futurile/guix-play
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gnu: icecat: Update to 38.7.1-gnu1.

Browse Source 
* gnu/packages/gnuzilla.scm (icecat): Update to 38.7.1-gnu1.
[sources]: Remove numerous patches.
* gnu/packages/patches/icecat-CVE-2015-4477.patch,
gnu/packages/patches/icecat-CVE-2015-7207.patch,
gnu/packages/patches/icecat-CVE-2016-1952-pt01.patch,
gnu/packages/patches/icecat-CVE-2016-1952-pt02.patch,
gnu/packages/patches/icecat-CVE-2016-1952-pt03.patch,
gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch,
gnu/packages/patches/icecat-CVE-2016-1952-pt05.patch,
gnu/packages/patches/icecat-CVE-2016-1952-pt06.patch,
gnu/packages/patches/icecat-CVE-2016-1954.patch,
gnu/packages/patches/icecat-CVE-2016-1960.patch,
gnu/packages/patches/icecat-CVE-2016-1961.patch,
gnu/packages/patches/icecat-CVE-2016-1962.patch,
gnu/packages/patches/icecat-CVE-2016-1964.patch,
gnu/packages/patches/icecat-CVE-2016-1965.patch,
gnu/packages/patches/icecat-CVE-2016-1966.patch,
gnu/packages/patches/icecat-CVE-2016-1974.patch,
gnu/packages/patches/icecat-icecatbug-1248851.patch,
gnu/packages/patches/icecat-update-graphite2.patch,
gnu/packages/patches/icecat-update-graphite2-pt2.patch: Remove files.
* gnu-system.am (dist_patch_DATA): Remove them.
This commit is contained in:
Efraim Flashner 2016-04-10 08:40:31 +03:00
parent 9c45c51992
commit 58e87f66ce
21 changed files with 4 additions and 13657 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
gnu-system.am
View File

@ -522,26 +522,7 @@ dist_patch_DATA = \
gnu/packages/patches/hydra-automake-1.15.patch \
gnu/packages/patches/hydra-disable-darcs-test.patch \
gnu/packages/patches/icecat-avoid-bundled-includes.patch \
gnu/packages/patches/icecat-update-graphite2.patch \
gnu/packages/patches/icecat-update-graphite2-pt2.patch \
gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch \
gnu/packages/patches/icecat-CVE-2015-4477.patch \
gnu/packages/patches/icecat-CVE-2015-7207.patch \
gnu/packages/patches/icecat-CVE-2016-1952-pt01.patch \
gnu/packages/patches/icecat-CVE-2016-1952-pt02.patch \
gnu/packages/patches/icecat-CVE-2016-1952-pt03.patch \
gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch \
gnu/packages/patches/icecat-CVE-2016-1952-pt05.patch \
gnu/packages/patches/icecat-CVE-2016-1952-pt06.patch \
gnu/packages/patches/icecat-CVE-2016-1954.patch \
gnu/packages/patches/icecat-CVE-2016-1960.patch \
gnu/packages/patches/icecat-CVE-2016-1961.patch \
gnu/packages/patches/icecat-CVE-2016-1962.patch \
gnu/packages/patches/icecat-CVE-2016-1964.patch \
gnu/packages/patches/icecat-CVE-2016-1965.patch \
gnu/packages/patches/icecat-CVE-2016-1966.patch \
gnu/packages/patches/icecat-CVE-2016-1974.patch \
gnu/packages/patches/icecat-bug-1248851.patch \
gnu/packages/patches/icu4c-CVE-2014-6585.patch \
gnu/packages/patches/icu4c-CVE-2015-1270.patch \
gnu/packages/patches/icu4c-CVE-2015-4760.patch \

26
gnu/packages/gnuzilla.scm
View File

@ -3,6 +3,7 @@
;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
;;;
;;; This file is part of GNU Guix.
;;;
@ -277,7 +278,7 @@ standards.")
(define-public icecat
(package
(name "icecat")
(version "38.6.0-gnu1")
(version "38.7.1-gnu1")
(source
(origin
(method url-fetch)
@ -286,29 +287,10 @@ standards.")
name "-" version ".tar.bz2"))
(sha256
(base32
"0bd4k5cwr8ynscaxffvj2x3kgky3dmjq0qhpcb931l98bh0103lx"))
"1wdmd6hasra36g86ha1dw8sl7a5mvr7c4jbjx4zyg9629y5gqr8g"))
(patches (map search-patch
'("icecat-avoid-bundled-includes.patch"
"icecat-re-enable-DHE-cipher-suites.patch"
"icecat-update-graphite2.patch"
"icecat-update-graphite2-pt2.patch"
"icecat-CVE-2015-4477.patch"
"icecat-CVE-2015-7207.patch"
"icecat-CVE-2016-1952-pt01.patch"
"icecat-CVE-2016-1952-pt02.patch"
"icecat-CVE-2016-1952-pt03.patch"
"icecat-CVE-2016-1952-pt04.patch"
"icecat-CVE-2016-1952-pt05.patch"
"icecat-CVE-2016-1952-pt06.patch"
"icecat-CVE-2016-1954.patch"
"icecat-CVE-2016-1960.patch"
"icecat-CVE-2016-1961.patch"
"icecat-CVE-2016-1962.patch"
"icecat-CVE-2016-1964.patch"
"icecat-CVE-2016-1965.patch"
"icecat-CVE-2016-1966.patch"
"icecat-CVE-2016-1974.patch"
"icecat-bug-1248851.patch")))
"icecat-re-enable-DHE-cipher-suites.patch")))
(modules '((guix build utils)))
(snippet
'(begin

37
gnu/packages/patches/icecat-CVE-2015-4477.patch
View File

@ -1,37 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/beae8783b8c2
# HG changeset patch
# User Paul Adenot <paul@paul.cx>
# Date 1456422965 0
# Node ID beae8783b8c2c672da12a95c70ae663cbd0d5016
# Parent 3a606f8182c82480f8f350b622ab55a170ec1eb6
Bug 1179484. r=roc
MozReview-Commit-ID: HNaYLyMe3sM
diff --git a/dom/media/webaudio/MediaStreamAudioDestinationNode.cpp b/dom/media/webaudio/MediaStreamAudioDestinationNode.cpp
--- a/dom/media/webaudio/MediaStreamAudioDestinationNode.cpp
+++ b/dom/media/webaudio/MediaStreamAudioDestinationNode.cpp
@@ -69,16 +69,20 @@ MediaStreamAudioDestinationNode::MediaSt
ChannelInterpretation::Speakers)
, mDOMStream(DOMAudioNodeMediaStream::CreateTrackUnionStream(GetOwner(),
this))
{
TrackUnionStream* tus = static_cast<TrackUnionStream*>(mDOMStream->GetStream());
MOZ_ASSERT(tus == mDOMStream->GetStream()->AsProcessedStream());
tus->SetTrackIDFilter(FilterAudioNodeStreamTrack);
+ if (aContext->Graph() != tus->Graph()) {
+ return;
+ }
+
MediaStreamDestinationEngine* engine = new MediaStreamDestinationEngine(this, tus);
mStream = aContext->Graph()->CreateAudioNodeStream(engine, MediaStreamGraph::INTERNAL_STREAM);
mPort = tus->AllocateInputPort(mStream, 0);
nsIDocument* doc = aContext->GetParentObject()->GetExtantDoc();
if (doc) {
mDOMStream->CombineWithPrincipal(doc->NodePrincipal());
}

1140
gnu/packages/patches/icecat-CVE-2015-7207.patch
View File

File diff suppressed because it is too large Load Diff

356
gnu/packages/patches/icecat-CVE-2016-1952-pt01.patch
View File

@ -1,356 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/c1d67bd4c993
# HG changeset patch
# User Timothy Nikkel <tnikkel@gmail.com>
# Date 1454023801 21600
# Node ID c1d67bd4c993b9e344c68954e6f0392c82b81e38
# Parent 530559abe159d3c23f078d673d30ff03d9c244e2
Bug 1224979 - Check if we compute usable filters for the downscaler, and if not put the downscaler in error state so it's not used. r=edwin, a=al
diff --git a/image/Downscaler.cpp b/image/Downscaler.cpp
new file mode 100644
--- /dev/null
+++ b/image/Downscaler.cpp
@@ -0,0 +1,340 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "Downscaler.h"
+
+#include <algorithm>
+#include <ctime>
+#include "gfxPrefs.h"
+#include "image_operations.h"
+#include "mozilla/SSE.h"
+#include "convolver.h"
+#include "skia/include/core/SkTypes.h"
+
+using std::max;
+using std::swap;
+
+namespace mozilla {
+namespace image {
+
+Downscaler::Downscaler(const nsIntSize& aTargetSize)
+ : mTargetSize(aTargetSize)
+ , mOutputBuffer(nullptr)
+ , mXFilter(MakeUnique<skia::ConvolutionFilter1D>())
+ , mYFilter(MakeUnique<skia::ConvolutionFilter1D>())
+ , mWindowCapacity(0)
+ , mHasAlpha(true)
+ , mFlipVertically(false)
+{
+ MOZ_ASSERT(gfxPrefs::ImageDownscaleDuringDecodeEnabled(),
+ "Downscaling even though downscale-during-decode is disabled?");
+ MOZ_ASSERT(mTargetSize.width > 0 && mTargetSize.height > 0,
+ "Invalid target size");
+}
+
+Downscaler::~Downscaler()
+{
+ ReleaseWindow();
+}
+
+void
+Downscaler::ReleaseWindow()
+{
+ if (!mWindow) {
+ return;
+ }
+
+ for (int32_t i = 0; i < mWindowCapacity; ++i) {
+ delete[] mWindow[i];
+ }
+
+ mWindow = nullptr;
+ mWindowCapacity = 0;
+}
+
+nsresult
+Downscaler::BeginFrame(const nsIntSize& aOriginalSize,
+ const Maybe<nsIntRect>& aFrameRect,
+ uint8_t* aOutputBuffer,
+ bool aHasAlpha,
+ bool aFlipVertically /* = false */)
+{
+ MOZ_ASSERT(aOutputBuffer);
+ MOZ_ASSERT(mTargetSize != aOriginalSize,
+ "Created a downscaler, but not downscaling?");
+ MOZ_ASSERT(mTargetSize.width <= aOriginalSize.width,
+ "Created a downscaler, but width is larger");
+ MOZ_ASSERT(mTargetSize.height <= aOriginalSize.height,
+ "Created a downscaler, but height is larger");
+ MOZ_ASSERT(aOriginalSize.width > 0 && aOriginalSize.height > 0,
+ "Invalid original size");
+
+ mFrameRect = aFrameRect.valueOr(nsIntRect(nsIntPoint(), aOriginalSize));
+ MOZ_ASSERT(mFrameRect.x >= 0 && mFrameRect.y >= 0 &&
+ mFrameRect.width >= 0 && mFrameRect.height >= 0,
+ "Frame rect must have non-negative components");
+ MOZ_ASSERT(nsIntRect(0, 0, aOriginalSize.width, aOriginalSize.height)
+ .Contains(mFrameRect),
+ "Frame rect must fit inside image");
+ MOZ_ASSERT_IF(!nsIntRect(0, 0, aOriginalSize.width, aOriginalSize.height)
+ .IsEqualEdges(mFrameRect),
+ aHasAlpha);
+
+ mOriginalSize = aOriginalSize;
+ mScale = gfxSize(double(mOriginalSize.width) / mTargetSize.width,
+ double(mOriginalSize.height) / mTargetSize.height);
+ mOutputBuffer = aOutputBuffer;
+ mHasAlpha = aHasAlpha;
+ mFlipVertically = aFlipVertically;
+
+ ReleaseWindow();
+
+ auto resizeMethod = skia::ImageOperations::RESIZE_LANCZOS3;
+
+ skia::resize::ComputeFilters(resizeMethod,
+ mOriginalSize.width, mTargetSize.width,
+ 0, mTargetSize.width,
+ mXFilter.get());
+
+ if (mXFilter->max_filter() <= 0 || mXFilter->num_values() != mTargetSize.width) {
+ NS_WARNING("Failed to compute filters for image downscaling");
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ skia::resize::ComputeFilters(resizeMethod,
+ mOriginalSize.height, mTargetSize.height,
+ 0, mTargetSize.height,
+ mYFilter.get());
+
+ if (mYFilter->max_filter() <= 0 || mYFilter->num_values() != mTargetSize.height) {
+ NS_WARNING("Failed to compute filters for image downscaling");
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ // Allocate the buffer, which contains scanlines of the original image.
+ // pad by 15 to handle overreads by the simd code
+ size_t bufferLen = mOriginalSize.width * sizeof(uint32_t) + 15;
+ mRowBuffer.reset(new (fallible) uint8_t[bufferLen]);
+ if (MOZ_UNLIKELY(!mRowBuffer)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ // Zero buffer to keep valgrind happy.
+ memset(mRowBuffer.get(), 0, bufferLen);
+
+ // Allocate the window, which contains horizontally downscaled scanlines. (We
+ // can store scanlines which are already downscale because our downscaling
+ // filter is separable.)
+ mWindowCapacity = mYFilter->max_filter();
+ mWindow.reset(new (fallible) uint8_t*[mWindowCapacity]);
+ if (MOZ_UNLIKELY(!mWindow)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ bool anyAllocationFailed = false;
+ // pad by 15 to handle overreads by the simd code
+ const int rowSize = mTargetSize.width * sizeof(uint32_t) + 15;
+ for (int32_t i = 0; i < mWindowCapacity; ++i) {
+ mWindow[i] = new (fallible) uint8_t[rowSize];
+ anyAllocationFailed = anyAllocationFailed || mWindow[i] == nullptr;
+ }
+
+ if (MOZ_UNLIKELY(anyAllocationFailed)) {
+ // We intentionally iterate through the entire array even if an allocation
+ // fails, to ensure that all the pointers in it are either valid or nullptr.
+ // That in turn ensures that ReleaseWindow() can clean up correctly.
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ ResetForNextProgressivePass();
+
+ return NS_OK;
+}
+
+void
+Downscaler::SkipToRow(int32_t aRow)
+{
+ if (mCurrentInLine < aRow) {
+ ClearRow();
+ do {
+ CommitRow();
+ } while (mCurrentInLine < aRow);
+ }
+}
+
+void
+Downscaler::ResetForNextProgressivePass()
+{
+ mPrevInvalidatedLine = 0;
+ mCurrentOutLine = 0;
+ mCurrentInLine = 0;
+ mLinesInBuffer = 0;
+
+ if (mFrameRect.IsEmpty()) {
+ // Our frame rect is zero size; commit rows until the end of the image.
+ SkipToRow(mOriginalSize.height - 1);
+ } else {
+ // If we have a vertical offset, commit rows to shift us past it.
+ SkipToRow(mFrameRect.y);
+ }
+}
+
+static void
+GetFilterOffsetAndLength(UniquePtr<skia::ConvolutionFilter1D>& aFilter,
+ int32_t aOutputImagePosition,
+ int32_t* aFilterOffsetOut,
+ int32_t* aFilterLengthOut)
+{
+ MOZ_ASSERT(aOutputImagePosition < aFilter->num_values());
+ aFilter->FilterForValue(aOutputImagePosition,
+ aFilterOffsetOut,
+ aFilterLengthOut);
+}
+
+void
+Downscaler::ClearRow(uint32_t aStartingAtCol)
+{
+ MOZ_ASSERT(int64_t(mOriginalSize.width) > int64_t(aStartingAtCol));
+ uint32_t bytesToClear = (mOriginalSize.width - aStartingAtCol)
+ * sizeof(uint32_t);
+ memset(mRowBuffer.get() + (aStartingAtCol * sizeof(uint32_t)),
+ 0, bytesToClear);
+}
+
+void
+Downscaler::CommitRow()
+{
+ MOZ_ASSERT(mOutputBuffer, "Should have a current frame");
+ MOZ_ASSERT(mCurrentInLine < mOriginalSize.height, "Past end of input");
+
+ if (mCurrentOutLine < mTargetSize.height) {
+ int32_t filterOffset = 0;
+ int32_t filterLength = 0;
+ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+ &filterOffset, &filterLength);
+
+ int32_t inLineToRead = filterOffset + mLinesInBuffer;
+ MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
+ if (mCurrentInLine == inLineToRead) {
+ skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
+ mWindow[mLinesInBuffer++], mHasAlpha,
+ supports_sse2());
+ }
+
+ MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
+ "Writing past end of output");
+
+ while (mLinesInBuffer == filterLength) {
+ DownscaleInputLine();
+
+ if (mCurrentOutLine == mTargetSize.height) {
+ break; // We're done.
+ }
+
+ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+ &filterOffset, &filterLength);
+ }
+ }
+
+ mCurrentInLine += 1;
+
+ // If we're at the end of the part of the original image that has data, commit
+ // rows to shift us to the end.
+ if (mCurrentInLine == (mFrameRect.y + mFrameRect.height)) {
+ SkipToRow(mOriginalSize.height - 1);
+ }
+}
+
+bool
+Downscaler::HasInvalidation() const
+{
+ return mCurrentOutLine > mPrevInvalidatedLine;
+}
+
+DownscalerInvalidRect
+Downscaler::TakeInvalidRect()
+{
+ if (MOZ_UNLIKELY(!HasInvalidation())) {
+ return DownscalerInvalidRect();
+ }
+
+ DownscalerInvalidRect invalidRect;
+
+ // Compute the target size invalid rect.
+ if (mFlipVertically) {
+ // We need to flip it. This will implicitly flip the original size invalid
+ // rect, since we compute it by scaling this rect.
+ invalidRect.mTargetSizeRect =
+ IntRect(0, mTargetSize.height - mCurrentOutLine,
+ mTargetSize.width, mCurrentOutLine - mPrevInvalidatedLine);
+ } else {
+ invalidRect.mTargetSizeRect =
+ IntRect(0, mPrevInvalidatedLine,
+ mTargetSize.width, mCurrentOutLine - mPrevInvalidatedLine);
+ }
+
+ mPrevInvalidatedLine = mCurrentOutLine;
+
+ // Compute the original size invalid rect.
+ invalidRect.mOriginalSizeRect = invalidRect.mTargetSizeRect;
+ invalidRect.mOriginalSizeRect.ScaleRoundOut(mScale.width, mScale.height);
+
+ return invalidRect;
+}
+
+void
+Downscaler::DownscaleInputLine()
+{
+ typedef skia::ConvolutionFilter1D::Fixed FilterValue;
+
+ MOZ_ASSERT(mOutputBuffer);
+ MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
+ "Writing past end of output");
+
+ int32_t filterOffset = 0;
+ int32_t filterLength = 0;
+ MOZ_ASSERT(mCurrentOutLine < mYFilter->num_values());
+ auto filterValues =
+ mYFilter->FilterForValue(mCurrentOutLine, &filterOffset, &filterLength);
+
+ int32_t currentOutLine = mFlipVertically
+ ? mTargetSize.height - (mCurrentOutLine + 1)
+ : mCurrentOutLine;
+ MOZ_ASSERT(currentOutLine >= 0);
+
+ uint8_t* outputLine =
+ &mOutputBuffer[currentOutLine * mTargetSize.width * sizeof(uint32_t)];
+ skia::ConvolveVertically(static_cast<const FilterValue*>(filterValues),
+ filterLength, mWindow.get(), mXFilter->num_values(),
+ outputLine, mHasAlpha, supports_sse2());
+
+ mCurrentOutLine += 1;
+
+ if (mCurrentOutLine == mTargetSize.height) {
+ // We're done.
+ return;
+ }
+
+ int32_t newFilterOffset = 0;
+ int32_t newFilterLength = 0;
+ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+ &newFilterOffset, &newFilterLength);
+
+ int diff = newFilterOffset - filterOffset;
+ MOZ_ASSERT(diff >= 0, "Moving backwards in the filter?");
+
+ // Shift the buffer. We're just moving pointers here, so this is cheap.
+ mLinesInBuffer -= diff;
+ mLinesInBuffer = max(mLinesInBuffer, 0);
+ for (int32_t i = 0; i < mLinesInBuffer; ++i) {
+ swap(mWindow[i], mWindow[filterLength - mLinesInBuffer + i]);
+ }
+}
+
+
+
+} // namespace image
+} // namespace mozilla

58
gnu/packages/patches/icecat-CVE-2016-1952-pt02.patch
View File

@ -1,58 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/9719b71d72dd
# HG changeset patch
# User Byron Campen [:bwc] <docfaraday@gmail.com>
# Date 1454100887 21600
# Node ID 9719b71d72dd2a3c5ee12ace156af2a63d9595ac
# Parent b68673d974a10f65390f80b36d4307eb31e44669
Bug 1234578 - Assert if PCM is destroyed improperly. r=rjesup, a=sylvestre
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
@@ -712,16 +712,18 @@ PeerConnectionMedia::SelfDestruct_m()
{
CSFLogDebug(logTag, "%s: ", __FUNCTION__);
ASSERT_ON_THREAD(mMainThread);
mLocalSourceStreams.Clear();
mRemoteSourceStreams.Clear();
+ mMainThread = nullptr;
+
// Final self-destruct.
this->Release();
}
void
PeerConnectionMedia::ShutdownMediaTransport_s()
{
ASSERT_ON_THREAD(mSTSThread);
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
@@ -210,17 +210,20 @@ class RemoteSourceStreamInfo : public So
std::vector<std::string> mTrackIdMap;
// True iff SetPullEnabled(true) has been called on the DOMMediaStream. This
// happens when offer/answer concludes.
bool mReceiving;
};
class PeerConnectionMedia : public sigslot::has_slots<> {
- ~PeerConnectionMedia() {}
+ ~PeerConnectionMedia()
+ {
+ MOZ_RELEASE_ASSERT(!mMainThread);
+ }
public:
explicit PeerConnectionMedia(PeerConnectionImpl *parent);
PeerConnectionImpl* GetPC() { return mParent; }
nsresult Init(const std::vector<NrIceStunServer>& stun_servers,
const std::vector<NrIceTurnServer>& turn_servers);
// WARNING: This destroys the object!

60
gnu/packages/patches/icecat-CVE-2016-1952-pt03.patch
View File

@ -1,60 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/2839062f84fb
# HG changeset patch
# User Jan de Mooij <jdemooij@mozilla.com>
# Date 1455119320 -3600
# Node ID 2839062f84fb6cba2781ea8d59150f13d4813ddc
# Parent 185b233ea03f3811404e3979b65ec86b29d13555
Bug 1242279 - r=bhackett1024 a=sylvestre
diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
--- a/js/src/vm/TypeInference.cpp
+++ b/js/src/vm/TypeInference.cpp
@@ -3961,16 +3961,22 @@ JSScript::maybeSweepTypes(AutoClearTypeI
unsigned num = TypeScript::NumTypeSets(this);
StackTypeSet* typeArray = types_->typeArray();
// Remove constraints and references to dead objects from stack type sets.
for (unsigned i = 0; i < num; i++)
typeArray[i].sweep(zone(), *oom);
+ if (oom->hadOOM()) {
+ // It's possible we OOM'd while copying freeze constraints, so they
+ // need to be regenerated.
+ hasFreezeConstraints_ = false;
+ }
+
// Update the recompile indexes in any IonScripts still on the script.
if (hasIonScript())
ionScript()->recompileInfoRef().shouldSweep(types);
}
void
TypeScript::destroy()
{
diff --git a/js/src/vm/TypeInference.h b/js/src/vm/TypeInference.h
--- a/js/src/vm/TypeInference.h
+++ b/js/src/vm/TypeInference.h
@@ -566,16 +566,19 @@ class AutoClearTypeInferenceStateOnOOM
: zone(zone), oom(false)
{}
~AutoClearTypeInferenceStateOnOOM();
void setOOM() {
oom = true;
}
+ bool hadOOM() const {
+ return oom;
+ }
};
/* Superclass common to stack and heap type sets. */
class ConstraintTypeSet : public TypeSet
{
public:
/* Chain of constraints which propagate changes out from this type set. */
TypeConstraint* constraintList;

53
gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch
View File

@ -1,53 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/9dd60e798819
# HG changeset patch
# User Olli Pettay <bugs@pettay.fi>
# Date 1455204078 -3600
# Node ID 9dd60e798819fe2ebf1e5bd36aa9006ecd2f82c9
# Parent c1d67bd4c993b9e344c68954e6f0392c82b81e38
Bug 1244250 - r=mats, a=al
diff --git a/layout/style/nsAnimationManager.cpp b/layout/style/nsAnimationManager.cpp
--- a/layout/style/nsAnimationManager.cpp
+++ b/layout/style/nsAnimationManager.cpp
@@ -715,16 +715,17 @@ nsAnimationManager::FlushAnimations(Flus
}
DispatchEvents(); // may destroy us
}
void
nsAnimationManager::DoDispatchEvents()
{
+ nsRefPtr<nsAnimationManager> kungFuDeathGrip(this);
EventArray events;
mPendingEvents.SwapElements(events);
for (uint32_t i = 0, i_end = events.Length(); i < i_end; ++i) {
AnimationEventInfo &info = events[i];
EventDispatcher::Dispatch(info.mElement, mPresContext, &info.mEvent);
if (!mPresContext) {
break;
diff --git a/layout/style/nsTransitionManager.cpp b/layout/style/nsTransitionManager.cpp
--- a/layout/style/nsTransitionManager.cpp
+++ b/layout/style/nsTransitionManager.cpp
@@ -753,16 +753,17 @@ nsTransitionManager::FlushTransitions(Fl
}
}
}
if (didThrottle) {
mPresContext->Document()->SetNeedStyleFlush();
}
+ nsRefPtr<nsTransitionManager> kungFuDeathGrip(this);
for (uint32_t i = 0, i_end = events.Length(); i < i_end; ++i) {
TransitionEventInfo &info = events[i];
EventDispatcher::Dispatch(info.mElement, mPresContext, &info.mEvent);
if (!mPresContext) {
break;
}
}

32
gnu/packages/patches/icecat-CVE-2016-1952-pt05.patch
View File

@ -1,32 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/1dd0ca8e70bd
# HG changeset patch
# User Nicolas B. Pierron <nicolas.b.pierron@mozilla.com>
# Date 1456161361 0
# Node ID 1dd0ca8e70bd77b6fd93f36cc4e9c2cebfe8ba0a
# Parent 95ff874886905ef46a7bbc760981d15ad0831096
Bug 1221872 - ValueNumbering: Set the dominator index of fixup blocks when they are created. r=sunfish, a=ritu
diff --git a/js/src/jit/ValueNumbering.cpp b/js/src/jit/ValueNumbering.cpp
--- a/js/src/jit/ValueNumbering.cpp
+++ b/js/src/jit/ValueNumbering.cpp
@@ -433,16 +433,17 @@ ValueNumberer::fixupOSROnlyLoop(MBasicBl
MBasicBlock* fake = MBasicBlock::NewAsmJS(graph_, block->info(),
nullptr, MBasicBlock::NORMAL);
if (fake == nullptr)
return false;
graph_.insertBlockBefore(block, fake);
fake->setImmediateDominator(fake);
fake->addNumDominated(1);
+ fake->setDomIndex(fake->id());
// Create zero-input phis to use as inputs for any phis in |block|.
// Again, this is a little odd, but it's the least-odd thing we can do
// without significant complexity.
for (MPhiIterator iter(block->phisBegin()), end(block->phisEnd()); iter != end; ++iter) {
MPhi* phi = *iter;
MPhi* fakePhi = MPhi::New(graph_.alloc(), phi->type());
fake->addPhi(fakePhi);

103
gnu/packages/patches/icecat-CVE-2016-1952-pt06.patch
View File

@ -1,103 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/6f4d51302387
# HG changeset patch
# User Andrew McCreight <continuation@gmail.com>
# Date 1456273423 28800
# Node ID 6f4d5130238790fa5810c76ffeb9eccc65efa8c9
# Parent 70f6c59d9d73a5edefd216b48ca74a931da12cf1
Bug 1249685 - Use more nsCOMPtrs for stack variables in DOM code. r=smaug, a=ritu
diff --git a/dom/base/nsRange.cpp b/dom/base/nsRange.cpp
--- a/dom/base/nsRange.cpp
+++ b/dom/base/nsRange.cpp
@@ -1985,17 +1985,17 @@ nsRange::CutContents(DocumentFragment**
rv = closestAncestor ? PrependChild(closestAncestor, nodeToResult)
: PrependChild(commonCloneAncestor, nodeToResult);
NS_ENSURE_SUCCESS(rv, rv);
NS_ENSURE_STATE(!guard.Mutated(parent ? 2 : 1) ||
ValidateCurrentNode(this, iter));
} else if (nodeToResult) {
nsMutationGuard guard;
nsCOMPtr<nsINode> node = nodeToResult;
- nsINode* parent = node->GetParentNode();
+ nsCOMPtr<nsINode> parent = node->GetParentNode();
if (parent) {
mozilla::ErrorResult error;
parent->RemoveChild(*node, error);
NS_ENSURE_FALSE(error.Failed(), error.ErrorCode());
}
NS_ENSURE_STATE(!guard.Mutated(1) ||
ValidateCurrentNode(this, iter));
}
diff --git a/dom/base/nsTreeSanitizer.cpp b/dom/base/nsTreeSanitizer.cpp
--- a/dom/base/nsTreeSanitizer.cpp
+++ b/dom/base/nsTreeSanitizer.cpp
@@ -1423,18 +1423,18 @@ nsTreeSanitizer::SanitizeChildren(nsINod
mAllowStyles,
false);
}
node = node->GetNextNonChildNode(aRoot);
continue;
}
if (MustFlatten(ns, localName)) {
RemoveAllAttributes(node);
- nsIContent* next = node->GetNextNode(aRoot);
- nsIContent* parent = node->GetParent();
+ nsCOMPtr<nsIContent> next = node->GetNextNode(aRoot);
+ nsCOMPtr<nsIContent> parent = node->GetParent();
nsCOMPtr<nsIContent> child; // Must keep the child alive during move
ErrorResult rv;
while ((child = node->GetFirstChild())) {
parent->InsertBefore(*child, node, rv);
if (rv.Failed()) {
break;
}
}
diff --git a/dom/html/HTMLSelectElement.cpp b/dom/html/HTMLSelectElement.cpp
--- a/dom/html/HTMLSelectElement.cpp
+++ b/dom/html/HTMLSelectElement.cpp
@@ -624,17 +624,17 @@ HTMLSelectElement::Add(nsGenericHTMLElem
{
if (!aBefore) {
Element::AppendChild(aElement, aError);
return;
}
// Just in case we're not the parent, get the parent of the reference
// element
- nsINode* parent = aBefore->Element::GetParentNode();
+ nsCOMPtr<nsINode> parent = aBefore->Element::GetParentNode();
if (!parent || !nsContentUtils::ContentIsDescendantOf(parent, this)) {
// NOT_FOUND_ERR: Raised if before is not a descendant of the SELECT
// element.
aError.Throw(NS_ERROR_DOM_NOT_FOUND_ERR);
return;
}
// If the before parameter is not null, we are equivalent to the
diff --git a/dom/html/HTMLTableElement.cpp b/dom/html/HTMLTableElement.cpp
--- a/dom/html/HTMLTableElement.cpp
+++ b/dom/html/HTMLTableElement.cpp
@@ -516,18 +516,18 @@ HTMLTableElement::InsertRow(int32_t aInd
if (rowCount > 0) {
if (refIndex == rowCount || aIndex == -1) {
// we set refIndex to the last row so we can get the last row's
// parent we then do an AppendChild below if (rowCount<aIndex)
refIndex = rowCount - 1;
}
- Element* refRow = rows->Item(refIndex);
- nsINode* parent = refRow->GetParentNode();
+ RefPtr<Element> refRow = rows->Item(refIndex);
+ nsCOMPtr<nsINode> parent = refRow->GetParentNode();
// create the row
nsRefPtr<mozilla::dom::NodeInfo> nodeInfo;
nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tr,
getter_AddRefs(nodeInfo));
newRow = NS_NewHTMLTableRowElement(nodeInfo.forget());

32
gnu/packages/patches/icecat-CVE-2016-1954.patch
View File

@ -1,32 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/a5c4c18849b4
# HG changeset patch
# User Christoph Kerschbaumer <mozilla@christophkerschbaumer.com>
# Date 1456157874 28800
# Node ID a5c4c18849b486ef8693e20421b69239a2cbe574
# Parent e93aeb25e2a44df8d22f5a065b4410620e2c8730
Bug 1243178: CSP - Skip sending reports for non http schemes (r=dveditz) a=ritu
diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
--- a/dom/security/nsCSPContext.cpp
+++ b/dom/security/nsCSPContext.cpp
@@ -798,16 +798,17 @@ nsCSPContext::SendReports(nsISupports* a
(NS_SUCCEEDED(reportURI->SchemeIs("https", &isHttpScheme)) && isHttpScheme);
if (!isHttpScheme) {
const char16_t* params[] = { reportURIs[r].get() };
CSP_LogLocalizedStr(NS_LITERAL_STRING("reportURInotHttpsOrHttp2").get(),
params, ArrayLength(params),
aSourceFile, aScriptSample, aLineNum, 0,
nsIScriptError::errorFlag, "CSP", mInnerWindowID);
+ continue;
}
// make sure this is an anonymous request (no cookies) so in case the
// policy URI is injected, it can't be abused for CSRF.
nsLoadFlags flags;
rv = reportChannel->GetLoadFlags(&flags);
NS_ENSURE_SUCCESS(rv, rv);
flags |= nsIRequest::LOAD_ANONYMOUS;

55
gnu/packages/patches/icecat-CVE-2016-1960.patch
View File

@ -1,55 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/185b233ea03f
# HG changeset patch
# User Henri Sivonen <hsivonen@hsivonen.fi>
# Date 1455100746 -7200
# Node ID 185b233ea03f3811404e3979b65ec86b29d13555
# Parent 271e3a5a53d96871141e89271f611033b512e3e4
Bug 1246014. r=wchen. a=sylvestre
diff --git a/parser/html/javasrc/TreeBuilder.java b/parser/html/javasrc/TreeBuilder.java
--- a/parser/html/javasrc/TreeBuilder.java
+++ b/parser/html/javasrc/TreeBuilder.java
@@ -4437,17 +4437,17 @@ public abstract class TreeBuilder<T> imp
return TreeBuilder.NOT_FOUND_ON_STACK;
}
private void clearStackBackTo(int eltPos) throws SAXException {
int eltGroup = stack[eltPos].getGroup();
while (currentPtr > eltPos) { // > not >= intentional
if (stack[currentPtr].ns == "http://www.w3.org/1999/xhtml"
&& stack[currentPtr].getGroup() == TEMPLATE
- && (eltGroup == TABLE || eltGroup == TBODY_OR_THEAD_OR_TFOOT|| eltGroup == TR || eltGroup == HTML)) {
+ && (eltGroup == TABLE || eltGroup == TBODY_OR_THEAD_OR_TFOOT|| eltGroup == TR || eltPos == 0)) {
return;
}
pop();
}
}
private void resetTheInsertionMode() {
StackNode<T> node;
diff --git a/parser/html/nsHtml5TreeBuilder.cpp b/parser/html/nsHtml5TreeBuilder.cpp
--- a/parser/html/nsHtml5TreeBuilder.cpp
+++ b/parser/html/nsHtml5TreeBuilder.cpp
@@ -3301,17 +3301,17 @@ nsHtml5TreeBuilder::findLastInTableScope
return NS_HTML5TREE_BUILDER_NOT_FOUND_ON_STACK;
}
void
nsHtml5TreeBuilder::clearStackBackTo(int32_t eltPos)
{
int32_t eltGroup = stack[eltPos]->getGroup();
while (currentPtr > eltPos) {
- if (stack[currentPtr]->ns == kNameSpaceID_XHTML && stack[currentPtr]->getGroup() == NS_HTML5TREE_BUILDER_TEMPLATE && (eltGroup == NS_HTML5TREE_BUILDER_TABLE || eltGroup == NS_HTML5TREE_BUILDER_TBODY_OR_THEAD_OR_TFOOT || eltGroup == NS_HTML5TREE_BUILDER_TR || eltGroup == NS_HTML5TREE_BUILDER_HTML)) {
+ if (stack[currentPtr]->ns == kNameSpaceID_XHTML && stack[currentPtr]->getGroup() == NS_HTML5TREE_BUILDER_TEMPLATE && (eltGroup == NS_HTML5TREE_BUILDER_TABLE || eltGroup == NS_HTML5TREE_BUILDER_TBODY_OR_THEAD_OR_TFOOT || eltGroup == NS_HTML5TREE_BUILDER_TR || !eltPos)) {
return;
}
pop();
}
}
void
nsHtml5TreeBuilder::resetTheInsertionMode()

33
gnu/packages/patches/icecat-CVE-2016-1961.patch
View File

@ -1,33 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/e93aeb25e2a4
# HG changeset patch
# User Andrew McCreight <continuation@gmail.com>
# Date 1455891967 28800
# Node ID e93aeb25e2a44df8d22f5a065b4410620e2c8730
# Parent 221de852fda32714a9e484774ceafafb450ea73c
Bug 1249377 - Hold a strong reference to |root| in nsHTMLDocument::SetBody. r=bz, a=sylvestre
diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -1044,17 +1044,17 @@ nsHTMLDocument::SetBody(nsIDOMHTMLElemen
ErrorResult rv;
SetBody(static_cast<nsGenericHTMLElement*>(newBody.get()), rv);
return rv.ErrorCode();
}
void
nsHTMLDocument::SetBody(nsGenericHTMLElement* newBody, ErrorResult& rv)
{
- Element* root = GetRootElement();
+ nsCOMPtr<Element> root = GetRootElement();
// The body element must be either a body tag or a frameset tag. And we must
// have a html root tag, otherwise GetBody will not return the newly set
// body.
if (!newBody || !(newBody->Tag() == nsGkAtoms::body ||
newBody->Tag() == nsGkAtoms::frameset) ||
!root || !root->IsHTML() ||
root->Tag() != nsGkAtoms::html) {

107
gnu/packages/patches/icecat-CVE-2016-1962.patch
View File

@ -1,107 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/221de852fda3
# HG changeset patch
# User Randell Jesup <rjesup@jesup.org>
# Date 1455862087 18000
# Node ID 221de852fda32714a9e484774ceafafb450ea73c
# Parent b03db72e32f6e3acdc9f8705371cb222d7e6c456
Bug 1240760: Update DataChannel::Close() r=mcmanus, a=ritu
MozReview-Commit-ID: 7nN9h3M3O8w
diff --git a/netwerk/sctp/datachannel/DataChannel.cpp b/netwerk/sctp/datachannel/DataChannel.cpp
--- a/netwerk/sctp/datachannel/DataChannel.cpp
+++ b/netwerk/sctp/datachannel/DataChannel.cpp
@@ -1771,17 +1771,17 @@ DataChannelConnection::HandleStreamReset
}
NS_DispatchToMainThread(new DataChannelOnMessageAvailable(
DataChannelOnMessageAvailable::ON_CHANNEL_CLOSED, this,
channel));
mStreams[channel->mStream] = nullptr;
LOG(("Disconnected DataChannel %p from connection %p",
(void *) channel.get(), (void *) channel->mConnection.get()));
- channel->Destroy();
+ channel->DestroyLocked();
// At this point when we leave here, the object is a zombie held alive only by the DOM object
} else {
LOG(("Can't find incoming channel %d",i));
}
}
}
}
@@ -2498,17 +2498,17 @@ DataChannelConnection::CloseInt(DataChan
mStreams[channel->mStream] = nullptr;
} else {
SendOutgoingStreamReset();
}
}
aChannel->mState = CLOSING;
if (mState == CLOSED) {
// we're not going to hang around waiting
- channel->Destroy();
+ channel->DestroyLocked();
}
// At this point when we leave here, the object is a zombie held alive only by the DOM object
}
void DataChannelConnection::CloseAll()
{
LOG(("Closing all channels (connection %p)", (void*) this));
// Don't need to lock here
@@ -2552,23 +2552,25 @@ DataChannel::~DataChannel()
// wrong, nothing bad happens. A worst it's a leak.
NS_ASSERTION(mState == CLOSED || mState == CLOSING, "unexpected state in ~DataChannel");
}
void
DataChannel::Close()
{
ENSURE_DATACONNECTION;
+ RefPtr<DataChannelConnection> connection(mConnection);
mConnection->Close(this);
}
// Used when disconnecting from the DataChannelConnection
void
-DataChannel::Destroy()
+DataChannel::DestroyLocked()
{
+ mConnection->mLock.AssertCurrentThreadOwns();
ENSURE_DATACONNECTION;
LOG(("Destroying Data channel %u", mStream));
MOZ_ASSERT_IF(mStream != INVALID_STREAM,
!mConnection->FindChannelByStream(mStream));
mStream = INVALID_STREAM;
mState = CLOSED;
mConnection = nullptr;
diff --git a/netwerk/sctp/datachannel/DataChannel.h b/netwerk/sctp/datachannel/DataChannel.h
--- a/netwerk/sctp/datachannel/DataChannel.h
+++ b/netwerk/sctp/datachannel/DataChannel.h
@@ -331,19 +331,20 @@ public:
{
NS_ASSERTION(mConnection,"NULL connection");
}
private:
~DataChannel();
public:
- void Destroy(); // when we disconnect from the connection after stream RESET
+ NS_INLINE_DECL_THREADSAFE_REFCOUNTING(DataChannel)
- NS_INLINE_DECL_THREADSAFE_REFCOUNTING(DataChannel)
+ // when we disconnect from the connection after stream RESET
+ void DestroyLocked();
// Close this DataChannel. Can be called multiple times. MUST be called
// before destroying the DataChannel (state must be CLOSED or CLOSING).
void Close();
// Set the listener (especially for channels created from the other side)
void SetListener(DataChannelListener *aListener, nsISupports *aContext);

54
gnu/packages/patches/icecat-CVE-2016-1964.patch
View File

@ -1,54 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/a653013e7b50
# HG changeset patch
# User Peter Van der Beken <peterv@propagandism.org>
# Date 1454340035 -3600
# Node ID a653013e7b503912a32621e8da64a37171316588
# Parent 0d0d7e8292f7ecf5f1149d528c0524f04447c4ad
Bug 1243335 - report bad QName. r=sicking, a=sylvestre
diff --git a/dom/xslt/xslt/txInstructions.cpp b/dom/xslt/xslt/txInstructions.cpp
--- a/dom/xslt/xslt/txInstructions.cpp
+++ b/dom/xslt/xslt/txInstructions.cpp
@@ -93,16 +93,19 @@ txAttribute::txAttribute(nsAutoPtr<Expr>
txNamespaceMap* aMappings)
: mName(Move(aName)), mNamespace(Move(aNamespace)), mMappings(aMappings)
{
}
nsresult
txAttribute::execute(txExecutionState& aEs)
{
+ nsAutoPtr<txTextHandler> handler(
+ static_cast<txTextHandler*>(aEs.popResultHandler()));
+
nsAutoString name;
nsresult rv = mName->evaluateToString(aEs.getEvalContext(), name);
NS_ENSURE_SUCCESS(rv, rv);
const char16_t* colon;
if (!XMLUtils::isValidQName(name, &colon) ||
TX_StringEqualsAtom(name, nsGkAtoms::xmlns)) {
return NS_OK;
@@ -125,19 +128,16 @@ txAttribute::execute(txExecutionState& a
if (!nspace.IsEmpty()) {
nsId = txNamespaceManager::getNamespaceID(nspace);
}
}
else if (colon) {
nsId = mMappings->lookupNamespace(prefix);
}
- nsAutoPtr<txTextHandler> handler(
- static_cast<txTextHandler*>(aEs.popResultHandler()));
-
// add attribute if everything was ok
return nsId != kNameSpaceID_Unknown ?
aEs.mResultHandler->attribute(prefix, Substring(name, lnameStart),
nsId, handler->mValue) :
NS_OK;
}
txCallTemplate::txCallTemplate(const txExpandedName& aName)

44
gnu/packages/patches/icecat-CVE-2016-1965.patch
View File

@ -1,44 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/b4467681abd6
# HG changeset patch
# User Gijs Kruitbosch <gijskruitbosch@gmail.com>
# Date 1455276061 0
# Node ID b4467681abd676cd5575cbdf922927f8f54d2ad9
# Parent 8c1d40e45a72c6432e879137a0afa519dc6c9841
Bug 1245264 - r=bz, r=ritu
MozReview-Commit-ID: I0sVdritpD3
diff --git a/dom/base/nsLocation.cpp b/dom/base/nsLocation.cpp
--- a/dom/base/nsLocation.cpp
+++ b/dom/base/nsLocation.cpp
@@ -735,16 +735,27 @@ nsLocation::SetProtocol(const nsAString&
return rv;
}
rv = uri->SetScheme(NS_ConvertUTF16toUTF8(aProtocol));
if (NS_WARN_IF(NS_FAILED(rv))) {
return rv;
}
+ nsAutoCString newSpec;
+ rv = uri->GetSpec(newSpec);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+ // We may want a new URI class for the new URI, so recreate it:
+ rv = NS_NewURI(getter_AddRefs(uri), newSpec);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
return SetURI(uri);
}
void
nsLocation::GetUsername(nsAString& aUsername, ErrorResult& aError)
{
if (!CallerSubsumes()) {
aError.Throw(NS_ERROR_DOM_SECURITY_ERR);

36
gnu/packages/patches/icecat-CVE-2016-1966.patch
View File

@ -1,36 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/291c2f31c48c
# HG changeset patch
# User Nicholas Nethercote <nnethercote@mozilla.com>
# Date 1454650565 -39600
# Node ID 291c2f31c48c7e96b1884b55273355970fa0fc30
# Parent 11e6614756551cfd7291e73eefb90c52873a8480
Bug 1246054 - Fix an erroneous nsNPObjWrapper assertion. r=froydnj. a=ritu
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -1915,18 +1915,19 @@ nsNPObjWrapper::GetNewOrUsed(NPP npp, JS
// No existing JSObject, create one.
JS::Rooted<JSObject*> obj(cx, ::JS_NewObject(cx, js::Jsvalify(&sNPObjectJSWrapperClass)));
if (generation != sNPObjWrappers.Generation()) {
// Reload entry if the JS_NewObject call caused a GC and reallocated
// the table (see bug 445229). This is guaranteed to succeed.
- NS_ASSERTION(PL_DHashTableSearch(&sNPObjWrappers, npobj),
- "Hashtable didn't find what we just added?");
+ entry = static_cast<NPObjWrapperHashEntry*>
+ (PL_DHashTableSearch(&sNPObjWrappers, npobj));
+ NS_ASSERTION(entry, "Hashtable didn't find what we just added?");
}
if (!obj) {
// OOM? Remove the stale entry from the hash.
PL_DHashTableRawRemove(&sNPObjWrappers, entry);
return nullptr;

530
gnu/packages/patches/icecat-CVE-2016-1974.patch
View File

@ -1,530 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/271e3a5a53d9
# HG changeset patch
# User Henri Sivonen <hsivonen@hsivonen.fi>
# Date 1455014759 -7200
# Node ID 271e3a5a53d96871141e89271f611033b512e3e4
# Parent 9719b71d72dd2a3c5ee12ace156af2a63d9595ac
Bug 1228103. r=smaug. a=sylvestre
diff --git a/parser/htmlparser/nsExpatDriver.cpp b/parser/htmlparser/nsExpatDriver.cpp
--- a/parser/htmlparser/nsExpatDriver.cpp
+++ b/parser/htmlparser/nsExpatDriver.cpp
@@ -1127,22 +1127,28 @@ nsExpatDriver::ConsumeToken(nsScanner& a
XML_Size lastLineLength = XML_GetCurrentColumnNumber(mExpatParser);
if (lastLineLength <= consumed) {
// The length of the last line was less than what expat consumed, so
// there was at least one line break in the consumed data. Store the
// last line until the point where we stopped parsing.
nsScannerIterator startLastLine = currentExpatPosition;
startLastLine.advance(-((ptrdiff_t)lastLineLength));
- CopyUnicodeTo(startLastLine, currentExpatPosition, mLastLine);
+ if (!CopyUnicodeTo(startLastLine, currentExpatPosition, mLastLine)) {
+ return (mInternalState = NS_ERROR_OUT_OF_MEMORY);
+ }
}
else {
// There was no line break in the consumed data, append the consumed
// data.
- AppendUnicodeTo(oldExpatPosition, currentExpatPosition, mLastLine);
+ if (!AppendUnicodeTo(oldExpatPosition,
+ currentExpatPosition,
+ mLastLine)) {
+ return (mInternalState = NS_ERROR_OUT_OF_MEMORY);
+ }
}
}
mExpatBuffered += length - consumed;
if (BlockedOrInterrupted()) {
PR_LOG(GetExpatDriverLog(), PR_LOG_DEBUG,
("Blocked or interrupted parser (probably for loading linked "
diff --git a/parser/htmlparser/nsParser.cpp b/parser/htmlparser/nsParser.cpp
--- a/parser/htmlparser/nsParser.cpp
+++ b/parser/htmlparser/nsParser.cpp
@@ -1508,17 +1508,19 @@ nsParser::ResumeParse(bool allowIteratio
DidBuildModel(mStreamStatus);
return NS_OK;
}
} else {
CParserContext* theContext = PopContext();
if (theContext) {
theIterationIsOk = allowIteration && theContextIsStringBased;
if (theContext->mCopyUnused) {
- theContext->mScanner->CopyUnusedData(mUnusedInput);
+ if (!theContext->mScanner->CopyUnusedData(mUnusedInput)) {
+ mInternalState = NS_ERROR_OUT_OF_MEMORY;
+ }
}
delete theContext;
}
result = mInternalState;
aIsFinalChunk = mParserContext &&
mParserContext->mStreamListenerState == eOnStop;
diff --git a/parser/htmlparser/nsScanner.cpp b/parser/htmlparser/nsScanner.cpp
--- a/parser/htmlparser/nsScanner.cpp
+++ b/parser/htmlparser/nsScanner.cpp
@@ -379,17 +379,19 @@ nsresult nsScanner::Peek(nsAString& aStr
if (mCountRemaining < uint32_t(aNumChars + aOffset)) {
end = mEndPosition;
}
else {
end = start;
end.advance(aNumChars);
}
- CopyUnicodeTo(start, end, aStr);
+ if (!CopyUnicodeTo(start, end, aStr)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
return NS_OK;
}
/**
* Skip whitespace on scanner input stream
*
@@ -542,17 +544,19 @@ nsresult nsScanner::ReadTagIdentifier(ns
if (!found) {
++current;
}
}
// Don't bother appending nothing.
if (current != mCurrentPosition) {
- AppendUnicodeTo(mCurrentPosition, current, aString);
+ if (!AppendUnicodeTo(mCurrentPosition, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
}
SetPosition(current);
if (current == end) {
result = kEOF;
}
//DoErrTest(aString);
@@ -597,26 +601,30 @@ nsresult nsScanner::ReadEntityIdentifier
default:
found = ('a'<=theChar && theChar<='z') ||
('A'<=theChar && theChar<='Z') ||
('0'<=theChar && theChar<='9');
break;
}
if(!found) {
- AppendUnicodeTo(mCurrentPosition, current, aString);
+ if (!AppendUnicodeTo(mCurrentPosition, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
break;
}
}
++current;
}
SetPosition(current);
if (current == end) {
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
return kEOF;
}
//DoErrTest(aString);
return result;
}
@@ -646,26 +654,30 @@ nsresult nsScanner::ReadNumber(nsString&
while(current != end) {
theChar=*current;
if(theChar) {
done = (theChar < '0' || theChar > '9') &&
((aBase == 16)? (theChar < 'A' || theChar > 'F') &&
(theChar < 'a' || theChar > 'f')
:true);
if(done) {
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
break;
}
}
++current;
}
SetPosition(current);
if (current == end) {
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
return kEOF;
}
//DoErrTest(aString);
return result;
}
@@ -712,37 +724,43 @@ nsresult nsScanner::ReadWhitespace(nsSca
char16_t thePrevChar = theChar;
theChar = (++current != end) ? *current : '\0';
if ((thePrevChar == '\r' && theChar == '\n') ||
(thePrevChar == '\n' && theChar == '\r')) {
theChar = (++current != end) ? *current : '\0'; // CRLF == LFCR => LF
haveCR = true;
} else if (thePrevChar == '\r') {
// Lone CR becomes CRLF; callers should know to remove extra CRs
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
aString.writable().Append(char16_t('\n'));
origin = current;
haveCR = true;
}
}
break;
case ' ' :
case '\t':
theChar = (++current != end) ? *current : '\0';
break;
default:
done = true;
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
break;
}
}
SetPosition(current);
if (current == end) {
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
result = kEOF;
}
aHaveCR = haveCR;
return result;
}
//XXXbz callers of this have to manage their lone '\r' themselves if they want
@@ -846,34 +864,38 @@ nsresult nsScanner::ReadUntil(nsAString&
if(!(theChar & aEndCondition.mFilter)) {
// They were. Do a thorough check.
setcurrent = setstart;
while (*setcurrent) {
if (*setcurrent == theChar) {
if(addTerminal)
++current;
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
SetPosition(current);
//DoErrTest(aString);
return NS_OK;
}
++setcurrent;
}
}
++current;
}
// If we are here, we didn't find any terminator in the string and
// current = mEndPosition
SetPosition(current);
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
return kEOF;
}
nsresult nsScanner::ReadUntil(nsScannerSharedSubstring& aString,
const nsReadEndCondition& aEndCondition,
bool addTerminal)
{
if (!mSlidingBuffer) {
@@ -906,34 +928,38 @@ nsresult nsScanner::ReadUntil(nsScannerS
if(!(theChar & aEndCondition.mFilter)) {
// They were. Do a thorough check.
setcurrent = setstart;
while (*setcurrent) {
if (*setcurrent == theChar) {
if(addTerminal)
++current;
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
SetPosition(current);
//DoErrTest(aString);
return NS_OK;
}
++setcurrent;
}
}
++current;
}
// If we are here, we didn't find any terminator in the string and
// current = mEndPosition
SetPosition(current);
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
return kEOF;
}
nsresult nsScanner::ReadUntil(nsScannerIterator& aStart,
nsScannerIterator& aEnd,
const nsReadEndCondition &aEndCondition,
bool addTerminal)
{
@@ -1025,26 +1051,30 @@ nsresult nsScanner::ReadUntil(nsAString&
if (theChar == '\0') {
ReplaceCharacter(current, sInvalid);
theChar = sInvalid;
}
if (aTerminalChar == theChar) {
if(addTerminal)
++current;
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
SetPosition(current);
return NS_OK;
}
++current;
}
// If we are here, we didn't find any terminator in the string and
// current = mEndPosition
- AppendUnicodeTo(origin, current, aString);
+ if (!AppendUnicodeTo(origin, current, aString)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
SetPosition(current);
return kEOF;
}
void nsScanner::BindSubstring(nsScannerSubstring& aSubstring, const nsScannerIterator& aStart, const nsScannerIterator& aEnd)
{
aSubstring.Rebind(*mSlidingBuffer, aStart, aEnd);
@@ -1142,29 +1172,29 @@ bool nsScanner::AppendToBuffer(nsScanner
}
/**
* call this to copy bytes out of the scanner that have not yet been consumed
* by the tokenization process.
*
* @update gess 5/12/98
* @param aCopyBuffer is where the scanner buffer will be copied to
- * @return nada
+ * @return true if OK or false on OOM
*/
-void nsScanner::CopyUnusedData(nsString& aCopyBuffer) {
+bool nsScanner::CopyUnusedData(nsString& aCopyBuffer) {
if (!mSlidingBuffer) {
aCopyBuffer.Truncate();
- return;
+ return true;
}
nsScannerIterator start, end;
start = mCurrentPosition;
end = mEndPosition;
- CopyUnicodeTo(start, end, aCopyBuffer);
+ return CopyUnicodeTo(start, end, aCopyBuffer);
}
/**
* Retrieve the name of the file that the scanner is reading from.
* In some cases, it's just a given name, because the scanner isn't
* really reading from a file.
*
* @update gess 5/12/98
diff --git a/parser/htmlparser/nsScanner.h b/parser/htmlparser/nsScanner.h
--- a/parser/htmlparser/nsScanner.h
+++ b/parser/htmlparser/nsScanner.h
@@ -204,19 +204,19 @@ class nsScanner {
nsIRequest *aRequest);
/**
* Call this to copy bytes out of the scanner that have not yet been consumed
* by the tokenization process.
*
* @update gess 5/12/98
* @param aCopyBuffer is where the scanner buffer will be copied to
- * @return nada
+ * @return true if OK or false on OOM
*/
- void CopyUnusedData(nsString& aCopyBuffer);
+ bool CopyUnusedData(nsString& aCopyBuffer);
/**
* Retrieve the name of the file that the scanner is reading from.
* In some cases, it's just a given name, because the scanner isn't
* really reading from a file.
*
* @update gess 5/12/98
* @return
diff --git a/parser/htmlparser/nsScannerString.cpp b/parser/htmlparser/nsScannerString.cpp
--- a/parser/htmlparser/nsScannerString.cpp
+++ b/parser/htmlparser/nsScannerString.cpp
@@ -461,61 +461,63 @@ copy_multifragment_string( nsScannerIter
sink_traits::write(result, source_traits::read(first), distance);
NS_ASSERTION(distance > 0, "|copy_multifragment_string| will never terminate");
source_traits::advance(first, distance);
}
return result;
}
-void
+bool
CopyUnicodeTo( const nsScannerIterator& aSrcStart,
const nsScannerIterator& aSrcEnd,
nsAString& aDest )
{
nsAString::iterator writer;
if (!aDest.SetLength(Distance(aSrcStart, aSrcEnd), mozilla::fallible)) {
aDest.Truncate();
- return; // out of memory
+ return false; // out of memory
}
aDest.BeginWriting(writer);
nsScannerIterator fromBegin(aSrcStart);
copy_multifragment_string(fromBegin, aSrcEnd, writer);
+ return true;
}
-void
+bool
AppendUnicodeTo( const nsScannerIterator& aSrcStart,
const nsScannerIterator& aSrcEnd,
nsScannerSharedSubstring& aDest )
{
// Check whether we can just create a dependent string.
if (aDest.str().IsEmpty()) {
// We can just make |aDest| point to the buffer.
// This will take care of copying if the buffer spans fragments.
aDest.Rebind(aSrcStart, aSrcEnd);
- } else {
- // The dest string is not empty, so it can't be a dependent substring.
- AppendUnicodeTo(aSrcStart, aSrcEnd, aDest.writable());
+ return true;
}
+ // The dest string is not empty, so it can't be a dependent substring.
+ return AppendUnicodeTo(aSrcStart, aSrcEnd, aDest.writable());
}
-void
+bool
AppendUnicodeTo( const nsScannerIterator& aSrcStart,
const nsScannerIterator& aSrcEnd,
nsAString& aDest )
{
nsAString::iterator writer;
uint32_t oldLength = aDest.Length();
if (!aDest.SetLength(oldLength + Distance(aSrcStart, aSrcEnd), mozilla::fallible))
- return; // out of memory
+ return false; // out of memory
aDest.BeginWriting(writer).advance(oldLength);
nsScannerIterator fromBegin(aSrcStart);
copy_multifragment_string(fromBegin, aSrcEnd, writer);
+ return true;
}
bool
FindCharInReadable( char16_t aChar,
nsScannerIterator& aSearchStart,
const nsScannerIterator& aSearchEnd )
{
while ( aSearchStart != aSearchEnd )
diff --git a/parser/htmlparser/nsScannerString.h b/parser/htmlparser/nsScannerString.h
--- a/parser/htmlparser/nsScannerString.h
+++ b/parser/htmlparser/nsScannerString.h
@@ -539,43 +539,43 @@ nsScannerBufferList::Position::operator=
inline
size_t
Distance( const nsScannerIterator& aStart, const nsScannerIterator& aEnd )
{
typedef nsScannerBufferList::Position Position;
return Position::Distance(Position(aStart), Position(aEnd));
}
-void
+bool
CopyUnicodeTo( const nsScannerIterator& aSrcStart,
const nsScannerIterator& aSrcEnd,
nsAString& aDest );
inline
-void
+bool
CopyUnicodeTo( const nsScannerSubstring& aSrc, nsAString& aDest )
{
nsScannerIterator begin, end;
- CopyUnicodeTo(aSrc.BeginReading(begin), aSrc.EndReading(end), aDest);
+ return CopyUnicodeTo(aSrc.BeginReading(begin), aSrc.EndReading(end), aDest);
}
-void
+bool
AppendUnicodeTo( const nsScannerIterator& aSrcStart,
const nsScannerIterator& aSrcEnd,
nsAString& aDest );
inline
-void
+bool
AppendUnicodeTo( const nsScannerSubstring& aSrc, nsAString& aDest )
{
nsScannerIterator begin, end;
- AppendUnicodeTo(aSrc.BeginReading(begin), aSrc.EndReading(end), aDest);
+ return AppendUnicodeTo(aSrc.BeginReading(begin), aSrc.EndReading(end), aDest);
}
-void
+bool
AppendUnicodeTo( const nsScannerIterator& aSrcStart,
const nsScannerIterator& aSrcEnd,
nsScannerSharedSubstring& aDest );
bool
FindCharInReadable( char16_t aChar,
nsScannerIterator& aStart,
const nsScannerIterator& aEnd );

37
gnu/packages/patches/icecat-bug-1248851.patch
View File

@ -1,37 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/8c1d40e45a72
# HG changeset patch
# User Xidorn Quan <quanxunzhen@gmail.com>
# Date 1456199544 -28800
# Node ID 8c1d40e45a72c6432e879137a0afa519dc6c9841
# Parent 1dd0ca8e70bd77b6fd93f36cc4e9c2cebfe8ba0a
Bug 1248851 - r=sicking, a=ritu
diff --git a/dom/indexedDB/ActorsParent.cpp b/dom/indexedDB/ActorsParent.cpp
--- a/dom/indexedDB/ActorsParent.cpp
+++ b/dom/indexedDB/ActorsParent.cpp
@@ -14823,22 +14823,19 @@ ObjectStoreAddOrPutRequestOp::DoDatabase
}
snappy::RawCompress(uncompressed, uncompressedLength, compressed,
&compressedLength);
uint8_t* dataBuffer = reinterpret_cast<uint8_t*>(compressed);
size_t dataBufferLength = compressedLength;
- // If this call succeeds, | compressed | is now owned by the statement, and
- // we are no longer responsible for it.
rv = stmt->BindAdoptedBlobByName(NS_LITERAL_CSTRING("data"), dataBuffer,
dataBufferLength);
if (NS_WARN_IF(NS_FAILED(rv))) {
- moz_free(compressed);
return rv;
}
}
nsCOMPtr<nsIFile> fileDirectory;
nsCOMPtr<nsIFile> journalDirectory;
if (mFileManager) {

861
gnu/packages/patches/icecat-update-graphite2-pt2.patch
View File

@ -1,861 +0,0 @@
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/ec9cff7bb543
# HG changeset patch
# User Jonathan Kew <jkew@mozilla.com>
# Date 1456760339 0
# Node ID ec9cff7bb5439b2b4c1249ff9376d07a80172c27
# Parent 6f4d5130238790fa5810c76ffeb9eccc65efa8c9
Bug 1248876 - Update graphite2 to upstream release 1.3.6. r=jrmuizel a=sledru
diff --git a/gfx/graphite2/README.mozilla b/gfx/graphite2/README.mozilla
--- a/gfx/graphite2/README.mozilla
+++ b/gfx/graphite2/README.mozilla
@@ -1,7 +1,3 @@
-This directory contains the Graphite2 library release 1.3.5 from
-https://github.com/silnrsi/graphite/releases/download/1.3.5/graphite2-minimal-1.3.5.tgz
+This directory contains the Graphite2 library release 1.3.6 from
+https://github.com/silnrsi/graphite/releases/download/1.3.6/graphite-minimal-1.3.6.tgz
See gfx/graphite2/moz-gr-update.sh for update procedure.
-
-Also includes two post-1.3.5 fixes:
-a8b3ac2aed0eb132cd80efe7de88f8153e73c829
-e569e28d83491fedb31b9220493f3c07f6ec6d80
diff --git a/gfx/graphite2/include/graphite2/Font.h b/gfx/graphite2/include/graphite2/Font.h
--- a/gfx/graphite2/include/graphite2/Font.h
+++ b/gfx/graphite2/include/graphite2/Font.h
@@ -25,17 +25,17 @@
either version 2 of the License or (at your option) any later version.
*/
#pragma once
#include "graphite2/Types.h"
#define GR2_VERSION_MAJOR 1
#define GR2_VERSION_MINOR 3
-#define GR2_VERSION_BUGFIX 5
+#define GR2_VERSION_BUGFIX 6
#ifdef __cplusplus
extern "C"
{
#endif
typedef struct gr_face gr_face;
typedef struct gr_font gr_font;
diff --git a/gfx/graphite2/moz-gr-update.sh b/gfx/graphite2/moz-gr-update.sh
--- a/gfx/graphite2/moz-gr-update.sh
+++ b/gfx/graphite2/moz-gr-update.sh
@@ -14,17 +14,17 @@
RELEASE=$1
if [ "x$RELEASE" == "x" ]
then
echo "Must provide the version number to be used."
exit 1
fi
-TARBALL="https://github.com/silnrsi/graphite/releases/download/$RELEASE/graphite2-minimal-$RELEASE.tgz"
+TARBALL="https://github.com/silnrsi/graphite/releases/download/$RELEASE/graphite-minimal-$RELEASE.tgz"
foo=`basename $0`
TMPFILE=`mktemp -t ${foo}` || exit 1
curl -L "$TARBALL" -o "$TMPFILE"
tar -x -z -C gfx/graphite2/ --strip-components 1 -f "$TMPFILE" || exit 1
rm "$TMPFILE"
diff --git a/gfx/graphite2/src/CmapCache.cpp b/gfx/graphite2/src/CmapCache.cpp
--- a/gfx/graphite2/src/CmapCache.cpp
+++ b/gfx/graphite2/src/CmapCache.cpp
@@ -33,43 +33,43 @@ of the License or (at your option) any l
using namespace graphite2;
const void * bmp_subtable(const Face::Table & cmap)
{
const void * stbl;
if (!cmap.size()) return 0;
- if (TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 1, cmap.size()), cmap.size())
- || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 3, cmap.size()), cmap.size())
- || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 2, cmap.size()), cmap.size())
- || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 1, cmap.size()), cmap.size())
- || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 0, cmap.size()), cmap.size()))
+ if (TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 1, cmap.size()), cmap + cmap.size())
+ || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 3, cmap.size()), cmap + cmap.size())
+ || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 2, cmap.size()), cmap + cmap.size())
+ || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 1, cmap.size()), cmap + cmap.size())
+ || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 0, cmap.size()), cmap + cmap.size()))
return stbl;
return 0;
}
const void * smp_subtable(const Face::Table & cmap)
{
const void * stbl;
if (!cmap.size()) return 0;
- if (TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 10, cmap.size()), cmap.size())
- || TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 4, cmap.size()), cmap.size()))
+ if (TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 10, cmap.size()), cmap + cmap.size())
+ || TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 4, cmap.size()), cmap + cmap.size()))
return stbl;
return 0;
}
template <unsigned int (*NextCodePoint)(const void *, unsigned int, int *),
uint16 (*LookupCodePoint)(const void *, unsigned int, int)>
bool cache_subtable(uint16 * blocks[], const void * cst, const unsigned int limit)
{
int rangeKey = 0;
uint32 codePoint = NextCodePoint(cst, 0, &rangeKey),
prevCodePoint = 0;
- while (codePoint != limit)
+ while (codePoint < limit)
{
unsigned int block = codePoint >> 8;
if (!blocks[block])
{
blocks[block] = grzeroalloc<uint16>(0x100);
if (!blocks[block])
return false;
}
diff --git a/gfx/graphite2/src/Code.cpp b/gfx/graphite2/src/Code.cpp
--- a/gfx/graphite2/src/Code.cpp
+++ b/gfx/graphite2/src/Code.cpp
@@ -79,18 +79,19 @@ struct context
class Machine::Code::decoder
{
public:
struct limits;
struct analysis
{
+ static const int NUMCONTEXTS = 256;
uint8 slotref;
- context contexts[256];
+ context contexts[NUMCONTEXTS];
byte max_ref;
analysis() : slotref(0), max_ref(0) {};
void set_ref(int index, bool incinsert=false) throw();
void set_noref(int index) throw();
void set_changed(int index) throw();
};
@@ -363,29 +364,33 @@ opcode Machine::Code::decoder::fetch_opc
break;
case ATTR_SET :
case ATTR_ADD :
case ATTR_SUB :
case ATTR_SET_SLOT :
if (--_stack_depth < 0)
failure(underfull_stack);
valid_upto(gr_slatMax, bc[0]);
+ if (attrCode(bc[0]) == gr_slatUserDefn) // use IATTR for user attributes
+ failure(out_of_range_data);
test_context();
break;
case IATTR_SET_SLOT :
if (--_stack_depth < 0)
failure(underfull_stack);
if (valid_upto(gr_slatMax, bc[0]))
valid_upto(_max.attrid[bc[0]], bc[1]);
test_context();
break;
case PUSH_SLOT_ATTR :
++_stack_depth;
valid_upto(gr_slatMax, bc[0]);
valid_upto(_rule_length, _pre_context + int8(bc[1]));
+ if (attrCode(bc[0]) == gr_slatUserDefn) // use IATTR for user attributes
+ failure(out_of_range_data);
break;
case PUSH_GLYPH_ATTR_OBS :
++_stack_depth;
valid_upto(_max.glyf_attrs, bc[0]);
valid_upto(_rule_length, _pre_context + int8(bc[1]));
break;
case PUSH_GLYPH_METRIC :
++_stack_depth;
@@ -656,24 +661,24 @@ bool Machine::Code::decoder::validate_op
return false;
}
return true;
}
bool Machine::Code::decoder::valid_upto(const uint16 limit, const uint16 x) const throw()
{
- const bool t = x < limit;
+ const bool t = (limit != 0) && (x < limit);
if (!t) failure(out_of_range_data);
return t;
}
bool Machine::Code::decoder::test_context() const throw()
{
- if (_pre_context >= _rule_length)
+ if (_pre_context >= _rule_length || _analysis.slotref >= analysis::NUMCONTEXTS - 1)
{
failure(out_of_range_data);
return false;
}
return true;
}
inline
@@ -681,34 +686,34 @@ void Machine::Code::failure(const status
release_buffers();
_status = s;
}
inline
void Machine::Code::decoder::analysis::set_ref(int index, bool incinsert) throw() {
if (incinsert && contexts[slotref].flags.inserted) --index;
- if (index + slotref < 0) return;
+ if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
contexts[index + slotref].flags.referenced = true;
if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
}
inline
void Machine::Code::decoder::analysis::set_noref(int index) throw() {
if (contexts[slotref].flags.inserted) --index;
- if (index + slotref < 0) return;
+ if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
}
inline
void Machine::Code::decoder::analysis::set_changed(int index) throw() {
if (contexts[slotref].flags.inserted) --index;
- if (index + slotref < 0) return;
+ if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
contexts[index + slotref].flags.changed = true;
if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
}
void Machine::Code::release_buffers() throw()
{
if (_own)
diff --git a/gfx/graphite2/src/GlyphCache.cpp b/gfx/graphite2/src/GlyphCache.cpp
--- a/gfx/graphite2/src/GlyphCache.cpp
+++ b/gfx/graphite2/src/GlyphCache.cpp
@@ -260,17 +260,17 @@ GlyphCache::Loader::Loader(const Face &
_head = Face::Table();
return;
}
if (!dumb_font)
{
if ((m_pGlat = Face::Table(face, Tag::Glat, 0x00030000)) == NULL
|| (m_pGloc = Face::Table(face, Tag::Gloc)) == NULL
- || m_pGloc.size() < 6)
+ || m_pGloc.size() < 8)
{
_head = Face::Table();
return;
}
const byte * p = m_pGloc;
int version = be::read<uint32>(p);
const uint16 flags = be::read<uint16>(p);
_num_attrs = be::read<uint16>(p);
diff --git a/gfx/graphite2/src/Pass.cpp b/gfx/graphite2/src/Pass.cpp
--- a/gfx/graphite2/src/Pass.cpp
+++ b/gfx/graphite2/src/Pass.cpp
@@ -233,17 +233,17 @@ bool Pass::readRules(const byte * rule_m
m_codes = new Code [m_numRules*2];
const size_t prog_pool_sz = vm::Machine::Code::estimateCodeDataOut(ac_end - ac_data + rc_end - rc_data);
m_progs = gralloc<byte>(prog_pool_sz);
byte * prog_pool_free = m_progs,
* prog_pool_end = m_progs + prog_pool_sz;
if (e.test(!(m_rules && m_codes && m_progs), E_OUTOFMEM)) return face.error(e);
Rule * r = m_rules + m_numRules - 1;
- for (size_t n = m_numRules; n; --n, --r, ac_end = ac_begin, rc_end = rc_begin)
+ for (size_t n = m_numRules; r >= m_rules; --n, --r, ac_end = ac_begin, rc_end = rc_begin)
{
face.error_context((face.error_context() & 0xFFFF00) + EC_ARULE + ((n - 1) << 24));
r->preContext = *--precontext;
r->sort = be::peek<uint16>(--sort_key);
#ifndef NDEBUG
r->rule_idx = n - 1;
#endif
if (r->sort > 63 || r->preContext >= r->sort || r->preContext > m_maxPreCtxt || r->preContext < m_minPreCtxt)
@@ -405,16 +405,17 @@ bool Pass::runGraphite(vm::Machine & m,
json::closer rules_array_closer(fsm.dbgout);
#endif
m.slotMap().highwater(currHigh);
int lc = m_iMaxLoop;
do
{
findNDoRule(s, m, fsm);
+ if (m.status() != Machine::finished) return false;
if (s && (s == m.slotMap().highwater() || m.slotMap().highpassed() || --lc == 0)) {
if (!lc)
s = m.slotMap().highwater();
lc = m_iMaxLoop;
if (s)
m.slotMap().highwater(s->next());
}
} while (s);
@@ -495,17 +496,22 @@ void Pass::findNDoRule(Slot * & slot, Ma
{
assert(slot);
if (runFSM(fsm, slot))
{
// Search for the first rule which passes the constraint
const RuleEntry * r = fsm.rules.begin(),
* const re = fsm.rules.end();
- while (r != re && !testConstraint(*r->rule, m)) ++r;
+ while (r != re && !testConstraint(*r->rule, m))
+ {
+ ++r;
+ if (m.status() != Machine::finished)
+ return;
+ }
#if !defined GRAPHITE2_NTRACING
if (fsm.dbgout)
{
if (fsm.rules.size() != 0)
{
*fsm.dbgout << json::item << json::object;
dumpRuleEventConsidered(fsm, *r);
@@ -530,16 +536,17 @@ void Pass::findNDoRule(Slot * & slot, Ma
}
}
else
#endif
{
if (r != re)
{
const int adv = doAction(r->rule->action, slot, m);
+ if (m.status() != Machine::finished) return;
if (r->rule->action->deletes()) fsm.slots.collectGarbage(slot);
adjustSlot(adv, slot, fsm.slots);
return;
}
}
}
slot = slot->next();
diff --git a/gfx/graphite2/src/Segment.cpp b/gfx/graphite2/src/Segment.cpp
--- a/gfx/graphite2/src/Segment.cpp
+++ b/gfx/graphite2/src/Segment.cpp
@@ -205,18 +205,23 @@ Slot *Segment::newSlot()
void Segment::freeSlot(Slot *aSlot)
{
if (m_last == aSlot) m_last = aSlot->prev();
if (m_first == aSlot) m_first = aSlot->next();
if (aSlot->attachedTo())
aSlot->attachedTo()->removeChild(aSlot);
while (aSlot->firstChild())
{
- aSlot->firstChild()->attachTo(NULL);
- aSlot->removeChild(aSlot->firstChild());
+ if (aSlot->firstChild()->attachedTo() == aSlot)
+ {
+ aSlot->firstChild()->attachTo(NULL);
+ aSlot->removeChild(aSlot->firstChild());
+ }
+ else
+ aSlot->firstChild(NULL);
}
// reset the slot incase it is reused
::new (aSlot) Slot(aSlot->userAttrs());
memset(aSlot->userAttrs(), 0, m_silf->numUser() * sizeof(int16));
// Update generation counter for debug
#if !defined GRAPHITE2_NTRACING
if (m_face->logger())
++aSlot->userAttrs()[m_silf->numUser()];
diff --git a/gfx/graphite2/src/Slot.cpp b/gfx/graphite2/src/Slot.cpp
--- a/gfx/graphite2/src/Slot.cpp
+++ b/gfx/graphite2/src/Slot.cpp
@@ -192,16 +192,18 @@ int32 Slot::clusterMetric(const Segment
#define SLOTGETCOLATTR(x) { SlotCollision *c = seg->collisionInfo(this); return c ? int(c-> x) : 0; }
int Slot::getAttr(const Segment *seg, attrCode ind, uint8 subindex) const
{
if (ind == gr_slatUserDefnV1)
{
ind = gr_slatUserDefn;
subindex = 0;
+ if (seg->numAttrs() == 0)
+ return 0;
}
else if (ind >= gr_slatJStretch && ind < gr_slatJStretch + 20 && ind != gr_slatJWidth)
{
int indx = ind - gr_slatJStretch;
return getJustify(seg, indx / 5, indx % 5);
}
switch (ind)
@@ -269,16 +271,18 @@ int Slot::getAttr(const Segment *seg, at
break; }
void Slot::setAttr(Segment *seg, attrCode ind, uint8 subindex, int16 value, const SlotMap & map)
{
if (ind == gr_slatUserDefnV1)
{
ind = gr_slatUserDefn;
subindex = 0;
+ if (seg->numAttrs() == 0)
+ return;
}
else if (ind >= gr_slatJStretch && ind < gr_slatJStretch + 20 && ind != gr_slatJWidth)
{
int indx = ind - gr_slatJStretch;
return setJustify(seg, indx / 5, indx % 5, value);
}
switch (ind)
@@ -416,32 +420,32 @@ bool Slot::sibling(Slot *ap)
}
bool Slot::removeChild(Slot *ap)
{
if (this == ap || !m_child) return false;
else if (ap == m_child)
{
Slot *nSibling = m_child->nextSibling();
- m_child->sibling(NULL);
+ m_child->removeSibling(nSibling);
m_child = nSibling;
return true;
}
else
return m_child->removeSibling(ap);
return true;
}
bool Slot::removeSibling(Slot *ap)
{
if (this == ap || !m_sibling) return false;
else if (ap == m_sibling)
{
m_sibling = m_sibling->nextSibling();
- ap->sibling(NULL);
+ if (m_sibling) ap->removeSibling(m_sibling);
return true;
}
else
return m_sibling->removeSibling(ap);
return true;
}
void Slot::setGlyph(Segment *seg, uint16 glyphid, const GlyphFace * theGlyph)
diff --git a/gfx/graphite2/src/TtfUtil.cpp b/gfx/graphite2/src/TtfUtil.cpp
--- a/gfx/graphite2/src/TtfUtil.cpp
+++ b/gfx/graphite2/src/TtfUtil.cpp
@@ -884,18 +884,19 @@ const void * FindCmapSubtable(const void
}
return 0;
}
/*----------------------------------------------------------------------------------------------
Check the Microsoft Unicode subtable for expected values
----------------------------------------------------------------------------------------------*/
-bool CheckCmapSubtable4(const void * pCmapSubtable4, size_t table_len /*, unsigned int maxgid*/)
+bool CheckCmapSubtable4(const void * pCmapSubtable4, const void * pCmapEnd /*, unsigned int maxgid*/)
{
+ size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable4;
if (!pCmapSubtable4) return false;
const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable4);
// Bob H say some freeware TT fonts have version 1 (eg, CALIGULA.TTF)
// so don't check subtable version. 21 Mar 2002 spec changes version to language.
if (be::swap(pTable->format) != 4) return false;
const Sfnt::CmapSubTableFormat4 * pTable4 = reinterpret_cast<const Sfnt::CmapSubTableFormat4 *>(pCmapSubtable4);
uint16 length = be::swap(pTable4->length);
if (length > table_len)
@@ -1044,17 +1045,17 @@ unsigned int CmapSubtable4NextCodepoint(
*pRangeKey = nRange - 1;
return 0xFFFF;
}
int iRange = (pRangeKey) ? *pRangeKey : 0;
// Just in case we have a bad key:
while (iRange > 0 && be::peek<uint16>(pStartCode + iRange) > nUnicodePrev)
iRange--;
- while (be::peek<uint16>(pTable->end_code + iRange) < nUnicodePrev)
+ while (iRange < nRange - 1 && be::peek<uint16>(pTable->end_code + iRange) < nUnicodePrev)
iRange++;
// Now iRange is the range containing nUnicodePrev.
unsigned int nStartCode = be::peek<uint16>(pStartCode + iRange);
unsigned int nEndCode = be::peek<uint16>(pTable->end_code + iRange);
if (nStartCode > nUnicodePrev)
// Oops, nUnicodePrev is not in the cmap! Adjust so we get a reasonable
@@ -1069,36 +1070,37 @@ unsigned int CmapSubtable4NextCodepoint(
return nUnicodePrev + 1;
}
// Otherwise the next codepoint is the first one in the next range.
// There is guaranteed to be a next range because there must be one that
// ends with 0xFFFF.
if (pRangeKey)
*pRangeKey = iRange + 1;
- return be::peek<uint16>(pStartCode + iRange + 1);
+ return (iRange + 1 >= nRange) ? 0xFFFF : be::peek<uint16>(pStartCode + iRange + 1);
}
/*----------------------------------------------------------------------------------------------
Check the Microsoft UCS-4 subtable for expected values.
----------------------------------------------------------------------------------------------*/
-bool CheckCmapSubtable12(const void *pCmapSubtable12, size_t table_len /*, unsigned int maxgid*/)
+bool CheckCmapSubtable12(const void *pCmapSubtable12, const void *pCmapEnd /*, unsigned int maxgid*/)
{
+ size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable12;
if (!pCmapSubtable12) return false;
const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable12);
if (be::swap(pTable->format) != 12)
return false;
const Sfnt::CmapSubTableFormat12 * pTable12 = reinterpret_cast<const Sfnt::CmapSubTableFormat12 *>(pCmapSubtable12);
uint32 length = be::swap(pTable12->length);
if (length > table_len)
return false;
if (length < sizeof(Sfnt::CmapSubTableFormat12))
return false;
uint32 num_groups = be::swap(pTable12->num_groups);
- if (length != (sizeof(Sfnt::CmapSubTableFormat12) + (num_groups - 1) * sizeof(uint32) * 3))
+ if (num_groups > 0x10000000 || length != (sizeof(Sfnt::CmapSubTableFormat12) + (num_groups - 1) * sizeof(uint32) * 3))
return false;
#if 0
for (unsigned int i = 0; i < num_groups; ++i)
{
if (be::swap(pTable12->group[i].end_char_code) - be::swap(pTable12->group[i].start_char_code) + be::swap(pTable12->group[i].start_glyph_id) > maxgid)
return false;
if (i > 0 && be::swap(pTable12->group[i].start_char_code) <= be::swap(pTable12->group[i-1].end_char_code))
return false;
@@ -1161,17 +1163,17 @@ unsigned int CmapSubtable12NextCodepoint
*pRangeKey = nRange;
return 0x10FFFF;
}
int iRange = (pRangeKey) ? *pRangeKey : 0;
// Just in case we have a bad key:
while (iRange > 0 && be::swap(pTable->group[iRange].start_char_code) > nUnicodePrev)
iRange--;
- while (be::swap(pTable->group[iRange].end_char_code) < nUnicodePrev)
+ while (iRange < nRange - 1 && be::swap(pTable->group[iRange].end_char_code) < nUnicodePrev)
iRange++;
// Now iRange is the range containing nUnicodePrev.
unsigned int nStartCode = be::swap(pTable->group[iRange].start_char_code);
unsigned int nEndCode = be::swap(pTable->group[iRange].end_char_code);
if (nStartCode > nUnicodePrev)
diff --git a/gfx/graphite2/src/call_machine.cpp b/gfx/graphite2/src/call_machine.cpp
--- a/gfx/graphite2/src/call_machine.cpp
+++ b/gfx/graphite2/src/call_machine.cpp
@@ -67,32 +67,34 @@ using namespace vm;
struct regbank {
slotref is;
slotref * map;
SlotMap & smap;
slotref * const map_base;
const instr * & ip;
uint8 direction;
int8 flags;
+ Machine::status_t & status;
};
typedef bool (* ip_t)(registers);
// Pull in the opcode definitions
// We pull these into a private namespace so these otherwise common names dont
// pollute the toplevel namespace.
namespace {
#define smap reg.smap
#define seg smap.segment
#define is reg.is
#define ip reg.ip
#define map reg.map
#define mapb reg.map_base
#define flags reg.flags
#define dir reg.direction
+#define status reg.status
#include "inc/opcodes.h"
#undef smap
#undef seg
#undef is
#undef ip
#undef map
@@ -108,17 +110,17 @@ Machine::stack_t Machine::run(const ins
{
assert(program != 0);
// Declare virtual machine registers
const instr * ip = program-1;
const byte * dp = data;
stack_t * sp = _stack + Machine::STACK_GUARD,
* const sb = sp;
- regbank reg = {*map, map, _map, _map.begin()+_map.context(), ip, _map.dir(), 0};
+ regbank reg = {*map, map, _map, _map.begin()+_map.context(), ip, _map.dir(), 0, _status};
// Run the program
while ((reinterpret_cast<ip_t>(*++ip))(dp, sp, sb, reg)) {}
const stack_t ret = sp == _stack+STACK_GUARD+1 ? *sp-- : 0;
check_final_stack(sp);
map = reg.map;
*map = reg.is;
diff --git a/gfx/graphite2/src/direct_machine.cpp b/gfx/graphite2/src/direct_machine.cpp
--- a/gfx/graphite2/src/direct_machine.cpp
+++ b/gfx/graphite2/src/direct_machine.cpp
@@ -57,36 +57,37 @@ using namespace vm;
namespace {
const void * direct_run(const bool get_table_mode,
const instr * program,
const byte * data,
Machine::stack_t * stack,
slotref * & __map,
uint8 _dir,
+ Machine::status_t & status,
SlotMap * __smap=0)
{
// We need to define and return to opcode table from within this function
// other inorder to take the addresses of the instruction bodies.
#include "inc/opcode_table.h"
if (get_table_mode)
return opcode_table;
// Declare virtual machine registers
- const instr * ip = program;
- const byte * dp = data;
- Machine::stack_t * sp = stack + Machine::STACK_GUARD,
- * const sb = sp;
- SlotMap & smap = *__smap;
- Segment & seg = smap.segment;
- slotref is = *__map,
- * map = __map,
- * const mapb = smap.begin()+smap.context();
- uint8 dir = _dir;
- int8 flags = 0;
+ const instr * ip = program;
+ const byte * dp = data;
+ Machine::stack_t * sp = stack + Machine::STACK_GUARD,
+ * const sb = sp;
+ SlotMap & smap = *__smap;
+ Segment & seg = smap.segment;
+ slotref is = *__map,
+ * map = __map,
+ * const mapb = smap.begin()+smap.context();
+ uint8 dir = _dir;
+ int8 flags = 0;
// start the program
goto **ip;
// Pull in the opcode definitions
#include "inc/opcodes.h"
end:
@@ -95,25 +96,26 @@ const void * direct_run(const bool
return sp;
}
}
const opcode_t * Machine::getOpcodeTable() throw()
{
slotref * dummy;
- return static_cast<const opcode_t *>(direct_run(true, 0, 0, 0, dummy, 0));
+ Machine::status_t dumstat = Machine::finished;
+ return static_cast<const opcode_t *>(direct_run(true, 0, 0, 0, dummy, 0, dumstat));
}
Machine::stack_t Machine::run(const instr * program,
const byte * data,
slotref * & is)
{
assert(program != 0);
const stack_t *sp = static_cast<const stack_t *>(
- direct_run(false, program, data, _stack, is, _map.dir(), &_map));
+ direct_run(false, program, data, _stack, is, _map.dir(), _status, &_map));
const stack_t ret = sp == _stack+STACK_GUARD+1 ? *sp-- : 0;
check_final_stack(sp);
return ret;
}
diff --git a/gfx/graphite2/src/inc/Code.h b/gfx/graphite2/src/inc/Code.h
--- a/gfx/graphite2/src/inc/Code.h
+++ b/gfx/graphite2/src/inc/Code.h
@@ -109,17 +109,17 @@ public:
int32 run(Machine &m, slotref * & map) const;
CLASS_NEW_DELETE;
};
inline
size_t Machine::Code::estimateCodeDataOut(size_t n_bc)
{
- return n_bc * (sizeof(instr)+sizeof(byte));
+ return (n_bc + 1) * (sizeof(instr)+sizeof(byte));
}
inline Machine::Code::Code() throw()
: _code(0), _data(0), _data_size(0), _instr_count(0), _max_ref(0),
_status(loaded), _constraint(false), _modify(false), _delete(false),
_own(false)
{
diff --git a/gfx/graphite2/src/inc/Machine.h b/gfx/graphite2/src/inc/Machine.h
--- a/gfx/graphite2/src/inc/Machine.h
+++ b/gfx/graphite2/src/inc/Machine.h
@@ -135,17 +135,18 @@ public:
class Code;
enum status_t {
finished = 0,
stack_underflow,
stack_not_empty,
stack_overflow,
- slot_offset_out_bounds
+ slot_offset_out_bounds,
+ died_early
};
Machine(SlotMap &) throw();
static const opcode_t * getOpcodeTable() throw();
CLASS_NEW_DELETE;
SlotMap & slotMap() const throw();
diff --git a/gfx/graphite2/src/inc/TtfUtil.h b/gfx/graphite2/src/inc/TtfUtil.h
--- a/gfx/graphite2/src/inc/TtfUtil.h
+++ b/gfx/graphite2/src/inc/TtfUtil.h
@@ -132,21 +132,21 @@ public:
int GetLangsForNames(const void * pName, int nPlatformId, int nEncodingId,
int *nameIdList, int cNameIds, short *langIdList);
void SwapWString(void * pWStr, size_t nSize = 0); // throw (std::invalid_argument);
#endif
////////////////////////////////// cmap lookup tools
const void * FindCmapSubtable(const void * pCmap, int nPlatformId = 3,
int nEncodingId = 1, size_t length = 0);
- bool CheckCmapSubtable4(const void * pCmap31, size_t table_len /*, unsigned int maxgid*/);
+ bool CheckCmapSubtable4(const void * pCmap31, const void * pCmapEnd /*, unsigned int maxgid*/);
gid16 CmapSubtable4Lookup(const void * pCmapSubtabel4, unsigned int nUnicodeId, int rangeKey = 0);
unsigned int CmapSubtable4NextCodepoint(const void *pCmap31, unsigned int nUnicodeId,
int * pRangeKey = 0);
- bool CheckCmapSubtable12(const void *pCmap310, size_t table_len /*, unsigned int maxgid*/);
+ bool CheckCmapSubtable12(const void *pCmap310, const void * pCmapEnd /*, unsigned int maxgid*/);
gid16 CmapSubtable12Lookup(const void * pCmap310, unsigned int uUnicodeId, int rangeKey = 0);
unsigned int CmapSubtable12NextCodepoint(const void *pCmap310, unsigned int nUnicodeId,
int * pRangeKey = 0);
///////////////////////////////// horizontal metric data for a glyph
bool HorMetrics(gid16 nGlyphId, const void * pHmtx, size_t lHmtxSize,
const void * pHhea, int & nLsb, unsigned int & nAdvWid);
diff --git a/gfx/graphite2/src/inc/opcodes.h b/gfx/graphite2/src/inc/opcodes.h
--- a/gfx/graphite2/src/inc/opcodes.h
+++ b/gfx/graphite2/src/inc/opcodes.h
@@ -71,17 +71,17 @@ of the License or (at your option) any l
#define use_params(n) dp += n
#define declare_params(n) const byte * param = dp; \
use_params(n);
#define push(n) { *++sp = n; }
#define pop() (*sp--)
#define slotat(x) (map[(x)])
-#define DIE { is=seg.last(); EXIT(1); }
+#define DIE { is=seg.last(); status = Machine::died_early; EXIT(1); }
#define POSITIONED 1
STARTOP(nop)
do {} while (0);
ENDOP
STARTOP(push_byte)
declare_params(1);
@@ -387,30 +387,30 @@ STARTOP(attr_set)
ENDOP
STARTOP(attr_add)
declare_params(1);
const attrCode slat = attrCode(uint8(*param));
const int val = int(pop());
if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
{
- seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+ seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
flags |= POSITIONED;
}
int res = is->getAttr(&seg, slat, 0);
is->setAttr(&seg, slat, 0, val + res, smap);
ENDOP
STARTOP(attr_sub)
declare_params(1);
const attrCode slat = attrCode(uint8(*param));
const int val = int(pop());
if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
{
- seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+ seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
flags |= POSITIONED;
}
int res = is->getAttr(&seg, slat, 0);
is->setAttr(&seg, slat, 0, res - val, smap);
ENDOP
STARTOP(attr_set_slot)
declare_params(1);
@@ -429,17 +429,17 @@ STARTOP(iattr_set_slot)
ENDOP
STARTOP(push_slot_attr)
declare_params(2);
const attrCode slat = attrCode(uint8(param[0]));
const int slot_ref = int8(param[1]);
if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
{
- seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+ seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
flags |= POSITIONED;
}
slotref slot = slotat(slot_ref);
if (slot)
{
int res = slot->getAttr(&seg, slat, 0);
push(res);
}
@@ -505,17 +505,17 @@ ENDOP
STARTOP(push_islot_attr)
declare_params(3);
const attrCode slat = attrCode(uint8(param[0]));
const int slot_ref = int8(param[1]),
idx = uint8(param[2]);
if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
{
- seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+ seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
flags |= POSITIONED;
}
slotref slot = slotat(slot_ref);
if (slot)
{
int res = slot->getAttr(&seg, slat, idx);
push(res);
}

9988
gnu/packages/patches/icecat-update-graphite2.patch
View File

File diff suppressed because it is too large Load Diff