Merge branch 'master' into remove-unboxed

2 files changed, 12 insertions, 9 deletions

diff --git a/widget/cocoa/nsNativeThemeCocoa.mm b/widget/cocoa/nsNativeThemeCocoa.mm
index 597c25a48..fc4f7f2e9 100644
--- a/widget/cocoa/nsNativeThemeCocoa.mm
+++ b/widget/cocoa/nsNativeThemeCocoa.mm
@@ -2778,9 +2778,8 @@ nsNativeThemeCocoa::DrawWidgetBackground(nsRenderingContext* aContext,
       NSMutableDictionary* options = [NSMutableDictionary dictionaryWithObjectsAndKeys:
         (isOverlay ? @"kCUIWidgetOverlayScrollBar" : @"scrollbar"), @"widget",
         (isSmall ? @"small" : @"regular"), @"size",
-        (isOverlay && isOnTopOfDarkBackground ? @"kCUIVariantWhite" : @""),
-          @"kCUIVariantKey",
-        (isOnTopOfDarkBackground ? @"kCUIVariantWhite" : @""), @"kCUIVariantKey",
+        (isHorizontal ? @"kCUIOrientHorizontal" : @"kCUIOrientVertical"), @"kCUIOrientationKey",
+        (isOverlay && isOnTopOfDarkBackground ? @"kCUIVariantWhite" : @""), @"kCUIVariantKey",
         [NSNumber numberWithBool:YES], @"indiconly",
         [NSNumber numberWithBool:YES], @"kCUIThumbProportionKey",
         [NSNumber numberWithBool:YES], @"is.flipped",
diff --git a/widget/windows/nsClipboard.cpp b/widget/windows/nsClipboard.cpp
index c93f351c8..0ca9568d0 100644
--- a/widget/windows/nsClipboard.cpp
+++ b/widget/windows/nsClipboard.cpp
@@ -291,16 +291,20 @@ nsresult nsClipboard::GetGlobalData(HGLOBAL aHGBL, void ** aData, uint32_t * aLe
   nsresult  result = NS_ERROR_FAILURE;
   if (aHGBL != nullptr) {
     LPSTR lpStr = (LPSTR) GlobalLock(aHGBL);
-    DWORD allocSize = GlobalSize(aHGBL);
-    char* data = static_cast<char*>(malloc(allocSize + 3));
+    CheckedInt<uint32_t> allocSize = CheckedInt<uint32_t>(GlobalSize(aHGBL)) + 3;
+    if (!allocSize.isValid()) {
+      return NS_ERROR_INVALID_ARG;
+    }
+    char* data = static_cast<char*>(malloc(allocSize.value()));
     if ( data ) {    
-      memcpy ( data, lpStr, allocSize );
-      data[allocSize] = data[allocSize + 1] = data[allocSize + 2] =
-          '\0'; // null terminate for safety
+      uint32_t size = allocSize.value() - 3;
+      memcpy(data, lpStr, size);
+      // null terminate for safety
+      data[size] = data[size + 1] = data[size + 2] = '\0';
 
       GlobalUnlock(aHGBL);
       *aData = data;
-      *aLen = allocSize;
+      *aLen = size;
 
       result = NS_OK;
     }