gnu: icecat: Update to 38.7.1-gnu1.

* gnu/packages/gnuzilla.scm (icecat): Update to 38.7.1-gnu1. [sources]: Remove numerous patches. * gnu/packages/patches/icecat-CVE-2015-4477.patch, gnu/packages/patches/icecat-CVE-2015-7207.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt01.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt02.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt03.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt05.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt06.patch, gnu/packages/patches/icecat-CVE-2016-1954.patch, gnu/packages/patches/icecat-CVE-2016-1960.patch, gnu/packages/patches/icecat-CVE-2016-1961.patch, gnu/packages/patches/icecat-CVE-2016-1962.patch, gnu/packages/patches/icecat-CVE-2016-1964.patch, gnu/packages/patches/icecat-CVE-2016-1965.patch, gnu/packages/patches/icecat-CVE-2016-1966.patch, gnu/packages/patches/icecat-CVE-2016-1974.patch, gnu/packages/patches/icecat-icecatbug-1248851.patch, gnu/packages/patches/icecat-update-graphite2.patch, gnu/packages/patches/icecat-update-graphite2-pt2.patch: Remove files. * gnu-system.am (dist_patch_DATA): Remove them.
2016-04-10 08:40:31 +03:00 · 2016-04-10 08:40:31 +03:00 · 58e87f66ce
commit 58e87f66ce
parent 9c45c51992
21 changed files with 4 additions and 13657 deletions
--- a/gnu-system.am
+++ b/gnu-system.am
@ -522,26 +522,7 @@ dist_patch_DATA =						\
  gnu/packages/patches/hydra-automake-1.15.patch		\
  gnu/packages/patches/hydra-disable-darcs-test.patch		\
  gnu/packages/patches/icecat-avoid-bundled-includes.patch	\
-  gnu/packages/patches/icecat-update-graphite2.patch		\
-  gnu/packages/patches/icecat-update-graphite2-pt2.patch	\
  gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch	\
-  gnu/packages/patches/icecat-CVE-2015-4477.patch		\
-  gnu/packages/patches/icecat-CVE-2015-7207.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1952-pt01.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1952-pt02.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1952-pt03.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1952-pt05.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1952-pt06.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1954.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1960.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1961.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1962.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1964.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1965.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1966.patch		\
-  gnu/packages/patches/icecat-CVE-2016-1974.patch		\
-  gnu/packages/patches/icecat-bug-1248851.patch			\
  gnu/packages/patches/icu4c-CVE-2014-6585.patch		\
  gnu/packages/patches/icu4c-CVE-2015-1270.patch		\
  gnu/packages/patches/icu4c-CVE-2015-4760.patch		\
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@ -3,6 +3,7 @@
 ;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
+;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -277,7 +278,7 @@ (define-public nss
 (define-public icecat
  (package
    (name "icecat")
-    (version "38.6.0-gnu1")
+    (version "38.7.1-gnu1")
    (source
     (origin
      (method url-fetch)
@ -286,29 +287,10 @@ (define-public icecat
                          name "-" version ".tar.bz2"))
      (sha256
       (base32
-        "0bd4k5cwr8ynscaxffvj2x3kgky3dmjq0qhpcb931l98bh0103lx"))
+        "1wdmd6hasra36g86ha1dw8sl7a5mvr7c4jbjx4zyg9629y5gqr8g"))
      (patches (map search-patch
                    '("icecat-avoid-bundled-includes.patch"
-                      "icecat-re-enable-DHE-cipher-suites.patch"
-                      "icecat-update-graphite2.patch"
-                      "icecat-update-graphite2-pt2.patch"
-                      "icecat-CVE-2015-4477.patch"
-                      "icecat-CVE-2015-7207.patch"
-                      "icecat-CVE-2016-1952-pt01.patch"
-                      "icecat-CVE-2016-1952-pt02.patch"
-                      "icecat-CVE-2016-1952-pt03.patch"
-                      "icecat-CVE-2016-1952-pt04.patch"
-                      "icecat-CVE-2016-1952-pt05.patch"
-                      "icecat-CVE-2016-1952-pt06.patch"
-                      "icecat-CVE-2016-1954.patch"
-                      "icecat-CVE-2016-1960.patch"
-                      "icecat-CVE-2016-1961.patch"
-                      "icecat-CVE-2016-1962.patch"
-                      "icecat-CVE-2016-1964.patch"
-                      "icecat-CVE-2016-1965.patch"
-                      "icecat-CVE-2016-1966.patch"
-                      "icecat-CVE-2016-1974.patch"
-                      "icecat-bug-1248851.patch")))
+                      "icecat-re-enable-DHE-cipher-suites.patch")))
      (modules '((guix build utils)))
      (snippet
       '(begin
--- a/gnu/packages/patches/icecat-CVE-2015-4477.patch
+++ b/gnu/packages/patches/icecat-CVE-2015-4477.patch
@ -1,37 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/beae8783b8c2
-
-# HG changeset patch
-# User Paul Adenot <paul@paul.cx>
-# Date 1456422965 0
-# Node ID beae8783b8c2c672da12a95c70ae663cbd0d5016
-# Parent  3a606f8182c82480f8f350b622ab55a170ec1eb6
-Bug 1179484. r=roc
-
-MozReview-Commit-ID: HNaYLyMe3sM
-
-diff --git a/dom/media/webaudio/MediaStreamAudioDestinationNode.cpp b/dom/media/webaudio/MediaStreamAudioDestinationNode.cpp
--- a/dom/media/webaudio/MediaStreamAudioDestinationNode.cpp
-+++ b/dom/media/webaudio/MediaStreamAudioDestinationNode.cpp
-@@ -69,16 +69,20 @@ MediaStreamAudioDestinationNode::MediaSt
-               ChannelInterpretation::Speakers)
-   , mDOMStream(DOMAudioNodeMediaStream::CreateTrackUnionStream(GetOwner(),
-                                                                this))
- {
-   TrackUnionStream* tus = static_cast<TrackUnionStream*>(mDOMStream->GetStream());
-   MOZ_ASSERT(tus == mDOMStream->GetStream()->AsProcessedStream());
-   tus->SetTrackIDFilter(FilterAudioNodeStreamTrack);
- 
-+  if (aContext->Graph() != tus->Graph()) {
-+    return;
-+  }
-+
-   MediaStreamDestinationEngine* engine = new MediaStreamDestinationEngine(this, tus);
-   mStream = aContext->Graph()->CreateAudioNodeStream(engine, MediaStreamGraph::INTERNAL_STREAM);
-   mPort = tus->AllocateInputPort(mStream, 0);
- 
-   nsIDocument* doc = aContext->GetParentObject()->GetExtantDoc();
-   if (doc) {
-     mDOMStream->CombineWithPrincipal(doc->NodePrincipal());
-   }
-
--- a/gnu/packages/patches/icecat-CVE-2015-7207.patch
+++ b/gnu/packages/patches/icecat-CVE-2015-7207.patch
--- a/gnu/packages/patches/icecat-CVE-2016-1952-pt01.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1952-pt01.patch
@ -1,356 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/c1d67bd4c993
-
-# HG changeset patch
-# User Timothy Nikkel <tnikkel@gmail.com>
-# Date 1454023801 21600
-# Node ID c1d67bd4c993b9e344c68954e6f0392c82b81e38
-# Parent  530559abe159d3c23f078d673d30ff03d9c244e2
-Bug 1224979 - Check if we compute usable filters for the downscaler, and if not put the downscaler in error state so it's not used. r=edwin, a=al
-
-diff --git a/image/Downscaler.cpp b/image/Downscaler.cpp
-new file mode 100644
--- /dev/null
-+++ b/image/Downscaler.cpp
-@@ -0,0 +1,340 @@
-+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
-+ *
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+
-+#include "Downscaler.h"
-+
-+#include <algorithm>
-+#include <ctime>
-+#include "gfxPrefs.h"
-+#include "image_operations.h"
-+#include "mozilla/SSE.h"
-+#include "convolver.h"
-+#include "skia/include/core/SkTypes.h"
-+
-+using std::max;
-+using std::swap;
-+
-+namespace mozilla {
-+namespace image {
-+
-+Downscaler::Downscaler(const nsIntSize& aTargetSize)
-+  : mTargetSize(aTargetSize)
-+  , mOutputBuffer(nullptr)
-+  , mXFilter(MakeUnique<skia::ConvolutionFilter1D>())
-+  , mYFilter(MakeUnique<skia::ConvolutionFilter1D>())
-+  , mWindowCapacity(0)
-+  , mHasAlpha(true)
-+  , mFlipVertically(false)
-+{
-+  MOZ_ASSERT(gfxPrefs::ImageDownscaleDuringDecodeEnabled(),
-+             "Downscaling even though downscale-during-decode is disabled?");
-+  MOZ_ASSERT(mTargetSize.width > 0 && mTargetSize.height > 0,
-+             "Invalid target size");
-+}
-+
-+Downscaler::~Downscaler()
-+{
-+  ReleaseWindow();
-+}
-+
-+void
-+Downscaler::ReleaseWindow()
-+{
-+  if (!mWindow) {
-+    return;
-+  }
-+
-+  for (int32_t i = 0; i < mWindowCapacity; ++i) {
-+    delete[] mWindow[i];
-+  }
-+
-+  mWindow = nullptr;
-+  mWindowCapacity = 0;
-+}
-+
-+nsresult
-+Downscaler::BeginFrame(const nsIntSize& aOriginalSize,
-+                       const Maybe<nsIntRect>& aFrameRect,
-+                       uint8_t* aOutputBuffer,
-+                       bool aHasAlpha,
-+                       bool aFlipVertically /* = false */)
-+{
-+  MOZ_ASSERT(aOutputBuffer);
-+  MOZ_ASSERT(mTargetSize != aOriginalSize,
-+             "Created a downscaler, but not downscaling?");
-+  MOZ_ASSERT(mTargetSize.width <= aOriginalSize.width,
-+             "Created a downscaler, but width is larger");
-+  MOZ_ASSERT(mTargetSize.height <= aOriginalSize.height,
-+             "Created a downscaler, but height is larger");
-+  MOZ_ASSERT(aOriginalSize.width > 0 && aOriginalSize.height > 0,
-+             "Invalid original size");
-+
-+  mFrameRect = aFrameRect.valueOr(nsIntRect(nsIntPoint(), aOriginalSize));
-+  MOZ_ASSERT(mFrameRect.x >= 0 && mFrameRect.y >= 0 &&
-+             mFrameRect.width >= 0 && mFrameRect.height >= 0,
-+             "Frame rect must have non-negative components");
-+  MOZ_ASSERT(nsIntRect(0, 0, aOriginalSize.width, aOriginalSize.height)
-+               .Contains(mFrameRect),
-+             "Frame rect must fit inside image");
-+  MOZ_ASSERT_IF(!nsIntRect(0, 0, aOriginalSize.width, aOriginalSize.height)
-+                  .IsEqualEdges(mFrameRect),
-+                aHasAlpha);
-+
-+  mOriginalSize = aOriginalSize;
-+  mScale = gfxSize(double(mOriginalSize.width) / mTargetSize.width,
-+                   double(mOriginalSize.height) / mTargetSize.height);
-+  mOutputBuffer = aOutputBuffer;
-+  mHasAlpha = aHasAlpha;
-+  mFlipVertically = aFlipVertically;
-+
-+  ReleaseWindow();
-+
-+  auto resizeMethod = skia::ImageOperations::RESIZE_LANCZOS3;
-+
-+  skia::resize::ComputeFilters(resizeMethod,
-+                               mOriginalSize.width, mTargetSize.width,
-+                               0, mTargetSize.width,
-+                               mXFilter.get());
-+
-+  if (mXFilter->max_filter() <= 0 || mXFilter->num_values() != mTargetSize.width) {
-+    NS_WARNING("Failed to compute filters for image downscaling");
-+    return NS_ERROR_OUT_OF_MEMORY;
-+  }
-+
-+  skia::resize::ComputeFilters(resizeMethod,
-+                               mOriginalSize.height, mTargetSize.height,
-+                               0, mTargetSize.height,
-+                               mYFilter.get());
-+
-+  if (mYFilter->max_filter() <= 0 || mYFilter->num_values() != mTargetSize.height) {
-+    NS_WARNING("Failed to compute filters for image downscaling");
-+    return NS_ERROR_OUT_OF_MEMORY;
-+  }
-+
-+  // Allocate the buffer, which contains scanlines of the original image.
-+  // pad by 15 to handle overreads by the simd code
-+  size_t bufferLen = mOriginalSize.width * sizeof(uint32_t) + 15;
-+  mRowBuffer.reset(new (fallible) uint8_t[bufferLen]);
-+  if (MOZ_UNLIKELY(!mRowBuffer)) {
-+    return NS_ERROR_OUT_OF_MEMORY;
-+  }
-+
-+  // Zero buffer to keep valgrind happy.
-+  memset(mRowBuffer.get(), 0, bufferLen);
-+
-+  // Allocate the window, which contains horizontally downscaled scanlines. (We
-+  // can store scanlines which are already downscale because our downscaling
-+  // filter is separable.)
-+  mWindowCapacity = mYFilter->max_filter();
-+  mWindow.reset(new (fallible) uint8_t*[mWindowCapacity]);
-+  if (MOZ_UNLIKELY(!mWindow)) {
-+    return NS_ERROR_OUT_OF_MEMORY;
-+  }
-+
-+  bool anyAllocationFailed = false;
-+  // pad by 15 to handle overreads by the simd code
-+  const int rowSize = mTargetSize.width * sizeof(uint32_t) + 15;
-+  for (int32_t i = 0; i < mWindowCapacity; ++i) {
-+    mWindow[i] = new (fallible) uint8_t[rowSize];
-+    anyAllocationFailed = anyAllocationFailed || mWindow[i] == nullptr;
-+  }
-+
-+  if (MOZ_UNLIKELY(anyAllocationFailed)) {
-+    // We intentionally iterate through the entire array even if an allocation
-+    // fails, to ensure that all the pointers in it are either valid or nullptr.
-+    // That in turn ensures that ReleaseWindow() can clean up correctly.
-+    return NS_ERROR_OUT_OF_MEMORY;
-+  }
-+
-+  ResetForNextProgressivePass();
-+
-+  return NS_OK;
-+}
-+
-+void
-+Downscaler::SkipToRow(int32_t aRow)
-+{
-+  if (mCurrentInLine < aRow) {
-+    ClearRow();
-+    do {
-+      CommitRow();
-+    } while (mCurrentInLine < aRow);
-+  }
-+}
-+
-+void
-+Downscaler::ResetForNextProgressivePass()
-+{
-+  mPrevInvalidatedLine = 0;
-+  mCurrentOutLine = 0;
-+  mCurrentInLine = 0;
-+  mLinesInBuffer = 0;
-+
-+  if (mFrameRect.IsEmpty()) {
-+    // Our frame rect is zero size; commit rows until the end of the image.
-+    SkipToRow(mOriginalSize.height - 1);
-+  } else {
-+    // If we have a vertical offset, commit rows to shift us past it.
-+    SkipToRow(mFrameRect.y);
-+  }
-+}
-+
-+static void
-+GetFilterOffsetAndLength(UniquePtr<skia::ConvolutionFilter1D>& aFilter,
-+                         int32_t aOutputImagePosition,
-+                         int32_t* aFilterOffsetOut,
-+                         int32_t* aFilterLengthOut)
-+{
-+  MOZ_ASSERT(aOutputImagePosition < aFilter->num_values());
-+  aFilter->FilterForValue(aOutputImagePosition,
-+                          aFilterOffsetOut,
-+                          aFilterLengthOut);
-+}
-+
-+void
-+Downscaler::ClearRow(uint32_t aStartingAtCol)
-+{
-+  MOZ_ASSERT(int64_t(mOriginalSize.width) > int64_t(aStartingAtCol));
-+  uint32_t bytesToClear = (mOriginalSize.width - aStartingAtCol)
-+                        * sizeof(uint32_t);
-+  memset(mRowBuffer.get() + (aStartingAtCol * sizeof(uint32_t)),
-+         0, bytesToClear);
-+}
-+
-+void
-+Downscaler::CommitRow()
-+{
-+  MOZ_ASSERT(mOutputBuffer, "Should have a current frame");
-+  MOZ_ASSERT(mCurrentInLine < mOriginalSize.height, "Past end of input");
-+
-+  if (mCurrentOutLine < mTargetSize.height) {
-+    int32_t filterOffset = 0;
-+    int32_t filterLength = 0;
-+    GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
-+                             &filterOffset, &filterLength);
-+
-+    int32_t inLineToRead = filterOffset + mLinesInBuffer;
-+    MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
-+    if (mCurrentInLine == inLineToRead) {
-+      skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
-+                                 mWindow[mLinesInBuffer++], mHasAlpha,
-+                                 supports_sse2());
-+    }
-+
-+    MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
-+               "Writing past end of output");
-+
-+    while (mLinesInBuffer == filterLength) {
-+      DownscaleInputLine();
-+
-+      if (mCurrentOutLine == mTargetSize.height) {
-+        break;  // We're done.
-+      }
-+
-+      GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
-+                               &filterOffset, &filterLength);
-+    }
-+  }
-+
-+  mCurrentInLine += 1;
-+
-+  // If we're at the end of the part of the original image that has data, commit
-+  // rows to shift us to the end.
-+  if (mCurrentInLine == (mFrameRect.y + mFrameRect.height)) {
-+    SkipToRow(mOriginalSize.height - 1);
-+  }
-+}
-+
-+bool
-+Downscaler::HasInvalidation() const
-+{
-+  return mCurrentOutLine > mPrevInvalidatedLine;
-+}
-+
-+DownscalerInvalidRect
-+Downscaler::TakeInvalidRect()
-+{
-+  if (MOZ_UNLIKELY(!HasInvalidation())) {
-+    return DownscalerInvalidRect();
-+  }
-+
-+  DownscalerInvalidRect invalidRect;
-+
-+  // Compute the target size invalid rect.
-+  if (mFlipVertically) {
-+    // We need to flip it. This will implicitly flip the original size invalid
-+    // rect, since we compute it by scaling this rect.
-+    invalidRect.mTargetSizeRect =
-+      IntRect(0, mTargetSize.height - mCurrentOutLine,
-+              mTargetSize.width, mCurrentOutLine - mPrevInvalidatedLine);
-+  } else {
-+    invalidRect.mTargetSizeRect =
-+      IntRect(0, mPrevInvalidatedLine,
-+              mTargetSize.width, mCurrentOutLine - mPrevInvalidatedLine);
-+  }
-+
-+  mPrevInvalidatedLine = mCurrentOutLine;
-+
-+  // Compute the original size invalid rect.
-+  invalidRect.mOriginalSizeRect = invalidRect.mTargetSizeRect;
-+  invalidRect.mOriginalSizeRect.ScaleRoundOut(mScale.width, mScale.height);
-+
-+  return invalidRect;
-+}
-+
-+void
-+Downscaler::DownscaleInputLine()
-+{
-+  typedef skia::ConvolutionFilter1D::Fixed FilterValue;
-+
-+  MOZ_ASSERT(mOutputBuffer);
-+  MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
-+             "Writing past end of output");
-+
-+  int32_t filterOffset = 0;
-+  int32_t filterLength = 0;
-+  MOZ_ASSERT(mCurrentOutLine < mYFilter->num_values());
-+  auto filterValues =
-+    mYFilter->FilterForValue(mCurrentOutLine, &filterOffset, &filterLength);
-+
-+  int32_t currentOutLine = mFlipVertically
-+                         ? mTargetSize.height - (mCurrentOutLine + 1)
-+                         : mCurrentOutLine;
-+  MOZ_ASSERT(currentOutLine >= 0);
-+
-+  uint8_t* outputLine =
-+    &mOutputBuffer[currentOutLine * mTargetSize.width * sizeof(uint32_t)];
-+  skia::ConvolveVertically(static_cast<const FilterValue*>(filterValues),
-+                           filterLength, mWindow.get(), mXFilter->num_values(),
-+                           outputLine, mHasAlpha, supports_sse2());
-+
-+  mCurrentOutLine += 1;
-+
-+  if (mCurrentOutLine == mTargetSize.height) {
-+    // We're done.
-+    return;
-+  }
-+
-+  int32_t newFilterOffset = 0;
-+  int32_t newFilterLength = 0;
-+  GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
-+                           &newFilterOffset, &newFilterLength);
-+
-+  int diff = newFilterOffset - filterOffset;
-+  MOZ_ASSERT(diff >= 0, "Moving backwards in the filter?");
-+
-+  // Shift the buffer. We're just moving pointers here, so this is cheap.
-+  mLinesInBuffer -= diff;
-+  mLinesInBuffer = max(mLinesInBuffer, 0);
-+  for (int32_t i = 0; i < mLinesInBuffer; ++i) {
-+    swap(mWindow[i], mWindow[filterLength - mLinesInBuffer + i]);
-+  }
-+}
-+
-+
-+
-+} // namespace image
-+} // namespace mozilla
-
--- a/gnu/packages/patches/icecat-CVE-2016-1952-pt02.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1952-pt02.patch
@ -1,58 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/9719b71d72dd
-
-# HG changeset patch
-# User Byron Campen [:bwc] <docfaraday@gmail.com>
-# Date 1454100887 21600
-# Node ID 9719b71d72dd2a3c5ee12ace156af2a63d9595ac
-# Parent  b68673d974a10f65390f80b36d4307eb31e44669
-Bug 1234578 - Assert if PCM is destroyed improperly. r=rjesup, a=sylvestre
-
-diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
-+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
-@@ -712,16 +712,18 @@ PeerConnectionMedia::SelfDestruct_m()
- {
-   CSFLogDebug(logTag, "%s: ", __FUNCTION__);
- 
-   ASSERT_ON_THREAD(mMainThread);
- 
-   mLocalSourceStreams.Clear();
-   mRemoteSourceStreams.Clear();
- 
-+  mMainThread = nullptr;
-+
-   // Final self-destruct.
-   this->Release();
- }
- 
- void
- PeerConnectionMedia::ShutdownMediaTransport_s()
- {
-   ASSERT_ON_THREAD(mSTSThread);
-diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
-+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
-@@ -210,17 +210,20 @@ class RemoteSourceStreamInfo : public So
-   std::vector<std::string> mTrackIdMap;
- 
-   // True iff SetPullEnabled(true) has been called on the DOMMediaStream. This
-   // happens when offer/answer concludes.
-   bool mReceiving;
- };
- 
- class PeerConnectionMedia : public sigslot::has_slots<> {
-  ~PeerConnectionMedia() {}
-+  ~PeerConnectionMedia()
-+  {
-+    MOZ_RELEASE_ASSERT(!mMainThread);
-+  }
- 
-  public:
-   explicit PeerConnectionMedia(PeerConnectionImpl *parent);
- 
-   PeerConnectionImpl* GetPC() { return mParent; }
-   nsresult Init(const std::vector<NrIceStunServer>& stun_servers,
-                 const std::vector<NrIceTurnServer>& turn_servers);
-   // WARNING: This destroys the object!
-
--- a/gnu/packages/patches/icecat-CVE-2016-1952-pt03.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1952-pt03.patch
@ -1,60 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/2839062f84fb
-
-# HG changeset patch
-# User Jan de Mooij <jdemooij@mozilla.com>
-# Date 1455119320 -3600
-# Node ID 2839062f84fb6cba2781ea8d59150f13d4813ddc
-# Parent  185b233ea03f3811404e3979b65ec86b29d13555
-Bug 1242279 - r=bhackett1024 a=sylvestre
-
-diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
--- a/js/src/vm/TypeInference.cpp
-+++ b/js/src/vm/TypeInference.cpp
-@@ -3961,16 +3961,22 @@ JSScript::maybeSweepTypes(AutoClearTypeI
- 
-     unsigned num = TypeScript::NumTypeSets(this);
-     StackTypeSet* typeArray = types_->typeArray();
- 
-     // Remove constraints and references to dead objects from stack type sets.
-     for (unsigned i = 0; i < num; i++)
-         typeArray[i].sweep(zone(), *oom);
- 
-+    if (oom->hadOOM()) {
-+        // It's possible we OOM'd while copying freeze constraints, so they
-+        // need to be regenerated.
-+        hasFreezeConstraints_ = false;
-+    }
-+
-     // Update the recompile indexes in any IonScripts still on the script.
-     if (hasIonScript())
-         ionScript()->recompileInfoRef().shouldSweep(types);
- }
- 
- void
- TypeScript::destroy()
- {
-diff --git a/js/src/vm/TypeInference.h b/js/src/vm/TypeInference.h
--- a/js/src/vm/TypeInference.h
-+++ b/js/src/vm/TypeInference.h
-@@ -566,16 +566,19 @@ class AutoClearTypeInferenceStateOnOOM
-       : zone(zone), oom(false)
-     {}
- 
-     ~AutoClearTypeInferenceStateOnOOM();
- 
-     void setOOM() {
-         oom = true;
-     }
-+    bool hadOOM() const {
-+        return oom;
-+    }
- };
- 
- /* Superclass common to stack and heap type sets. */
- class ConstraintTypeSet : public TypeSet
- {
-   public:
-     /* Chain of constraints which propagate changes out from this type set. */
-     TypeConstraint* constraintList;
-
--- a/gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch
@ -1,53 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/9dd60e798819
-
-# HG changeset patch
-# User Olli Pettay <bugs@pettay.fi>
-# Date 1455204078 -3600
-# Node ID 9dd60e798819fe2ebf1e5bd36aa9006ecd2f82c9
-# Parent  c1d67bd4c993b9e344c68954e6f0392c82b81e38
-Bug 1244250 - r=mats, a=al
-
-diff --git a/layout/style/nsAnimationManager.cpp b/layout/style/nsAnimationManager.cpp
--- a/layout/style/nsAnimationManager.cpp
-+++ b/layout/style/nsAnimationManager.cpp
-@@ -715,16 +715,17 @@ nsAnimationManager::FlushAnimations(Flus
-   }
- 
-   DispatchEvents(); // may destroy us
- }
- 
- void
- nsAnimationManager::DoDispatchEvents()
- {
-+  nsRefPtr<nsAnimationManager> kungFuDeathGrip(this);
-   EventArray events;
-   mPendingEvents.SwapElements(events);
-   for (uint32_t i = 0, i_end = events.Length(); i < i_end; ++i) {
-     AnimationEventInfo &info = events[i];
-     EventDispatcher::Dispatch(info.mElement, mPresContext, &info.mEvent);
- 
-     if (!mPresContext) {
-       break;
-diff --git a/layout/style/nsTransitionManager.cpp b/layout/style/nsTransitionManager.cpp
--- a/layout/style/nsTransitionManager.cpp
-+++ b/layout/style/nsTransitionManager.cpp
-@@ -753,16 +753,17 @@ nsTransitionManager::FlushTransitions(Fl
-       }
-     }
-   }
- 
-   if (didThrottle) {
-     mPresContext->Document()->SetNeedStyleFlush();
-   }
- 
-+  nsRefPtr<nsTransitionManager> kungFuDeathGrip(this);
-   for (uint32_t i = 0, i_end = events.Length(); i < i_end; ++i) {
-     TransitionEventInfo &info = events[i];
-     EventDispatcher::Dispatch(info.mElement, mPresContext, &info.mEvent);
- 
-     if (!mPresContext) {
-       break;
-     }
-   }
-
--- a/gnu/packages/patches/icecat-CVE-2016-1952-pt05.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1952-pt05.patch
@ -1,32 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/1dd0ca8e70bd
-
-# HG changeset patch
-# User Nicolas B. Pierron <nicolas.b.pierron@mozilla.com>
-# Date 1456161361 0
-# Node ID 1dd0ca8e70bd77b6fd93f36cc4e9c2cebfe8ba0a
-# Parent  95ff874886905ef46a7bbc760981d15ad0831096
-Bug 1221872 - ValueNumbering: Set the dominator index of fixup blocks when they are created. r=sunfish, a=ritu
-
-diff --git a/js/src/jit/ValueNumbering.cpp b/js/src/jit/ValueNumbering.cpp
--- a/js/src/jit/ValueNumbering.cpp
-+++ b/js/src/jit/ValueNumbering.cpp
-@@ -433,16 +433,17 @@ ValueNumberer::fixupOSROnlyLoop(MBasicBl
-     MBasicBlock* fake = MBasicBlock::NewAsmJS(graph_, block->info(),
-                                               nullptr, MBasicBlock::NORMAL);
-     if (fake == nullptr)
-         return false;
- 
-     graph_.insertBlockBefore(block, fake);
-     fake->setImmediateDominator(fake);
-     fake->addNumDominated(1);
-+    fake->setDomIndex(fake->id());
- 
-     // Create zero-input phis to use as inputs for any phis in |block|.
-     // Again, this is a little odd, but it's the least-odd thing we can do
-     // without significant complexity.
-     for (MPhiIterator iter(block->phisBegin()), end(block->phisEnd()); iter != end; ++iter) {
-         MPhi* phi = *iter;
-         MPhi* fakePhi = MPhi::New(graph_.alloc(), phi->type());
-         fake->addPhi(fakePhi);
-
--- a/gnu/packages/patches/icecat-CVE-2016-1952-pt06.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1952-pt06.patch
@ -1,103 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/6f4d51302387
-
-# HG changeset patch
-# User Andrew McCreight <continuation@gmail.com>
-# Date 1456273423 28800
-# Node ID 6f4d5130238790fa5810c76ffeb9eccc65efa8c9
-# Parent  70f6c59d9d73a5edefd216b48ca74a931da12cf1
-Bug 1249685 - Use more nsCOMPtrs for stack variables in DOM code. r=smaug, a=ritu
-
-diff --git a/dom/base/nsRange.cpp b/dom/base/nsRange.cpp
--- a/dom/base/nsRange.cpp
-+++ b/dom/base/nsRange.cpp
-@@ -1985,17 +1985,17 @@ nsRange::CutContents(DocumentFragment** 
-       rv = closestAncestor ? PrependChild(closestAncestor, nodeToResult)
-                            : PrependChild(commonCloneAncestor, nodeToResult);
-       NS_ENSURE_SUCCESS(rv, rv);
-       NS_ENSURE_STATE(!guard.Mutated(parent ? 2 : 1) ||
-                       ValidateCurrentNode(this, iter));
-     } else if (nodeToResult) {
-       nsMutationGuard guard;
-       nsCOMPtr<nsINode> node = nodeToResult;
-      nsINode* parent = node->GetParentNode();
-+      nsCOMPtr<nsINode> parent = node->GetParentNode();
-       if (parent) {
-         mozilla::ErrorResult error;
-         parent->RemoveChild(*node, error);
-         NS_ENSURE_FALSE(error.Failed(), error.ErrorCode());
-       }
-       NS_ENSURE_STATE(!guard.Mutated(1) ||
-                       ValidateCurrentNode(this, iter));
-     }
-diff --git a/dom/base/nsTreeSanitizer.cpp b/dom/base/nsTreeSanitizer.cpp
--- a/dom/base/nsTreeSanitizer.cpp
-+++ b/dom/base/nsTreeSanitizer.cpp
-@@ -1423,18 +1423,18 @@ nsTreeSanitizer::SanitizeChildren(nsINod
-                              mAllowStyles,
-                              false);
-         }
-         node = node->GetNextNonChildNode(aRoot);
-         continue;
-       }
-       if (MustFlatten(ns, localName)) {
-         RemoveAllAttributes(node);
-        nsIContent* next = node->GetNextNode(aRoot);
-        nsIContent* parent = node->GetParent();
-+        nsCOMPtr<nsIContent> next = node->GetNextNode(aRoot);
-+        nsCOMPtr<nsIContent> parent = node->GetParent();
-         nsCOMPtr<nsIContent> child; // Must keep the child alive during move
-         ErrorResult rv;
-         while ((child = node->GetFirstChild())) {
-           parent->InsertBefore(*child, node, rv);
-           if (rv.Failed()) {
-             break;
-           }
-         }
-diff --git a/dom/html/HTMLSelectElement.cpp b/dom/html/HTMLSelectElement.cpp
--- a/dom/html/HTMLSelectElement.cpp
-+++ b/dom/html/HTMLSelectElement.cpp
-@@ -624,17 +624,17 @@ HTMLSelectElement::Add(nsGenericHTMLElem
- {
-   if (!aBefore) {
-     Element::AppendChild(aElement, aError);
-     return;
-   }
- 
-   // Just in case we're not the parent, get the parent of the reference
-   // element
-  nsINode* parent = aBefore->Element::GetParentNode();
-+  nsCOMPtr<nsINode> parent = aBefore->Element::GetParentNode();
-   if (!parent || !nsContentUtils::ContentIsDescendantOf(parent, this)) {
-     // NOT_FOUND_ERR: Raised if before is not a descendant of the SELECT
-     // element.
-     aError.Throw(NS_ERROR_DOM_NOT_FOUND_ERR);
-     return;
-   }
- 
-   // If the before parameter is not null, we are equivalent to the
-diff --git a/dom/html/HTMLTableElement.cpp b/dom/html/HTMLTableElement.cpp
--- a/dom/html/HTMLTableElement.cpp
-+++ b/dom/html/HTMLTableElement.cpp
-@@ -516,18 +516,18 @@ HTMLTableElement::InsertRow(int32_t aInd
-   if (rowCount > 0) {
-     if (refIndex == rowCount || aIndex == -1) {
-       // we set refIndex to the last row so we can get the last row's
-       // parent we then do an AppendChild below if (rowCount<aIndex)
- 
-       refIndex = rowCount - 1;
-     }
- 
-    Element* refRow = rows->Item(refIndex);
-    nsINode* parent = refRow->GetParentNode();
-+    RefPtr<Element> refRow = rows->Item(refIndex);
-+    nsCOMPtr<nsINode> parent = refRow->GetParentNode();
- 
-     // create the row
-     nsRefPtr<mozilla::dom::NodeInfo> nodeInfo;
-     nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tr,
-                                 getter_AddRefs(nodeInfo));
- 
-     newRow = NS_NewHTMLTableRowElement(nodeInfo.forget());
- 
-
--- a/gnu/packages/patches/icecat-CVE-2016-1954.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1954.patch
@ -1,32 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/a5c4c18849b4
-
-# HG changeset patch
-# User Christoph Kerschbaumer <mozilla@christophkerschbaumer.com>
-# Date 1456157874 28800
-# Node ID a5c4c18849b486ef8693e20421b69239a2cbe574
-# Parent  e93aeb25e2a44df8d22f5a065b4410620e2c8730
-Bug 1243178: CSP - Skip sending reports for non http schemes (r=dveditz) a=ritu
-
-diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
--- a/dom/security/nsCSPContext.cpp
-+++ b/dom/security/nsCSPContext.cpp
-@@ -798,16 +798,17 @@ nsCSPContext::SendReports(nsISupports* a
-       (NS_SUCCEEDED(reportURI->SchemeIs("https", &isHttpScheme)) && isHttpScheme);
- 
-     if (!isHttpScheme) {
-       const char16_t* params[] = { reportURIs[r].get() };
-       CSP_LogLocalizedStr(NS_LITERAL_STRING("reportURInotHttpsOrHttp2").get(),
-                           params, ArrayLength(params),
-                           aSourceFile, aScriptSample, aLineNum, 0,
-                           nsIScriptError::errorFlag, "CSP", mInnerWindowID);
-+      continue;
-     }
- 
-     // make sure this is an anonymous request (no cookies) so in case the
-     // policy URI is injected, it can't be abused for CSRF.
-     nsLoadFlags flags;
-     rv = reportChannel->GetLoadFlags(&flags);
-     NS_ENSURE_SUCCESS(rv, rv);
-     flags |= nsIRequest::LOAD_ANONYMOUS;
-
--- a/gnu/packages/patches/icecat-CVE-2016-1960.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1960.patch
@ -1,55 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/185b233ea03f
-
-# HG changeset patch
-# User Henri Sivonen <hsivonen@hsivonen.fi>
-# Date 1455100746 -7200
-# Node ID 185b233ea03f3811404e3979b65ec86b29d13555
-# Parent  271e3a5a53d96871141e89271f611033b512e3e4
-Bug 1246014. r=wchen. a=sylvestre
-
-diff --git a/parser/html/javasrc/TreeBuilder.java b/parser/html/javasrc/TreeBuilder.java
--- a/parser/html/javasrc/TreeBuilder.java
-+++ b/parser/html/javasrc/TreeBuilder.java
-@@ -4437,17 +4437,17 @@ public abstract class TreeBuilder<T> imp
-         return TreeBuilder.NOT_FOUND_ON_STACK;
-     }
- 
-     private void clearStackBackTo(int eltPos) throws SAXException {
-         int eltGroup = stack[eltPos].getGroup();
-         while (currentPtr > eltPos) { // > not >= intentional
-             if (stack[currentPtr].ns == "http://www.w3.org/1999/xhtml"
-                     && stack[currentPtr].getGroup() == TEMPLATE
-                    && (eltGroup == TABLE || eltGroup == TBODY_OR_THEAD_OR_TFOOT|| eltGroup == TR || eltGroup == HTML)) {
-+                    && (eltGroup == TABLE || eltGroup == TBODY_OR_THEAD_OR_TFOOT|| eltGroup == TR || eltPos == 0)) {
-                 return;
-             }
-             pop();
-         }
-     }
- 
-     private void resetTheInsertionMode() {
-         StackNode<T> node;
-diff --git a/parser/html/nsHtml5TreeBuilder.cpp b/parser/html/nsHtml5TreeBuilder.cpp
--- a/parser/html/nsHtml5TreeBuilder.cpp
-+++ b/parser/html/nsHtml5TreeBuilder.cpp
-@@ -3301,17 +3301,17 @@ nsHtml5TreeBuilder::findLastInTableScope
-   return NS_HTML5TREE_BUILDER_NOT_FOUND_ON_STACK;
- }
- 
- void 
- nsHtml5TreeBuilder::clearStackBackTo(int32_t eltPos)
- {
-   int32_t eltGroup = stack[eltPos]->getGroup();
-   while (currentPtr > eltPos) {
-    if (stack[currentPtr]->ns == kNameSpaceID_XHTML && stack[currentPtr]->getGroup() == NS_HTML5TREE_BUILDER_TEMPLATE && (eltGroup == NS_HTML5TREE_BUILDER_TABLE || eltGroup == NS_HTML5TREE_BUILDER_TBODY_OR_THEAD_OR_TFOOT || eltGroup == NS_HTML5TREE_BUILDER_TR || eltGroup == NS_HTML5TREE_BUILDER_HTML)) {
-+    if (stack[currentPtr]->ns == kNameSpaceID_XHTML && stack[currentPtr]->getGroup() == NS_HTML5TREE_BUILDER_TEMPLATE && (eltGroup == NS_HTML5TREE_BUILDER_TABLE || eltGroup == NS_HTML5TREE_BUILDER_TBODY_OR_THEAD_OR_TFOOT || eltGroup == NS_HTML5TREE_BUILDER_TR || !eltPos)) {
-       return;
-     }
-     pop();
-   }
- }
- 
- void 
- nsHtml5TreeBuilder::resetTheInsertionMode()
-
--- a/gnu/packages/patches/icecat-CVE-2016-1961.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1961.patch
@ -1,33 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/e93aeb25e2a4
-
-# HG changeset patch
-# User Andrew McCreight <continuation@gmail.com>
-# Date 1455891967 28800
-# Node ID e93aeb25e2a44df8d22f5a065b4410620e2c8730
-# Parent  221de852fda32714a9e484774ceafafb450ea73c
-Bug 1249377 - Hold a strong reference to |root| in nsHTMLDocument::SetBody. r=bz, a=sylvestre
-
-diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
--- a/dom/html/nsHTMLDocument.cpp
-+++ b/dom/html/nsHTMLDocument.cpp
-@@ -1044,17 +1044,17 @@ nsHTMLDocument::SetBody(nsIDOMHTMLElemen
-   ErrorResult rv;
-   SetBody(static_cast<nsGenericHTMLElement*>(newBody.get()), rv);
-   return rv.ErrorCode();
- }
- 
- void
- nsHTMLDocument::SetBody(nsGenericHTMLElement* newBody, ErrorResult& rv)
- {
-  Element* root = GetRootElement();
-+  nsCOMPtr<Element> root = GetRootElement();
- 
-   // The body element must be either a body tag or a frameset tag. And we must
-   // have a html root tag, otherwise GetBody will not return the newly set
-   // body.
-   if (!newBody || !(newBody->Tag() == nsGkAtoms::body ||
-                     newBody->Tag() == nsGkAtoms::frameset) ||
-       !root || !root->IsHTML() ||
-       root->Tag() != nsGkAtoms::html) {
-
--- a/gnu/packages/patches/icecat-CVE-2016-1962.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1962.patch
@ -1,107 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/221de852fda3
-
-# HG changeset patch
-# User Randell Jesup <rjesup@jesup.org>
-# Date 1455862087 18000
-# Node ID 221de852fda32714a9e484774ceafafb450ea73c
-# Parent  b03db72e32f6e3acdc9f8705371cb222d7e6c456
-Bug 1240760: Update DataChannel::Close() r=mcmanus, a=ritu
-
-MozReview-Commit-ID: 7nN9h3M3O8w
-
-diff --git a/netwerk/sctp/datachannel/DataChannel.cpp b/netwerk/sctp/datachannel/DataChannel.cpp
--- a/netwerk/sctp/datachannel/DataChannel.cpp
-+++ b/netwerk/sctp/datachannel/DataChannel.cpp
-@@ -1771,17 +1771,17 @@ DataChannelConnection::HandleStreamReset
-           }
-           NS_DispatchToMainThread(new DataChannelOnMessageAvailable(
-                                     DataChannelOnMessageAvailable::ON_CHANNEL_CLOSED, this,
-                                     channel));
-           mStreams[channel->mStream] = nullptr;
- 
-           LOG(("Disconnected DataChannel %p from connection %p",
-                (void *) channel.get(), (void *) channel->mConnection.get()));
-          channel->Destroy();
-+          channel->DestroyLocked();
-           // At this point when we leave here, the object is a zombie held alive only by the DOM object
-         } else {
-           LOG(("Can't find incoming channel %d",i));
-         }
-       }
-     }
-   }
- 
-@@ -2498,17 +2498,17 @@ DataChannelConnection::CloseInt(DataChan
-       mStreams[channel->mStream] = nullptr;
-     } else {
-       SendOutgoingStreamReset();
-     }
-   }
-   aChannel->mState = CLOSING;
-   if (mState == CLOSED) {
-     // we're not going to hang around waiting
-    channel->Destroy();
-+    channel->DestroyLocked();
-   }
-   // At this point when we leave here, the object is a zombie held alive only by the DOM object
- }
- 
- void DataChannelConnection::CloseAll()
- {
-   LOG(("Closing all channels (connection %p)", (void*) this));
-   // Don't need to lock here
-@@ -2552,23 +2552,25 @@ DataChannel::~DataChannel()
-   // wrong, nothing bad happens.  A worst it's a leak.
-   NS_ASSERTION(mState == CLOSED || mState == CLOSING, "unexpected state in ~DataChannel");
- }
- 
- void
- DataChannel::Close()
- {
-   ENSURE_DATACONNECTION;
-+  RefPtr<DataChannelConnection> connection(mConnection);
-   mConnection->Close(this);
- }
- 
- // Used when disconnecting from the DataChannelConnection
- void
-DataChannel::Destroy()
-+DataChannel::DestroyLocked()
- {
-+  mConnection->mLock.AssertCurrentThreadOwns();
-   ENSURE_DATACONNECTION;
- 
-   LOG(("Destroying Data channel %u", mStream));
-   MOZ_ASSERT_IF(mStream != INVALID_STREAM,
-                 !mConnection->FindChannelByStream(mStream));
-   mStream = INVALID_STREAM;
-   mState = CLOSED;
-   mConnection = nullptr;
-diff --git a/netwerk/sctp/datachannel/DataChannel.h b/netwerk/sctp/datachannel/DataChannel.h
--- a/netwerk/sctp/datachannel/DataChannel.h
-+++ b/netwerk/sctp/datachannel/DataChannel.h
-@@ -331,19 +331,20 @@ public:
-     {
-       NS_ASSERTION(mConnection,"NULL connection");
-     }
- 
- private:
-   ~DataChannel();
- 
- public:
-  void Destroy(); // when we disconnect from the connection after stream RESET
-+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(DataChannel)
- 
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(DataChannel)
-+  // when we disconnect from the connection after stream RESET
-+  void DestroyLocked();
- 
-   // Close this DataChannel.  Can be called multiple times.  MUST be called
-   // before destroying the DataChannel (state must be CLOSED or CLOSING).
-   void Close();
- 
-   // Set the listener (especially for channels created from the other side)
-   void SetListener(DataChannelListener *aListener, nsISupports *aContext);
- 
-
--- a/gnu/packages/patches/icecat-CVE-2016-1964.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1964.patch
@ -1,54 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/a653013e7b50
-
-# HG changeset patch
-# User Peter Van der Beken <peterv@propagandism.org>
-# Date 1454340035 -3600
-# Node ID a653013e7b503912a32621e8da64a37171316588
-# Parent  0d0d7e8292f7ecf5f1149d528c0524f04447c4ad
-Bug 1243335 - report bad QName. r=sicking, a=sylvestre
-
-diff --git a/dom/xslt/xslt/txInstructions.cpp b/dom/xslt/xslt/txInstructions.cpp
--- a/dom/xslt/xslt/txInstructions.cpp
-+++ b/dom/xslt/xslt/txInstructions.cpp
-@@ -93,16 +93,19 @@ txAttribute::txAttribute(nsAutoPtr<Expr>
-                          txNamespaceMap* aMappings)
-     : mName(Move(aName)), mNamespace(Move(aNamespace)), mMappings(aMappings)
- {
- }
- 
- nsresult
- txAttribute::execute(txExecutionState& aEs)
- {
-+    nsAutoPtr<txTextHandler> handler(
-+        static_cast<txTextHandler*>(aEs.popResultHandler()));
-+
-     nsAutoString name;
-     nsresult rv = mName->evaluateToString(aEs.getEvalContext(), name);
-     NS_ENSURE_SUCCESS(rv, rv);
- 
-     const char16_t* colon;
-     if (!XMLUtils::isValidQName(name, &colon) ||
-         TX_StringEqualsAtom(name, nsGkAtoms::xmlns)) {
-         return NS_OK;
-@@ -125,19 +128,16 @@ txAttribute::execute(txExecutionState& a
-         if (!nspace.IsEmpty()) {
-             nsId = txNamespaceManager::getNamespaceID(nspace);
-         }
-     }
-     else if (colon) {
-         nsId = mMappings->lookupNamespace(prefix);
-     }
- 
-    nsAutoPtr<txTextHandler> handler(
-        static_cast<txTextHandler*>(aEs.popResultHandler()));
-
-     // add attribute if everything was ok
-     return nsId != kNameSpaceID_Unknown ?
-            aEs.mResultHandler->attribute(prefix, Substring(name, lnameStart),
-                                          nsId, handler->mValue) :
-            NS_OK;
- }
- 
- txCallTemplate::txCallTemplate(const txExpandedName& aName)
-
--- a/gnu/packages/patches/icecat-CVE-2016-1965.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1965.patch
@ -1,44 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/b4467681abd6
-
-# HG changeset patch
-# User Gijs Kruitbosch <gijskruitbosch@gmail.com>
-# Date 1455276061 0
-# Node ID b4467681abd676cd5575cbdf922927f8f54d2ad9
-# Parent  8c1d40e45a72c6432e879137a0afa519dc6c9841
-Bug 1245264 - r=bz, r=ritu
-
-MozReview-Commit-ID: I0sVdritpD3
-
-diff --git a/dom/base/nsLocation.cpp b/dom/base/nsLocation.cpp
--- a/dom/base/nsLocation.cpp
-+++ b/dom/base/nsLocation.cpp
-@@ -735,16 +735,27 @@ nsLocation::SetProtocol(const nsAString&
-     return rv;
-   }
- 
-   rv = uri->SetScheme(NS_ConvertUTF16toUTF8(aProtocol));
-   if (NS_WARN_IF(NS_FAILED(rv))) {
-     return rv;
-   }
- 
-+  nsAutoCString newSpec;
-+  rv = uri->GetSpec(newSpec);
-+  if (NS_FAILED(rv)) {
-+    return rv;
-+  }
-+  // We may want a new URI class for the new URI, so recreate it:
-+  rv = NS_NewURI(getter_AddRefs(uri), newSpec);
-+  if (NS_FAILED(rv)) {
-+    return rv;
-+  }
-+
-   return SetURI(uri);
- }
- 
- void
- nsLocation::GetUsername(nsAString& aUsername, ErrorResult& aError)
- {
-   if (!CallerSubsumes()) {
-     aError.Throw(NS_ERROR_DOM_SECURITY_ERR);
-
--- a/gnu/packages/patches/icecat-CVE-2016-1966.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1966.patch
@ -1,36 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/291c2f31c48c
-
-# HG changeset patch
-# User Nicholas Nethercote <nnethercote@mozilla.com>
-# Date 1454650565 -39600
-# Node ID 291c2f31c48c7e96b1884b55273355970fa0fc30
-# Parent  11e6614756551cfd7291e73eefb90c52873a8480
-Bug 1246054 - Fix an erroneous nsNPObjWrapper assertion. r=froydnj. a=ritu
-
-diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
--- a/dom/plugins/base/nsJSNPRuntime.cpp
-+++ b/dom/plugins/base/nsJSNPRuntime.cpp
-@@ -1915,18 +1915,19 @@ nsNPObjWrapper::GetNewOrUsed(NPP npp, JS
-   // No existing JSObject, create one.
- 
-   JS::Rooted<JSObject*> obj(cx, ::JS_NewObject(cx, js::Jsvalify(&sNPObjectJSWrapperClass)));
- 
-   if (generation != sNPObjWrappers.Generation()) {
-       // Reload entry if the JS_NewObject call caused a GC and reallocated
-       // the table (see bug 445229). This is guaranteed to succeed.
- 
-      NS_ASSERTION(PL_DHashTableSearch(&sNPObjWrappers, npobj),
-                   "Hashtable didn't find what we just added?");
-+      entry = static_cast<NPObjWrapperHashEntry*>
-+        (PL_DHashTableSearch(&sNPObjWrappers, npobj));
-+      NS_ASSERTION(entry, "Hashtable didn't find what we just added?");
-   }
- 
-   if (!obj) {
-     // OOM? Remove the stale entry from the hash.
- 
-     PL_DHashTableRawRemove(&sNPObjWrappers, entry);
- 
-     return nullptr;
-
--- a/gnu/packages/patches/icecat-CVE-2016-1974.patch
+++ b/gnu/packages/patches/icecat-CVE-2016-1974.patch
@ -1,530 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/271e3a5a53d9
-
-# HG changeset patch
-# User Henri Sivonen <hsivonen@hsivonen.fi>
-# Date 1455014759 -7200
-# Node ID 271e3a5a53d96871141e89271f611033b512e3e4
-# Parent  9719b71d72dd2a3c5ee12ace156af2a63d9595ac
-Bug 1228103. r=smaug. a=sylvestre
-
-diff --git a/parser/htmlparser/nsExpatDriver.cpp b/parser/htmlparser/nsExpatDriver.cpp
--- a/parser/htmlparser/nsExpatDriver.cpp
-+++ b/parser/htmlparser/nsExpatDriver.cpp
-@@ -1127,22 +1127,28 @@ nsExpatDriver::ConsumeToken(nsScanner& a
-       XML_Size lastLineLength = XML_GetCurrentColumnNumber(mExpatParser);
- 
-       if (lastLineLength <= consumed) {
-         // The length of the last line was less than what expat consumed, so
-         // there was at least one line break in the consumed data. Store the
-         // last line until the point where we stopped parsing.
-         nsScannerIterator startLastLine = currentExpatPosition;
-         startLastLine.advance(-((ptrdiff_t)lastLineLength));
-        CopyUnicodeTo(startLastLine, currentExpatPosition, mLastLine);
-+        if (!CopyUnicodeTo(startLastLine, currentExpatPosition, mLastLine)) {
-+          return (mInternalState = NS_ERROR_OUT_OF_MEMORY);
-+        }
-       }
-       else {
-         // There was no line break in the consumed data, append the consumed
-         // data.
-        AppendUnicodeTo(oldExpatPosition, currentExpatPosition, mLastLine);
-+        if (!AppendUnicodeTo(oldExpatPosition,
-+                             currentExpatPosition,
-+                             mLastLine)) {
-+          return (mInternalState = NS_ERROR_OUT_OF_MEMORY);
-+        }
-       }
-     }
- 
-     mExpatBuffered += length - consumed;
- 
-     if (BlockedOrInterrupted()) {
-       PR_LOG(GetExpatDriverLog(), PR_LOG_DEBUG,
-              ("Blocked or interrupted parser (probably for loading linked "
-diff --git a/parser/htmlparser/nsParser.cpp b/parser/htmlparser/nsParser.cpp
--- a/parser/htmlparser/nsParser.cpp
-+++ b/parser/htmlparser/nsParser.cpp
-@@ -1508,17 +1508,19 @@ nsParser::ResumeParse(bool allowIteratio
-                 DidBuildModel(mStreamStatus);
-                 return NS_OK;
-               }
-             } else {
-               CParserContext* theContext = PopContext();
-               if (theContext) {
-                 theIterationIsOk = allowIteration && theContextIsStringBased;
-                 if (theContext->mCopyUnused) {
-                  theContext->mScanner->CopyUnusedData(mUnusedInput);
-+                  if (!theContext->mScanner->CopyUnusedData(mUnusedInput)) {
-+                    mInternalState = NS_ERROR_OUT_OF_MEMORY;
-+                  }
-                 }
- 
-                 delete theContext;
-               }
- 
-               result = mInternalState;
-               aIsFinalChunk = mParserContext &&
-                               mParserContext->mStreamListenerState == eOnStop;
-diff --git a/parser/htmlparser/nsScanner.cpp b/parser/htmlparser/nsScanner.cpp
--- a/parser/htmlparser/nsScanner.cpp
-+++ b/parser/htmlparser/nsScanner.cpp
-@@ -379,17 +379,19 @@ nsresult nsScanner::Peek(nsAString& aStr
-   if (mCountRemaining < uint32_t(aNumChars + aOffset)) {
-     end = mEndPosition;
-   }
-   else {
-     end = start;
-     end.advance(aNumChars);
-   }
- 
-  CopyUnicodeTo(start, end, aStr);
-+  if (!CopyUnicodeTo(start, end, aStr)) {
-+    return NS_ERROR_OUT_OF_MEMORY;
-+  }
- 
-   return NS_OK;
- }
- 
- 
- /**
-  *  Skip whitespace on scanner input stream
-  *  
-@@ -542,17 +544,19 @@ nsresult nsScanner::ReadTagIdentifier(ns
- 
-     if (!found) {
-       ++current;
-     }
-   }
- 
-   // Don't bother appending nothing.
-   if (current != mCurrentPosition) {
-    AppendUnicodeTo(mCurrentPosition, current, aString);
-+    if (!AppendUnicodeTo(mCurrentPosition, current, aString)) {
-+      return NS_ERROR_OUT_OF_MEMORY;
-+    }
-   }
- 
-   SetPosition(current);  
-   if (current == end) {
-     result = kEOF;
-   }
- 
-   //DoErrTest(aString);
-@@ -597,26 +601,30 @@ nsresult nsScanner::ReadEntityIdentifier
-         default:
-           found = ('a'<=theChar && theChar<='z') ||
-                   ('A'<=theChar && theChar<='Z') ||
-                   ('0'<=theChar && theChar<='9');
-           break;
-       }
- 
-       if(!found) {
-        AppendUnicodeTo(mCurrentPosition, current, aString);
-+        if (!AppendUnicodeTo(mCurrentPosition, current, aString)) {
-+          return NS_ERROR_OUT_OF_MEMORY;
-+        }
-         break;
-       }
-     }
-     ++current;
-   }
-   
-   SetPosition(current);
-   if (current == end) {
-    AppendUnicodeTo(origin, current, aString);
-+    if (!AppendUnicodeTo(origin, current, aString)) {
-+      return NS_ERROR_OUT_OF_MEMORY;
-+    }
-     return kEOF;
-   }
- 
-   //DoErrTest(aString);
- 
-   return result;
- }
- 
-@@ -646,26 +654,30 @@ nsresult nsScanner::ReadNumber(nsString&
-   while(current != end) {
-     theChar=*current;
-     if(theChar) {
-       done = (theChar < '0' || theChar > '9') && 
-              ((aBase == 16)? (theChar < 'A' || theChar > 'F') &&
-                              (theChar < 'a' || theChar > 'f')
-                              :true);
-       if(done) {
-        AppendUnicodeTo(origin, current, aString);
-+        if (!AppendUnicodeTo(origin, current, aString)) {
-+          return NS_ERROR_OUT_OF_MEMORY;
-+        }
-         break;
-       }
-     }
-     ++current;
-   }
- 
-   SetPosition(current);
-   if (current == end) {
-    AppendUnicodeTo(origin, current, aString);
-+    if (!AppendUnicodeTo(origin, current, aString)) {
-+      return NS_ERROR_OUT_OF_MEMORY;
-+    }
-     return kEOF;
-   }
- 
-   //DoErrTest(aString);
- 
-   return result;
- }
- 
-@@ -712,37 +724,43 @@ nsresult nsScanner::ReadWhitespace(nsSca
-           char16_t thePrevChar = theChar;
-           theChar = (++current != end) ? *current : '\0';
-           if ((thePrevChar == '\r' && theChar == '\n') ||
-               (thePrevChar == '\n' && theChar == '\r')) {
-             theChar = (++current != end) ? *current : '\0'; // CRLF == LFCR => LF
-             haveCR = true;
-           } else if (thePrevChar == '\r') {
-             // Lone CR becomes CRLF; callers should know to remove extra CRs
-            AppendUnicodeTo(origin, current, aString);
-+            if (!AppendUnicodeTo(origin, current, aString)) {
-+              return NS_ERROR_OUT_OF_MEMORY;
-+            }
-             aString.writable().Append(char16_t('\n'));
-             origin = current;
-             haveCR = true;
-           }
-         }
-         break;
-       case ' ' :
-       case '\t':
-         theChar = (++current != end) ? *current : '\0';
-         break;
-       default:
-         done = true;
-        AppendUnicodeTo(origin, current, aString);
-+        if (!AppendUnicodeTo(origin, current, aString)) {
-+          return NS_ERROR_OUT_OF_MEMORY;
-+        }
-         break;
-     }
-   }
- 
-   SetPosition(current);
-   if (current == end) {
-    AppendUnicodeTo(origin, current, aString);
-+    if (!AppendUnicodeTo(origin, current, aString)) {
-+      return NS_ERROR_OUT_OF_MEMORY;
-+    }
-     result = kEOF;
-   }
- 
-   aHaveCR = haveCR;
-   return result;
- }
- 
- //XXXbz callers of this have to manage their lone '\r' themselves if they want
-@@ -846,34 +864,38 @@ nsresult nsScanner::ReadUntil(nsAString&
-     if(!(theChar & aEndCondition.mFilter)) {
-       // They were. Do a thorough check.
- 
-       setcurrent = setstart;
-       while (*setcurrent) {
-         if (*setcurrent == theChar) {
-           if(addTerminal)
-             ++current;
-          AppendUnicodeTo(origin, current, aString);
-+          if (!AppendUnicodeTo(origin, current, aString)) {
-+            return NS_ERROR_OUT_OF_MEMORY;
-+          }
-           SetPosition(current);
- 
-           //DoErrTest(aString);
- 
-           return NS_OK;
-         }
-         ++setcurrent;
-       }
-     }
-     
-     ++current;
-   }
- 
-   // If we are here, we didn't find any terminator in the string and
-   // current = mEndPosition
-   SetPosition(current);
-  AppendUnicodeTo(origin, current, aString);
-+  if (!AppendUnicodeTo(origin, current, aString)) {
-+    return NS_ERROR_OUT_OF_MEMORY;
-+  }
-   return kEOF;
- }
- 
- nsresult nsScanner::ReadUntil(nsScannerSharedSubstring& aString,
-                               const nsReadEndCondition& aEndCondition,
-                               bool addTerminal)
- {  
-   if (!mSlidingBuffer) {
-@@ -906,34 +928,38 @@ nsresult nsScanner::ReadUntil(nsScannerS
-     if(!(theChar & aEndCondition.mFilter)) {
-       // They were. Do a thorough check.
- 
-       setcurrent = setstart;
-       while (*setcurrent) {
-         if (*setcurrent == theChar) {
-           if(addTerminal)
-             ++current;
-          AppendUnicodeTo(origin, current, aString);
-+          if (!AppendUnicodeTo(origin, current, aString)) {
-+            return NS_ERROR_OUT_OF_MEMORY;
-+          }
-           SetPosition(current);
- 
-           //DoErrTest(aString);
- 
-           return NS_OK;
-         }
-         ++setcurrent;
-       }
-     }
-     
-     ++current;
-   }
- 
-   // If we are here, we didn't find any terminator in the string and
-   // current = mEndPosition
-   SetPosition(current);
-  AppendUnicodeTo(origin, current, aString);
-+  if (!AppendUnicodeTo(origin, current, aString)) {
-+    return NS_ERROR_OUT_OF_MEMORY;
-+  }
-   return kEOF;
- }
- 
- nsresult nsScanner::ReadUntil(nsScannerIterator& aStart, 
-                               nsScannerIterator& aEnd,
-                               const nsReadEndCondition &aEndCondition,
-                               bool addTerminal)
- {
-@@ -1025,26 +1051,30 @@ nsresult nsScanner::ReadUntil(nsAString&
-     if (theChar == '\0') {
-       ReplaceCharacter(current, sInvalid);
-       theChar = sInvalid;
-     }
- 
-     if (aTerminalChar == theChar) {
-       if(addTerminal)
-         ++current;
-      AppendUnicodeTo(origin, current, aString);
-+      if (!AppendUnicodeTo(origin, current, aString)) {
-+        return NS_ERROR_OUT_OF_MEMORY;
-+      }
-       SetPosition(current);
-       return NS_OK;
-     }
-     ++current;
-   }
- 
-   // If we are here, we didn't find any terminator in the string and
-   // current = mEndPosition
-  AppendUnicodeTo(origin, current, aString);
-+  if (!AppendUnicodeTo(origin, current, aString)) {
-+    return NS_ERROR_OUT_OF_MEMORY;
-+  }
-   SetPosition(current);
-   return kEOF;
- 
- }
- 
- void nsScanner::BindSubstring(nsScannerSubstring& aSubstring, const nsScannerIterator& aStart, const nsScannerIterator& aEnd)
- {
-   aSubstring.Rebind(*mSlidingBuffer, aStart, aEnd);
-@@ -1142,29 +1172,29 @@ bool nsScanner::AppendToBuffer(nsScanner
- }
- 
- /**
-  *  call this to copy bytes out of the scanner that have not yet been consumed
-  *  by the tokenization process.
-  *  
-  *  @update  gess 5/12/98
-  *  @param   aCopyBuffer is where the scanner buffer will be copied to
- *  @return  nada
-+ *  @return  true if OK or false on OOM
-  */
-void nsScanner::CopyUnusedData(nsString& aCopyBuffer) {
-+bool nsScanner::CopyUnusedData(nsString& aCopyBuffer) {
-   if (!mSlidingBuffer) {
-     aCopyBuffer.Truncate();
-    return;
-+    return true;
-   }
- 
-   nsScannerIterator start, end;
-   start = mCurrentPosition;
-   end = mEndPosition;
- 
-  CopyUnicodeTo(start, end, aCopyBuffer);
-+  return CopyUnicodeTo(start, end, aCopyBuffer);
- }
- 
- /**
-  *  Retrieve the name of the file that the scanner is reading from.
-  *  In some cases, it's just a given name, because the scanner isn't
-  *  really reading from a file.
-  *  
-  *  @update  gess 5/12/98
-diff --git a/parser/htmlparser/nsScanner.h b/parser/htmlparser/nsScanner.h
--- a/parser/htmlparser/nsScanner.h
-+++ b/parser/htmlparser/nsScanner.h
-@@ -204,19 +204,19 @@ class nsScanner {
-                       nsIRequest *aRequest);
- 
-       /**
-        *  Call this to copy bytes out of the scanner that have not yet been consumed
-        *  by the tokenization process.
-        *  
-        *  @update  gess 5/12/98
-        *  @param   aCopyBuffer is where the scanner buffer will be copied to
-       *  @return  nada
-+       *  @return  true if OK or false on OOM
-        */
-      void CopyUnusedData(nsString& aCopyBuffer);
-+      bool CopyUnusedData(nsString& aCopyBuffer);
- 
-       /**
-        *  Retrieve the name of the file that the scanner is reading from.
-        *  In some cases, it's just a given name, because the scanner isn't
-        *  really reading from a file.
-        *  
-        *  @update  gess 5/12/98
-        *  @return  
-diff --git a/parser/htmlparser/nsScannerString.cpp b/parser/htmlparser/nsScannerString.cpp
--- a/parser/htmlparser/nsScannerString.cpp
-+++ b/parser/htmlparser/nsScannerString.cpp
-@@ -461,61 +461,63 @@ copy_multifragment_string( nsScannerIter
-         sink_traits::write(result, source_traits::read(first), distance);
-         NS_ASSERTION(distance > 0, "|copy_multifragment_string| will never terminate");
-         source_traits::advance(first, distance);
-       }
- 
-     return result;
-   }
- 
-void
-+bool
- CopyUnicodeTo( const nsScannerIterator& aSrcStart,
-                const nsScannerIterator& aSrcEnd,
-                nsAString& aDest )
-   {
-     nsAString::iterator writer;
-     if (!aDest.SetLength(Distance(aSrcStart, aSrcEnd), mozilla::fallible)) {
-       aDest.Truncate();
-      return; // out of memory
-+      return false; // out of memory
-     }
-     aDest.BeginWriting(writer);
-     nsScannerIterator fromBegin(aSrcStart);
-     
-     copy_multifragment_string(fromBegin, aSrcEnd, writer);
-+    return true;
-   }
- 
-void
-+bool
- AppendUnicodeTo( const nsScannerIterator& aSrcStart,
-                  const nsScannerIterator& aSrcEnd,
-                  nsScannerSharedSubstring& aDest )
-   {
-     // Check whether we can just create a dependent string.
-     if (aDest.str().IsEmpty()) {
-       // We can just make |aDest| point to the buffer.
-       // This will take care of copying if the buffer spans fragments.
-       aDest.Rebind(aSrcStart, aSrcEnd);
-    } else {
-      // The dest string is not empty, so it can't be a dependent substring.
-      AppendUnicodeTo(aSrcStart, aSrcEnd, aDest.writable());
-+      return true;
-     }
-+    // The dest string is not empty, so it can't be a dependent substring.
-+    return AppendUnicodeTo(aSrcStart, aSrcEnd, aDest.writable());
-   }
- 
-void
-+bool
- AppendUnicodeTo( const nsScannerIterator& aSrcStart,
-                  const nsScannerIterator& aSrcEnd,
-                  nsAString& aDest )
-   {
-     nsAString::iterator writer;
-     uint32_t oldLength = aDest.Length();
-     if (!aDest.SetLength(oldLength + Distance(aSrcStart, aSrcEnd), mozilla::fallible))
-      return; // out of memory
-+      return false; // out of memory
-     aDest.BeginWriting(writer).advance(oldLength);
-     nsScannerIterator fromBegin(aSrcStart);
-     
-     copy_multifragment_string(fromBegin, aSrcEnd, writer);
-+    return true;
-   }
- 
- bool
- FindCharInReadable( char16_t aChar,
-                     nsScannerIterator& aSearchStart,
-                     const nsScannerIterator& aSearchEnd )
-   {
-     while ( aSearchStart != aSearchEnd )
-diff --git a/parser/htmlparser/nsScannerString.h b/parser/htmlparser/nsScannerString.h
--- a/parser/htmlparser/nsScannerString.h
-+++ b/parser/htmlparser/nsScannerString.h
-@@ -539,43 +539,43 @@ nsScannerBufferList::Position::operator=
- inline
- size_t
- Distance( const nsScannerIterator& aStart, const nsScannerIterator& aEnd )
-   {
-     typedef nsScannerBufferList::Position Position;
-     return Position::Distance(Position(aStart), Position(aEnd));
-   }
- 
-void
-+bool
- CopyUnicodeTo( const nsScannerIterator& aSrcStart,
-                const nsScannerIterator& aSrcEnd,
-                nsAString& aDest );
- 
- inline
-void
-+bool
- CopyUnicodeTo( const nsScannerSubstring& aSrc, nsAString& aDest )
-   {
-     nsScannerIterator begin, end;
-    CopyUnicodeTo(aSrc.BeginReading(begin), aSrc.EndReading(end), aDest);
-+    return CopyUnicodeTo(aSrc.BeginReading(begin), aSrc.EndReading(end), aDest);
-   }
- 
-void
-+bool
- AppendUnicodeTo( const nsScannerIterator& aSrcStart,
-                  const nsScannerIterator& aSrcEnd,
-                  nsAString& aDest );
- 
- inline
-void
-+bool
- AppendUnicodeTo( const nsScannerSubstring& aSrc, nsAString& aDest )
-   {
-     nsScannerIterator begin, end;
-    AppendUnicodeTo(aSrc.BeginReading(begin), aSrc.EndReading(end), aDest);
-+    return AppendUnicodeTo(aSrc.BeginReading(begin), aSrc.EndReading(end), aDest);
-   }
- 
-void
-+bool
- AppendUnicodeTo( const nsScannerIterator& aSrcStart,
-                  const nsScannerIterator& aSrcEnd,
-                  nsScannerSharedSubstring& aDest );
- 
- bool
- FindCharInReadable( char16_t aChar,
-                     nsScannerIterator& aStart,
-                     const nsScannerIterator& aEnd );
-
--- a/gnu/packages/patches/icecat-bug-1248851.patch
+++ b/gnu/packages/patches/icecat-bug-1248851.patch
@ -1,37 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/8c1d40e45a72
-
-# HG changeset patch
-# User Xidorn Quan <quanxunzhen@gmail.com>
-# Date 1456199544 -28800
-# Node ID 8c1d40e45a72c6432e879137a0afa519dc6c9841
-# Parent  1dd0ca8e70bd77b6fd93f36cc4e9c2cebfe8ba0a
-Bug 1248851 - r=sicking, a=ritu
-
-diff --git a/dom/indexedDB/ActorsParent.cpp b/dom/indexedDB/ActorsParent.cpp
--- a/dom/indexedDB/ActorsParent.cpp
-+++ b/dom/indexedDB/ActorsParent.cpp
-@@ -14823,22 +14823,19 @@ ObjectStoreAddOrPutRequestOp::DoDatabase
-     }
- 
-     snappy::RawCompress(uncompressed, uncompressedLength, compressed,
-                         &compressedLength);
- 
-     uint8_t* dataBuffer = reinterpret_cast<uint8_t*>(compressed);
-     size_t dataBufferLength = compressedLength;
- 
-    // If this call succeeds, | compressed | is now owned by the statement, and
-    // we are no longer responsible for it.
-     rv = stmt->BindAdoptedBlobByName(NS_LITERAL_CSTRING("data"), dataBuffer,
-                                      dataBufferLength);
-     if (NS_WARN_IF(NS_FAILED(rv))) {
-      moz_free(compressed);
-       return rv;
-     }
-   }
- 
-   nsCOMPtr<nsIFile> fileDirectory;
-   nsCOMPtr<nsIFile> journalDirectory;
- 
-   if (mFileManager) {
-
--- a/gnu/packages/patches/icecat-update-graphite2-pt2.patch
+++ b/gnu/packages/patches/icecat-update-graphite2-pt2.patch
@ -1,861 +0,0 @@
-Copied from upstream:
-https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/ec9cff7bb543
-
-# HG changeset patch
-# User Jonathan Kew <jkew@mozilla.com>
-# Date 1456760339 0
-# Node ID ec9cff7bb5439b2b4c1249ff9376d07a80172c27
-# Parent  6f4d5130238790fa5810c76ffeb9eccc65efa8c9
-Bug 1248876 - Update graphite2 to upstream release 1.3.6. r=jrmuizel a=sledru
-
-diff --git a/gfx/graphite2/README.mozilla b/gfx/graphite2/README.mozilla
--- a/gfx/graphite2/README.mozilla
-+++ b/gfx/graphite2/README.mozilla
-@@ -1,7 +1,3 @@
-This directory contains the Graphite2 library release 1.3.5 from
-https://github.com/silnrsi/graphite/releases/download/1.3.5/graphite2-minimal-1.3.5.tgz
-+This directory contains the Graphite2 library release 1.3.6 from
-+https://github.com/silnrsi/graphite/releases/download/1.3.6/graphite-minimal-1.3.6.tgz
- See gfx/graphite2/moz-gr-update.sh for update procedure.
-
-Also includes two post-1.3.5 fixes:
-a8b3ac2aed0eb132cd80efe7de88f8153e73c829
-e569e28d83491fedb31b9220493f3c07f6ec6d80
-diff --git a/gfx/graphite2/include/graphite2/Font.h b/gfx/graphite2/include/graphite2/Font.h
--- a/gfx/graphite2/include/graphite2/Font.h
-+++ b/gfx/graphite2/include/graphite2/Font.h
-@@ -25,17 +25,17 @@
-     either version 2 of the License or (at your option) any later version.
- */
- #pragma once
- 
- #include "graphite2/Types.h"
- 
- #define GR2_VERSION_MAJOR   1
- #define GR2_VERSION_MINOR   3
-#define GR2_VERSION_BUGFIX  5
-+#define GR2_VERSION_BUGFIX  6
- 
- #ifdef __cplusplus
- extern "C"
- {
- #endif
- 
- typedef struct gr_face          gr_face;
- typedef struct gr_font          gr_font;
-diff --git a/gfx/graphite2/moz-gr-update.sh b/gfx/graphite2/moz-gr-update.sh
--- a/gfx/graphite2/moz-gr-update.sh
-+++ b/gfx/graphite2/moz-gr-update.sh
-@@ -14,17 +14,17 @@
- RELEASE=$1
- 
- if [ "x$RELEASE" == "x" ]
- then
-     echo "Must provide the version number to be used."
-     exit 1
- fi
- 
-TARBALL="https://github.com/silnrsi/graphite/releases/download/$RELEASE/graphite2-minimal-$RELEASE.tgz"
-+TARBALL="https://github.com/silnrsi/graphite/releases/download/$RELEASE/graphite-minimal-$RELEASE.tgz"
- 
- foo=`basename $0`
- TMPFILE=`mktemp -t ${foo}` || exit 1
- 
- curl -L "$TARBALL" -o "$TMPFILE"
- tar -x -z -C gfx/graphite2/ --strip-components 1 -f "$TMPFILE" || exit 1
- rm "$TMPFILE"
- 
-diff --git a/gfx/graphite2/src/CmapCache.cpp b/gfx/graphite2/src/CmapCache.cpp
--- a/gfx/graphite2/src/CmapCache.cpp
-+++ b/gfx/graphite2/src/CmapCache.cpp
-@@ -33,43 +33,43 @@ of the License or (at your option) any l
- 
- 
- using namespace graphite2;
- 
- const void * bmp_subtable(const Face::Table & cmap)
- {
-     const void * stbl;
-     if (!cmap.size()) return 0;
-    if (TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 1, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 3, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 2, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 1, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 0, cmap.size()), cmap.size()))
-+    if (TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 1, cmap.size()), cmap + cmap.size())
-+     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 3, cmap.size()), cmap + cmap.size())
-+     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 2, cmap.size()), cmap + cmap.size())
-+     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 1, cmap.size()), cmap + cmap.size())
-+     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 0, cmap.size()), cmap + cmap.size()))
-         return stbl;
-     return 0;
- }
- 
- const void * smp_subtable(const Face::Table & cmap)
- {
-     const void * stbl;
-     if (!cmap.size()) return 0;
-    if (TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 10, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 4, cmap.size()), cmap.size()))
-+    if (TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 10, cmap.size()), cmap + cmap.size())
-+     || TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 4, cmap.size()), cmap + cmap.size()))
-         return stbl;
-     return 0;
- }
- 
- template <unsigned int (*NextCodePoint)(const void *, unsigned int, int *),
-           uint16 (*LookupCodePoint)(const void *, unsigned int, int)>
- bool cache_subtable(uint16 * blocks[], const void * cst, const unsigned int limit)
- {
-     int rangeKey = 0;
-     uint32          codePoint = NextCodePoint(cst, 0, &rangeKey),
-                     prevCodePoint = 0;
-    while (codePoint != limit)
-+    while (codePoint < limit)
-     {
-         unsigned int block = codePoint >> 8;
-         if (!blocks[block])
-         {
-             blocks[block] = grzeroalloc<uint16>(0x100);
-             if (!blocks[block])
-                 return false;
-         }
-diff --git a/gfx/graphite2/src/Code.cpp b/gfx/graphite2/src/Code.cpp
--- a/gfx/graphite2/src/Code.cpp
-+++ b/gfx/graphite2/src/Code.cpp
-@@ -79,18 +79,19 @@ struct context
- 
- 
- class Machine::Code::decoder
- {
- public:
-     struct limits;
-     struct analysis
-     {
-+        static const int NUMCONTEXTS = 256;
-         uint8     slotref;
-        context   contexts[256];
-+        context   contexts[NUMCONTEXTS];
-         byte      max_ref;
-         
-         analysis() : slotref(0), max_ref(0) {};
-         void set_ref(int index, bool incinsert=false) throw();
-         void set_noref(int index) throw();
-         void set_changed(int index) throw();
- 
-     };
-@@ -363,29 +364,33 @@ opcode Machine::Code::decoder::fetch_opc
-             break;
-         case ATTR_SET :
-         case ATTR_ADD :
-         case ATTR_SUB :
-         case ATTR_SET_SLOT :
-             if (--_stack_depth < 0)
-                 failure(underfull_stack);
-             valid_upto(gr_slatMax, bc[0]);
-+            if (attrCode(bc[0]) == gr_slatUserDefn)     // use IATTR for user attributes
-+                failure(out_of_range_data);
-             test_context();
-             break;
-         case IATTR_SET_SLOT :
-             if (--_stack_depth < 0)
-                 failure(underfull_stack);
-             if (valid_upto(gr_slatMax, bc[0]))
-                 valid_upto(_max.attrid[bc[0]], bc[1]);
-             test_context();
-             break;
-         case PUSH_SLOT_ATTR :
-             ++_stack_depth;
-             valid_upto(gr_slatMax, bc[0]);
-             valid_upto(_rule_length, _pre_context + int8(bc[1]));
-+            if (attrCode(bc[0]) == gr_slatUserDefn)     // use IATTR for user attributes
-+                failure(out_of_range_data);
-             break;
-         case PUSH_GLYPH_ATTR_OBS :
-             ++_stack_depth;
-             valid_upto(_max.glyf_attrs, bc[0]);
-             valid_upto(_rule_length, _pre_context + int8(bc[1]));
-             break;
-         case PUSH_GLYPH_METRIC :
-             ++_stack_depth;
-@@ -656,24 +661,24 @@ bool Machine::Code::decoder::validate_op
-         return false;
-     }
-     return true;
- }
- 
- 
- bool Machine::Code::decoder::valid_upto(const uint16 limit, const uint16 x) const throw()
- {
-    const bool t = x < limit;
-+    const bool t = (limit != 0) && (x < limit);
-     if (!t) failure(out_of_range_data);
-     return t;
- }
- 
- bool Machine::Code::decoder::test_context() const throw()
- {
-    if (_pre_context >= _rule_length)
-+    if (_pre_context >= _rule_length || _analysis.slotref >= analysis::NUMCONTEXTS - 1)
-     {
-         failure(out_of_range_data);
-         return false;
-     }
-     return true;
- }
- 
- inline 
-@@ -681,34 +686,34 @@ void Machine::Code::failure(const status
-     release_buffers();
-     _status = s;
- }
- 
- 
- inline
- void Machine::Code::decoder::analysis::set_ref(int index, bool incinsert) throw() {
-     if (incinsert && contexts[slotref].flags.inserted) --index;
-    if (index + slotref < 0) return;
-+    if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
-     contexts[index + slotref].flags.referenced = true;
-     if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
- }
- 
- 
- inline
- void Machine::Code::decoder::analysis::set_noref(int index) throw() {
-     if (contexts[slotref].flags.inserted) --index;
-    if (index + slotref < 0) return;
-+    if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
-     if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
- }
- 
- 
- inline
- void Machine::Code::decoder::analysis::set_changed(int index) throw() {
-     if (contexts[slotref].flags.inserted) --index;
-    if (index + slotref < 0) return;
-+    if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
-     contexts[index + slotref].flags.changed = true;
-     if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
- }
- 
- 
- void Machine::Code::release_buffers() throw()
- {
-     if (_own)
-diff --git a/gfx/graphite2/src/GlyphCache.cpp b/gfx/graphite2/src/GlyphCache.cpp
--- a/gfx/graphite2/src/GlyphCache.cpp
-+++ b/gfx/graphite2/src/GlyphCache.cpp
-@@ -260,17 +260,17 @@ GlyphCache::Loader::Loader(const Face & 
-         _head = Face::Table();
-         return;
-     }
- 
-     if (!dumb_font)
-     {
-         if ((m_pGlat = Face::Table(face, Tag::Glat, 0x00030000)) == NULL
-             || (m_pGloc = Face::Table(face, Tag::Gloc)) == NULL
-            || m_pGloc.size() < 6)
-+            || m_pGloc.size() < 8)
-         {
-             _head = Face::Table();
-             return;
-         }
-         const byte    * p = m_pGloc;
-         int       version = be::read<uint32>(p);
-         const uint16    flags = be::read<uint16>(p);
-         _num_attrs = be::read<uint16>(p);
-diff --git a/gfx/graphite2/src/Pass.cpp b/gfx/graphite2/src/Pass.cpp
--- a/gfx/graphite2/src/Pass.cpp
-+++ b/gfx/graphite2/src/Pass.cpp
-@@ -233,17 +233,17 @@ bool Pass::readRules(const byte * rule_m
-     m_codes = new Code [m_numRules*2];
-     const size_t prog_pool_sz = vm::Machine::Code::estimateCodeDataOut(ac_end - ac_data + rc_end - rc_data);
-     m_progs = gralloc<byte>(prog_pool_sz);
-     byte * prog_pool_free = m_progs,
-          * prog_pool_end  = m_progs + prog_pool_sz;
-     if (e.test(!(m_rules && m_codes && m_progs), E_OUTOFMEM)) return face.error(e);
- 
-     Rule * r = m_rules + m_numRules - 1;
-    for (size_t n = m_numRules; n; --n, --r, ac_end = ac_begin, rc_end = rc_begin)
-+    for (size_t n = m_numRules; r >= m_rules; --n, --r, ac_end = ac_begin, rc_end = rc_begin)
-     {
-         face.error_context((face.error_context() & 0xFFFF00) + EC_ARULE + ((n - 1) << 24));
-         r->preContext = *--precontext;
-         r->sort       = be::peek<uint16>(--sort_key);
- #ifndef NDEBUG
-         r->rule_idx   = n - 1;
- #endif
-         if (r->sort > 63 || r->preContext >= r->sort || r->preContext > m_maxPreCtxt || r->preContext < m_minPreCtxt)
-@@ -405,16 +405,17 @@ bool Pass::runGraphite(vm::Machine & m, 
-         json::closer rules_array_closer(fsm.dbgout);
- #endif
- 
-         m.slotMap().highwater(currHigh);
-         int lc = m_iMaxLoop;
-         do
-         {
-             findNDoRule(s, m, fsm);
-+            if (m.status() != Machine::finished) return false;
-             if (s && (s == m.slotMap().highwater() || m.slotMap().highpassed() || --lc == 0)) {
-                 if (!lc)
-                     s = m.slotMap().highwater();
-                 lc = m_iMaxLoop;
-                 if (s)
-                     m.slotMap().highwater(s->next());
-             }
-         } while (s);
-@@ -495,17 +496,22 @@ void Pass::findNDoRule(Slot * & slot, Ma
- {
-     assert(slot);
- 
-     if (runFSM(fsm, slot))
-     {
-         // Search for the first rule which passes the constraint
-         const RuleEntry *        r = fsm.rules.begin(),
-                         * const re = fsm.rules.end();
-        while (r != re && !testConstraint(*r->rule, m)) ++r;
-+        while (r != re && !testConstraint(*r->rule, m))
-+        {
-+            ++r;
-+            if (m.status() != Machine::finished)
-+                return;
-+        }
- 
- #if !defined GRAPHITE2_NTRACING
-         if (fsm.dbgout)
-         {
-             if (fsm.rules.size() != 0)
-             {
-                 *fsm.dbgout << json::item << json::object;
-                 dumpRuleEventConsidered(fsm, *r);
-@@ -530,16 +536,17 @@ void Pass::findNDoRule(Slot * & slot, Ma
-             }
-         }
-         else
- #endif
-         {
-             if (r != re)
-             {
-                 const int adv = doAction(r->rule->action, slot, m);
-+                if (m.status() != Machine::finished) return;
-                 if (r->rule->action->deletes()) fsm.slots.collectGarbage(slot);
-                 adjustSlot(adv, slot, fsm.slots);
-                 return;
-             }
-         }
-     }
- 
-     slot = slot->next();
-diff --git a/gfx/graphite2/src/Segment.cpp b/gfx/graphite2/src/Segment.cpp
--- a/gfx/graphite2/src/Segment.cpp
-+++ b/gfx/graphite2/src/Segment.cpp
-@@ -205,18 +205,23 @@ Slot *Segment::newSlot()
- void Segment::freeSlot(Slot *aSlot)
- {
-     if (m_last == aSlot) m_last = aSlot->prev();
-     if (m_first == aSlot) m_first = aSlot->next();
-     if (aSlot->attachedTo())
-         aSlot->attachedTo()->removeChild(aSlot);
-     while (aSlot->firstChild())
-     {
-        aSlot->firstChild()->attachTo(NULL);
-        aSlot->removeChild(aSlot->firstChild());
-+        if (aSlot->firstChild()->attachedTo() == aSlot)
-+        {
-+            aSlot->firstChild()->attachTo(NULL);
-+            aSlot->removeChild(aSlot->firstChild());
-+        }
-+        else
-+            aSlot->firstChild(NULL);
-     }
-     // reset the slot incase it is reused
-     ::new (aSlot) Slot(aSlot->userAttrs());
-     memset(aSlot->userAttrs(), 0, m_silf->numUser() * sizeof(int16));
-     // Update generation counter for debug
- #if !defined GRAPHITE2_NTRACING
-     if (m_face->logger())
-         ++aSlot->userAttrs()[m_silf->numUser()];
-diff --git a/gfx/graphite2/src/Slot.cpp b/gfx/graphite2/src/Slot.cpp
--- a/gfx/graphite2/src/Slot.cpp
-+++ b/gfx/graphite2/src/Slot.cpp
-@@ -192,16 +192,18 @@ int32 Slot::clusterMetric(const Segment 
- #define SLOTGETCOLATTR(x) { SlotCollision *c = seg->collisionInfo(this); return c ? int(c-> x) : 0; }
- 
- int Slot::getAttr(const Segment *seg, attrCode ind, uint8 subindex) const
- {
-     if (ind == gr_slatUserDefnV1)
-     {
-         ind = gr_slatUserDefn;
-         subindex = 0;
-+        if (seg->numAttrs() == 0)
-+            return 0;
-     }
-     else if (ind >= gr_slatJStretch && ind < gr_slatJStretch + 20 && ind != gr_slatJWidth)
-     {
-         int indx = ind - gr_slatJStretch;
-         return getJustify(seg, indx / 5, indx % 5);
-     }
- 
-     switch (ind)
-@@ -269,16 +271,18 @@ int Slot::getAttr(const Segment *seg, at
-         break; }
- 
- void Slot::setAttr(Segment *seg, attrCode ind, uint8 subindex, int16 value, const SlotMap & map)
- {
-     if (ind == gr_slatUserDefnV1)
-     {
-         ind = gr_slatUserDefn;
-         subindex = 0;
-+        if (seg->numAttrs() == 0)
-+            return;
-     }
-     else if (ind >= gr_slatJStretch && ind < gr_slatJStretch + 20 && ind != gr_slatJWidth)
-     {
-         int indx = ind - gr_slatJStretch;
-         return setJustify(seg, indx / 5, indx % 5, value);
-     }
- 
-     switch (ind)
-@@ -416,32 +420,32 @@ bool Slot::sibling(Slot *ap)
- }
- 
- bool Slot::removeChild(Slot *ap)
- {
-     if (this == ap || !m_child) return false;
-     else if (ap == m_child)
-     {
-         Slot *nSibling = m_child->nextSibling();
-        m_child->sibling(NULL);
-+        m_child->removeSibling(nSibling);
-         m_child = nSibling;
-         return true;
-     }
-     else
-         return m_child->removeSibling(ap);
-     return true;
- }
- 
- bool Slot::removeSibling(Slot *ap)
- {
-     if (this == ap || !m_sibling) return false;
-     else if (ap == m_sibling)
-     {
-         m_sibling = m_sibling->nextSibling();
-        ap->sibling(NULL);
-+        if (m_sibling) ap->removeSibling(m_sibling);
-         return true;
-     }
-     else
-         return m_sibling->removeSibling(ap);
-     return true;
- }
- 
- void Slot::setGlyph(Segment *seg, uint16 glyphid, const GlyphFace * theGlyph)
-diff --git a/gfx/graphite2/src/TtfUtil.cpp b/gfx/graphite2/src/TtfUtil.cpp
--- a/gfx/graphite2/src/TtfUtil.cpp
-+++ b/gfx/graphite2/src/TtfUtil.cpp
-@@ -884,18 +884,19 @@ const void * FindCmapSubtable(const void
-     }
- 
-     return 0;
- }
- 
- /*----------------------------------------------------------------------------------------------
-     Check the Microsoft Unicode subtable for expected values
- ----------------------------------------------------------------------------------------------*/
-bool CheckCmapSubtable4(const void * pCmapSubtable4, size_t table_len /*, unsigned int maxgid*/)
-+bool CheckCmapSubtable4(const void * pCmapSubtable4, const void * pCmapEnd /*, unsigned int maxgid*/)
- {
-+    size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable4;
-     if (!pCmapSubtable4) return false;
-     const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable4);
-     // Bob H say some freeware TT fonts have version 1 (eg, CALIGULA.TTF) 
-     // so don't check subtable version. 21 Mar 2002 spec changes version to language.
-     if (be::swap(pTable->format) != 4) return false;
-     const Sfnt::CmapSubTableFormat4 * pTable4 = reinterpret_cast<const Sfnt::CmapSubTableFormat4 *>(pCmapSubtable4);
-     uint16 length = be::swap(pTable4->length);
-     if (length > table_len)
-@@ -1044,17 +1045,17 @@ unsigned int CmapSubtable4NextCodepoint(
-             *pRangeKey = nRange - 1;
-         return 0xFFFF;
-     }
- 
-     int iRange = (pRangeKey) ? *pRangeKey : 0;
-     // Just in case we have a bad key:
-     while (iRange > 0 && be::peek<uint16>(pStartCode + iRange) > nUnicodePrev)
-         iRange--;
-    while (be::peek<uint16>(pTable->end_code + iRange) < nUnicodePrev)
-+    while (iRange < nRange - 1 && be::peek<uint16>(pTable->end_code + iRange) < nUnicodePrev)
-         iRange++;
- 
-     // Now iRange is the range containing nUnicodePrev.
-     unsigned int nStartCode = be::peek<uint16>(pStartCode + iRange);
-     unsigned int nEndCode = be::peek<uint16>(pTable->end_code + iRange);
- 
-     if (nStartCode > nUnicodePrev)
-         // Oops, nUnicodePrev is not in the cmap! Adjust so we get a reasonable
-@@ -1069,36 +1070,37 @@ unsigned int CmapSubtable4NextCodepoint(
-         return nUnicodePrev + 1;
-     }
- 
-     // Otherwise the next codepoint is the first one in the next range.
-     // There is guaranteed to be a next range because there must be one that
-     // ends with 0xFFFF.
-     if (pRangeKey)
-         *pRangeKey = iRange + 1;
-    return be::peek<uint16>(pStartCode + iRange + 1);
-+    return (iRange + 1 >= nRange) ? 0xFFFF : be::peek<uint16>(pStartCode + iRange + 1);
- }
- 
- /*----------------------------------------------------------------------------------------------
-     Check the Microsoft UCS-4 subtable for expected values.
- ----------------------------------------------------------------------------------------------*/
-bool CheckCmapSubtable12(const void *pCmapSubtable12, size_t table_len /*, unsigned int maxgid*/)
-+bool CheckCmapSubtable12(const void *pCmapSubtable12, const void *pCmapEnd /*, unsigned int maxgid*/)
- {
-+    size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable12;
-     if (!pCmapSubtable12)  return false;
-     const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable12);
-     if (be::swap(pTable->format) != 12)
-         return false;
-     const Sfnt::CmapSubTableFormat12 * pTable12 = reinterpret_cast<const Sfnt::CmapSubTableFormat12 *>(pCmapSubtable12);
-     uint32 length = be::swap(pTable12->length);
-     if (length > table_len)
-         return false;
-     if (length < sizeof(Sfnt::CmapSubTableFormat12))
-         return false;
-     uint32 num_groups = be::swap(pTable12->num_groups);
-    if (length != (sizeof(Sfnt::CmapSubTableFormat12) + (num_groups - 1) * sizeof(uint32) * 3))
-+    if (num_groups > 0x10000000 || length != (sizeof(Sfnt::CmapSubTableFormat12) + (num_groups - 1) * sizeof(uint32) * 3))
-         return false;
- #if 0
-     for (unsigned int i = 0; i < num_groups; ++i)
-     {
-         if (be::swap(pTable12->group[i].end_char_code)  - be::swap(pTable12->group[i].start_char_code) + be::swap(pTable12->group[i].start_glyph_id) > maxgid)
-             return false;
-         if (i > 0 && be::swap(pTable12->group[i].start_char_code) <= be::swap(pTable12->group[i-1].end_char_code))
-             return false;
-@@ -1161,17 +1163,17 @@ unsigned int CmapSubtable12NextCodepoint
-             *pRangeKey = nRange;
-         return 0x10FFFF;
-     }
- 
-     int iRange = (pRangeKey) ? *pRangeKey : 0;
-     // Just in case we have a bad key:
-     while (iRange > 0 && be::swap(pTable->group[iRange].start_char_code) > nUnicodePrev)
-         iRange--;
-    while (be::swap(pTable->group[iRange].end_char_code) < nUnicodePrev)
-+    while (iRange < nRange - 1 && be::swap(pTable->group[iRange].end_char_code) < nUnicodePrev)
-         iRange++;
- 
-     // Now iRange is the range containing nUnicodePrev.
- 
-     unsigned int nStartCode = be::swap(pTable->group[iRange].start_char_code);
-     unsigned int nEndCode = be::swap(pTable->group[iRange].end_char_code);
- 
-     if (nStartCode > nUnicodePrev)
-diff --git a/gfx/graphite2/src/call_machine.cpp b/gfx/graphite2/src/call_machine.cpp
--- a/gfx/graphite2/src/call_machine.cpp
-+++ b/gfx/graphite2/src/call_machine.cpp
-@@ -67,32 +67,34 @@ using namespace vm;
- struct regbank  {
-     slotref         is;
-     slotref *       map;
-     SlotMap       & smap;
-     slotref * const map_base;
-     const instr * & ip;
-     uint8           direction;
-     int8            flags;
-+    Machine::status_t & status;
- };
- 
- typedef bool        (* ip_t)(registers);
- 
- // Pull in the opcode definitions
- // We pull these into a private namespace so these otherwise common names dont
- // pollute the toplevel namespace.
- namespace {
- #define smap    reg.smap
- #define seg     smap.segment
- #define is      reg.is
- #define ip      reg.ip
- #define map     reg.map
- #define mapb    reg.map_base
- #define flags   reg.flags
- #define dir     reg.direction
-+#define status  reg.status
- 
- #include "inc/opcodes.h"
- 
- #undef smap
- #undef seg
- #undef is
- #undef ip
- #undef map
-@@ -108,17 +110,17 @@ Machine::stack_t  Machine::run(const ins
- {
-     assert(program != 0);
- 
-     // Declare virtual machine registers
-     const instr   * ip = program-1;
-     const byte    * dp = data;
-     stack_t       * sp = _stack + Machine::STACK_GUARD,
-             * const sb = sp;
-    regbank         reg = {*map, map, _map, _map.begin()+_map.context(), ip, _map.dir(), 0};
-+    regbank         reg = {*map, map, _map, _map.begin()+_map.context(), ip, _map.dir(), 0, _status};
- 
-     // Run the program        
-     while ((reinterpret_cast<ip_t>(*++ip))(dp, sp, sb, reg)) {}
-     const stack_t ret = sp == _stack+STACK_GUARD+1 ? *sp-- : 0;
- 
-     check_final_stack(sp);
-     map = reg.map;
-     *map = reg.is;
-diff --git a/gfx/graphite2/src/direct_machine.cpp b/gfx/graphite2/src/direct_machine.cpp
--- a/gfx/graphite2/src/direct_machine.cpp
-+++ b/gfx/graphite2/src/direct_machine.cpp
-@@ -57,36 +57,37 @@ using namespace vm;
- namespace {
- 
- const void * direct_run(const bool          get_table_mode,
-                         const instr       * program,
-                         const byte        * data,
-                         Machine::stack_t  * stack,
-                         slotref         * & __map,
-                         uint8                _dir,
-+                        Machine::status_t & status,
-                         SlotMap           * __smap=0)
- {
-     // We need to define and return to opcode table from within this function 
-     // other inorder to take the addresses of the instruction bodies.
-     #include "inc/opcode_table.h"
-     if (get_table_mode)
-         return opcode_table;
- 
-     // Declare virtual machine registers
-    const instr       * ip = program;
-    const byte        * dp = data;
-    Machine::stack_t  * sp = stack + Machine::STACK_GUARD,
-                * const sb = sp;
-    SlotMap         & smap = *__smap;
-    Segment          & seg = smap.segment;
-    slotref             is = *__map,
-                     * map = __map,
-              * const mapb = smap.begin()+smap.context();
-    uint8            dir = _dir;
-    int8             flags = 0;
-+    const instr           * ip = program;
-+    const byte            * dp = data;
-+    Machine::stack_t      * sp = stack + Machine::STACK_GUARD,
-+                    * const sb = sp;
-+    SlotMap             & smap = *__smap;
-+    Segment              & seg = smap.segment;
-+    slotref                 is = *__map,
-+                         * map = __map,
-+                  * const mapb = smap.begin()+smap.context();
-+    uint8                  dir = _dir;
-+    int8                 flags = 0;
-     
-     // start the program
-     goto **ip;
- 
-     // Pull in the opcode definitions
-     #include "inc/opcodes.h"
-     
-     end:
-@@ -95,25 +96,26 @@ const void * direct_run(const bool      
-     return sp;
- }
- 
- }
- 
- const opcode_t * Machine::getOpcodeTable() throw()
- {
-     slotref * dummy;
-    return static_cast<const opcode_t *>(direct_run(true, 0, 0, 0, dummy, 0));
-+    Machine::status_t dumstat = Machine::finished;
-+    return static_cast<const opcode_t *>(direct_run(true, 0, 0, 0, dummy, 0, dumstat));
- }
- 
- 
- Machine::stack_t  Machine::run(const instr   * program,
-                                const byte    * data,
-                                slotref     * & is)
- {
-     assert(program != 0);
-     
-     const stack_t *sp = static_cast<const stack_t *>(
-                direct_run(false, program, data, _stack, is, _map.dir(), &_map));
-+                direct_run(false, program, data, _stack, is, _map.dir(), _status, &_map));
-     const stack_t ret = sp == _stack+STACK_GUARD+1 ? *sp-- : 0;
-     check_final_stack(sp);
-     return ret;
- }
- 
-diff --git a/gfx/graphite2/src/inc/Code.h b/gfx/graphite2/src/inc/Code.h
--- a/gfx/graphite2/src/inc/Code.h
-+++ b/gfx/graphite2/src/inc/Code.h
-@@ -109,17 +109,17 @@ public:
-     int32 run(Machine &m, slotref * & map) const;
-     
-     CLASS_NEW_DELETE;
- };
- 
- inline
- size_t  Machine::Code::estimateCodeDataOut(size_t n_bc)
- {
-    return n_bc * (sizeof(instr)+sizeof(byte));
-+    return (n_bc + 1) * (sizeof(instr)+sizeof(byte));
- }
- 
- 
- inline Machine::Code::Code() throw()
- : _code(0), _data(0), _data_size(0), _instr_count(0), _max_ref(0),
-   _status(loaded), _constraint(false), _modify(false), _delete(false),
-   _own(false)
- {
-diff --git a/gfx/graphite2/src/inc/Machine.h b/gfx/graphite2/src/inc/Machine.h
--- a/gfx/graphite2/src/inc/Machine.h
-+++ b/gfx/graphite2/src/inc/Machine.h
-@@ -135,17 +135,18 @@ public:
- 
-     class Code;
- 
-     enum status_t {
-         finished = 0,
-         stack_underflow,
-         stack_not_empty,
-         stack_overflow,
-        slot_offset_out_bounds
-+        slot_offset_out_bounds,
-+        died_early
-     };
- 
-     Machine(SlotMap &) throw();
-     static const opcode_t *   getOpcodeTable() throw();
- 
-     CLASS_NEW_DELETE;
- 
-     SlotMap   & slotMap() const throw();
-diff --git a/gfx/graphite2/src/inc/TtfUtil.h b/gfx/graphite2/src/inc/TtfUtil.h
--- a/gfx/graphite2/src/inc/TtfUtil.h
-+++ b/gfx/graphite2/src/inc/TtfUtil.h
-@@ -132,21 +132,21 @@ public:
-     int GetLangsForNames(const void * pName, int nPlatformId, int nEncodingId,
-         int *nameIdList, int cNameIds, short *langIdList);
-     void SwapWString(void * pWStr, size_t nSize = 0); // throw (std::invalid_argument);
- #endif
- 
-     ////////////////////////////////// cmap lookup tools 
-     const void * FindCmapSubtable(const void * pCmap, int nPlatformId = 3, 
-         int nEncodingId = 1, size_t length = 0);
-    bool CheckCmapSubtable4(const void * pCmap31, size_t table_len /*, unsigned int maxgid*/);
-+    bool CheckCmapSubtable4(const void * pCmap31, const void * pCmapEnd /*, unsigned int maxgid*/);
-     gid16 CmapSubtable4Lookup(const void * pCmapSubtabel4, unsigned int nUnicodeId, int rangeKey = 0);
-     unsigned int CmapSubtable4NextCodepoint(const void *pCmap31, unsigned int nUnicodeId,
-         int * pRangeKey = 0);
-    bool CheckCmapSubtable12(const void *pCmap310, size_t table_len /*, unsigned int maxgid*/);
-+    bool CheckCmapSubtable12(const void *pCmap310, const void * pCmapEnd /*, unsigned int maxgid*/);
-     gid16 CmapSubtable12Lookup(const void * pCmap310, unsigned int uUnicodeId, int rangeKey = 0);
-     unsigned int CmapSubtable12NextCodepoint(const void *pCmap310, unsigned int nUnicodeId,
-         int * pRangeKey = 0);
- 
-     ///////////////////////////////// horizontal metric data for a glyph
-     bool HorMetrics(gid16 nGlyphId, const void * pHmtx, size_t lHmtxSize, 
-         const void * pHhea, int & nLsb, unsigned int & nAdvWid);
- 
-diff --git a/gfx/graphite2/src/inc/opcodes.h b/gfx/graphite2/src/inc/opcodes.h
--- a/gfx/graphite2/src/inc/opcodes.h
-+++ b/gfx/graphite2/src/inc/opcodes.h
-@@ -71,17 +71,17 @@ of the License or (at your option) any l
- #define use_params(n)       dp += n
- 
- #define declare_params(n)   const byte * param = dp; \
-                             use_params(n);
- 
- #define push(n)             { *++sp = n; }
- #define pop()               (*sp--)
- #define slotat(x)           (map[(x)])
-#define DIE                 { is=seg.last(); EXIT(1); }
-+#define DIE                 { is=seg.last(); status = Machine::died_early; EXIT(1); }
- #define POSITIONED          1
- 
- STARTOP(nop)
-     do {} while (0);
- ENDOP
- 
- STARTOP(push_byte)
-     declare_params(1);
-@@ -387,30 +387,30 @@ STARTOP(attr_set)
- ENDOP
- 
- STARTOP(attr_add)
-     declare_params(1);
-     const attrCode      slat = attrCode(uint8(*param));
-     const          int  val  = int(pop());
-     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
-     {
-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
-+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
-         flags |= POSITIONED;
-     }
-     int res = is->getAttr(&seg, slat, 0);
-     is->setAttr(&seg, slat, 0, val + res, smap);
- ENDOP
- 
- STARTOP(attr_sub)
-     declare_params(1);
-     const attrCode      slat = attrCode(uint8(*param));
-     const          int  val  = int(pop());
-     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
-     {
-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
-+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
-         flags |= POSITIONED;
-     }
-     int res = is->getAttr(&seg, slat, 0);
-     is->setAttr(&seg, slat, 0, res - val, smap);
- ENDOP
- 
- STARTOP(attr_set_slot)
-     declare_params(1);
-@@ -429,17 +429,17 @@ STARTOP(iattr_set_slot)
- ENDOP
- 
- STARTOP(push_slot_attr)
-     declare_params(2);
-     const attrCode      slat     = attrCode(uint8(param[0]));
-     const int           slot_ref = int8(param[1]);
-     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
-     {
-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
-+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
-         flags |= POSITIONED;
-     }
-     slotref slot = slotat(slot_ref);
-     if (slot)
-     {
-         int res = slot->getAttr(&seg, slat, 0);
-         push(res);
-     }
-@@ -505,17 +505,17 @@ ENDOP
- 
- STARTOP(push_islot_attr)
-     declare_params(3);
-     const attrCode  slat     = attrCode(uint8(param[0]));
-     const int           slot_ref = int8(param[1]),
-                         idx      = uint8(param[2]);
-     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
-     {
-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
-+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
-         flags |= POSITIONED;
-     }
-     slotref slot = slotat(slot_ref);
-     if (slot)
-     {
-         int res = slot->getAttr(&seg, slat, idx);
-         push(res);
-     }
-
--- a/gnu/packages/patches/icecat-update-graphite2.patch
+++ b/gnu/packages/patches/icecat-update-graphite2.patch