gnu: icecat: Add fixes for CVE-2016-{2818,2819,2821,2824,2828,2831}.

* gnu/packages/patches/icecat-CVE-2016-2818-pt1.patch,
gnu/packages/patches/icecat-CVE-2016-2818-pt2.patch,
gnu/packages/patches/icecat-CVE-2016-2818-pt3.patch,
gnu/packages/patches/icecat-CVE-2016-2818-pt4.patch,
gnu/packages/patches/icecat-CVE-2016-2818-pt5.patch,
gnu/packages/patches/icecat-CVE-2016-2818-pt6.patch,
gnu/packages/patches/icecat-CVE-2016-2818-pt7.patch,
gnu/packages/patches/icecat-CVE-2016-2818-pt8.patch,
gnu/packages/patches/icecat-CVE-2016-2818-pt9.patch,
gnu/packages/patches/icecat-CVE-2016-2819.patch,
gnu/packages/patches/icecat-CVE-2016-2821.patch,
gnu/packages/patches/icecat-CVE-2016-2824.patch,
gnu/packages/patches/icecat-CVE-2016-2828.patch,
gnu/packages/patches/icecat-CVE-2016-2831.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add patches.

1 files changed, 61 insertions, 0 deletions

diff --git a/gnu/packages/patches/icecat-CVE-2016-2818-pt4.patch b/gnu/packages/patches/icecat-CVE-2016-2818-pt4.patch
new file mode 100644
index 0000000000..0973203e0f
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-2818-pt4.patch
@@ -0,0 +1,61 @@
+  changeset:   312055:b74f1ab939d2
+  user:        Olli Pettay <Olli.Pettay@helsinki.fi>
+  Date:        Mon May 16 21:42:24 2016 +0300
+  summary:     Bug 1273202, make sure to not keep objects alive too long because of some useless event dispatching, r=jwatt a=ritu
+
+diff -r 072992bf176d -r b74f1ab939d2 dom/html/HTMLInputElement.cpp
+--- a/dom/html/HTMLInputElement.cpp	Sun May 15 17:03:06 2016 +0300
++++ b/dom/html/HTMLInputElement.cpp	Mon May 16 21:42:24 2016 +0300
+@@ -1168,7 +1168,7 @@
+     mFileList->Disconnect();
+   }
+   if (mNumberControlSpinnerIsSpinning) {
+-    StopNumberControlSpinnerSpin();
++    StopNumberControlSpinnerSpin(eDisallowDispatchingEvents);
+   }
+   DestroyImageLoadingContent();
+   FreeData();
+@@ -3721,7 +3721,7 @@
+ }
+ 
+ void
+-HTMLInputElement::StopNumberControlSpinnerSpin()
++HTMLInputElement::StopNumberControlSpinnerSpin(SpinnerStopState aState)
+ {
+   if (mNumberControlSpinnerIsSpinning) {
+     if (nsIPresShell::GetCapturingContent() == this) {
+@@ -3732,11 +3732,16 @@
+ 
+     mNumberControlSpinnerIsSpinning = false;
+ 
+-    FireChangeEventIfNeeded();
++    if (aState == eAllowDispatchingEvents) {
++      FireChangeEventIfNeeded();
++    }
+ 
+     nsNumberControlFrame* numberControlFrame =
+       do_QueryFrame(GetPrimaryFrame());
+     if (numberControlFrame) {
++      MOZ_ASSERT(aState == eAllowDispatchingEvents,
++                 "Shouldn't have primary frame for the element when we're not "
++                 "allowed to dispatch events to it anymore.");
+       numberControlFrame->SpinnerStateChanged();
+     }
+   }
+diff -r 072992bf176d -r b74f1ab939d2 dom/html/HTMLInputElement.h
+--- a/dom/html/HTMLInputElement.h	Sun May 15 17:03:06 2016 +0300
++++ b/dom/html/HTMLInputElement.h	Mon May 16 21:42:24 2016 +0300
+@@ -721,7 +721,12 @@
+   HTMLInputElement* GetOwnerNumberControl();
+ 
+   void StartNumberControlSpinnerSpin();
+-  void StopNumberControlSpinnerSpin();
++  enum SpinnerStopState {
++    eAllowDispatchingEvents,
++    eDisallowDispatchingEvents
++  };
++  void StopNumberControlSpinnerSpin(SpinnerStopState aState =
++                                      eAllowDispatchingEvents);
+   void StepNumberControlForUserEvent(int32_t aDirection);
+ 
+   /**