Update to 31.7.0

Changelog:
Fixed in Thunderbird 31.7

    2015-57 Privilege escalation through IPC channel messages
    2015-54 Buffer overflow when parsing compressed XML
    2015-51 Use-after-free during text processing with vertical text enabled
    2015-48 Buffer overflow with SVG content and CSS
    2015-47 Buffer overflow parsing H.264 video with Linux Gstreamer
    2015-46 Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)

3 files changed, 4 insertions, 163 deletions

diff --git a/mail/thunderbird/patches/patch-mozilla_js_src_builtin_TypedObject.cpp b/mail/thunderbird/patches/patch-mozilla_js_src_builtin_TypedObject.cpp
deleted file mode 100644
index 7a040b536ad..00000000000
--- a/mail/thunderbird/patches/patch-mozilla_js_src_builtin_TypedObject.cpp
+++ /dev/null
@@ -1,146 +0,0 @@
-$NetBSD: patch-mozilla_js_src_builtin_TypedObject.cpp,v 1.1 2014/10/17 16:47:22 joerg Exp $
-
---- mozilla/js/src/builtin/TypedObject.cpp.orig	2014-10-17 09:18:05.000000000 +0000
-+++ mozilla/js/src/builtin/TypedObject.cpp
-@@ -710,12 +710,12 @@ ArrayMetaTypeDescr::construct(JSContext 
-     contents.append(")");
-     RootedAtom stringRepr(cx, contents.finishAtom());
-     if (!stringRepr)
--        return nullptr;
-+        return false;
- 
-     // Extract ArrayType.prototype
-     RootedObject arrayTypePrototype(cx, GetPrototype(cx, arrayTypeGlobal));
-     if (!arrayTypePrototype)
--        return nullptr;
-+        return false;
- 
-     // Create the instance of ArrayType
-     Rooted<UnsizedArrayTypeDescr *> obj(cx);
-@@ -728,7 +728,7 @@ ArrayMetaTypeDescr::construct(JSContext 
-     if (!JSObject::defineProperty(cx, obj, cx->names().length,
-                                   UndefinedHandleValue, nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     args.rval().setObject(*obj);
-     return true;
-@@ -762,7 +762,7 @@ UnsizedArrayTypeDescr::dimension(JSConte
-     if (!size.isValid()) {
-         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
-                              JSMSG_TYPEDOBJECT_TOO_BIG);
--        return nullptr;
-+        return false;
-     }
- 
-     // Construct a canonical string `new ArrayType(<elementType>).dimension(N)`:
-@@ -775,7 +775,7 @@ UnsizedArrayTypeDescr::dimension(JSConte
-     contents.append(")");
-     RootedAtom stringRepr(cx, contents.finishAtom());
-     if (!stringRepr)
--        return nullptr;
-+        return false;
- 
-     // Create the sized type object.
-     Rooted<SizedArrayTypeDescr*> obj(cx);
-@@ -793,7 +793,7 @@ UnsizedArrayTypeDescr::dimension(JSConte
-     if (!JSObject::defineProperty(cx, obj, cx->names().length,
-                                   lengthVal, nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     // Add `unsized` property, which is a link from the sized
-     // array to the unsized array.
-@@ -801,7 +801,7 @@ UnsizedArrayTypeDescr::dimension(JSConte
-     if (!JSObject::defineProperty(cx, obj, cx->names().unsized,
-                                   unsizedTypeDescrValue, nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     args.rval().setObject(*obj);
-     return true;
-@@ -1253,7 +1253,7 @@ DefineSimpleTypeDescr(JSContext *cx,
-     Rooted<TypedProto*> proto(cx);
-     proto = NewObjectWithProto<TypedProto>(cx, objProto, nullptr, TenuredObject);
-     if (!proto)
--        return nullptr;
-+        return false;
-     proto->initTypeDescrSlot(*descr);
-     descr->initReservedSlot(JS_DESCR_SLOT_TYPROTO, ObjectValue(*proto));
- 
-@@ -1358,14 +1358,14 @@ GlobalObject::initTypedObjectModule(JSCo
- #define BINARYDATA_SCALAR_DEFINE(constant_, type_, name_)                       \
-     if (!DefineSimpleTypeDescr<ScalarTypeDescr>(cx, global, module, constant_,      \
-                                             cx->names().name_))                 \
--        return nullptr;
-+        return false;
-     JS_FOR_EACH_SCALAR_TYPE_REPR(BINARYDATA_SCALAR_DEFINE)
- #undef BINARYDATA_SCALAR_DEFINE
- 
- #define BINARYDATA_REFERENCE_DEFINE(constant_, type_, name_)                    \
-     if (!DefineSimpleTypeDescr<ReferenceTypeDescr>(cx, global, module, constant_,   \
-                                                cx->names().name_))              \
--        return nullptr;
-+        return false;
-     JS_FOR_EACH_REFERENCE_TYPE_REPR(BINARYDATA_REFERENCE_DEFINE)
- #undef BINARYDATA_REFERENCE_DEFINE
- 
-@@ -1375,14 +1375,14 @@ GlobalObject::initTypedObjectModule(JSCo
-     arrayType = DefineMetaTypeDescr<ArrayMetaTypeDescr>(
-         cx, global, module, TypedObjectModuleObject::ArrayTypePrototype);
-     if (!arrayType)
--        return nullptr;
-+        return false;
- 
-     RootedValue arrayTypeValue(cx, ObjectValue(*arrayType));
-     if (!JSObject::defineProperty(cx, module, cx->names().ArrayType,
-                                   arrayTypeValue,
-                                   nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     // StructType.
- 
-@@ -1390,14 +1390,14 @@ GlobalObject::initTypedObjectModule(JSCo
-     structType = DefineMetaTypeDescr<StructMetaTypeDescr>(
-         cx, global, module, TypedObjectModuleObject::StructTypePrototype);
-     if (!structType)
--        return nullptr;
-+        return false;
- 
-     RootedValue structTypeValue(cx, ObjectValue(*structType));
-     if (!JSObject::defineProperty(cx, module, cx->names().StructType,
-                                   structTypeValue,
-                                   nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     // Everything is setup, install module on the global object:
-     RootedValue moduleValue(cx, ObjectValue(*module));
-@@ -1407,10 +1407,10 @@ GlobalObject::initTypedObjectModule(JSCo
-                                   nullptr, nullptr,
-                                   0))
-     {
--        return nullptr;
-+        return false;
-     }
- 
--    return module;
-+    return module != nullptr;
- }
- 
- JSObject *
-@@ -2466,7 +2466,7 @@ TypedObject::constructUnsized(JSContext 
-         if (length < 0) {
-             JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                  nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
--            return nullptr;
-+            return false;
-         }
-         Rooted<TypedObject*> obj(cx, createZeroed(cx, callee, length));
-         if (!obj)
diff --git a/mail/thunderbird/patches/patch-mozilla_js_src_frontend_BytecodeCompiler.cpp b/mail/thunderbird/patches/patch-mozilla_js_src_frontend_BytecodeCompiler.cpp
deleted file mode 100644
index b0aa224c4c8..00000000000
--- a/mail/thunderbird/patches/patch-mozilla_js_src_frontend_BytecodeCompiler.cpp
+++ /dev/null
@@ -1,13 +0,0 @@
-$NetBSD: patch-mozilla_js_src_frontend_BytecodeCompiler.cpp,v 1.1 2014/10/17 16:47:22 joerg Exp $
-
---- mozilla/js/src/frontend/BytecodeCompiler.cpp.orig	2014-10-17 09:17:47.000000000 +0000
-+++ mozilla/js/src/frontend/BytecodeCompiler.cpp
-@@ -544,7 +544,7 @@ CompileFunctionBody(JSContext *cx, Mutab
- 
-     RootedScriptSource sourceObject(cx, CreateScriptSourceObject(cx, options));
-     if (!sourceObject)
--        return nullptr;
-+        return false;
-     ScriptSource *ss = sourceObject->source();
- 
-     SourceCompressionTask sct(cx);
diff --git a/mail/thunderbird/patches/patch-mozilla_js_src_gc_Memory.cpp b/mail/thunderbird/patches/patch-mozilla_js_src_gc_Memory.cpp
index e7ac36480e7..5eb74343b5a 100644
--- a/mail/thunderbird/patches/patch-mozilla_js_src_gc_Memory.cpp
+++ b/mail/thunderbird/patches/patch-mozilla_js_src_gc_Memory.cpp
@@ -1,9 +1,9 @@
-$NetBSD: patch-mozilla_js_src_gc_Memory.cpp,v 1.1 2014/07/27 20:04:59 ryoon Exp $
+$NetBSD: patch-mozilla_js_src_gc_Memory.cpp,v 1.2 2015/05/26 12:34:42 ryoon Exp $
 
---- mozilla/js/src/gc/Memory.cpp.orig	2014-07-18 00:05:25.000000000 +0000
+--- mozilla/js/src/gc/Memory.cpp.orig	2015-05-07 18:53:49.000000000 +0000
 +++ mozilla/js/src/gc/Memory.cpp
-@@ -212,7 +212,7 @@ gc::InitMemorySubsystem(JSRuntime *rt)
- static inline void *
+@@ -212,7 +212,7 @@ gc::InitMemorySubsystem(JSRuntime* rt)
+ static inline void*
  MapMemory(size_t length, int prot, int flags, int fd, off_t offset)
  {
 -#if defined(__ia64__)