Update to 31.7.0

Changelog:
Fixed in Firefox ESR 31.7

    2015-57 Privilege escalation through IPC channel messages
    2015-54 Buffer overflow when parsing compressed XML
    2015-51 Use-after-free during text processing with vertical text enabled
    2015-48 Buffer overflow with SVG content and CSS
    2015-47 Buffer overflow parsing H.264 video with Linux Gstreamer
    2015-46 Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)

5 files changed, 12 insertions, 170 deletions

diff --git a/www/firefox31/Makefile b/www/firefox31/Makefile
index eefa7ab9b3c..c7cc3767f4c 100644
--- a/www/firefox31/Makefile
+++ b/www/firefox31/Makefile
@@ -1,13 +1,12 @@
-# $NetBSD: Makefile,v 1.13 2015/04/28 12:06:34 joerg Exp $
+# $NetBSD: Makefile,v 1.14 2015/05/26 12:18:23 ryoon Exp $
 
 FIREFOX_VER=	${MOZ_BRANCH}${MOZ_BRANCH_MINOR}esr
 # Also update MOZ_BRANCH= in devel/xulrunner31/Makefile
-MOZ_BRANCH=	31.6
+MOZ_BRANCH=	31.7
 MOZ_BRANCH_MINOR=	.0
 
 DISTNAME=	firefox-${FIREFOX_VER}.source
 PKGNAME=	firefox31-${MOZ_BRANCH}${MOZ_BRANCH_MINOR:S/b/beta/:S/esr//}
-PKGREVISION=	2
 CATEGORIES=	www
 MASTER_SITES=	${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/}
 MASTER_SITES+=	${MASTER_SITE_MOZILLA_ALL:=firefox/releases/${FIREFOX_VER}/source/}
diff --git a/www/firefox31/distinfo b/www/firefox31/distinfo
index 0d0b4ce9cc3..e6b45a0dccc 100644
--- a/www/firefox31/distinfo
+++ b/www/firefox31/distinfo
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.11 2015/04/28 12:06:34 joerg Exp $
+$NetBSD: distinfo,v 1.12 2015/05/26 12:18:23 ryoon Exp $
 
-SHA1 (firefox-31.6.0esr.source.tar.bz2) = 9c13012fec260c672e0e97ffb29f36fe360b02ad
-RMD160 (firefox-31.6.0esr.source.tar.bz2) = 76f216cc87609081efaa7b5de837952d06a5f2fb
-Size (firefox-31.6.0esr.source.tar.bz2) = 147767808 bytes
+SHA1 (firefox-31.7.0esr.source.tar.bz2) = d8c79d4228c15ff903e79362d2392401329e027f
+RMD160 (firefox-31.7.0esr.source.tar.bz2) = 1f04f235a3b2b0f2ac5d33951ae04e2131e5fff7
+Size (firefox-31.7.0esr.source.tar.bz2) = 147772244 bytes
 SHA1 (patch-aa) = 381ec50c3e66a2637f19401ac2c5ec4a29dc5627
 SHA1 (patch-ak) = 971ddb1f12b14bcee604c9d7e72da5e7bf47d9be
 SHA1 (patch-al) = cca5df21d018bb9f428ad26d00718f33afe88ec5
@@ -82,11 +82,9 @@ SHA1 (patch-ipc_ipdl_ipdl_lower.py) = 2ef9504e462d0e3db16f9b0a6303ea5971b9c2a2
 SHA1 (patch-js__src__vm__SPSProfiler.cpp) = 989ba25e4c5308d21d07baa802decce13609a475
 SHA1 (patch-js_src_Makefile.in) = 780e408dfddfd90c6013b316e2e52800c62eee5e
 SHA1 (patch-js_src_assembler_jit_ExecutableAllocator.h) = 819180c7ba72dc2641fe6cdce373f492e73cb5ff
-SHA1 (patch-js_src_builtin_TypedObject.cpp) = d44063579a0e36349d4c370a2e2cf09ebe6071e6
 SHA1 (patch-js_src_ctypes_CTypes.h) = 768a084239f92a424c1c7dc9eaaf9be9456ca9f0
-SHA1 (patch-js_src_frontend_BytecodeCompiler.cpp) = add5dee91325ee76df84beaf6b66eb7b7fed4aca
 SHA1 (patch-js_src_frontend_ParseMaps.cpp) = c00117d79b78904bc50a1d664a8fc0e4e339bfbc
-SHA1 (patch-js_src_gc_Memory.cpp) = 3db31553ec6f7b1fac4fd4ce11b77be1ea4208b8
+SHA1 (patch-js_src_gc_Memory.cpp) = 872db8ab6d86ca25956bf3e1b396ab46f8573cf0
 SHA1 (patch-js_src_jit_AsmJSModule.cpp) = 7e1876ef605f783889ae811c96bbf31d766aee6e
 SHA1 (patch-js_src_jit_arm_Architecture-arm.cpp) = 4e75d8a03c2372a3f2ccdd9e06caee11789b3acd
 SHA1 (patch-js_src_jit_arm_BaselineIC-arm.cpp) = 57ed2516904c17b7a037bb39e2d2ac2be403e313
diff --git a/www/firefox31/patches/patch-js_src_builtin_TypedObject.cpp b/www/firefox31/patches/patch-js_src_builtin_TypedObject.cpp
deleted file mode 100644
index a04bfd9419e..00000000000
--- a/www/firefox31/patches/patch-js_src_builtin_TypedObject.cpp
+++ /dev/null
@@ -1,142 +0,0 @@
-$NetBSD: patch-js_src_builtin_TypedObject.cpp,v 1.1 2014/11/06 12:26:51 joerg Exp $
-
---- js/src/builtin/TypedObject.cpp.orig	2014-11-05 15:45:47.000000000 +0000
-+++ js/src/builtin/TypedObject.cpp
-@@ -710,12 +710,12 @@ ArrayMetaTypeDescr::construct(JSContext 
-     contents.append(")");
-     RootedAtom stringRepr(cx, contents.finishAtom());
-     if (!stringRepr)
--        return nullptr;
-+        return false;
- 
-     // Extract ArrayType.prototype
-     RootedObject arrayTypePrototype(cx, GetPrototype(cx, arrayTypeGlobal));
-     if (!arrayTypePrototype)
--        return nullptr;
-+        return false;
- 
-     // Create the instance of ArrayType
-     Rooted<UnsizedArrayTypeDescr *> obj(cx);
-@@ -728,7 +728,7 @@ ArrayMetaTypeDescr::construct(JSContext 
-     if (!JSObject::defineProperty(cx, obj, cx->names().length,
-                                   UndefinedHandleValue, nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     args.rval().setObject(*obj);
-     return true;
-@@ -762,7 +762,7 @@ UnsizedArrayTypeDescr::dimension(JSConte
-     if (!size.isValid()) {
-         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
-                              JSMSG_TYPEDOBJECT_TOO_BIG);
--        return nullptr;
-+        return false;
-     }
- 
-     // Construct a canonical string `new ArrayType(<elementType>).dimension(N)`:
-@@ -775,7 +775,7 @@ UnsizedArrayTypeDescr::dimension(JSConte
-     contents.append(")");
-     RootedAtom stringRepr(cx, contents.finishAtom());
-     if (!stringRepr)
--        return nullptr;
-+        return false;
- 
-     // Create the sized type object.
-     Rooted<SizedArrayTypeDescr*> obj(cx);
-@@ -793,7 +793,7 @@ UnsizedArrayTypeDescr::dimension(JSConte
-     if (!JSObject::defineProperty(cx, obj, cx->names().length,
-                                   lengthVal, nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     // Add `unsized` property, which is a link from the sized
-     // array to the unsized array.
-@@ -801,7 +801,7 @@ UnsizedArrayTypeDescr::dimension(JSConte
-     if (!JSObject::defineProperty(cx, obj, cx->names().unsized,
-                                   unsizedTypeDescrValue, nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     args.rval().setObject(*obj);
-     return true;
-@@ -1253,7 +1253,7 @@ DefineSimpleTypeDescr(JSContext *cx,
-     Rooted<TypedProto*> proto(cx);
-     proto = NewObjectWithProto<TypedProto>(cx, objProto, nullptr, TenuredObject);
-     if (!proto)
--        return nullptr;
-+        return false;
-     proto->initTypeDescrSlot(*descr);
-     descr->initReservedSlot(JS_DESCR_SLOT_TYPROTO, ObjectValue(*proto));
- 
-@@ -1358,14 +1358,14 @@ GlobalObject::initTypedObjectModule(JSCo
- #define BINARYDATA_SCALAR_DEFINE(constant_, type_, name_)                       \
-     if (!DefineSimpleTypeDescr<ScalarTypeDescr>(cx, global, module, constant_,      \
-                                             cx->names().name_))                 \
--        return nullptr;
-+        return false;
-     JS_FOR_EACH_SCALAR_TYPE_REPR(BINARYDATA_SCALAR_DEFINE)
- #undef BINARYDATA_SCALAR_DEFINE
- 
- #define BINARYDATA_REFERENCE_DEFINE(constant_, type_, name_)                    \
-     if (!DefineSimpleTypeDescr<ReferenceTypeDescr>(cx, global, module, constant_,   \
-                                                cx->names().name_))              \
--        return nullptr;
-+        return false;
-     JS_FOR_EACH_REFERENCE_TYPE_REPR(BINARYDATA_REFERENCE_DEFINE)
- #undef BINARYDATA_REFERENCE_DEFINE
- 
-@@ -1375,14 +1375,14 @@ GlobalObject::initTypedObjectModule(JSCo
-     arrayType = DefineMetaTypeDescr<ArrayMetaTypeDescr>(
-         cx, global, module, TypedObjectModuleObject::ArrayTypePrototype);
-     if (!arrayType)
--        return nullptr;
-+        return false;
- 
-     RootedValue arrayTypeValue(cx, ObjectValue(*arrayType));
-     if (!JSObject::defineProperty(cx, module, cx->names().ArrayType,
-                                   arrayTypeValue,
-                                   nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     // StructType.
- 
-@@ -1390,14 +1390,14 @@ GlobalObject::initTypedObjectModule(JSCo
-     structType = DefineMetaTypeDescr<StructMetaTypeDescr>(
-         cx, global, module, TypedObjectModuleObject::StructTypePrototype);
-     if (!structType)
--        return nullptr;
-+        return false;
- 
-     RootedValue structTypeValue(cx, ObjectValue(*structType));
-     if (!JSObject::defineProperty(cx, module, cx->names().StructType,
-                                   structTypeValue,
-                                   nullptr, nullptr,
-                                   JSPROP_READONLY | JSPROP_PERMANENT))
--        return nullptr;
-+        return false;
- 
-     // Everything is setup, install module on the global object:
-     RootedValue moduleValue(cx, ObjectValue(*module));
-@@ -1407,7 +1407,7 @@ GlobalObject::initTypedObjectModule(JSCo
-                                   nullptr, nullptr,
-                                   0))
-     {
--        return nullptr;
-+        return false;
-     }
- 
-     return module;
-@@ -2466,7 +2466,7 @@ TypedObject::constructUnsized(JSContext 
-         if (length < 0) {
-             JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                  nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
--            return nullptr;
-+            return false;
-         }
-         Rooted<TypedObject*> obj(cx, createZeroed(cx, callee, length));
-         if (!obj)
diff --git a/www/firefox31/patches/patch-js_src_frontend_BytecodeCompiler.cpp b/www/firefox31/patches/patch-js_src_frontend_BytecodeCompiler.cpp
deleted file mode 100644
index 5c755b83c95..00000000000
--- a/www/firefox31/patches/patch-js_src_frontend_BytecodeCompiler.cpp
+++ /dev/null
@@ -1,13 +0,0 @@
-$NetBSD: patch-js_src_frontend_BytecodeCompiler.cpp,v 1.1 2014/11/06 12:26:51 joerg Exp $
-
---- js/src/frontend/BytecodeCompiler.cpp.orig	2014-11-05 15:54:54.000000000 +0000
-+++ js/src/frontend/BytecodeCompiler.cpp
-@@ -544,7 +544,7 @@ CompileFunctionBody(JSContext *cx, Mutab
- 
-     RootedScriptSource sourceObject(cx, CreateScriptSourceObject(cx, options));
-     if (!sourceObject)
--        return nullptr;
-+        return false;
-     ScriptSource *ss = sourceObject->source();
- 
-     SourceCompressionTask sct(cx);
diff --git a/www/firefox31/patches/patch-js_src_gc_Memory.cpp b/www/firefox31/patches/patch-js_src_gc_Memory.cpp
index 5c6f33742b9..5d11a0892db 100644
--- a/www/firefox31/patches/patch-js_src_gc_Memory.cpp
+++ b/www/firefox31/patches/patch-js_src_gc_Memory.cpp
@@ -1,4 +1,4 @@
-$NetBSD: patch-js_src_gc_Memory.cpp,v 1.1 2014/11/03 12:18:32 ryoon Exp $
+$NetBSD: patch-js_src_gc_Memory.cpp,v 1.2 2015/05/26 12:18:23 ryoon Exp $
 
 Make sure mmap() delivers memory with upper 17 bits clear on sparc64 on NetBSD:
 with topdown-vm we would map in the last 4 gig of the address space (past
@@ -7,10 +7,10 @@ the VA hole) otherwise by default, thus busting the JSValue restrictions.
 https://bugzilla.mozilla.org/show_bug.cgi?id=994133
 
 
---- js/src/gc/Memory.cpp.orig	2014-04-09 20:42:54.000000000 +0200
-+++ js/src/gc/Memory.cpp	2014-04-09 20:38:34.000000000 +0200
-@@ -312,7 +312,7 @@ gc::InitMemorySubsystem(JSRuntime *rt)
- static inline void *
+--- js/src/gc/Memory.cpp.orig	2015-05-05 02:53:53.000000000 +0000
++++ js/src/gc/Memory.cpp
+@@ -212,7 +212,7 @@ gc::InitMemorySubsystem(JSRuntime* rt)
+ static inline void*
  MapMemory(size_t length, int prot, int flags, int fd, off_t offset)
  {
 -#if defined(__ia64__)