 add_task(test_h2_ws_with_h2_proxy);
+add_task(test_bug_1848013);
diff --git a/netwerk/test/unit/test_websocket_server_multiclient.js b/netwerk/test/unit/test_websocket_server_multiclient.js
index 91c5b5d55f..33e730acbf 100644
--- a/netwerk/test/unit/test_websocket_server_multiclient.js
+++ b/netwerk/test/unit/test_websocket_server_multiclient.js
@@ -116,20 +116,17 @@ async function test_h1_ws_with_h2_proxy() {
 
 // ws h2 with insecure h1.1 proxy
 async function test_h2_ws_with_insecure_h1_proxy() {
-  // disabled until bug 1800533 complete
-  // await spinup_and_check(NodeHTTPProxyServer, NodeWebSocketHttp2Server);
+  await spinup_and_check(NodeHTTPProxyServer, NodeWebSocketHttp2Server);
 }
 
 // ws h2 with secure h1 proxy
 async function test_h2_ws_with_secure_h1_proxy() {
-  // disabled until bug 1800533 complete
-  // await spinup_and_check(NodeHTTPSProxyServer, NodeWebSocketHttp2Server);
+  await spinup_and_check(NodeHTTPSProxyServer, NodeWebSocketHttp2Server);
 }
 
 // ws h2 with secure h2 proxy
 async function test_h2_ws_with_h2_proxy() {
-  // disabled until bug 1800533 complete
-  // await spinup_and_check(NodeHTTP2ProxyServer, NodeWebSocketHttp2Server);
+  await spinup_and_check(NodeHTTP2ProxyServer, NodeWebSocketHttp2Server);
 }
 
 add_task(test_h1_websocket_direct);
diff --git a/netwerk/test/unit/xpcshell.ini b/netwerk/test/unit/xpcshell.ini
index 456e8ddfc5..ed69ad2627 100644
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -403,9 +403,7 @@ skip-if = appname == "thunderbird"
 [test_bug464591.js]
 skip-if = appname == "thunderbird"
 [test_alt-data_simple.js]
-skip-if =
-  win10_2004 && bits == 64 # Bug 1718292
-  win11_2009 && bits == 64 && !debug # Bug 1797751
+skip-if = os == "win" # Bug 1760081
 run-sequentially = very high failure rate in parallel
 [test_alt-data_stream.js]
 [test_alt-data_too_big.js]
diff --git a/netwerk/wifi/gtest/moz.build b/netwerk/wifi/gtest/moz.build
index d47976926f..40f6f5b24d 100644
--- a/netwerk/wifi/gtest/moz.build
+++ b/netwerk/wifi/gtest/moz.build
@@ -7,7 +7,7 @@
 LOCAL_INCLUDES += ["/netwerk/wifi"]
 
 UNIFIED_SOURCES += [
-    "TestWifiMonitor.cpp",
+    #    "TestWifiMonitor.cpp",  # see bug 1833020
 ]
 
 FINAL_LIBRARY = "xul-gtest"