summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--gnu-system.am11
-rw-r--r--gnu/packages/gnuzilla.scm15
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-0797.patch35
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2708-pt1.patch240
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2708-pt2.patch284
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2708-pt3.patch228
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2708-pt4.patch26
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2710-pt1.patch199
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2710-pt2.patch64
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2710-pt3.patch50
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2713-pt1.patch102
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2713-pt2.patch47
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2716.patch62
13 files changed, 2 insertions, 1361 deletions
diff --git a/gnu-system.am b/gnu-system.am
index 2cd4c62cf73..3073fef498b 100644
--- a/gnu-system.am
+++ b/gnu-system.am
@@ -453,17 +453,6 @@ dist_patch_DATA = \
453 gnu/packages/patches/gtkglext-disable-disable-deprecated.patch \ 453 gnu/packages/patches/gtkglext-disable-disable-deprecated.patch \
454 gnu/packages/patches/hop-bigloo-4.0b.patch \ 454 gnu/packages/patches/hop-bigloo-4.0b.patch \
455 gnu/packages/patches/hop-linker-flags.patch \ 455 gnu/packages/patches/hop-linker-flags.patch \
456 gnu/packages/patches/icecat-CVE-2015-0797.patch \
457 gnu/packages/patches/icecat-CVE-2015-2708-pt1.patch \
458 gnu/packages/patches/icecat-CVE-2015-2708-pt2.patch \
459 gnu/packages/patches/icecat-CVE-2015-2708-pt3.patch \
460 gnu/packages/patches/icecat-CVE-2015-2708-pt4.patch \
461 gnu/packages/patches/icecat-CVE-2015-2710-pt1.patch \
462 gnu/packages/patches/icecat-CVE-2015-2710-pt2.patch \
463 gnu/packages/patches/icecat-CVE-2015-2710-pt3.patch \
464 gnu/packages/patches/icecat-CVE-2015-2713-pt1.patch \
465 gnu/packages/patches/icecat-CVE-2015-2713-pt2.patch \
466 gnu/packages/patches/icecat-CVE-2015-2716.patch \
467 gnu/packages/patches/irrlicht-mesa-10.patch \ 456 gnu/packages/patches/irrlicht-mesa-10.patch \
468 gnu/packages/patches/jbig2dec-ignore-testtest.patch \ 457 gnu/packages/patches/jbig2dec-ignore-testtest.patch \
469 gnu/packages/patches/kmod-module-directory.patch \ 458 gnu/packages/patches/kmod-module-directory.patch \
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index 2450a1e68a1..7caa7314a9b 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -225,7 +225,7 @@ standards.")
225(define-public icecat 225(define-public icecat
226 (package 226 (package
227 (name "icecat") 227 (name "icecat")
228 (version "31.6.0-gnu1") 228 (version "31.7.0-gnu1")
229 (source 229 (source
230 (origin 230 (origin
231 (method url-fetch) 231 (method url-fetch)
@@ -234,18 +234,7 @@ standards.")
234 name "-" version ".tar.bz2")) 234 name "-" version ".tar.bz2"))
235 (sha256 235 (sha256
236 (base32 236 (base32
237 "1a4l23msg4cpc4yp59q2z6xv63r6advlbnjy65v4djv6yhgnqf1i")) 237 "0a25jp5afla2dxzj7i4cyvqpa5smsn7ns3xvpzqw6pc7naixkpap"))))
238 (patches (map search-patch '("icecat-CVE-2015-0797.patch"
239 "icecat-CVE-2015-2708-pt1.patch"
240 "icecat-CVE-2015-2708-pt2.patch"
241 "icecat-CVE-2015-2708-pt3.patch"
242 "icecat-CVE-2015-2708-pt4.patch"
243 "icecat-CVE-2015-2710-pt1.patch"
244 "icecat-CVE-2015-2710-pt2.patch"
245 "icecat-CVE-2015-2710-pt3.patch"
246 "icecat-CVE-2015-2713-pt1.patch"
247 "icecat-CVE-2015-2713-pt2.patch"
248 "icecat-CVE-2015-2716.patch")))))
249 (build-system gnu-build-system) 238 (build-system gnu-build-system)
250 (inputs 239 (inputs
251 `(("alsa-lib" ,alsa-lib) 240 `(("alsa-lib" ,alsa-lib)
diff --git a/gnu/packages/patches/icecat-CVE-2015-0797.patch b/gnu/packages/patches/icecat-CVE-2015-0797.patch
deleted file mode 100644
index 5727ed753ca..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-0797.patch
+++ /dev/null
@@ -1,35 +0,0 @@
1From 147543038273042f71284fa8487c71670163da5f Mon Sep 17 00:00:00 2001
2From: Ralph Giles <giles@mozilla.com>
3Date: Tue, 31 Mar 2015 16:18:22 -0700
4Subject: [PATCH] Bug 1080995 - Don't use the h264parser gstreamer element.
5 r=kinetik, a=sledru
6
7---
8 content/media/gstreamer/GStreamerFormatHelper.cpp | 4 +++-
9 1 file changed, 3 insertions(+), 1 deletion(-)
10
11diff --git a/content/media/gstreamer/GStreamerFormatHelper.cpp b/content/media/gstreamer/GStreamerFormatHelper.cpp
12index 25095e7..ebd12c2 100644
13--- a/content/media/gstreamer/GStreamerFormatHelper.cpp
14+++ b/content/media/gstreamer/GStreamerFormatHelper.cpp
15@@ -67,6 +67,7 @@ static char const * const sDefaultCodecCaps[][2] = {
16
17 static char const * const sPluginBlacklist[] = {
18 "flump3dec",
19+ "h264parse",
20 };
21
22 GStreamerFormatHelper::GStreamerFormatHelper()
23@@ -251,7 +252,8 @@ static gboolean FactoryFilter(GstPluginFeature *aFeature, gpointer)
24 const gchar *className =
25 gst_element_factory_get_klass(GST_ELEMENT_FACTORY_CAST(aFeature));
26
27- if (!strstr(className, "Decoder") && !strstr(className, "Demux")) {
28+ if (!strstr(className, "Decoder") && !strstr(className, "Demux") &&
29+ !strstr(className, "Parser")) {
30 return FALSE;
31 }
32
33--
342.2.1
35
diff --git a/gnu/packages/patches/icecat-CVE-2015-2708-pt1.patch b/gnu/packages/patches/icecat-CVE-2015-2708-pt1.patch
deleted file mode 100644
index e755d7531aa..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2708-pt1.patch
+++ /dev/null
@@ -1,240 +0,0 @@
1From 5f61ae17ec82d288a3fe4892ec999c0e20c486c0 Mon Sep 17 00:00:00 2001
2From: "Byron Campen [:bwc]" <docfaraday@gmail.com>
3Date: Mon, 6 Apr 2015 11:52:28 -0700
4Subject: [PATCH] Bug 1151139 - Simplify how we choose which streams to gather
5 stats from. r=mt, a=abillings
6
7---
8 ...t_peerConnection_offerRequiresReceiveAudio.html | 2 +
9 ...t_peerConnection_offerRequiresReceiveVideo.html | 2 +
10 ...rConnection_offerRequiresReceiveVideoAudio.html | 2 +
11 media/mtransport/nricectx.h | 13 +++++
12 media/mtransport/nricemediastream.cpp | 1 +
13 media/mtransport/nricemediastream.h | 5 +-
14 .../src/peerconnection/PeerConnectionImpl.cpp | 66 ++++++++++------------
15 .../src/peerconnection/PeerConnectionImpl.h | 2 +-
16 8 files changed, 54 insertions(+), 39 deletions(-)
17
18diff --git a/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveAudio.html b/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveAudio.html
19index 69d7e49..d68c078 100644
20--- a/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveAudio.html
21+++ b/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveAudio.html
22@@ -17,6 +17,8 @@
23
24 runTest(function() {
25 var test = new PeerConnectionTest();
26+ test.chain.remove('PC_LOCAL_CHECK_STATS');
27+ test.chain.remove('PC_REMOTE_CHECK_STATS');
28 test.setOfferConstraints({ mandatory: { OfferToReceiveAudio: true } });
29 test.run();
30 });
31diff --git a/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideo.html b/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideo.html
32index 5f1d0e5..0ecb0b7 100644
33--- a/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideo.html
34+++ b/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideo.html
35@@ -17,6 +17,8 @@
36
37 runTest(function() {
38 var test = new PeerConnectionTest();
39+ test.chain.remove('PC_LOCAL_CHECK_STATS');
40+ test.chain.remove('PC_REMOTE_CHECK_STATS');
41 test.setOfferConstraints({ mandatory: { OfferToReceiveVideo: true } });
42 test.run();
43 });
44diff --git a/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideoAudio.html b/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideoAudio.html
45index c3dea10..78eb0d4 100644
46--- a/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideoAudio.html
47+++ b/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideoAudio.html
48@@ -17,6 +17,8 @@
49
50 runTest(function() {
51 var test = new PeerConnectionTest();
52+ test.chain.remove('PC_LOCAL_CHECK_STATS');
53+ test.chain.remove('PC_REMOTE_CHECK_STATS');
54 test.setOfferConstraints({ mandatory: {
55 OfferToReceiveVideo: true,
56 OfferToReceiveAudio: true
57diff --git a/media/mtransport/nricectx.h b/media/mtransport/nricectx.h
58index d1209a7..7350666 100644
59--- a/media/mtransport/nricectx.h
60+++ b/media/mtransport/nricectx.h
61@@ -196,6 +196,19 @@ class NrIceCtx {
62 RefPtr<NrIceMediaStream> CreateStream(const std::string& name,
63 int components);
64
65+ RefPtr<NrIceMediaStream> GetStream(size_t index) {
66+ if (index < streams_.size()) {
67+ return streams_[index];
68+ }
69+ return nullptr;
70+ }
71+
72+ // Some might be null
73+ size_t GetStreamCount() const
74+ {
75+ return streams_.size();
76+ }
77+
78 // The name of the ctx
79 const std::string& name() const { return name_; }
80
81diff --git a/media/mtransport/nricemediastream.cpp b/media/mtransport/nricemediastream.cpp
82index 9e96cb5..d2b6429 100644
83--- a/media/mtransport/nricemediastream.cpp
84+++ b/media/mtransport/nricemediastream.cpp
85@@ -209,6 +209,7 @@ nsresult NrIceMediaStream::ParseAttributes(std::vector<std::string>&
86 return NS_ERROR_FAILURE;
87 }
88
89+ has_parsed_attrs_ = true;
90 return NS_OK;
91 }
92
93diff --git a/media/mtransport/nricemediastream.h b/media/mtransport/nricemediastream.h
94index aba5fc3..2494ecf 100644
95--- a/media/mtransport/nricemediastream.h
96+++ b/media/mtransport/nricemediastream.h
97@@ -149,6 +149,7 @@ class NrIceMediaStream {
98
99 // Parse remote attributes
100 nsresult ParseAttributes(std::vector<std::string>& candidates);
101+ bool HasParsedAttributes() const { return has_parsed_attrs_; }
102
103 // Parse trickle ICE candidate
104 nsresult ParseTrickleCandidate(const std::string& candidate);
105@@ -204,7 +205,8 @@ class NrIceMediaStream {
106 name_(name),
107 components_(components),
108 stream_(nullptr),
109- opaque_(nullptr) {}
110+ opaque_(nullptr),
111+ has_parsed_attrs_(false) {}
112
113 DISALLOW_COPY_ASSIGN(NrIceMediaStream);
114
115@@ -214,6 +216,7 @@ class NrIceMediaStream {
116 const int components_;
117 nr_ice_media_stream *stream_;
118 ScopedDeletePtr<NrIceOpaque> opaque_;
119+ bool has_parsed_attrs_;
120 };
121
122
123diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
124index ebcc17d..c70e3e4 100644
125--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
126+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
127@@ -149,7 +149,8 @@ PRLogModuleInfo *signalingLogInfo() {
128 namespace sipcc {
129
130 #ifdef MOZILLA_INTERNAL_API
131-RTCStatsQuery::RTCStatsQuery(bool internal) : internalStats(internal) {
132+RTCStatsQuery::RTCStatsQuery(bool internal) : internalStats(internal),
133+ grabAllLevels(false) {
134 }
135
136 RTCStatsQuery::~RTCStatsQuery() {
137@@ -2037,32 +2038,8 @@ PeerConnectionImpl::BuildStatsQuery_m(
138
139 query->iceCtx = mMedia->ice_ctx();
140
141- // From the list of MediaPipelines, determine the set of NrIceMediaStreams
142- // we are interested in.
143- std::set<size_t> levelsToGrab;
144- if (trackId) {
145- for (size_t p = 0; p < query->pipelines.Length(); ++p) {
146- size_t level = query->pipelines[p]->level();
147- MOZ_ASSERT(level);
148- levelsToGrab.insert(level);
149- }
150- } else {
151- // We want to grab all streams, so ignore the pipelines (this also ends up
152- // grabbing DataChannel streams, which is what we want)
153- for (size_t s = 0; s < mMedia->num_ice_media_streams(); ++s) {
154- levelsToGrab.insert(s + 1); // mIceStreams is 0-indexed
155- }
156- }
157-
158- for (auto s = levelsToGrab.begin(); s != levelsToGrab.end(); ++s) {
159- // TODO(bcampen@mozilla.com): I may need to revisit this for bundle.
160- // (Bug 786234)
161- RefPtr<NrIceMediaStream> temp(mMedia->ice_media_stream(*s - 1));
162- RefPtr<TransportFlow> flow(mMedia->GetTransportFlow(*s, false));
163- // flow can be null for unused levels, such as unused DataChannels
164- if (temp && flow) {
165- query->streams.AppendElement(temp);
166- }
167+ if (!trackId) {
168+ query->grabAllLevels = true;
169 }
170
171 return rv;
172@@ -2103,6 +2080,9 @@ static void RecordIceStats_s(
173 bool internalStats,
174 DOMHighResTimeStamp now,
175 RTCStatsReportInternal* report) {
176+ if (!mediaStream.HasParsedAttributes()) {
177+ return;
178+ }
179
180 NS_ConvertASCIItoUTF16 componentId(mediaStream.name().c_str());
181 if (internalStats) {
182@@ -2292,20 +2272,32 @@ PeerConnectionImpl::ExecuteStatsQuery_s(RTCStatsQuery *query) {
183 break;
184 }
185 }
186+
187+ if (!query->grabAllLevels) {
188+ // If we're grabbing all levels, that means we want datachannels too,
189+ // which don't have pipelines.
190+ if (query->iceCtx->GetStream(p - 1)) {
191+ RecordIceStats_s(*query->iceCtx->GetStream(p - 1),
192+ query->internalStats,
193+ query->now,
194+ &(query->report));
195+ }
196+ }
197 }
198
199- // Gather stats from ICE
200- for (size_t s = 0; s != query->streams.Length(); ++s) {
201- RecordIceStats_s(*query->streams[s],
202- query->internalStats,
203- query->now,
204- &(query->report));
205+ if (query->grabAllLevels) {
206+ for (size_t i = 0; i < query->iceCtx->GetStreamCount(); ++i) {
207+ if (query->iceCtx->GetStream(i)) {
208+ RecordIceStats_s(*query->iceCtx->GetStream(i),
209+ query->internalStats,
210+ query->now,
211+ &(query->report));
212+ }
213+ }
214 }
215
216- // NrIceCtx and NrIceMediaStream must be destroyed on STS, so it is not safe
217- // to dispatch them back to main.
218- // We clear streams first to maintain destruction order
219- query->streams.Clear();
220+ // NrIceCtx must be destroyed on STS, so it is not safe
221+ // to dispatch it back to main.
222 query->iceCtx = nullptr;
223 return NS_OK;
224 }
225diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
226index 847085c..497230a 100644
227--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
228+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
229@@ -174,7 +174,7 @@ class RTCStatsQuery {
230 bool internalStats;
231 nsTArray<mozilla::RefPtr<mozilla::MediaPipeline>> pipelines;
232 mozilla::RefPtr<NrIceCtx> iceCtx;
233- nsTArray<mozilla::RefPtr<NrIceMediaStream>> streams;
234+ bool grabAllLevels;
235 DOMHighResTimeStamp now;
236 };
237 #endif // MOZILLA_INTERNAL_API
238--
2392.2.1
240
diff --git a/gnu/packages/patches/icecat-CVE-2015-2708-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2708-pt2.patch
deleted file mode 100644
index 9788806557e..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2708-pt2.patch
+++ /dev/null
@@ -1,284 +0,0 @@
1From 272c1ba11fac7a9ceede2f4f737bb27b4bbcad71 Mon Sep 17 00:00:00 2001
2From: Steve Fink <sfink@mozilla.com>
3Date: Thu, 19 Mar 2015 20:50:57 -0700
4Subject: [PATCH] Bug 1120655 - Suppress zone/compartment collection while
5 iterating. r=terrence, a=bkerensa
6
7---
8 js/src/gc/Zone.h | 9 ++++----
9 js/src/jsgc.cpp | 57 +++++++++++++++++++++++++++++++++++----------------
10 js/src/jsgc.h | 11 +++++++++-
11 js/src/vm/Runtime.cpp | 1 +
12 js/src/vm/Runtime.h | 3 +++
13 5 files changed, 58 insertions(+), 23 deletions(-)
14
15diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
16index e7f687a..dd058f0 100644
17--- a/js/src/gc/Zone.h
18+++ b/js/src/gc/Zone.h
19@@ -353,10 +353,11 @@ enum ZoneSelector {
20
21 class ZonesIter {
22 private:
23+ gc::AutoEnterIteration iterMarker;
24 JS::Zone **it, **end;
25
26 public:
27- ZonesIter(JSRuntime *rt, ZoneSelector selector) {
28+ ZonesIter(JSRuntime *rt, ZoneSelector selector) : iterMarker(rt) {
29 it = rt->zones.begin();
30 end = rt->zones.end();
31
32@@ -427,13 +428,13 @@ struct CompartmentsInZoneIter
33 template<class ZonesIterT>
34 class CompartmentsIterT
35 {
36- private:
37+ gc::AutoEnterIteration iterMarker;
38 ZonesIterT zone;
39 mozilla::Maybe<CompartmentsInZoneIter> comp;
40
41 public:
42 explicit CompartmentsIterT(JSRuntime *rt)
43- : zone(rt)
44+ : iterMarker(rt), zone(rt)
45 {
46 if (zone.done())
47 comp.construct();
48@@ -442,7 +443,7 @@ class CompartmentsIterT
49 }
50
51 CompartmentsIterT(JSRuntime *rt, ZoneSelector selector)
52- : zone(rt, selector)
53+ : iterMarker(rt), zone(rt, selector)
54 {
55 if (zone.done())
56 comp.construct();
57diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
58index 15c86c8..1dfe0ab 100644
59--- a/js/src/jsgc.cpp
60+++ b/js/src/jsgc.cpp
61@@ -2525,7 +2525,7 @@ ReleaseObservedTypes(JSRuntime* rt)
62 * arbitrary compartment in the zone.
63 */
64 static void
65-SweepCompartments(FreeOp *fop, Zone *zone, bool keepAtleastOne, bool lastGC)
66+SweepCompartments(FreeOp *fop, Zone *zone, bool keepAtleastOne, bool destroyingRuntime)
67 {
68 JSRuntime *rt = zone->runtimeFromMainThread();
69 JSDestroyCompartmentCallback callback = rt->destroyCompartmentCallback;
70@@ -2543,7 +2543,7 @@ SweepCompartments(FreeOp *fop, Zone *zone, bool keepAtleastOne, bool lastGC)
71 * deleted and keepAtleastOne is true.
72 */
73 bool dontDelete = read == end && !foundOne && keepAtleastOne;
74- if ((!comp->marked && !dontDelete) || lastGC) {
75+ if ((!comp->marked && !dontDelete) || destroyingRuntime) {
76 if (callback)
77 callback(fop, comp);
78 if (comp->principals)
79@@ -2559,9 +2559,13 @@ SweepCompartments(FreeOp *fop, Zone *zone, bool keepAtleastOne, bool lastGC)
80 }
81
82 static void
83-SweepZones(FreeOp *fop, bool lastGC)
84+SweepZones(FreeOp *fop, bool destroyingRuntime)
85 {
86 JSRuntime *rt = fop->runtime();
87+ MOZ_ASSERT_IF(destroyingRuntime, rt->numActiveZoneIters == 0);
88+ if (rt->numActiveZoneIters)
89+ return;
90+
91 JSZoneCallback callback = rt->destroyZoneCallback;
92
93 /* Skip the atomsCompartment zone. */
94@@ -2576,17 +2580,17 @@ SweepZones(FreeOp* fop, bool lastGC)
95
96 if (zone->wasGCStarted()) {
97 if ((zone->allocator.arenas.arenaListsAreEmpty() && !zone->hasMarkedCompartments()) ||
98- lastGC)
99+ destroyingRuntime)
100 {
101 zone->allocator.arenas.checkEmptyFreeLists();
102 if (callback)
103 callback(zone);
104- SweepCompartments(fop, zone, false, lastGC);
105+ SweepCompartments(fop, zone, false, destroyingRuntime);
106 JS_ASSERT(zone->compartments.empty());
107 fop->delete_(zone);
108 continue;
109 }
110- SweepCompartments(fop, zone, true, lastGC);
111+ SweepCompartments(fop, zone, true, destroyingRuntime);
112 }
113 *write++ = zone;
114 }
115@@ -3787,7 +3791,7 @@ EndSweepingZoneGroup(JSRuntime *rt)
116 }
117
118 static void
119-BeginSweepPhase(JSRuntime *rt, bool lastGC)
120+BeginSweepPhase(JSRuntime *rt, bool destroyingRuntime)
121 {
122 /*
123 * Sweep phase.
124@@ -3804,7 +3808,7 @@ BeginSweepPhase(JSRuntime *rt, bool lastGC)
125 gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_SWEEP);
126
127 #ifdef JS_THREADSAFE
128- rt->gcSweepOnBackgroundThread = !lastGC && rt->useHelperThreads();
129+ rt->gcSweepOnBackgroundThread = !destroyingRuntime && rt->useHelperThreads();
130 #endif
131
132 #ifdef DEBUG
133@@ -3903,12 +3907,12 @@ SweepPhase(JSRuntime *rt, SliceBudget &sliceBudget)
134 }
135
136 static void
137-EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, bool lastGC)
138+EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, bool destroyingRuntime)
139 {
140 gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_SWEEP);
141 FreeOp fop(rt, rt->gcSweepOnBackgroundThread);
142
143- JS_ASSERT_IF(lastGC, !rt->gcSweepOnBackgroundThread);
144+ JS_ASSERT_IF(destroyingRuntime, !rt->gcSweepOnBackgroundThread);
145
146 JS_ASSERT(rt->gcMarker.isDrained());
147 rt->gcMarker.stop();
148@@ -3959,8 +3963,8 @@ EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, bool lastGC)
149 * This removes compartments from rt->compartment, so we do it last to make
150 * sure we don't miss sweeping any compartments.
151 */
152- if (!lastGC)
153- SweepZones(&fop, lastGC);
154+ if (!destroyingRuntime)
155+ SweepZones(&fop, destroyingRuntime);
156
157 if (!rt->gcSweepOnBackgroundThread) {
158 /*
159@@ -4001,8 +4005,8 @@ EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, bool lastGC)
160 rt->freeLifoAlloc.freeAll();
161
162 /* Ensure the compartments get swept if it's the last GC. */
163- if (lastGC)
164- SweepZones(&fop, lastGC);
165+ if (destroyingRuntime)
166+ SweepZones(&fop, destroyingRuntime);
167 }
168
169 for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
170@@ -4339,7 +4343,7 @@ IncrementalCollectSlice(JSRuntime *rt,
171 AutoCopyFreeListToArenasForGC copy(rt);
172 AutoGCSlice slice(rt);
173
174- bool lastGC = (reason == JS::gcreason::DESTROY_RUNTIME);
175+ bool destroyingRuntime = (reason == JS::gcreason::DESTROY_RUNTIME);
176
177 gc::State initialState = rt->gcIncrementalState;
178
179@@ -4384,7 +4388,7 @@ IncrementalCollectSlice(JSRuntime *rt,
180 return;
181 }
182
183- if (!lastGC)
184+ if (!destroyingRuntime)
185 PushZealSelectedObjects(rt);
186
187 rt->gcIncrementalState = MARK;
188@@ -4426,7 +4430,7 @@ IncrementalCollectSlice(JSRuntime *rt,
189 * This runs to completion, but we don't continue if the budget is
190 * now exhasted.
191 */
192- BeginSweepPhase(rt, lastGC);
193+ BeginSweepPhase(rt, destroyingRuntime);
194 if (sliceBudget.isOverBudget())
195 break;
196
197@@ -4445,7 +4449,7 @@ IncrementalCollectSlice(JSRuntime *rt,
198 if (!finished)
199 break;
200
201- EndSweepPhase(rt, gckind, lastGC);
202+ EndSweepPhase(rt, gckind, destroyingRuntime);
203
204 if (rt->gcSweepOnBackgroundThread)
205 rt->gcHelperThread.startBackgroundSweep(gckind == GC_SHRINK);
206@@ -5386,3 +5390,20 @@ JS::AutoAssertNoGC::~AutoAssertNoGC()
207 MOZ_ASSERT(gcNumber == runtime->gcNumber, "GC ran inside an AutoAssertNoGC scope.");
208 }
209 #endif
210+
211+namespace js {
212+namespace gc {
213+
214+AutoEnterIteration::AutoEnterIteration(JSRuntime *rt_) : rt(rt_)
215+{
216+ ++rt->numActiveZoneIters;
217+}
218+
219+AutoEnterIteration::~AutoEnterIteration()
220+{
221+ MOZ_ASSERT(rt->numActiveZoneIters);
222+ --rt->numActiveZoneIters;
223+}
224+
225+} /* namespace gc */
226+} /* namespace js */
227diff --git a/js/src/jsgc.h b/js/src/jsgc.h
228index 825cff5..ca331c0 100644
229--- a/js/src/jsgc.h
230+++ b/js/src/jsgc.h
231@@ -1077,7 +1077,7 @@ MaybeVerifyBarriers(JSContext* cx, bool always = false)
232 /*
233 * Instances of this class set the |JSRuntime::suppressGC| flag for the duration
234 * that they are live. Use of this class is highly discouraged. Please carefully
235- * read the comment in jscntxt.h above |suppressGC| and take all appropriate
236+ * read the comment in vm/Runtime.h above |suppressGC| and take all appropriate
237 * precautions before instantiating this class.
238 */
239 class AutoSuppressGC
240@@ -1113,6 +1113,15 @@ class AutoEnterOOMUnsafeRegion
241 class AutoEnterOOMUnsafeRegion {};
242 #endif /* DEBUG */
243
244+/* Prevent compartments and zones from being collected during iteration. */
245+class AutoEnterIteration {
246+ JSRuntime *rt;
247+
248+ public:
249+ AutoEnterIteration(JSRuntime *rt_);
250+ ~AutoEnterIteration();
251+};
252+
253 } /* namespace gc */
254
255 #ifdef DEBUG
256diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
257index bb5c8680..0d8c6cd 100644
258--- a/js/src/vm/Runtime.cpp
259+++ b/js/src/vm/Runtime.cpp
260@@ -195,6 +195,7 @@ JSRuntime::JSRuntime(JSRuntime *parentRuntime, JSUseHelperThreads useHelperThrea
261 gcShouldCleanUpEverything(false),
262 gcGrayBitsValid(false),
263 gcIsNeeded(0),
264+ numActiveZoneIters(0),
265 gcStats(thisFromCtor()),
266 gcNumber(0),
267 gcStartNumber(0),
268diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
269index 5aeb924..ba4180e 100644
270--- a/js/src/vm/Runtime.h
271+++ b/js/src/vm/Runtime.h
272@@ -1061,6 +1061,9 @@ struct JSRuntime : public JS::shadow::Runtime,
273 */
274 volatile uintptr_t gcIsNeeded;
275
276+ mozilla::Atomic<size_t, mozilla::ReleaseAcquire> numActiveZoneIters;
277+ friend class js::gc::AutoEnterIteration;
278+
279 js::gcstats::Statistics gcStats;
280
281 /* Incremented on every GC slice. */
282--
2832.2.1
284
diff --git a/gnu/packages/patches/icecat-CVE-2015-2708-pt3.patch b/gnu/packages/patches/icecat-CVE-2015-2708-pt3.patch
deleted file mode 100644
index f684804d0b7..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2708-pt3.patch
+++ /dev/null
@@ -1,228 +0,0 @@
1From 4dcbca8b3c26b451e1376cd1b7c88ab984a45b39 Mon Sep 17 00:00:00 2001
2From: Mats Palmgren <mats@mozilla.com>
3Date: Tue, 14 Apr 2015 22:12:39 -0400
4Subject: [PATCH] Bug 1143299 - Make frame insertion methods deal with
5 aPrevFrame being on an overflow list. r=roc, a=bkerensa
6
7---
8 layout/generic/nsBlockFrame.cpp | 18 ++++++++++++---
9 layout/generic/nsBlockFrame.h | 14 ++++++++----
10 layout/generic/nsContainerFrame.cpp | 41 +++++++++++++++++++---------------
11 layout/tables/nsTableFrame.cpp | 2 ++
12 layout/tables/nsTableRowFrame.cpp | 2 ++
13 layout/tables/nsTableRowGroupFrame.cpp | 2 ++
14 6 files changed, 54 insertions(+), 25 deletions(-)
15
16diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
17index a011bcf..70d5297 100644
18--- a/layout/generic/nsBlockFrame.cpp
19+++ b/layout/generic/nsBlockFrame.cpp
20@@ -1049,7 +1049,7 @@ nsBlockFrame::Reflow(nsPresContext* aPresContext,
21 state.mOverflowTracker = &tracker;
22
23 // Drain & handle pushed floats
24- DrainPushedFloats(state);
25+ DrainPushedFloats();
26 nsOverflowAreas fcBounds;
27 nsReflowStatus fcStatus = NS_FRAME_COMPLETE;
28 ReflowPushedFloats(state, fcBounds, fcStatus);
29@@ -4438,9 +4438,13 @@ nsBlockFrame::DrainSelfOverflowList()
30 * might push some of them on). Floats with placeholders in this block
31 * are reflowed by (nsBlockReflowState/nsLineLayout)::AddFloat, which
32 * also maintains these invariants.
33+ *
34+ * DrainSelfPushedFloats moves any pushed floats from this block's own
35+ * PushedFloats list back into mFloats. DrainPushedFloats additionally
36+ * moves frames from its prev-in-flow's PushedFloats list into mFloats.
37 */
38 void
39-nsBlockFrame::DrainPushedFloats(nsBlockReflowState& aState)
40+nsBlockFrame::DrainSelfPushedFloats()
41 {
42 #ifdef DEBUG
43 // Between when we drain pushed floats and when we complete reflow,
44@@ -4503,12 +4507,18 @@ nsBlockFrame::DrainPushedFloats(nsBlockReflowState& aState)
45 RemovePushedFloats()->Delete(presContext->PresShell());
46 }
47 }
48+}
49+
50+void
51+nsBlockFrame::DrainPushedFloats()
52+{
53+ DrainSelfPushedFloats();
54
55 // After our prev-in-flow has completed reflow, it may have a pushed
56 // floats list, containing floats that we need to own. Take these.
57 nsBlockFrame* prevBlock = static_cast<nsBlockFrame*>(GetPrevInFlow());
58 if (prevBlock) {
59- AutoFrameListPtr list(presContext, prevBlock->RemovePushedFloats());
60+ AutoFrameListPtr list(PresContext(), prevBlock->RemovePushedFloats());
61 if (list && list->NotEmpty()) {
62 mFloats.InsertFrames(this, nullptr, *list);
63 }
64@@ -4711,6 +4721,7 @@ nsBlockFrame::AppendFrames(ChildListID aListID,
65 return nsContainerFrame::AppendFrames(aListID, aFrameList);
66 }
67 else if (kFloatList == aListID) {
68+ DrainSelfPushedFloats(); // ensure the last frame is in mFloats
69 mFloats.AppendFrames(nullptr, aFrameList);
70 return NS_OK;
71 }
72@@ -4757,6 +4768,7 @@ nsBlockFrame::InsertFrames(ChildListID aListID,
73 return nsContainerFrame::InsertFrames(aListID, aPrevFrame, aFrameList);
74 }
75 else if (kFloatList == aListID) {
76+ DrainSelfPushedFloats(); // ensure aPrevFrame is in mFloats
77 mFloats.InsertFrames(this, aPrevFrame, aFrameList);
78 return NS_OK;
79 }
80diff --git a/layout/generic/nsBlockFrame.h b/layout/generic/nsBlockFrame.h
81index 1a6bb1e..07f7508 100644
82--- a/layout/generic/nsBlockFrame.h
83+++ b/layout/generic/nsBlockFrame.h
84@@ -533,10 +533,16 @@ protected:
85 return GetStateBits() & NS_BLOCK_HAS_OVERFLOW_OUT_OF_FLOWS;
86 }
87
88- /** grab pushed floats from this block's prevInFlow, and splice
89- * them into this block's mFloats list.
90- */
91- void DrainPushedFloats(nsBlockReflowState& aState);
92+ /**
93+ * Moves frames from our PushedFloats list back into our mFloats list.
94+ */
95+ void DrainSelfPushedFloats();
96+
97+ /**
98+ * First calls DrainSelfPushedFloats() then grabs pushed floats from this
99+ * block's prev-in-flow, and splice them into this block's mFloats list too.
100+ */
101+ void DrainPushedFloats();
102
103 /** Load all our floats into the float manager (without reflowing them).
104 * Assumes float manager is in our own coordinate system.
105diff --git a/layout/generic/nsContainerFrame.cpp b/layout/generic/nsContainerFrame.cpp
106index 76f0748..3ffcba7 100644
107--- a/layout/generic/nsContainerFrame.cpp
108+++ b/layout/generic/nsContainerFrame.cpp
109@@ -102,16 +102,18 @@ nsContainerFrame::AppendFrames(ChildListID aListID,
110 return NS_ERROR_INVALID_ARG;
111 }
112 }
113- if (aFrameList.NotEmpty()) {
114- mFrames.AppendFrames(this, aFrameList);
115
116- // Ask the parent frame to reflow me.
117- if (aListID == kPrincipalList)
118- {
119- PresContext()->PresShell()->
120- FrameNeedsReflow(this, nsIPresShell::eTreeChange,
121- NS_FRAME_HAS_DIRTY_CHILDREN);
122- }
123+ if (MOZ_UNLIKELY(aFrameList.IsEmpty())) {
124+ return NS_OK;
125+ }
126+
127+ DrainSelfOverflowList(); // ensure the last frame is in mFrames
128+ mFrames.AppendFrames(this, aFrameList);
129+
130+ if (aListID != kNoReflowPrincipalList) {
131+ PresContext()->PresShell()->
132+ FrameNeedsReflow(this, nsIPresShell::eTreeChange,
133+ NS_FRAME_HAS_DIRTY_CHILDREN);
134 }
135 return NS_OK;
136 }
137@@ -131,16 +133,19 @@ nsContainerFrame::InsertFrames(ChildListID aListID,
138 return NS_ERROR_INVALID_ARG;
139 }
140 }
141- if (aFrameList.NotEmpty()) {
142- // Insert frames after aPrevFrame
143- mFrames.InsertFrames(this, aPrevFrame, aFrameList);
144
145- if (aListID == kPrincipalList)
146- {
147- PresContext()->PresShell()->
148- FrameNeedsReflow(this, nsIPresShell::eTreeChange,
149- NS_FRAME_HAS_DIRTY_CHILDREN);
150- }
151+ if (MOZ_UNLIKELY(aFrameList.IsEmpty())) {
152+ return NS_OK;
153+ }
154+
155+ DrainSelfOverflowList(); // ensure aPrevFrame is in mFrames
156+ mFrames.InsertFrames(this, aPrevFrame, aFrameList);
157+
158+ if (aListID != kNoReflowPrincipalList) {
159+ PresContext()->PresShell()->
160+ FrameNeedsReflow(this, nsIPresShell::eTreeChange,
161+ NS_FRAME_HAS_DIRTY_CHILDREN);
162+
163 }
164 return NS_OK;
165 }
166diff --git a/layout/tables/nsTableFrame.cpp b/layout/tables/nsTableFrame.cpp
167index 60613ba..44088da 100644
168--- a/layout/tables/nsTableFrame.cpp
169+++ b/layout/tables/nsTableFrame.cpp
170@@ -2232,6 +2232,7 @@ nsTableFrame::AppendFrames(ChildListID aListID,
171 InsertColGroups(startColIndex,
172 nsFrameList::Slice(mColGroups, f, f->GetNextSibling()));
173 } else if (IsRowGroup(display->mDisplay)) {
174+ DrainSelfOverflowList(); // ensure the last frame is in mFrames
175 // Append the new row group frame to the sibling chain
176 mFrames.AppendFrame(nullptr, f);
177
178@@ -2404,6 +2405,7 @@ nsTableFrame::HomogenousInsertFrames(ChildListID aListID,
179 InsertColGroups(startColIndex, newColgroups);
180 } else if (IsRowGroup(display->mDisplay)) {
181 NS_ASSERTION(aListID == kPrincipalList, "unexpected child list");
182+ DrainSelfOverflowList(); // ensure aPrevFrame is in mFrames
183 // Insert the frames in the sibling chain
184 const nsFrameList::Slice& newRowGroups =
185 mFrames.InsertFrames(nullptr, aPrevFrame, aFrameList);
186diff --git a/layout/tables/nsTableRowFrame.cpp b/layout/tables/nsTableRowFrame.cpp
187index d1c493b..2351de3 100644
188--- a/layout/tables/nsTableRowFrame.cpp
189+++ b/layout/tables/nsTableRowFrame.cpp
190@@ -182,6 +182,7 @@ nsTableRowFrame::AppendFrames(ChildListID aListID,
191 {
192 NS_ASSERTION(aListID == kPrincipalList, "unexpected child list");
193
194+ DrainSelfOverflowList(); // ensure the last frame is in mFrames
195 const nsFrameList::Slice& newCells = mFrames.AppendFrames(nullptr, aFrameList);
196
197 // Add the new cell frames to the table
198@@ -208,6 +209,7 @@ nsTableRowFrame::InsertFrames(ChildListID aListID,
199 NS_ASSERTION(aListID == kPrincipalList, "unexpected child list");
200 NS_ASSERTION(!aPrevFrame || aPrevFrame->GetParent() == this,
201 "inserting after sibling frame with different parent");
202+ DrainSelfOverflowList(); // ensure aPrevFrame is in mFrames
203 //Insert Frames in the frame list
204 const nsFrameList::Slice& newCells = mFrames.InsertFrames(nullptr, aPrevFrame, aFrameList);
205
206diff --git a/layout/tables/nsTableRowGroupFrame.cpp b/layout/tables/nsTableRowGroupFrame.cpp
207index 34aaf02..40b349b 100644
208--- a/layout/tables/nsTableRowGroupFrame.cpp
209+++ b/layout/tables/nsTableRowGroupFrame.cpp
210@@ -1389,6 +1389,7 @@ nsTableRowGroupFrame::AppendFrames(ChildListID aListID,
211 {
212 NS_ASSERTION(aListID == kPrincipalList, "unexpected child list");
213
214+ DrainSelfOverflowList(); // ensure the last frame is in mFrames
215 ClearRowCursor();
216
217 // collect the new row frames in an array
218@@ -1430,6 +1431,7 @@ nsTableRowGroupFrame::InsertFrames(ChildListID aListID,
219 NS_ASSERTION(!aPrevFrame || aPrevFrame->GetParent() == this,
220 "inserting after sibling frame with different parent");
221
222+ DrainSelfOverflowList(); // ensure aPrevFrame is in mFrames
223 ClearRowCursor();
224
225 // collect the new row frames in an array
226--
2272.2.1
228
diff --git a/gnu/packages/patches/icecat-CVE-2015-2708-pt4.patch b/gnu/packages/patches/icecat-CVE-2015-2708-pt4.patch
deleted file mode 100644
index eb2295f5acd..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2708-pt4.patch
+++ /dev/null
@@ -1,26 +0,0 @@
1From e6082e031f0fa2a4a7a63ff124c6f22aeb75393d Mon Sep 17 00:00:00 2001
2From: Terrence Cole <terrence@mozilla.com>
3Date: Fri, 10 Apr 2015 08:58:26 -0700
4Subject: [PATCH] Bug 1152177 - Make jsid and Value pre barriers symetrical.
5 r=jonco, a=abillings
6
7---
8 js/src/gc/Barrier.h | 2 ++
9 1 file changed, 2 insertions(+)
10
11diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
12index 7efd785..9fc6bd0 100644
13--- a/js/src/gc/Barrier.h
14+++ b/js/src/gc/Barrier.h
15@@ -1062,6 +1062,8 @@ class BarrieredId
16 JS_ASSERT(obj == JSID_TO_OBJECT(value));
17 }
18 } else if (JSID_IS_STRING(value)) {
19+ if (StringIsPermanentAtom(JSID_TO_STRING(value)))
20+ return;
21 JSString *str = JSID_TO_STRING(value);
22 JS::shadow::Zone *shadowZone = ShadowZoneOfStringFromAnyThread(str);
23 if (shadowZone->needsBarrier()) {
24--
252.2.1
26
diff --git a/gnu/packages/patches/icecat-CVE-2015-2710-pt1.patch b/gnu/packages/patches/icecat-CVE-2015-2710-pt1.patch
deleted file mode 100644
index 4f119f6fe90..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2710-pt1.patch
+++ /dev/null
@@ -1,199 +0,0 @@
1From 0bd8486f4088c0845514986f61861688e0be011d Mon Sep 17 00:00:00 2001
2From: Cameron McCormack <cam@mcc.id.au>
3Date: Mon, 6 Apr 2015 09:11:55 -0400
4Subject: [PATCH] Bug 1149542 - Part 1: Return early from SVG text layout if we
5 discover mPositions is not long enough. r=dholbert, a=sledru
6
7---
8 layout/svg/SVGTextFrame.cpp | 59 +++++++++++++++++++++++++++++++--------------
9 layout/svg/SVGTextFrame.h | 23 ++++++++++++------
10 2 files changed, 56 insertions(+), 26 deletions(-)
11
12diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp
13index 721e699..45327881 100644
14--- a/layout/svg/SVGTextFrame.cpp
15+++ b/layout/svg/SVGTextFrame.cpp
16@@ -14,6 +14,7 @@
17 #include "gfxTypes.h"
18 #include "LookAndFeel.h"
19 #include "mozilla/gfx/2D.h"
20+#include "mozilla/Likely.h"
21 #include "nsAlgorithm.h"
22 #include "nsBlockFrame.h"
23 #include "nsCaret.h"
24@@ -4316,23 +4317,28 @@ ShouldStartRunAtIndex(const nsTArray<CharPosition>& aPositions,
25 return false;
26 }
27
28-uint32_t
29-SVGTextFrame::ResolvePositions(nsIContent* aContent,
30- uint32_t aIndex,
31- bool aInTextPath,
32- bool& aForceStartOfChunk,
33- nsTArray<gfxPoint>& aDeltas)
34+bool
35+SVGTextFrame::ResolvePositionsForNode(nsIContent* aContent,
36+ uint32_t& aIndex,
37+ bool aInTextPath,
38+ bool& aForceStartOfChunk,
39+ nsTArray<gfxPoint>& aDeltas)
40 {
41 if (aContent->IsNodeOfType(nsINode::eTEXT)) {
42 // We found a text node.
43 uint32_t length = static_cast<nsTextNode*>(aContent)->TextLength();
44 if (length) {
45+ uint32_t end = aIndex + length;
46+ if (MOZ_UNLIKELY(end > mPositions.Length())) {
47+ MOZ_ASSERT_UNREACHABLE("length of mPositions does not match characters "
48+ "found by iterating content");
49+ return false;
50+ }
51 if (aForceStartOfChunk) {
52 // Note this character as starting a new anchored chunk.
53 mPositions[aIndex].mStartOfChunk = true;
54 aForceStartOfChunk = false;
55 }
56- uint32_t end = aIndex + length;
57 while (aIndex < end) {
58 // Record whether each of these characters should start a new rendered
59 // run. That is always the case for characters on a text path.
60@@ -4345,18 +4351,23 @@ SVGTextFrame::ResolvePositions(nsIContent* aContent,
61 aIndex++;
62 }
63 }
64- return aIndex;
65+ return true;
66 }
67
68 // Skip past elements that aren't text content elements.
69 if (!IsTextContentElement(aContent)) {
70- return aIndex;
71+ return true;
72 }
73
74 if (aContent->Tag() == nsGkAtoms::textPath) {
75 // <textPath> elements are as if they are specified with x="0" y="0", but
76 // only if they actually have some text content.
77 if (HasTextContent(aContent)) {
78+ if (MOZ_UNLIKELY(aIndex >= mPositions.Length())) {
79+ MOZ_ASSERT_UNREACHABLE("length of mPositions does not match characters "
80+ "found by iterating content");
81+ return false;
82+ }
83 mPositions[aIndex].mPosition = gfxPoint();
84 mPositions[aIndex].mStartOfChunk = true;
85 }
86@@ -4376,8 +4387,14 @@ SVGTextFrame::ResolvePositions(nsIContent* aContent,
87 rotate = &animatedRotate->GetAnimValue();
88 }
89
90- uint32_t count = GetTextContentLength(aContent);
91 bool percentages = false;
92+ uint32_t count = GetTextContentLength(aContent);
93+
94+ if (MOZ_UNLIKELY(aIndex + count > mPositions.Length())) {
95+ MOZ_ASSERT_UNREACHABLE("length of mPositions does not match characters "
96+ "found by iterating content");
97+ return false;
98+ }
99
100 // New text anchoring chunks start at each character assigned a position
101 // with x="" or y="", or if we forced one with aForceStartOfChunk due to
102@@ -4456,8 +4473,11 @@ SVGTextFrame::ResolvePositions(nsIContent* aContent,
103 for (nsIContent* child = aContent->GetFirstChild();
104 child;
105 child = child->GetNextSibling()) {
106- aIndex = ResolvePositions(child, aIndex, inTextPath, aForceStartOfChunk,
107- aDeltas);
108+ bool ok = ResolvePositionsForNode(child, aIndex, inTextPath,
109+ aForceStartOfChunk, aDeltas);
110+ if (!ok) {
111+ return false;
112+ }
113 }
114
115 if (aContent->Tag() == nsGkAtoms::textPath) {
116@@ -4465,7 +4485,7 @@ SVGTextFrame::ResolvePositions(nsIContent* aContent,
117 aForceStartOfChunk = true;
118 }
119
120- return aIndex;
121+ return true;
122 }
123
124 bool
125@@ -4501,8 +4521,10 @@ SVGTextFrame::ResolvePositions(nsTArray<gfxPoint>& aDeltas,
126
127 // Recurse over the content and fill in character positions as we go.
128 bool forceStartOfChunk = false;
129- return ResolvePositions(mContent, 0, aRunPerGlyph,
130- forceStartOfChunk, aDeltas) != 0;
131+ index = 0;
132+ bool ok = ResolvePositionsForNode(mContent, index, aRunPerGlyph,
133+ forceStartOfChunk, aDeltas);
134+ return ok && index > 0;
135 }
136
137 void
138@@ -4958,9 +4980,10 @@ SVGTextFrame::DoGlyphPositioning()
139 // Get the x, y, dx, dy, rotate values for the subtree.
140 nsTArray<gfxPoint> deltas;
141 if (!ResolvePositions(deltas, adjustingTextLength)) {
142- // If ResolvePositions returned false, it means that there were some
143- // characters in the DOM but none of them are displayed. Clear out
144- // mPositions so that we don't attempt to do any painting later.
145+ // If ResolvePositions returned false, it means either there were some
146+ // characters in the DOM but none of them are displayed, or there was
147+ // an error in processing mPositions. Clear out mPositions so that we don't
148+ // attempt to do any painting later.
149 mPositions.Clear();
150 return;
151 }
152diff --git a/layout/svg/SVGTextFrame.h b/layout/svg/SVGTextFrame.h
153index 48951f7..912af8b 100644
154--- a/layout/svg/SVGTextFrame.h
155+++ b/layout/svg/SVGTextFrame.h
156@@ -505,15 +505,18 @@ private:
157 * Recursive helper for ResolvePositions below.
158 *
159 * @param aContent The current node.
160- * @param aIndex The current character index.
161+ * @param aIndex (in/out) The current character index.
162 * @param aInTextPath Whether we are currently under a <textPath> element.
163- * @param aForceStartOfChunk Whether the next character we find should start a
164- * new anchored chunk.
165- * @return The character index we got up to.
166+ * @param aForceStartOfChunk (in/out) Whether the next character we find
167+ * should start a new anchored chunk.
168+ * @param aDeltas (in/out) Receives the resolved dx/dy values for each
169+ * character.
170+ * @return false if we discover that mPositions did not have enough
171+ * elements; true otherwise.
172 */
173- uint32_t ResolvePositions(nsIContent* aContent, uint32_t aIndex,
174- bool aInTextPath, bool& aForceStartOfChunk,
175- nsTArray<gfxPoint>& aDeltas);
176+ bool ResolvePositionsForNode(nsIContent* aContent, uint32_t& aIndex,
177+ bool aInTextPath, bool& aForceStartOfChunk,
178+ nsTArray<gfxPoint>& aDeltas);
179
180 /**
181 * Initializes mPositions with character position information based on
182@@ -521,9 +524,13 @@ private:
183 * was not given for that character. Also fills aDeltas with values based on
184 * dx/dy attributes.
185 *
186+ * @param aDeltas (in/out) Receives the resolved dx/dy values for each
187+ * character.
188 * @param aRunPerGlyph Whether mPositions should record that a new run begins
189 * at each glyph.
190- * @return True if we recorded any positions.
191+ * @return false if we did not record any positions (due to having no
192+ * displayed characters) or if we discover that mPositions did not have
193+ * enough elements; true otherwise.
194 */
195 bool ResolvePositions(nsTArray<gfxPoint>& aDeltas, bool aRunPerGlyph);
196
197--
1982.2.1
199
diff --git a/gnu/packages/patches/icecat-CVE-2015-2710-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2710-pt2.patch
deleted file mode 100644
index 26a10ca2e4f..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2710-pt2.patch
+++ /dev/null
@@ -1,64 +0,0 @@
1From f7c0070831e72735c43beb426ac0c2ce33403f4f Mon Sep 17 00:00:00 2001
2From: Cameron McCormack <cam@mcc.id.au>
3Date: Mon, 6 Apr 2015 09:12:06 -0400
4Subject: [PATCH] Bug 1149542 - Part 2: Track undisplayed characters before
5 empty text frames properly. r=dholbert, a=sledru
6
7---
8 layout/svg/SVGTextFrame.cpp | 29 ++++++++++++++++-------------
9 1 file changed, 16 insertions(+), 13 deletions(-)
10
11diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp
12index 45327881..9d331b8 100644
13--- a/layout/svg/SVGTextFrame.cpp
14+++ b/layout/svg/SVGTextFrame.cpp
15@@ -290,22 +290,25 @@ GetNonEmptyTextFrameAndNode(nsIFrame* aFrame,
16 nsTextNode*& aTextNode)
17 {
18 nsTextFrame* text = do_QueryFrame(aFrame);
19- if (!text) {
20- return false;
21- }
22+ bool isNonEmptyTextFrame = text && text->GetContentLength() != 0;
23
24- nsIContent* content = text->GetContent();
25- NS_ASSERTION(content && content->IsNodeOfType(nsINode::eTEXT),
26- "unexpected content type for nsTextFrame");
27+ if (isNonEmptyTextFrame) {
28+ nsIContent* content = text->GetContent();
29+ NS_ASSERTION(content && content->IsNodeOfType(nsINode::eTEXT),
30+ "unexpected content type for nsTextFrame");
31
32- nsTextNode* node = static_cast<nsTextNode*>(content);
33- if (node->TextLength() == 0) {
34- return false;
35+ nsTextNode* node = static_cast<nsTextNode*>(content);
36+ MOZ_ASSERT(node->TextLength() != 0,
37+ "frame's GetContentLength() should be 0 if the text node "
38+ "has no content");
39+
40+ aTextFrame = text;
41+ aTextNode = node;
42 }
43
44- aTextFrame = text;
45- aTextNode = node;
46- return true;
47+ MOZ_ASSERT(IsNonEmptyTextFrame(aFrame) == isNonEmptyTextFrame,
48+ "our logic should agree with IsNonEmptyTextFrame");
49+ return isNonEmptyTextFrame;
50 }
51
52 /**
53@@ -1298,7 +1301,7 @@ GetUndisplayedCharactersBeforeFrame(nsTextFrame* aFrame)
54 /**
55 * Traverses the nsTextFrames for an SVGTextFrame and records a
56 * TextNodeCorrespondenceProperty on each for the number of undisplayed DOM
57- * characters between each frame. This is done by iterating simultaenously
58+ * characters between each frame. This is done by iterating simultaneously
59 * over the nsTextNodes and nsTextFrames and noting when nsTextNodes (or
60 * parts of them) are skipped when finding the next nsTextFrame.
61 */
62--
632.2.1
64
diff --git a/gnu/packages/patches/icecat-CVE-2015-2710-pt3.patch b/gnu/packages/patches/icecat-CVE-2015-2710-pt3.patch
deleted file mode 100644
index 67595062134..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2710-pt3.patch
+++ /dev/null
@@ -1,50 +0,0 @@
1From 2cda46e6158a459b56b392c8e389b055fdf740ca Mon Sep 17 00:00:00 2001
2From: Ryan VanderMeulen <ryanvm@gmail.com>
3Date: Mon, 6 Apr 2015 22:59:41 -0400
4Subject: [PATCH] Bug 1149542 - Replace MOZ_ASSERT_UNREACHABLE with MOZ_ASSERT.
5 r=dholbert, a=bustage
6
7---
8 layout/svg/SVGTextFrame.cpp | 12 ++++++------
9 1 file changed, 6 insertions(+), 6 deletions(-)
10
11diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp
12index 9d331b8..e7b7275 100644
13--- a/layout/svg/SVGTextFrame.cpp
14+++ b/layout/svg/SVGTextFrame.cpp
15@@ -4333,8 +4333,8 @@ SVGTextFrame::ResolvePositionsForNode(nsIContent* aContent,
16 if (length) {
17 uint32_t end = aIndex + length;
18 if (MOZ_UNLIKELY(end > mPositions.Length())) {
19- MOZ_ASSERT_UNREACHABLE("length of mPositions does not match characters "
20- "found by iterating content");
21+ MOZ_ASSERT(false, "length of mPositions does not match characters "
22+ "found by iterating content");
23 return false;
24 }
25 if (aForceStartOfChunk) {
26@@ -4367,8 +4367,8 @@ SVGTextFrame::ResolvePositionsForNode(nsIContent* aContent,
27 // only if they actually have some text content.
28 if (HasTextContent(aContent)) {
29 if (MOZ_UNLIKELY(aIndex >= mPositions.Length())) {
30- MOZ_ASSERT_UNREACHABLE("length of mPositions does not match characters "
31- "found by iterating content");
32+ MOZ_ASSERT(false, "length of mPositions does not match characters "
33+ "found by iterating content");
34 return false;
35 }
36 mPositions[aIndex].mPosition = gfxPoint();
37@@ -4394,8 +4394,8 @@ SVGTextFrame::ResolvePositionsForNode(nsIContent* aContent,
38 uint32_t count = GetTextContentLength(aContent);
39
40 if (MOZ_UNLIKELY(aIndex + count > mPositions.Length())) {
41- MOZ_ASSERT_UNREACHABLE("length of mPositions does not match characters "
42- "found by iterating content");
43+ MOZ_ASSERT(false, "length of mPositions does not match characters "
44+ "found by iterating content");
45 return false;
46 }
47
48--
492.2.1
50
diff --git a/gnu/packages/patches/icecat-CVE-2015-2713-pt1.patch b/gnu/packages/patches/icecat-CVE-2015-2713-pt1.patch
deleted file mode 100644
index 9e52759ae81..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2713-pt1.patch
+++ /dev/null
@@ -1,102 +0,0 @@
1From 2b1c90da3e849e1c9d7457658290aa8eb01d0fa9 Mon Sep 17 00:00:00 2001
2From: Mats Palmgren <mats@mozilla.com>
3Date: Thu, 16 Apr 2015 09:04:19 +0000
4Subject: [PATCH] Bug 1153478 - Part 1: Add nsInlineFrame::StealFrame and make
5 it deal with being called on the wrong parent for aChild (due to lazy
6 reparenting). r=roc, a=sledru
7
8---
9 layout/generic/nsContainerFrame.cpp | 7 +++----
10 layout/generic/nsInlineFrame.cpp | 39 +++++++++++++++++++++++++++++++++++++
11 layout/generic/nsInlineFrame.h | 4 +++-
12 3 files changed, 45 insertions(+), 5 deletions(-)
13
14diff --git a/layout/generic/nsContainerFrame.cpp b/layout/generic/nsContainerFrame.cpp
15index 3ffcba7..34878af 100644
16--- a/layout/generic/nsContainerFrame.cpp
17+++ b/layout/generic/nsContainerFrame.cpp
18@@ -172,13 +172,12 @@ nsContainerFrame::RemoveFrame(ChildListID aListID,
19 nsIPresShell* shell = PresContext()->PresShell();
20 nsContainerFrame* lastParent = nullptr;
21 while (aOldFrame) {
22- //XXXfr probably should use StealFrame here. I'm not sure if we need to
23- // check the overflow lists atm, but we'll need a prescontext lookup
24- // for overflow containers once we can split abspos elements with
25- // inline containing blocks.
26 nsIFrame* oldFrameNextContinuation = aOldFrame->GetNextContinuation();
27 nsContainerFrame* parent =
28 static_cast<nsContainerFrame*>(aOldFrame->GetParent());
29+ // Please note that 'parent' may not actually be where 'aOldFrame' lives.
30+ // We really MUST use StealFrame() and nothing else here.
31+ // @see nsInlineFrame::StealFrame for details.
32 parent->StealFrame(aOldFrame, true);
33 aOldFrame->Destroy();
34 aOldFrame = oldFrameNextContinuation;
35diff --git a/layout/generic/nsInlineFrame.cpp b/layout/generic/nsInlineFrame.cpp
36index 526041e..a392a15 100644
37--- a/layout/generic/nsInlineFrame.cpp
38+++ b/layout/generic/nsInlineFrame.cpp
39@@ -172,6 +172,45 @@ nsInlineFrame::PeekOffsetCharacter(bool aForward, int32_t* aOffset,
40 return CONTINUE;
41 }
42
43+nsresult
44+nsInlineFrame::StealFrame(nsIFrame* aChild,
45+ bool aForceNormal)
46+{
47+ if (aChild->HasAnyStateBits(NS_FRAME_IS_OVERFLOW_CONTAINER) &&
48+ !aForceNormal) {
49+ return nsContainerFrame::StealFrame(aChild, aForceNormal);
50+ }
51+
52+ nsInlineFrame* parent = this;
53+ bool removed = false;
54+ do {
55+ removed = parent->mFrames.StartRemoveFrame(aChild);
56+ if (removed) {
57+ break;
58+ }
59+
60+ // We didn't find the child in our principal child list.
61+ // Maybe it's on the overflow list?
62+ nsFrameList* frameList = parent->GetOverflowFrames();
63+ if (frameList) {
64+ removed = frameList->ContinueRemoveFrame(aChild);
65+ if (frameList->IsEmpty()) {
66+ parent->DestroyOverflowList();
67+ }
68+ if (removed) {
69+ break;
70+ }
71+ }
72+
73+ // Due to our "lazy reparenting" optimization 'aChild' might not actually
74+ // be on any of our child lists, but instead in one of our next-in-flows.
75+ parent = static_cast<nsInlineFrame*>(parent->GetNextInFlow());
76+ } while (parent);
77+
78+ MOZ_ASSERT(removed, "nsInlineFrame::StealFrame: can't find aChild");
79+ return removed ? NS_OK : NS_ERROR_UNEXPECTED;
80+}
81+
82 void
83 nsInlineFrame::BuildDisplayList(nsDisplayListBuilder* aBuilder,
84 const nsRect& aDirtyRect,
85diff --git a/layout/generic/nsInlineFrame.h b/layout/generic/nsInlineFrame.h
86index 1a9899e..3e49241 100644
87--- a/layout/generic/nsInlineFrame.h
88+++ b/layout/generic/nsInlineFrame.h
89@@ -61,7 +61,9 @@ public:
90
91 virtual FrameSearchResult PeekOffsetCharacter(bool aForward, int32_t* aOffset,
92 bool aRespectClusters = true) MOZ_OVERRIDE;
93-
94+
95+ virtual nsresult StealFrame(nsIFrame* aChild, bool aForceNormal) MOZ_OVERRIDE;
96+
97 // nsIHTMLReflow overrides
98 virtual void AddInlineMinWidth(nsRenderingContext *aRenderingContext,
99 InlineMinWidthData *aData) MOZ_OVERRIDE;
100--
1012.2.1
102
diff --git a/gnu/packages/patches/icecat-CVE-2015-2713-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2713-pt2.patch
deleted file mode 100644
index b1f2adde471..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2713-pt2.patch
+++ /dev/null
@@ -1,47 +0,0 @@
1From d84ed2990dd2304fef752213f1908280ff24d77c Mon Sep 17 00:00:00 2001
2From: Mats Palmgren <mats@mozilla.com>
3Date: Thu, 16 Apr 2015 09:04:19 +0000
4Subject: [PATCH] Bug 1153478 - Part 2: Remove useless assertions. r=roc,
5 a=sledru
6
7---
8 layout/generic/nsContainerFrame.cpp | 1 -
9 layout/generic/nsInlineFrame.cpp | 3 ---
10 2 files changed, 4 deletions(-)
11
12diff --git a/layout/generic/nsContainerFrame.cpp b/layout/generic/nsContainerFrame.cpp
13index 34878af..b95bddd 100644
14--- a/layout/generic/nsContainerFrame.cpp
15+++ b/layout/generic/nsContainerFrame.cpp
16@@ -1516,7 +1516,6 @@ nsContainerFrame::DrainSelfOverflowList()
17 {
18 AutoFrameListPtr overflowFrames(PresContext(), StealOverflowFrames());
19 if (overflowFrames) {
20- NS_ASSERTION(mFrames.NotEmpty(), "overflow list w/o frames");
21 mFrames.AppendFrames(nullptr, *overflowFrames);
22 return true;
23 }
24diff --git a/layout/generic/nsInlineFrame.cpp b/layout/generic/nsInlineFrame.cpp
25index a392a15..e0922bb 100644
26--- a/layout/generic/nsInlineFrame.cpp
27+++ b/layout/generic/nsInlineFrame.cpp
28@@ -449,7 +449,6 @@ nsInlineFrame::DrainSelfOverflowListInternal(DrainFlags aFlags,
29 {
30 AutoFrameListPtr overflowFrames(PresContext(), StealOverflowFrames());
31 if (overflowFrames) {
32- NS_ASSERTION(mFrames.NotEmpty(), "overflow list w/o frames");
33 // The frames on our own overflowlist may have been pushed by a
34 // previous lazilySetParentPointer Reflow so we need to ensure the
35 // correct parent pointer. This is sometimes skipped by Reflow.
36@@ -1157,8 +1156,6 @@ nsFirstLineFrame::DrainSelfOverflowList()
37 {
38 AutoFrameListPtr overflowFrames(PresContext(), StealOverflowFrames());
39 if (overflowFrames) {
40- NS_ASSERTION(mFrames.NotEmpty(), "overflow list w/o frames");
41-
42 bool result = !overflowFrames->IsEmpty();
43 const nsFrameList::Slice& newFrames =
44 mFrames.AppendFrames(nullptr, *overflowFrames);
45--
462.2.1
47
diff --git a/gnu/packages/patches/icecat-CVE-2015-2716.patch b/gnu/packages/patches/icecat-CVE-2015-2716.patch
deleted file mode 100644
index ce036a0921f..00000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2716.patch
+++ /dev/null
@@ -1,62 +0,0 @@
1From 9dcb4563847cb6e2a8112dca03d2684907f96313 Mon Sep 17 00:00:00 2001
2From: Eric Rahm <erahm@mozilla.com>
3Date: Fri, 10 Apr 2015 15:50:23 -0700
4Subject: [PATCH] Bug 1140537 - Sanity check size calculations. r=peterv,
5 a=abillings
6
7---
8 parser/expat/lib/xmlparse.c | 23 +++++++++++++++++++++--
9 1 file changed, 21 insertions(+), 2 deletions(-)
10
11diff --git a/parser/expat/lib/xmlparse.c b/parser/expat/lib/xmlparse.c
12index 70acf1a..436b735 100644
13--- a/parser/expat/lib/xmlparse.c
14+++ b/parser/expat/lib/xmlparse.c
15@@ -1651,6 +1651,12 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal)
16 void * XMLCALL
17 XML_GetBuffer(XML_Parser parser, int len)
18 {
19+/* BEGIN MOZILLA CHANGE (sanity check len) */
20+ if (len < 0) {
21+ errorCode = XML_ERROR_NO_MEMORY;
22+ return NULL;
23+ }
24+/* END MOZILLA CHANGE */
25 switch (ps_parsing) {
26 case XML_SUSPENDED:
27 errorCode = XML_ERROR_SUSPENDED;
28@@ -1662,8 +1668,13 @@ XML_GetBuffer(XML_Parser parser, int len)
29 }
30
31 if (len > bufferLim - bufferEnd) {
32- /* FIXME avoid integer overflow */
33 int neededSize = len + (int)(bufferEnd - bufferPtr);
34+/* BEGIN MOZILLA CHANGE (sanity check neededSize) */
35+ if (neededSize < 0) {
36+ errorCode = XML_ERROR_NO_MEMORY;
37+ return NULL;
38+ }
39+/* END MOZILLA CHANGE */
40 #ifdef XML_CONTEXT_BYTES
41 int keep = (int)(bufferPtr - buffer);
42
43@@ -1692,7 +1703,15 @@ XML_GetBuffer(XML_Parser parser, int len)
44 bufferSize = INIT_BUFFER_SIZE;
45 do {
46 bufferSize *= 2;
47- } while (bufferSize < neededSize);
48+/* BEGIN MOZILLA CHANGE (prevent infinite loop on overflow) */
49+ } while (bufferSize < neededSize && bufferSize > 0);
50+/* END MOZILLA CHANGE */
51+/* BEGIN MOZILLA CHANGE (sanity check bufferSize) */
52+ if (bufferSize <= 0) {
53+ errorCode = XML_ERROR_NO_MEMORY;
54+ return NULL;
55+ }
56+/* END MOZILLA CHANGE */
57 newBuf = (char *)MALLOC(bufferSize);
58 if (newBuf == 0) {
59 errorCode = XML_ERROR_NO_MEMORY;
60--
612.2.1
62
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-03 08:53:50 +0000