aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/patches')
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2722-pt1.patch77
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2722-pt2.patch73
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2724-pt1.patch57
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch391
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2724-pt3.patch90
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2724-pt4.patch65
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2728-pt1.patch95
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2728-pt2.patch27
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2733-pt1.patch29
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2733-pt2.patch31
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2735.patch86
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2736.patch34
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2738.patch151
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2739.patch66
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2740.patch52
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2743.patch73
16 files changed, 1397 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-2722-pt1.patch b/gnu/packages/patches/icecat-CVE-2015-2722-pt1.patch
new file mode 100644
index 0000000000..e2c44ccaf8
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2722-pt1.patch
@@ -0,0 +1,77 @@
+From 7805485b75d06915bcb018b8fe5cb7de4ddebddb Mon Sep 17 00:00:00 2001
+From: Andrea Marchesini <amarchesini@mozilla.com>
+Date: Wed, 27 May 2015 14:21:44 -0700
+Subject: [PATCH] Bug 1166924 part 0 r=bent a=lizzard
+
+--HG--
+extra : source : 36bf5bcceb272fc9e303996f8dfe7350984a5e96
+---
+ dom/workers/XMLHttpRequest.cpp | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
+index 748fd39..8e4200a 100644
+--- a/dom/workers/XMLHttpRequest.cpp
++++ b/dom/workers/XMLHttpRequest.cpp
+@@ -113,6 +113,7 @@ public:
+ bool mLastUploadLengthComputable;
+ bool mSeenLoadStart;
+ bool mSeenUploadLoadStart;
++ bool mOpening;
+
+ // Only touched on the main thread.
+ bool mUploadEventListenersAttached;
+@@ -127,7 +128,7 @@ public:
+ mOuterEventStreamId(0), mOuterChannelId(0), mLastLoaded(0), mLastTotal(0),
+ mLastUploadLoaded(0), mLastUploadTotal(0), mIsSyncXHR(false),
+ mLastLengthComputable(false), mLastUploadLengthComputable(false),
+- mSeenLoadStart(false), mSeenUploadLoadStart(false),
++ mSeenLoadStart(false), mSeenUploadLoadStart(false), mOpening(false),
+ mUploadEventListenersAttached(false), mMainThreadSeenLoadStart(false),
+ mInOpen(false)
+ { }
+@@ -1498,7 +1499,11 @@ SendRunnable::MainThreadRun()
+ variant = wvariant;
+ }
+
+- MOZ_ASSERT(!mProxy->mWorkerPrivate);
++ // Send() has been already called.
++ if (mProxy->mWorkerPrivate) {
++ return NS_ERROR_FAILURE;
++ }
++
+ mProxy->mWorkerPrivate = mWorkerPrivate;
+
+ MOZ_ASSERT(!mProxy->mSyncLoopTarget);
+@@ -1789,6 +1794,12 @@ XMLHttpRequest::SendInternal(const nsAString& aStringBody,
+ {
+ mWorkerPrivate->AssertIsOnWorkerThread();
+
++ // No send() calls when open is running.
++ if (mProxy->mOpening) {
++ aRv.Throw(NS_ERROR_FAILURE);
++ return;
++ }
++
+ bool hasUploadListeners = mUpload ? mUpload->HasListeners() : false;
+
+ MaybePin(aRv);
+@@ -1874,12 +1885,15 @@ XMLHttpRequest::Open(const nsACString& aMethod, const nsAString& aUrl,
+ mBackgroundRequest, mWithCredentials,
+ mTimeout);
+
++ mProxy->mOpening = true;
+ if (!runnable->Dispatch(mWorkerPrivate->GetJSContext())) {
+ ReleaseProxy();
++ mProxy->mOpening = false;
+ aRv.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
++ mProxy->mOpening = false;
+ mProxy->mIsSyncXHR = !aAsync;
+ }
+
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2722-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2722-pt2.patch
new file mode 100644
index 0000000000..c82d0f7e6f
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2722-pt2.patch
@@ -0,0 +1,73 @@
+From 6eb772aa6a0c1b21aafcfa606cc3bf07659b53b9 Mon Sep 17 00:00:00 2001
+From: Wes Kocher <wkocher@mozilla.com>
+Date: Wed, 27 May 2015 14:33:22 -0700
+Subject: [PATCH] Bug 1166924 part 1 r=baku a=lizzard
+
+--HG--
+extra : source : 528d47773256bfee72e7adedc78b89c9fa573b7b
+---
+ dom/workers/XMLHttpRequest.cpp | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
+index 8e4200a..bf0cd3f 100644
+--- a/dom/workers/XMLHttpRequest.cpp
++++ b/dom/workers/XMLHttpRequest.cpp
+@@ -140,7 +140,7 @@ public:
+ Init();
+
+ void
+- Teardown();
++ Teardown(bool aSendUnpin);
+
+ bool
+ AddRemoveEventListeners(bool aUpload, bool aAdd);
+@@ -308,7 +308,9 @@ private:
+ {
+ AssertIsOnMainThread();
+
+- mProxy->Teardown();
++ // This means the XHR was GC'd, so we can't be pinned, and we don't need to
++ // try to unpin.
++ mProxy->Teardown(/* aSendUnpin */ false);
+ mProxy = nullptr;
+
+ return NS_OK;
+@@ -563,7 +565,7 @@ private:
+ virtual nsresult
+ MainThreadRun() MOZ_OVERRIDE
+ {
+- mProxy->Teardown();
++ mProxy->Teardown(/* aSendUnpin */ true);
+ MOZ_ASSERT(!mProxy->mSyncLoopTarget);
+ return NS_OK;
+ }
+@@ -935,7 +937,7 @@ Proxy::Init()
+ }
+
+ void
+-Proxy::Teardown()
++Proxy::Teardown(bool aSendUnpin)
+ {
+ AssertIsOnMainThread();
+
+@@ -948,10 +950,12 @@ Proxy::Teardown()
+ mXHR->Abort();
+
+ if (mOutstandingSendCount) {
+- nsRefPtr<XHRUnpinRunnable> runnable =
+- new XHRUnpinRunnable(mWorkerPrivate, mXMLHttpRequestPrivate);
+- if (!runnable->Dispatch(nullptr)) {
+- NS_RUNTIMEABORT("We're going to hang at shutdown anyways.");
++ if (aSendUnpin) {
++ nsRefPtr<XHRUnpinRunnable> runnable =
++ new XHRUnpinRunnable(mWorkerPrivate, mXMLHttpRequestPrivate);
++ if (!runnable->Dispatch(nullptr)) {
++ NS_RUNTIMEABORT("We're going to hang at shutdown anyways.");
++ }
+ }
+
+ if (mSyncLoopTarget) {
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2724-pt1.patch b/gnu/packages/patches/icecat-CVE-2015-2724-pt1.patch
new file mode 100644
index 0000000000..0b91b1ec86
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2724-pt1.patch
@@ -0,0 +1,57 @@
+From 6465a9f57b13fdf3d21016a41973f13d1e7f447c Mon Sep 17 00:00:00 2001
+From: Bobby Holley <bobbyholley@gmail.com>
+Date: Wed, 13 May 2015 11:08:30 -0700
+Subject: [PATCH] Bug 1164567 - Grab the principal when we need it in
+ MediaDecodeTask. r=jww, a=sledru
+
+---
+ content/media/webaudio/MediaBufferDecoder.cpp | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/content/media/webaudio/MediaBufferDecoder.cpp b/content/media/webaudio/MediaBufferDecoder.cpp
+index b9409ad..ee6538c 100644
+--- a/content/media/webaudio/MediaBufferDecoder.cpp
++++ b/content/media/webaudio/MediaBufferDecoder.cpp
+@@ -101,13 +101,6 @@ public:
+ {
+ MOZ_ASSERT(aBuffer);
+ MOZ_ASSERT(NS_IsMainThread());
+-
+- nsCOMPtr<nsPIDOMWindow> pWindow = do_QueryInterface(mDecodeJob.mContext->GetParentObject());
+- nsCOMPtr<nsIScriptObjectPrincipal> scriptPrincipal =
+- do_QueryInterface(pWindow);
+- if (scriptPrincipal) {
+- mPrincipal = scriptPrincipal->GetPrincipal();
+- }
+ }
+
+ NS_IMETHOD Run();
+@@ -150,7 +143,6 @@ private:
+ WebAudioDecodeJob& mDecodeJob;
+ PhaseEnum mPhase;
+ nsCOMPtr<nsIThreadPool> mThreadPool;
+- nsCOMPtr<nsIPrincipal> mPrincipal;
+ nsRefPtr<BufferDecoder> mBufferDecoder;
+ nsAutoPtr<MediaDecoderReader> mDecoderReader;
+ };
+@@ -179,9 +171,16 @@ MediaDecodeTask::CreateReader()
+ {
+ MOZ_ASSERT(NS_IsMainThread());
+
++
++ nsCOMPtr<nsIPrincipal> principal;
++ nsCOMPtr<nsIScriptObjectPrincipal> sop = do_QueryInterface(mDecodeJob.mContext->GetParentObject());
++ if (sop) {
++ principal = sop->GetPrincipal();
++ }
++
+ nsRefPtr<BufferMediaResource> resource =
+ new BufferMediaResource(static_cast<uint8_t*> (mBuffer),
+- mLength, mPrincipal, mContentType);
++ mLength, principal, mContentType);
+
+ MOZ_ASSERT(!mBufferDecoder);
+ mBufferDecoder = new BufferDecoder(resource);
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch
new file mode 100644
index 0000000000..486e92c66d
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch
@@ -0,0 +1,391 @@
+From 99641aa4446dc9df04dcfeede8b49ff03abcac42 Mon Sep 17 00:00:00 2001
+From: Jan de Mooij <jdemooij@mozilla.com>
+Date: Thu, 28 May 2015 10:16:24 +0200
+Subject: [PATCH] Bug 1160884 - Add KeepAlive instructions after elements/slots
+ uses. r=nbp, a=abillings
+
+---
+ js/src/jit/CodeGenerator.cpp | 7 ++
+ js/src/jit/CodeGenerator.h | 1 +
+ js/src/jit/Ion.cpp | 7 ++
+ js/src/jit/IonAnalysis.cpp | 112 ++++++++++++++++++++++++++++++++
+ js/src/jit/IonAnalysis.h | 3 +
+ js/src/jit/LIR-Common.h | 14 ++++
+ js/src/jit/LOpcodes.h | 1 +
+ js/src/jit/Lowering.cpp | 9 +++
+ js/src/jit/Lowering.h | 1 +
+ js/src/jit/MIR.h | 26 ++++++++
+ js/src/jit/MOpcodes.h | 1 +
+ js/src/jit/ParallelSafetyAnalysis.cpp | 1 +
+ js/src/jit/shared/Lowering-shared-inl.h | 8 ++-
+ js/src/jit/shared/Lowering-shared.h | 1 +
+ js/src/vm/TraceLogging.h | 3 +-
+ 15 files changed, 193 insertions(+), 2 deletions(-)
+
+diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
+index 5dff9df..7364178 100644
+--- a/js/src/jit/CodeGenerator.cpp
++++ b/js/src/jit/CodeGenerator.cpp
+@@ -1476,6 +1476,13 @@ CodeGenerator::visitPointer(LPointer* lir)
+ }
+
+ bool
++CodeGenerator::visitKeepAliveObject(LKeepAliveObject* lir)
++{
++ // No-op.
++ return true;
++}
++
++bool
+ CodeGenerator::visitSlots(LSlots* lir)
+ {
+ Address slots(ToRegister(lir->object()), JSObject::offsetOfSlots());
+diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
+index 95fb33b..e3b4fd7 100644
+--- a/js/src/jit/CodeGenerator.h
++++ b/js/src/jit/CodeGenerator.h
+@@ -106,6 +106,7 @@ class CodeGenerator : public CodeGeneratorSpecific
+ bool visitLambdaForSingleton(LLambdaForSingleton* lir);
+ bool visitLambdaPar(LLambdaPar* lir);
+ bool visitPointer(LPointer* lir);
++ bool visitKeepAliveObject(LKeepAliveObject* lir);
+ bool visitSlots(LSlots* lir);
+ bool visitStoreSlotV(LStoreSlotV* store);
+ bool visitElements(LElements* lir);
+diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
+index 015d387..1551a80 100644
+--- a/js/src/jit/Ion.cpp
++++ b/js/src/jit/Ion.cpp
+@@ -1536,6 +1536,13 @@ OptimizeMIR(MIRGenerator* mir)
+ AssertGraphCoherency(graph);
+ }
+
++ if (!mir->compilingAsmJS()) {
++ AutoTraceLog log(logger, TraceLogger::AddKeepAliveInstructions);
++ AddKeepAliveInstructions(graph);
++ IonSpewPass("Add KeepAlive Instructions");
++ AssertGraphCoherency(graph);
++ }
++
+ return true;
+ }
+
+diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
+index 8965724..af58aae 100644
+--- a/js/src/jit/IonAnalysis.cpp
++++ b/js/src/jit/IonAnalysis.cpp
+@@ -1971,6 +1971,118 @@ jit::UnsplitEdges(LIRGraph* lir)
+ return true;
+ }
+
++static bool
++NeedsKeepAlive(MInstruction* slotsOrElements, MInstruction* use)
++{
++ MOZ_ASSERT(slotsOrElements->type() == MIRType_Elements ||
++ slotsOrElements->type() == MIRType_Slots);
++
++ if (slotsOrElements->block() != use->block())
++ return true;
++
++ MBasicBlock* block = use->block();
++ MInstructionIterator iter(block->begin(slotsOrElements));
++ MOZ_ASSERT(*iter == slotsOrElements);
++ ++iter;
++
++ while (true) {
++ if (*iter == use)
++ return false;
++
++ switch (iter->op()) {
++ case MDefinition::Op_Nop:
++ case MDefinition::Op_Constant:
++ case MDefinition::Op_KeepAliveObject:
++ case MDefinition::Op_Unbox:
++ case MDefinition::Op_LoadSlot:
++ case MDefinition::Op_StoreSlot:
++ case MDefinition::Op_LoadFixedSlot:
++ case MDefinition::Op_StoreFixedSlot:
++ case MDefinition::Op_LoadElement:
++ case MDefinition::Op_StoreElement:
++ case MDefinition::Op_InitializedLength:
++ case MDefinition::Op_ArrayLength:
++ case MDefinition::Op_BoundsCheck:
++ iter++;
++ break;
++ default:
++ return true;
++ }
++ }
++
++ MOZ_CRASH("Unreachable");
++}
++
++void
++jit::AddKeepAliveInstructions(MIRGraph& graph)
++{
++ for (MBasicBlockIterator i(graph.begin()); i != graph.end(); i++) {
++ MBasicBlock* block = *i;
++
++ for (MInstructionIterator insIter(block->begin()); insIter != block->end(); insIter++) {
++ MInstruction* ins = *insIter;
++ if (ins->type() != MIRType_Elements && ins->type() != MIRType_Slots)
++ continue;
++
++ MDefinition* ownerObject;
++ switch (ins->op()) {
++ case MDefinition::Op_ConstantElements:
++ case MDefinition::Op_NewSlots:
++ continue;
++ case MDefinition::Op_ConvertElementsToDoubles:
++ // EliminateRedundantChecks should have replaced all uses.
++ MOZ_ASSERT(!ins->hasUses());
++ continue;
++ case MDefinition::Op_Elements:
++ case MDefinition::Op_TypedArrayElements:
++ case MDefinition::Op_TypedObjectElements:
++ MOZ_ASSERT(ins->numOperands() == 1);
++ ownerObject = ins->getOperand(0);
++ break;
++ case MDefinition::Op_Slots:
++ ownerObject = ins->toSlots()->object();
++ break;
++ default:
++ MOZ_CRASH("Unexpected op");
++ }
++
++ MOZ_ASSERT(ownerObject->type() == MIRType_Object);
++
++ if (ownerObject->isConstant()) {
++ // Constants are kept alive by other pointers, for instance
++ // ImmGCPtr in JIT code.
++ continue;
++ }
++
++ for (MUseDefIterator uses(ins); uses; uses++) {
++ MInstruction* use = uses.def()->toInstruction();
++
++ if (use->isStoreElementHole()) {
++ // StoreElementHole has an explicit object operand. If GVN
++ // is disabled, we can get different unbox instructions with
++ // the same object as input, so we check for that case.
++ MOZ_ASSERT_IF(!use->toStoreElementHole()->object()->isUnbox() && !ownerObject->isUnbox(),
++ use->toStoreElementHole()->object() == ownerObject);
++ continue;
++ }
++
++ if (use->isInArray()) {
++ // See StoreElementHole case above.
++ MOZ_ASSERT_IF(!use->toInArray()->object()->isUnbox() && !ownerObject->isUnbox(),
++ use->toInArray()->object() == ownerObject);
++ continue;
++ }
++
++ if (!NeedsKeepAlive(ins, use))
++ continue;
++
++ MKeepAliveObject* keepAlive = MKeepAliveObject::New(graph.alloc(), ownerObject);
++ use->block()->insertAfter(use, keepAlive);
++ }
++ }
++ }
++}
++
+ bool
+ LinearSum::multiply(int32_t scale)
+ {
+diff --git a/js/src/jit/IonAnalysis.h b/js/src/jit/IonAnalysis.h
+index aabf835..a320418 100644
+--- a/js/src/jit/IonAnalysis.h
++++ b/js/src/jit/IonAnalysis.h
+@@ -64,6 +64,9 @@ AssertExtendedGraphCoherency(MIRGraph& graph);
+ bool
+ EliminateRedundantChecks(MIRGraph& graph);
+
++void
++AddKeepAliveInstructions(MIRGraph& graph);
++
+ bool
+ UnsplitEdges(LIRGraph* lir);
+
+diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
+index 5fe0ee9..6b03a42 100644
+--- a/js/src/jit/LIR-Common.h
++++ b/js/src/jit/LIR-Common.h
+@@ -3591,6 +3591,20 @@ class LImplicitThis : public LInstructionHelper<BOX_PIECES, 1, 0>
+ }
+ };
+
++class LKeepAliveObject : public LInstructionHelper<0, 1, 0>
++{
++ public:
++ LIR_HEADER(KeepAliveObject)
++
++ explicit LKeepAliveObject(const LAllocation& object) {
++ setOperand(0, object);
++ }
++
++ const LAllocation* object() {
++ return getOperand(0);
++ }
++};
++
+ // Load the "slots" member out of a JSObject.
+ // Input: JSObject pointer
+ // Output: slots pointer
+diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
+index cd7eef8..424b22c 100644
+--- a/js/src/jit/LOpcodes.h
++++ b/js/src/jit/LOpcodes.h
+@@ -166,6 +166,7 @@
+ _(LambdaForSingleton) \
+ _(LambdaPar) \
+ _(ImplicitThis) \
++ _(KeepAliveObject) \
+ _(Slots) \
+ _(Elements) \
+ _(ConvertElementsToDoubles) \
+diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
+index d671fd4..c0d434e 100644
+--- a/js/src/jit/Lowering.cpp
++++ b/js/src/jit/Lowering.cpp
+@@ -2110,6 +2110,15 @@ LIRGenerator::visitImplicitThis(MImplicitThis* ins)
+ }
+
+ bool
++LIRGenerator::visitKeepAliveObject(MKeepAliveObject* ins)
++{
++ MDefinition* obj = ins->object();
++ MOZ_ASSERT(obj->type() == MIRType_Object);
++
++ return add(new(alloc()) LKeepAliveObject(useKeepalive(obj)), ins);
++}
++
++bool
+ LIRGenerator::visitSlots(MSlots* ins)
+ {
+ return define(new(alloc()) LSlots(useRegisterAtStart(ins->object())), ins);
+diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
+index ea50cab..a60dc30 100644
+--- a/js/src/jit/Lowering.h
++++ b/js/src/jit/Lowering.h
+@@ -160,6 +160,7 @@ class LIRGenerator : public LIRGeneratorSpecific
+ bool visitLambdaArrow(MLambdaArrow* ins);
+ bool visitLambdaPar(MLambdaPar* ins);
+ bool visitImplicitThis(MImplicitThis* ins);
++ bool visitKeepAliveObject(MKeepAliveObject* ins);
+ bool visitSlots(MSlots* ins);
+ bool visitElements(MElements* ins);
+ bool visitConstantElements(MConstantElements* ins);
+diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
+index 48e1dfb..a6060a2 100644
+--- a/js/src/jit/MIR.h
++++ b/js/src/jit/MIR.h
+@@ -5790,6 +5790,32 @@ class MSetTypedObjectOffset
+ }
+ };
+
++class MKeepAliveObject
++ : public MUnaryInstruction,
++ public SingleObjectPolicy
++{
++ explicit MKeepAliveObject(MDefinition* object)
++ : MUnaryInstruction(object)
++ {
++ setResultType(MIRType_None);
++ setGuard();
++ }
++
++ public:
++ INSTRUCTION_HEADER(KeepAliveObject)
++
++ static MKeepAliveObject* New(TempAllocator& alloc, MDefinition* object) {
++ return new(alloc) MKeepAliveObject(object);
++ }
++
++ MDefinition* object() const {
++ return getOperand(0);
++ }
++ TypePolicy* typePolicy() {
++ return this;
++ }
++};
++
+ // Perform !-operation
+ class MNot
+ : public MUnaryInstruction,
+diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
+index 83b9e63..cfc3895 100644
+--- a/js/src/jit/MOpcodes.h
++++ b/js/src/jit/MOpcodes.h
+@@ -110,6 +110,7 @@ namespace jit {
+ _(Lambda) \
+ _(LambdaArrow) \
+ _(ImplicitThis) \
++ _(KeepAliveObject) \
+ _(Slots) \
+ _(Elements) \
+ _(ConstantElements) \
+diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
+index a6a1202..13c577b 100644
+--- a/js/src/jit/ParallelSafetyAnalysis.cpp
++++ b/js/src/jit/ParallelSafetyAnalysis.cpp
+@@ -199,6 +199,7 @@ class ParallelSafetyVisitor : public MInstructionVisitor
+ CUSTOM_OP(Lambda)
+ UNSAFE_OP(LambdaArrow)
+ UNSAFE_OP(ImplicitThis)
++ SAFE_OP(KeepAliveObject)
+ SAFE_OP(Slots)
+ SAFE_OP(Elements)
+ SAFE_OP(ConstantElements)
+diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
+index 17bb74a..832cc61 100644
+--- a/js/src/jit/shared/Lowering-shared-inl.h
++++ b/js/src/jit/shared/Lowering-shared-inl.h
+@@ -372,11 +372,17 @@ LIRGeneratorShared::useStorableAtStart(MDefinition* mir)
+ #endif
+
+ LAllocation
++LIRGeneratorShared::useKeepalive(MDefinition* mir)
++{
++ return use(mir, LUse(LUse::KEEPALIVE));
++}
++
++LAllocation
+ LIRGeneratorShared::useKeepaliveOrConstant(MDefinition* mir)
+ {
+ if (mir->isConstant())
+ return LAllocation(mir->toConstant()->vp());
+- return use(mir, LUse(LUse::KEEPALIVE));
++ return useKeepalive(mir);
+ }
+
+ LUse
+diff --git a/js/src/jit/shared/Lowering-shared.h b/js/src/jit/shared/Lowering-shared.h
+index 4bd13b0..b23d20e 100644
+--- a/js/src/jit/shared/Lowering-shared.h
++++ b/js/src/jit/shared/Lowering-shared.h
+@@ -85,6 +85,7 @@ class LIRGeneratorShared : public MInstructionVisitorWithDefaults
+ // this is a generic "things we can expect to write into memory in 1 instruction"
+ inline LAllocation useStorable(MDefinition* mir);
+ inline LAllocation useStorableAtStart(MDefinition* mir);
++ inline LAllocation useKeepalive(MDefinition* mir);
+ inline LAllocation useKeepaliveOrConstant(MDefinition* mir);
+ inline LAllocation useRegisterOrConstant(MDefinition* mir);
+ inline LAllocation useRegisterOrConstantAtStart(MDefinition* mir);
+diff --git a/js/src/vm/TraceLogging.h b/js/src/vm/TraceLogging.h
+index 4c2ebfe..8447679 100644
+--- a/js/src/vm/TraceLogging.h
++++ b/js/src/vm/TraceLogging.h
+@@ -145,7 +145,8 @@ namespace jit {
+ _(EffectiveAddressAnalysis) \
+ _(EliminateDeadCode) \
+ _(EdgeCaseAnalysis) \
+- _(EliminateRedundantChecks)
++ _(EliminateRedundantChecks) \
++ _(AddKeepAliveInstructions)
+
+ class AutoTraceLog;
+
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2724-pt3.patch b/gnu/packages/patches/icecat-CVE-2015-2724-pt3.patch
new file mode 100644
index 0000000000..4b31bf1c6e
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2724-pt3.patch
@@ -0,0 +1,90 @@
+From 5da8e2ffd63deac27c0faca7dabee3623867dd6e Mon Sep 17 00:00:00 2001
+From: Steven Michaud <smichaud@pobox.com>
+Date: Wed, 3 Jun 2015 11:18:25 -0500
+Subject: [PATCH] Bug 1154876 - Block calls to hooked methods off the plugin
+ thread. r=spohl a=abillings
+
+---
+ dom/plugins/ipc/PluginInterposeOSX.mm | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/dom/plugins/ipc/PluginInterposeOSX.mm b/dom/plugins/ipc/PluginInterposeOSX.mm
+index f43192b..cfd8e57 100644
+--- a/dom/plugins/ipc/PluginInterposeOSX.mm
++++ b/dom/plugins/ipc/PluginInterposeOSX.mm
+@@ -38,8 +38,7 @@
+ #import <objc/runtime.h>
+ #import <Carbon/Carbon.h>
+
+-using mozilla::plugins::PluginModuleChild;
+-using mozilla::plugins::AssertPluginThread;
++using namespace mozilla::plugins;
+
+ namespace mac_plugin_interposing {
+
+@@ -544,7 +543,7 @@ void NSCursorInfo::SetCustomImageData(uint8_t* aData, uint32_t aDataLength)
+ bool NSCursorInfo::GetNativeCursorsSupported()
+ {
+ if (mNativeCursorsSupported == -1) {
+- AssertPluginThread();
++ ENSURE_PLUGIN_THREAD(false);
+ PluginModuleChild *pmc = PluginModuleChild::current();
+ if (pmc) {
+ bool result = pmc->GetNativeCursorsSupported();
+@@ -689,7 +688,7 @@ void FocusPluginProcess() {
+
+ void NotifyBrowserOfPluginShowWindow(uint32_t window_id, CGRect bounds,
+ bool modal) {
+- AssertPluginThread();
++ ENSURE_PLUGIN_THREAD_VOID();
+
+ PluginModuleChild *pmc = PluginModuleChild::current();
+ if (pmc)
+@@ -697,7 +696,7 @@ void NotifyBrowserOfPluginShowWindow(uint32_t window_id, CGRect bounds,
+ }
+
+ void NotifyBrowserOfPluginHideWindow(uint32_t window_id, CGRect bounds) {
+- AssertPluginThread();
++ ENSURE_PLUGIN_THREAD_VOID();
+
+ PluginModuleChild *pmc = PluginModuleChild::current();
+ if (pmc)
+@@ -706,7 +705,7 @@ void NotifyBrowserOfPluginHideWindow(uint32_t window_id, CGRect bounds) {
+
+ void NotifyBrowserOfSetCursor(NSCursorInfo& aCursorInfo)
+ {
+- AssertPluginThread();
++ ENSURE_PLUGIN_THREAD_VOID();
+ PluginModuleChild *pmc = PluginModuleChild::current();
+ if (pmc) {
+ pmc->SetCursor(aCursorInfo);
+@@ -715,7 +714,7 @@ void NotifyBrowserOfSetCursor(NSCursorInfo& aCursorInfo)
+
+ void NotifyBrowserOfShowCursor(bool show)
+ {
+- AssertPluginThread();
++ ENSURE_PLUGIN_THREAD_VOID();
+ PluginModuleChild *pmc = PluginModuleChild::current();
+ if (pmc) {
+ pmc->ShowCursor(show);
+@@ -724,7 +723,7 @@ void NotifyBrowserOfShowCursor(bool show)
+
+ void NotifyBrowserOfPushCursor(NSCursorInfo& aCursorInfo)
+ {
+- AssertPluginThread();
++ ENSURE_PLUGIN_THREAD_VOID();
+ PluginModuleChild *pmc = PluginModuleChild::current();
+ if (pmc) {
+ pmc->PushCursor(aCursorInfo);
+@@ -733,7 +732,7 @@ void NotifyBrowserOfPushCursor(NSCursorInfo& aCursorInfo)
+
+ void NotifyBrowserOfPopCursor()
+ {
+- AssertPluginThread();
++ ENSURE_PLUGIN_THREAD_VOID();
+ PluginModuleChild *pmc = PluginModuleChild::current();
+ if (pmc) {
+ pmc->PopCursor();
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2724-pt4.patch b/gnu/packages/patches/icecat-CVE-2015-2724-pt4.patch
new file mode 100644
index 0000000000..90c15e663e
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2724-pt4.patch
@@ -0,0 +1,65 @@
+From 96dc9518fab0929293a8fc388f6a4a64d05b0f6f Mon Sep 17 00:00:00 2001
+From: Jan de Mooij <jdemooij@mozilla.com>
+Date: Wed, 10 Jun 2015 18:01:09 +0200
+Subject: [PATCH] Bug 1143679 - Make TryNoteIterIon behave more like
+ Baseline/interpreter iterators. r=shu, a=lizzard
+
+--HG--
+extra : transplant_source : W%D0%1FGe%29%2A%E2%BC%0C%09%3BH%92%2A%A0%5CO%FD%89
+---
+ js/src/jit/IonFrames.cpp | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
+index 51f4301..3e41c0a 100644
+--- a/js/src/jit/IonFrames.cpp
++++ b/js/src/jit/IonFrames.cpp
+@@ -356,14 +356,20 @@ JitFrameIterator::machineState() const
+ return machine;
+ }
+
++static uint32_t
++NumArgAndLocalSlots(const InlineFrameIterator& frame)
++{
++ JSScript* script = frame.script();
++ return CountArgSlots(script, frame.maybeCallee()) + script->nfixed();
++}
++
+ static void
+-CloseLiveIterator(JSContext* cx, const InlineFrameIterator& frame, uint32_t localSlot)
++CloseLiveIterator(JSContext* cx, const InlineFrameIterator& frame, uint32_t stackSlot)
+ {
+ SnapshotIterator si = frame.snapshotIterator();
+
+ // Skip stack slots until we reach the iterator object.
+- uint32_t base = CountArgSlots(frame.script(), frame.maybeCallee()) + frame.script()->nfixed();
+- uint32_t skipSlots = base + localSlot - 1;
++ uint32_t skipSlots = NumArgAndLocalSlots(frame) + stackSlot - 1;
+
+ for (unsigned i = 0; i < skipSlots; i++)
+ si.skip();
+@@ -407,6 +413,11 @@ HandleExceptionIon(JSContext* cx, const InlineFrameIterator& frame, ResumeFromEx
+ if (!script->hasTrynotes())
+ return;
+
++ uint32_t base = NumArgAndLocalSlots(frame);
++ SnapshotIterator si = frame.snapshotIterator();
++ JS_ASSERT(si.numAllocations() >= base);
++ const uint32_t stackDepth = si.numAllocations() - base;
++
+ JSTryNote* tn = script->trynotes()->vector;
+ JSTryNote* tnEnd = tn + script->trynotes()->length;
+
+@@ -417,6 +428,9 @@ HandleExceptionIon(JSContext* cx, const InlineFrameIterator& frame, ResumeFromEx
+ if (pcOffset >= tn->start + tn->length)
+ continue;
+
++ if (tn->stackDepth > stackDepth)
++ continue;
++
+ switch (tn->kind) {
+ case JSTRY_ITER: {
+ JS_ASSERT(JSOp(*(script->main() + tn->start + tn->length)) == JSOP_ENDITER);
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2728-pt1.patch b/gnu/packages/patches/icecat-CVE-2015-2728-pt1.patch
new file mode 100644
index 0000000000..8bcae6177a
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2728-pt1.patch
@@ -0,0 +1,95 @@
+From 81ce99255a0ef65c98eaac300d90c1dc161efc54 Mon Sep 17 00:00:00 2001
+From: Ben Turner <bent.mozilla@gmail.com>
+Date: Tue, 9 Jun 2015 09:46:58 -0400
+Subject: [PATCH] Bug 1142210. r=khuey, a=dveditz CLOSED TREE
+
+--HG--
+extra : amend_source : 5626188ba4b79f7c25286d4f29c63dc387e63c75
+extra : transplant_source : %F0%A1%D6F%E6%1B%1FJO%BFH%29%FFo%97%2A%89%03%ECm
+---
+ dom/indexedDB/IDBRequest.cpp | 5 +++++
+ dom/indexedDB/IDBRequest.h | 3 +++
+ dom/indexedDB/IndexedDatabaseManager.cpp | 22 +++++++++++++++++-----
+ 3 files changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/dom/indexedDB/IDBRequest.cpp b/dom/indexedDB/IDBRequest.cpp
+index 36e8a96..695f2ee 100644
+--- a/dom/indexedDB/IDBRequest.cpp
++++ b/dom/indexedDB/IDBRequest.cpp
+@@ -35,6 +35,8 @@
+
+ namespace {
+
++NS_DEFINE_IID(kIDBRequestIID, PRIVATE_IDBREQUEST_IID);
++
+ #ifdef MOZ_ENABLE_PROFILER_SPS
+ uint64_t gNextRequestSerialNumber = 1;
+ #endif
+@@ -382,6 +384,9 @@ NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(IDBRequest, IDBWrapperCache)
+ NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(IDBRequest)
++ if (aIID.Equals(kIDBRequestIID)) {
++ foundInterface = this;
++ } else
+ NS_INTERFACE_MAP_END_INHERITING(IDBWrapperCache)
+
+ NS_IMPL_ADDREF_INHERITED(IDBRequest, IDBWrapperCache)
+diff --git a/dom/indexedDB/IDBRequest.h b/dom/indexedDB/IDBRequest.h
+index c835ae8..c8d1081 100644
+--- a/dom/indexedDB/IDBRequest.h
++++ b/dom/indexedDB/IDBRequest.h
+@@ -19,6 +19,9 @@
+
+ #include "mozilla/dom/indexedDB/IDBWrapperCache.h"
+
++#define PRIVATE_IDBREQUEST_IID \
++ {0xe68901e5, 0x1d50, 0x4ee9, {0xaf, 0x49, 0x90, 0x99, 0x4a, 0xff, 0xc8, 0x39}}
++
+ class nsIScriptContext;
+ class nsPIDOMWindow;
+
+diff --git a/dom/indexedDB/IndexedDatabaseManager.cpp b/dom/indexedDB/IndexedDatabaseManager.cpp
+index 466d0ff..820dfa6 100644
+--- a/dom/indexedDB/IndexedDatabaseManager.cpp
++++ b/dom/indexedDB/IndexedDatabaseManager.cpp
+@@ -318,19 +318,31 @@ IndexedDatabaseManager::FireWindowOnError(nsPIDOMWindow* aOwner,
+ return NS_OK;
+ }
+
++ Event* internalEvent = aVisitor.mDOMEvent->InternalDOMEvent();
++ MOZ_ASSERT(internalEvent);
++
++ if (!internalEvent->IsTrusted()) {
++ return NS_OK;
++ }
++
+ nsString type;
+- nsresult rv = aVisitor.mDOMEvent->GetType(type);
++ nsresult rv = internalEvent->GetType(type);
+ NS_ENSURE_SUCCESS(rv, rv);
+
+ if (!type.EqualsLiteral(ERROR_EVT_STR)) {
+ return NS_OK;
+ }
+
+- nsCOMPtr<EventTarget> eventTarget =
+- aVisitor.mDOMEvent->InternalDOMEvent()->GetTarget();
++ nsCOMPtr<EventTarget> eventTarget = internalEvent->GetTarget();
++ MOZ_ASSERT(eventTarget);
+
+- IDBRequest* request = static_cast<IDBRequest*>(eventTarget.get());
+- NS_ENSURE_TRUE(request, NS_ERROR_UNEXPECTED);
++ // Only mess with events that were originally targeted to an IDBRequest.
++ nsRefPtr<IDBRequest> request;
++ if (NS_FAILED(eventTarget->QueryInterface(kIDBRequestIID,
++ getter_AddRefs(request))) ||
++ !request) {
++ return NS_OK;
++ }
+
+ ErrorResult ret;
+ nsRefPtr<DOMError> error = request->GetError(ret);
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2728-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2728-pt2.patch
new file mode 100644
index 0000000000..5097cd0aef
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2728-pt2.patch
@@ -0,0 +1,27 @@
+From ecb3805b4425165d35b82874d4f9c55b75fb5390 Mon Sep 17 00:00:00 2001
+From: Ryan VanderMeulen <ryanvm@gmail.com>
+Date: Tue, 9 Jun 2015 12:12:13 -0400
+Subject: [PATCH] Bug 1142210 - Bustage follow-up on a CLOSED TREE.
+
+--HG--
+extra : transplant_source : %06B%8EGN%40%985%DC%D5%0E%DD%13%29%8AC%BF%1A%BA%B6
+---
+ dom/indexedDB/IndexedDatabaseManager.cpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/dom/indexedDB/IndexedDatabaseManager.cpp b/dom/indexedDB/IndexedDatabaseManager.cpp
+index 820dfa6..eabfe09 100644
+--- a/dom/indexedDB/IndexedDatabaseManager.cpp
++++ b/dom/indexedDB/IndexedDatabaseManager.cpp
+@@ -108,6 +108,8 @@ END_INDEXEDDB_NAMESPACE
+
+ namespace {
+
++NS_DEFINE_IID(kIDBRequestIID, PRIVATE_IDBREQUEST_IID);
++
+ mozilla::StaticRefPtr<IndexedDatabaseManager> gDBManager;
+
+ mozilla::Atomic<bool> gInitialized(false);
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2733-pt1.patch b/gnu/packages/patches/icecat-CVE-2015-2733-pt1.patch
new file mode 100644
index 0000000000..261d3e0e2c
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2733-pt1.patch
@@ -0,0 +1,29 @@
+From bfad3fb6fc3ab05819be144567ad99921c0c87be Mon Sep 17 00:00:00 2001
+From: Andrea Marchesini <amarchesini@mozilla.com>
+Date: Thu, 4 Jun 2015 15:04:09 +0100
+Subject: [PATCH] Bug 1169867 - nsXMLHttpRequest should use and free mProxy
+ correctly. r=ehsan, a=abillings
+
+--HG--
+extra : transplant_source : 7%D0%8A%F8G%3E%E3%D5%07%5B%7F%D4%2Ct%A6v%CCk%A1%F5
+---
+ dom/workers/XMLHttpRequest.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
+index bf0cd3f..5690af5 100644
+--- a/dom/workers/XMLHttpRequest.cpp
++++ b/dom/workers/XMLHttpRequest.cpp
+@@ -1891,8 +1891,8 @@ XMLHttpRequest::Open(const nsACString& aMethod, const nsAString& aUrl,
+
+ mProxy->mOpening = true;
+ if (!runnable->Dispatch(mWorkerPrivate->GetJSContext())) {
+- ReleaseProxy();
+ mProxy->mOpening = false;
++ ReleaseProxy();
+ aRv.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2733-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2733-pt2.patch
new file mode 100644
index 0000000000..cc74a33871
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2733-pt2.patch
@@ -0,0 +1,31 @@
+From 72cd6e97ae12b89659cd59788bad08cd2f514eff Mon Sep 17 00:00:00 2001
+From: Andrea Marchesini <amarchesini@mozilla.com>
+Date: Fri, 12 Jun 2015 10:06:19 -0400
+Subject: [PATCH] Bug 1169867 - XMLHttpRequest::SendInternal should not unpin
+ itself when the worker goes away. r=bent, a=abillings
+
+--HG--
+extra : transplant_source : %28%B3%BD%9D%E2p%F3%BE%94S%CCD%08%8B%07%8A%CC%17%B0%7B
+---
+ dom/workers/XMLHttpRequest.cpp | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
+index 5690af5..d425eac 100644
+--- a/dom/workers/XMLHttpRequest.cpp
++++ b/dom/workers/XMLHttpRequest.cpp
+@@ -1829,6 +1829,11 @@ XMLHttpRequest::SendInternal(const nsAString& aStringBody,
+ new SendRunnable(mWorkerPrivate, mProxy, aStringBody, Move(aBody),
+ aClonedObjects, syncLoopTarget, hasUploadListeners);
+ if (!runnable->Dispatch(cx)) {
++ // Dispatch() may have spun the event loop and we may have already unrooted.
++ // If so we don't want autoUnpin to try again.
++ if (!mRooted) {
++ autoUnpin.Clear();
++ }
+ aRv.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2735.patch b/gnu/packages/patches/icecat-CVE-2015-2735.patch
new file mode 100644
index 0000000000..fd39bde113
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2735.patch
@@ -0,0 +1,86 @@
+From 8c8a52d7c05d75c3c608e4deed4bb33ab90883b0 Mon Sep 17 00:00:00 2001
+From: Andrea Marchesini <amarchesini@mozilla.com>
+Date: Thu, 4 Jun 2015 15:04:10 +0100
+Subject: [PATCH] Bug 1166900 - Better string length check in
+ nsZipArchive::GetDataOffset. r+a=dveditz
+
+---
+ dom/file/ArchiveZipFile.cpp | 6 ++++--
+ modules/libjar/nsZipArchive.cpp | 15 +++++++++------
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/dom/file/ArchiveZipFile.cpp b/dom/file/ArchiveZipFile.cpp
+index c206b64..d28b5ba 100644
+--- a/dom/file/ArchiveZipFile.cpp
++++ b/dom/file/ArchiveZipFile.cpp
+@@ -102,7 +102,8 @@ ArchiveInputStream::Init()
+ uint32_t offset = ArchiveZipItem::StrToInt32(mCentral.localhdr_offset);
+
+ // The file is corrupt
+- if (offset + ZIPLOCAL_SIZE > mData.parentSize) {
++ if (mData.parentSize < ZIPLOCAL_SIZE ||
++ offset > mData.parentSize - ZIPLOCAL_SIZE) {
+ return NS_ERROR_UNEXPECTED;
+ }
+
+@@ -137,7 +138,8 @@ ArchiveInputStream::Init()
+ ArchiveZipItem::StrToInt16(local.extrafield_len);
+
+ // The file is corrupt if there is not enough data
+- if (offset + mData.sizeToBeRead > mData.parentSize) {
++ if (mData.parentSize < mData.sizeToBeRead ||
++ offset > mData.parentSize - mData.sizeToBeRead) {
+ return NS_ERROR_UNEXPECTED;
+ }
+
+diff --git a/modules/libjar/nsZipArchive.cpp b/modules/libjar/nsZipArchive.cpp
+index f8af715..5ec8225 100644
+--- a/modules/libjar/nsZipArchive.cpp
++++ b/modules/libjar/nsZipArchive.cpp
+@@ -637,18 +637,20 @@ MOZ_WIN_MEM_TRY_BEGIN
+ uint16_t namelen = xtoint(central->filename_len);
+ uint16_t extralen = xtoint(central->extrafield_len);
+ uint16_t commentlen = xtoint(central->commentfield_len);
+-
+- // Point to the next item at the top of loop
+- buf += ZIPCENTRAL_SIZE + namelen + extralen + commentlen;
++ uint32_t diff = ZIPCENTRAL_SIZE + namelen + extralen + commentlen;
+
+ // Sanity check variable sizes and refuse to deal with
+ // anything too big: it's likely a corrupt archive.
+ if (namelen < 1 ||
+ namelen > kMaxNameLength ||
+- buf >= endp) {
++ buf >= buf + diff || // No overflow
++ buf >= endp - diff) {
+ return NS_ERROR_FILE_CORRUPTED;
+ }
+
++ // Point to the next item at the top of loop
++ buf += diff;
++
+ nsZipItem* item = CreateZipItem();
+ if (!item)
+ return NS_ERROR_OUT_OF_MEMORY;
+@@ -779,7 +781,7 @@ MOZ_WIN_MEM_TRY_BEGIN
+ uint32_t len = mFd->mLen;
+ const uint8_t* data = mFd->mFileData;
+ uint32_t offset = aItem->LocalOffset();
+- if (offset + ZIPLOCAL_SIZE > len)
++ if (len < ZIPLOCAL_SIZE || offset > len - ZIPLOCAL_SIZE)
+ return nullptr;
+
+ // -- check signature before using the structure, in case the zip file is corrupt
+@@ -795,7 +797,8 @@ MOZ_WIN_MEM_TRY_BEGIN
+ xtoint(Local->extrafield_len);
+
+ // -- check if there is enough source data in the file
+- if (offset + aItem->Size() > len)
++ if (len < aItem->Size() ||
++ offset > len - aItem->Size())
+ return nullptr;
+
+ return data + offset;
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2736.patch b/gnu/packages/patches/icecat-CVE-2015-2736.patch
new file mode 100644
index 0000000000..a59cc64d10
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2736.patch
@@ -0,0 +1,34 @@
+From 6daa986c7fdf27835a0f5d897c88f6b8dc42b8db Mon Sep 17 00:00:00 2001
+From: Andrea Marchesini <amarchesini@mozilla.com>
+Date: Thu, 4 Jun 2015 15:04:10 +0100
+Subject: [PATCH] Bug 1167888 - Better string length check in
+ nsZipArchive::BuildFileList. r=smaug, a=dveditz
+
+--HG--
+extra : transplant_source : %5E6%3E%84%B6a%7F%1F%D21zGc%BD%E1%80%EF%0C%B5%F0
+---
+ modules/libjar/nsZipArchive.cpp | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/modules/libjar/nsZipArchive.cpp b/modules/libjar/nsZipArchive.cpp
+index cb3e5d0..f8af715 100644
+--- a/modules/libjar/nsZipArchive.cpp
++++ b/modules/libjar/nsZipArchive.cpp
+@@ -617,8 +617,13 @@ MOZ_WIN_MEM_TRY_BEGIN
+ if (!centralOffset)
+ return NS_ERROR_FILE_CORRUPTED;
+
+- //-- Read the central directory headers
+ buf = startp + centralOffset;
++
++ // avoid overflow of startp + centralOffset.
++ if (buf < startp)
++ return NS_ERROR_FILE_CORRUPTED;
++
++ //-- Read the central directory headers
+ uint32_t sig = 0;
+ while (buf + int32_t(sizeof(uint32_t)) <= endp &&
+ (sig = xtolong(buf)) == CENTRALSIG) {
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2738.patch b/gnu/packages/patches/icecat-CVE-2015-2738.patch
new file mode 100644
index 0000000000..beb784c615
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2738.patch
@@ -0,0 +1,151 @@
+From cda807c21650d0678761d6af8fd324ce622962d6 Mon Sep 17 00:00:00 2001
+From: Andrew Comminos <acomminos@mozilla.com>
+Date: Fri, 19 Jun 2015 11:32:17 -0400
+Subject: [PATCH] Bug 1167356 - Handle return value of DataSourceSurface::Map
+ wherever possible. r=Bas, a=abillings CLOSED TREE
+
+---
+ gfx/2d/SourceSurfaceD2D1.cpp | 11 +++++++++--
+ gfx/gl/GLScreenBuffer.cpp | 5 ++++-
+ gfx/gl/SharedSurfaceGL.cpp | 5 ++++-
+ gfx/layers/YCbCrImageDataSerializer.cpp | 4 +++-
+ gfx/layers/opengl/CompositorOGL.cpp | 6 +++++-
+ gfx/thebes/gfxPlatform.cpp | 6 ++++--
+ widget/gtk/nsImageToPixbuf.cpp | 4 +++-
+ 7 files changed, 32 insertions(+), 9 deletions(-)
+
+diff --git a/gfx/2d/SourceSurfaceD2D1.cpp b/gfx/2d/SourceSurfaceD2D1.cpp
+index fc64327..01f3a67 100644
+--- a/gfx/2d/SourceSurfaceD2D1.cpp
++++ b/gfx/2d/SourceSurfaceD2D1.cpp
+@@ -5,6 +5,7 @@
+
+ #include "SourceSurfaceD2D1.h"
+ #include "DrawTargetD2D1.h"
++#include "Logging.h"
+ #include "Tools.h"
+
+ namespace mozilla {
+@@ -156,7 +157,10 @@ DataSourceSurfaceD2D1::Map(MapType aMapType, MappedSurface *aMappedSurface)
+ }
+
+ D2D1_MAPPED_RECT map;
+- mBitmap->Map(D2D1_MAP_OPTIONS_READ, &map);
++ if (FAILED(mBitmap->Map(D2D1_MAP_OPTIONS_READ, &map))) {
++ gfxCriticalError() << "Failed to map bitmap.";
++ return false;
++ }
+ aMappedSurface->mData = map.bits;
+ aMappedSurface->mStride = map.pitch;
+
+@@ -189,7 +193,10 @@ DataSourceSurfaceD2D1::EnsureMapped()
+ if (mMapped) {
+ return;
+ }
+- mBitmap->Map(D2D1_MAP_OPTIONS_READ, &mMap);
++ if (FAILED(mBitmap->Map(D2D1_MAP_OPTIONS_READ, &mMap))) {
++ gfxCriticalError() << "Failed to map bitmap.";
++ return;
++ }
+ mMapped = true;
+ }
+
+diff --git a/gfx/gl/GLScreenBuffer.cpp b/gfx/gl/GLScreenBuffer.cpp
+index 432bdbc..d31e848 100755
+--- a/gfx/gl/GLScreenBuffer.cpp
++++ b/gfx/gl/GLScreenBuffer.cpp
+@@ -483,7 +483,10 @@ GLScreenBuffer::Readback(SharedSurface_GL* src, DataSourceSurface* dest)
+ {
+ MOZ_ASSERT(src && dest);
+ DataSourceSurface::MappedSurface ms;
+- dest->Map(DataSourceSurface::MapType::READ, &ms);
++ if (!dest->Map(DataSourceSurface::MapType::READ, &ms)) {
++ NS_ERROR("Failed to map surface for reading.");
++ return;
++ }
+ nsRefPtr<gfxImageSurface> wrappedDest =
+ new gfxImageSurface(ms.mData,
+ ThebesIntSize(dest->GetSize()),
+diff --git a/gfx/gl/SharedSurfaceGL.cpp b/gfx/gl/SharedSurfaceGL.cpp
+index 1aab56f..1f80c28 100644
+--- a/gfx/gl/SharedSurfaceGL.cpp
++++ b/gfx/gl/SharedSurfaceGL.cpp
+@@ -326,7 +326,10 @@ SharedSurface_Basic::Fence()
+ ScopedBindFramebuffer autoFB(mGL, mFB);
+
+ DataSourceSurface::MappedSurface map;
+- mData->Map(DataSourceSurface::MapType::WRITE, &map);
++ if (!mData->Map(DataSourceSurface::MapType::WRITE, &map)) {
++ NS_ERROR("Failed to map surface for writing.");
++ return;
++ }
+ nsRefPtr<gfxImageSurface> wrappedData =
+ new gfxImageSurface(map.mData,
+ ThebesIntSize(mData->GetSize()),
+diff --git a/gfx/layers/YCbCrImageDataSerializer.cpp b/gfx/layers/YCbCrImageDataSerializer.cpp
+index e16db18..6e7a908 100644
+--- a/gfx/layers/YCbCrImageDataSerializer.cpp
++++ b/gfx/layers/YCbCrImageDataSerializer.cpp
+@@ -278,7 +278,9 @@ YCbCrImageDataDeserializer::ToDataSourceSurface()
+ Factory::CreateDataSourceSurface(GetYSize(), gfx::SurfaceFormat::B8G8R8X8);
+
+ DataSourceSurface::MappedSurface map;
+- result->Map(DataSourceSurface::MapType::WRITE, &map);
++ if (NS_WARN_IF(!result->Map(DataSourceSurface::MapType::WRITE, &map))) {
++ return nullptr;
++ }
+
+ gfx::ConvertYCbCrToRGB32(GetYData(), GetCbData(), GetCrData(),
+ map.mData,
+diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp
+index 92432c3..2e0b51e 100644
+--- a/gfx/layers/opengl/CompositorOGL.cpp
++++ b/gfx/layers/opengl/CompositorOGL.cpp
+@@ -1346,7 +1346,11 @@ CompositorOGL::CopyToTarget(DrawTarget *aTarget, const gfx::Matrix& aTransform)
+ Factory::CreateDataSourceSurface(rect.Size(), gfx::SurfaceFormat::B8G8R8A8);
+
+ DataSourceSurface::MappedSurface map;
+- source->Map(DataSourceSurface::MapType::WRITE, &map);
++ if (!source->Map(DataSourceSurface::MapType::WRITE, &map)) {
++ NS_ERROR("Failed to map surface for writing!");
++ return;
++ }
++
+ // XXX we should do this properly one day without using the gfxImageSurface
+ nsRefPtr<gfxImageSurface> surf =
+ new gfxImageSurface(map.mData,
+diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
+index c869e53..8a2122c 100644
+--- a/gfx/thebes/gfxPlatform.cpp
++++ b/gfx/thebes/gfxPlatform.cpp
+@@ -662,8 +662,10 @@ CopySurface(gfxASurface* aSurface)
+ }
+
+ DataSourceSurface::MappedSurface map;
+- DebugOnly<bool> result = data->Map(DataSourceSurface::WRITE, &map);
+- MOZ_ASSERT(result, "Should always succeed mapping raw data surfaces!");
++ if (!data->Map(DataSourceSurface::WRITE, &map)) {
++ NS_ERROR("Failed to map surface for reading!");
++ return nullptr;
++ }
+
+ nsRefPtr<gfxImageSurface> image = new gfxImageSurface(map.mData, size, map.mStride, format);
+ nsRefPtr<gfxContext> ctx = new gfxContext(image);
+diff --git a/widget/gtk/nsImageToPixbuf.cpp b/widget/gtk/nsImageToPixbuf.cpp
+index ca05b3b..a83a570 100644
+--- a/widget/gtk/nsImageToPixbuf.cpp
++++ b/widget/gtk/nsImageToPixbuf.cpp
+@@ -75,7 +75,9 @@ nsImageToPixbuf::SourceSurfaceToPixbuf(SourceSurface* aSurface,
+
+ RefPtr<DataSourceSurface> dataSurface = aSurface->GetDataSurface();
+ DataSourceSurface::MappedSurface map;
+- dataSurface->Map(DataSourceSurface::MapType::READ, &map);
++ if (!dataSurface->Map(DataSourceSurface::MapType::READ, &map))
++ return nullptr;
++
+ uint8_t* srcData = map.mData;
+ int32_t srcStride = map.mStride;
+
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2739.patch b/gnu/packages/patches/icecat-CVE-2015-2739.patch
new file mode 100644
index 0000000000..9f70db8cf9
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2739.patch
@@ -0,0 +1,66 @@
+From 55d0298956b8a3cfbd5b70fe32fb07e120d364c2 Mon Sep 17 00:00:00 2001
+From: Boris Zbarsky <bzbarsky@mit.edu>
+Date: Mon, 1 Jun 2015 16:59:26 -0700
+Subject: [PATCH] Bug 1168207. Be a bit more careful with overflow checking in
+ XHR. r=baku a=lizzard
+
+---
+ content/base/src/nsXMLHttpRequest.cpp | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
+index 58a9ee0..56d1aa3 100644
+--- a/content/base/src/nsXMLHttpRequest.cpp
++++ b/content/base/src/nsXMLHttpRequest.cpp
+@@ -7,6 +7,7 @@
+ #include "nsXMLHttpRequest.h"
+
+ #include "mozilla/ArrayUtils.h"
++#include "mozilla/CheckedInt.h"
+ #include "mozilla/dom/XMLHttpRequestUploadBinding.h"
+ #include "mozilla/EventDispatcher.h"
+ #include "mozilla/EventListenerManager.h"
+@@ -3897,26 +3898,30 @@ bool
+ ArrayBufferBuilder::append(const uint8_t *aNewData, uint32_t aDataLen,
+ uint32_t aMaxGrowth)
+ {
++ CheckedUint32 neededCapacity = mLength;
++ neededCapacity += aDataLen;
++ if (!neededCapacity.isValid()) {
++ return false;
++ }
+ if (mLength + aDataLen > mCapacity) {
+- uint32_t newcap;
++ CheckedUint32 newcap = mCapacity;
+ // Double while under aMaxGrowth or if not specified.
+ if (!aMaxGrowth || mCapacity < aMaxGrowth) {
+- newcap = mCapacity * 2;
++ newcap *= 2;
+ } else {
+- newcap = mCapacity + aMaxGrowth;
++ newcap += aMaxGrowth;
+ }
+
+- // But make sure there's always enough to satisfy our request.
+- if (newcap < mLength + aDataLen) {
+- newcap = mLength + aDataLen;
++ if (!newcap.isValid()) {
++ return false;
+ }
+
+- // Did we overflow?
+- if (newcap < mCapacity) {
+- return false;
++ // But make sure there's always enough to satisfy our request.
++ if (newcap.value() < neededCapacity.value()) {
++ newcap = neededCapacity;
+ }
+
+- if (!setCapacity(newcap)) {
++ if (!setCapacity(newcap.value())) {
+ return false;
+ }
+ }
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2740.patch b/gnu/packages/patches/icecat-CVE-2015-2740.patch
new file mode 100644
index 0000000000..caafa52a23
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2740.patch
@@ -0,0 +1,52 @@
+From ccbae7ff07c2e72c48e0676adaa3e798990f33a1 Mon Sep 17 00:00:00 2001
+From: Andrea Marchesini <amarchesini@mozilla.com>
+Date: Tue, 23 Jun 2015 10:47:38 -0400
+Subject: [PATCH] Bug 1170809 - Improve the buffer size check in
+ nsXMLHttpRequest::AppendToResponseText. r=ehsan, r=bz, a=abillings
+
+---
+ content/base/src/nsXMLHttpRequest.cpp | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
+index 56d1aa3..86425d7 100644
+--- a/content/base/src/nsXMLHttpRequest.cpp
++++ b/content/base/src/nsXMLHttpRequest.cpp
+@@ -655,13 +655,18 @@ nsXMLHttpRequest::AppendToResponseText(const char * aSrcBuffer,
+ &destBufferLen);
+ NS_ENSURE_SUCCESS(rv, rv);
+
+- if (!mResponseText.SetCapacity(mResponseText.Length() + destBufferLen, fallible_t())) {
++ uint32_t size = mResponseText.Length() + destBufferLen;
++ if (size < (uint32_t)destBufferLen) {
++ return NS_ERROR_OUT_OF_MEMORY;
++ }
++
++ if (!mResponseText.SetCapacity(size, fallible_t())) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ char16_t* destBuffer = mResponseText.BeginWriting() + mResponseText.Length();
+
+- int32_t totalChars = mResponseText.Length();
++ CheckedInt32 totalChars = mResponseText.Length();
+
+ // This code here is basically a copy of a similar thing in
+ // nsScanner::Append(const char* aBuffer, uint32_t aLen).
+@@ -674,9 +679,11 @@ nsXMLHttpRequest::AppendToResponseText(const char * aSrcBuffer,
+ MOZ_ASSERT(NS_SUCCEEDED(rv));
+
+ totalChars += destlen;
++ if (!totalChars.isValid()) {
++ return NS_ERROR_OUT_OF_MEMORY;
++ }
+
+- mResponseText.SetLength(totalChars);
+-
++ mResponseText.SetLength(totalChars.value());
+ return NS_OK;
+ }
+
+--
+2.4.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-2743.patch b/gnu/packages/patches/icecat-CVE-2015-2743.patch
new file mode 100644
index 0000000000..a74fe7b270
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2743.patch
@@ -0,0 +1,73 @@
+From 9ed97d606aaaf79776b0e19a73ba30d8ad0685b5 Mon Sep 17 00:00:00 2001
+From: Ben Turner <bent.mozilla@gmail.com>
+Date: Tue, 26 May 2015 17:27:01 -0400
+Subject: [PATCH] Bug 1163109 - Restrict the resource:// weirdness in workers
+ to loads from a system principal. r=bzbarsky, a=lizzard
+
+--HG--
+extra : transplant_source : sQUdu%7C%ED%84%CA%5B%91%89/%1B2%25%CFY%B0%C3
+---
+ dom/workers/ScriptLoader.cpp | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/dom/workers/ScriptLoader.cpp b/dom/workers/ScriptLoader.cpp
+index 0dfe625..3335c3e 100644
+--- a/dom/workers/ScriptLoader.cpp
++++ b/dom/workers/ScriptLoader.cpp
+@@ -509,22 +509,6 @@ private:
+ rv = ssm->GetChannelPrincipal(channel, getter_AddRefs(channelPrincipal));
+ NS_ENSURE_SUCCESS(rv, rv);
+
+- // See if this is a resource URI. Since JSMs usually come from resource://
+- // URIs we're currently considering all URIs with the URI_IS_UI_RESOURCE
+- // flag as valid for creating privileged workers.
+- if (!nsContentUtils::IsSystemPrincipal(channelPrincipal)) {
+- bool isResource;
+- rv = NS_URIChainHasFlags(finalURI,
+- nsIProtocolHandler::URI_IS_UI_RESOURCE,
+- &isResource);
+- NS_ENSURE_SUCCESS(rv, rv);
+-
+- if (isResource) {
+- rv = ssm->GetSystemPrincipal(getter_AddRefs(channelPrincipal));
+- NS_ENSURE_SUCCESS(rv, rv);
+- }
+- }
+-
+ // If the load principal is the system principal then the channel
+ // principal must also be the system principal (we do not allow chrome
+ // code to create workers with non-chrome scripts). Otherwise this channel
+@@ -532,14 +516,25 @@ private:
+ // here in case redirects changed the location of the script).
+ if (nsContentUtils::IsSystemPrincipal(loadPrincipal)) {
+ if (!nsContentUtils::IsSystemPrincipal(channelPrincipal)) {
+- return NS_ERROR_DOM_BAD_URI;
++ // See if this is a resource URI. Since JSMs usually come from
++ // resource:// URIs we're currently considering all URIs with the
++ // URI_IS_UI_RESOURCE flag as valid for creating privileged workers.
++ bool isResource;
++ rv = NS_URIChainHasFlags(finalURI,
++ nsIProtocolHandler::URI_IS_UI_RESOURCE,
++ &isResource);
++ NS_ENSURE_SUCCESS(rv, rv);
++
++ if (isResource) {
++ // Assign the system principal to the resource:// worker only if it
++ // was loaded from code using the system principal.
++ channelPrincipal = loadPrincipal;
++ } else {
++ return NS_ERROR_DOM_BAD_URI;
++ }
+ }
+ }
+ else {
+- nsCString scheme;
+- rv = finalURI->GetScheme(scheme);
+- NS_ENSURE_SUCCESS(rv, rv);
+-
+ // We exempt data urls and other URI's that inherit their
+ // principal again.
+ if (NS_FAILED(loadPrincipal->CheckMayLoad(finalURI, false, true))) {
+--
+2.4.3
+
generated by cgit