--- a/browser/base/content/test/webextensions/browser.ini
+++ b/browser/base/content/test/webextensions/browser.ini
@@ -8,16 +8,18 @@ support-files =
   browser_webext_nopermissions.xpi
   browser_webext_unsigned.xpi
   browser_webext_update1.xpi
   browser_webext_update2.xpi
   browser_webext_update_icon1.xpi
   browser_webext_update_icon2.xpi
   browser_webext_update_perms1.xpi
   browser_webext_update_perms2.xpi
+  browser_webext_update_origins1.xpi
+  browser_webext_update_origins2.xpi
   browser_webext_update.json
   browser_webext_search.xml
 
 [browser_extension_sideloading.js]
 [browser_extension_update_background.js]
 [browser_extension_update_background_noprompt.js]
 [browser_permissions_addons_search.js]
 [browser_permissions_installTrigger.js]

--- a/browser/base/content/test/webextensions/browser_extension_update_background_noprompt.js
+++ b/browser/base/content/test/webextensions/browser_extension_update_background_noprompt.js
@@ -1,24 +1,27 @@
 const {AddonManagerPrivate} = Cu.import("resource://gre/modules/AddonManager.jsm", {});
 
 const ID_PERMS = "update_perms@tests.mozilla.org";
 const ID_LEGACY = "legacy_update@tests.mozilla.org";
+const ID_ORIGINS = "update_origins@tests.mozilla.org";
 
 function getBadgeStatus() {
   let menuButton = document.getElementById("PanelUI-menu-button");
   return menuButton.getAttribute("badge-status");
 }
 
 // Set some prefs that apply to all the tests in this file
 add_task(async function setup() {
   await SpecialPowers.pushPrefEnv({set: [
     // We don't have pre-pinned certificates for the local mochitest server
     ["extensions.install.requireBuiltInCerts", false],
     ["extensions.update.requireBuiltInCerts", false],
+    // Don't require the extensions to be signed
+    ["xpinstall.signatures.required", false],
   ]});
 
   // Navigate away from the initial page so that about:addons always
   // opens in a new tab during tests
   gBrowser.selectedBrowser.loadURI("about:robots");
   await BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
 
   registerCleanupFunction(async function() {
@@ -76,8 +79,13 @@ async function testNoPrompt(origUrl, id)
 // applied without showing a notification dialog.
 add_task(() => testNoPrompt(`${BASE}/browser_webext_update_perms1.xpi`,
                             ID_PERMS));
 
 // Test that an update from a legacy extension to a webextension
 // doesn't show a prompt even when the webextension uses
 // promptable required permissions.
 add_task(() => testNoPrompt(`${BASE}/browser_legacy.xpi`, ID_LEGACY));
+
+// Test that an update that narrows origin permissions is just applied without
+// showing a notification promt
+add_task(() => testNoPrompt(`${BASE}/browser_webext_update_origins1.xpi`,
+                            ID_ORIGINS));

--- a/browser/base/content/test/webextensions/browser_update_interactive_noprompt.js
+++ b/browser/base/content/test/webextensions/browser_update_interactive_noprompt.js
@@ -1,16 +1,19 @@
 
 // Set some prefs that apply to all the tests in this file
 add_task(async function setup() {
   await SpecialPowers.pushPrefEnv({set: [
     // We don't have pre-pinned certificates for the local mochitest server
     ["extensions.install.requireBuiltInCerts", false],
     ["extensions.update.requireBuiltInCerts", false],
 
+    // Don't require the extensions to be signed
+    ["xpinstall.signatures.required", false],
+
     // Point updates to the local mochitest server
     ["extensions.update.url", `${BASE}/browser_webext_update.json`],
   ]});
 });
 
 // Helper to test that an update of a given extension does not
 // generate any permission prompts.
 async function testUpdateNoPrompt(filename, id,
@@ -52,8 +55,13 @@ async function testUpdateNoPrompt(filena
 // extension to a webextension.
 add_task(() => testUpdateNoPrompt("browser_legacy.xpi",
                                   "legacy_update@tests.mozilla.org", "1.1"));
 
 // Test that we don't see a prompt when no new promptable permissions
 // are added.
 add_task(() => testUpdateNoPrompt("browser_webext_update_perms1.xpi",
                                   "update_perms@tests.mozilla.org"));
+
+// Test that an update that narrows origin permissions is just applied without
+// showing a notification promt
+add_task(() => testUpdateNoPrompt("browser_webext_update_origins1.xpi",
+                                  "update_origins@tests.mozilla.org"));

--- a/browser/base/content/test/webextensions/browser_webext_update.json
+++ b/browser/base/content/test/webextensions/browser_webext_update.json
@@ -47,11 +47,24 @@
           "applications": {
             "gecko": {
               "strict_min_version": "1",
               "advisory_max_version": "*"
             }
           }
         }
       ]
+    },
+    "update_origins@tests.mozilla.org": {
+      "updates": [
+        {
+          "version": "2.0",
+          "update_link": "https://example.com/browser/browser/base/content/test/webextensions/browser_webext_update_origins2.xpi",
+          "applications": {
+            "gecko": {
+              "strict_min_version": "1"
+            }
+          }
+        }
+      ]
     }
   }
 }

new file mode 100644
index 0000000000000000000000000000000000000000..2909f8e8fdc3000c101998740363dd69f21c2fc4
GIT binary patch
literal 268
zc$^FHW@h1HU|`^2&||dl*2~C!JpstO4aB@aoST@JnU-2yqL)>ipXb|in(L4QkL&lp
zU6Z!*yb5yp!#`2zRz%b1B%`;7jQ-~>6D<|q@%+x6rJ2zMFMc{s+C6hp!H0sZ{@q$O
zR+kteRoA2_yc9mZXY0Qs??w62)~|8uxmeV{RX0m4)yw_W{D;z_9|G<#vq)H`ry_Ur
z^j5#_!iPt%E#k~<*&6p{TCQzSk<KT{{Rbu2zFn5`l<E62ll%a0MkWyk+>S>DC|(Kh
RW@Q5jG6JDBklqbe0ss%QU@8Cr

new file mode 100644
index 0000000000000000000000000000000000000000..b1051affb152c65f5e0494b9898e2f549ba8a7d8
GIT binary patch
literal 275
zc$^FHW@h1HU|`^2Sio)J9V9>f-*h1F2@vxFac*K>W?E`-iC$K5ex7g7X|6*C0<Pcx
zb{U;kT3K>)>VL%`C#z`(_ndGM^!|6(Q~OoggL%cz*ZJOVx;$^)iOQ;kBrdsQWfmb1
zw>oo9a6ROfmNHr6+1{_}b?XgQEZ)FX+B2<ZU9Q+>F5z7ZcDCk=I270JJ|3Aq$7xZk
z&HPs;+Tw93Yr_<EH(c$$vuVA%Pu~pt$LTMQ?Rzg`x3ybrD(AZQ4=zo4#v9<x$Rxsm
Y+YhJ!#YX|&tZX1bMj*5X(ucrG06h3(WB>pF