gnu/packages/patches/icecat-CVE-2016-2818-pt8.patch

   1   changeset:   312069:3c2bd9158ad3
   2   user:        Timothy Nikkel <tnikkel@gmail.com>
   3   Date:        Tue May 10 22:58:47 2016 -0500
   4   summary:     Bug 1261752. Part 3. r=mats a=ritu
   5
   6 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 layout/forms/nsComboboxControlFrame.cpp
   7 --- a/layout/forms/nsComboboxControlFrame.cpp   Tue May 10 22:58:47 2016 -0500
   8 +++ b/layout/forms/nsComboboxControlFrame.cpp   Tue May 10 22:58:47 2016 -0500
   9 @@ -1417,7 +1417,11 @@
  10      // The popup's visibility doesn't update until the minimize animation has
  11      // finished, so call UpdateWidgetGeometry to update it right away.
  12      nsViewManager* viewManager = mDropdownFrame->GetView()->GetViewManager();
  13 -    viewManager->UpdateWidgetGeometry();
  14 +    viewManager->UpdateWidgetGeometry(); // might destroy us
  15 +  }
  16 +
  17 +  if (!weakFrame.IsAlive()) {
  18 +    return consume;
  19    }
  20
  21    return consume;
  22 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 view/nsViewManager.cpp
  23 --- a/view/nsViewManager.cpp    Tue May 10 22:58:47 2016 -0500
  24 +++ b/view/nsViewManager.cpp    Tue May 10 22:58:47 2016 -0500
  25 @@ -670,15 +670,16 @@
  26
  27  void nsViewManager::WillPaintWindow(nsIWidget* aWidget)
  28  {
  29 -  if (aWidget) {
  30 -    nsView* view = nsView::GetViewFor(aWidget);
  31 -    LayerManager *manager = aWidget->GetLayerManager();
  32 +  RefPtr<nsIWidget> widget(aWidget);
  33 +  if (widget) {
  34 +    nsView* view = nsView::GetViewFor(widget);
  35 +    LayerManager* manager = widget->GetLayerManager();
  36      if (view &&
  37          (view->ForcedRepaint() || !manager->NeedsWidgetInvalidation())) {
  38        ProcessPendingUpdates();
  39        // Re-get the view pointer here since the ProcessPendingUpdates might have
  40        // destroyed it during CallWillPaintOnObservers.
  41 -      view = nsView::GetViewFor(aWidget);
  42 +      view = nsView::GetViewFor(widget);
  43        if (view) {
  44          view->SetForcedRepaint(false);
  45        }
  46 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 widget/PuppetWidget.cpp
  47 --- a/widget/PuppetWidget.cpp   Tue May 10 22:58:47 2016 -0500
  48 +++ b/widget/PuppetWidget.cpp   Tue May 10 22:58:47 2016 -0500
  49 @@ -823,6 +823,8 @@
  50    mDirtyRegion.SetEmpty();
  51    mPaintTask.Revoke();
  52
  53 +  RefPtr<PuppetWidget> strongThis(this);
  54 +
  55    mAttachedWidgetListener->WillPaintWindow(this);
  56
  57    if (mAttachedWidgetListener) {
  58 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 widget/cocoa/nsChildView.mm
  59 --- a/widget/cocoa/nsChildView.mm       Tue May 10 22:58:47 2016 -0500
  60 +++ b/widget/cocoa/nsChildView.mm       Tue May 10 22:58:47 2016 -0500
  61 @@ -3716,6 +3716,8 @@
  62
  63  - (void)viewWillDraw
  64  {
  65 +  nsAutoRetainCocoaObject kungFuDeathGrip(self);
  66 +
  67    if (mGeckoChild) {
  68      // The OS normally *will* draw our NSWindow, no matter what we do here.
  69      // But Gecko can delete our parent widget(s) (along with mGeckoChild)
  70 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 widget/gonk/nsWindow.cpp
  71 --- a/widget/gonk/nsWindow.cpp  Tue May 10 22:58:47 2016 -0500
  72 +++ b/widget/gonk/nsWindow.cpp  Tue May 10 22:58:47 2016 -0500
  73 @@ -196,7 +196,7 @@
  74          return;
  75      }
  76
  77 -    nsWindow *targetWindow = (nsWindow *)sTopWindows[0];
  78 +    RefPtr<nsWindow> targetWindow = (nsWindow *)sTopWindows[0];
  79      while (targetWindow->GetLastChild())
  80          targetWindow = (nsWindow *)targetWindow->GetLastChild();
  81
  82 @@ -205,15 +205,15 @@
  83          listener->WillPaintWindow(targetWindow);
  84      }
  85
  86 -    LayerManager* lm = targetWindow->GetLayerManager();
  87 -    if (mozilla::layers::LayersBackend::LAYERS_CLIENT == lm->GetBackendType()) {
  88 -      // No need to do anything, the compositor will handle drawing
  89 -    } else {
  90 -        NS_RUNTIMEABORT("Unexpected layer manager type");
  91 -    }
  92 -
  93      listener = targetWindow->GetWidgetListener();
  94      if (listener) {
  95 +        LayerManager* lm = targetWindow->GetLayerManager();
  96 +        if (mozilla::layers::LayersBackend::LAYERS_CLIENT == lm->GetBackendType()) {
  97 +            // No need to do anything, the compositor will handle drawing
  98 +        } else {
  99 +            NS_RUNTIMEABORT("Unexpected layer manager type");
 100 +        }
 101 +
 102          listener->DidPaintWindow();
 103      }
 104  }
 105 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 widget/gtk/nsWindow.cpp
 106 --- a/widget/gtk/nsWindow.cpp   Tue May 10 22:58:47 2016 -0500
 107 +++ b/widget/gtk/nsWindow.cpp   Tue May 10 22:58:47 2016 -0500
 108 @@ -469,6 +469,12 @@
 109      }
 110  }
 111
 112 +nsIWidgetListener*
 113 +nsWindow::GetListener()
 114 +{
 115 +    return mAttachedWidgetListener ? mAttachedWidgetListener : mWidgetListener;
 116 +}
 117 +
 118  nsresult
 119  nsWindow::DispatchEvent(WidgetGUIEvent* aEvent, nsEventStatus& aStatus)
 120  {
 121 @@ -481,8 +487,7 @@
 122      aEvent->refPoint.y = GdkCoordToDevicePixels(aEvent->refPoint.y);
 123
 124      aStatus = nsEventStatus_eIgnore;
 125 -    nsIWidgetListener* listener =
 126 -        mAttachedWidgetListener ? mAttachedWidgetListener : mWidgetListener;
 127 +    nsIWidgetListener* listener = GetListener();
 128      if (listener) {
 129        aStatus = listener->HandleEvent(aEvent, mUseAttachedEvents);
 130      }
 131 @@ -2119,8 +2124,7 @@
 132      if (!mGdkWindow || mIsFullyObscured || !mHasMappedToplevel)
 133          return FALSE;
 134
 135 -    nsIWidgetListener *listener =
 136 -        mAttachedWidgetListener ? mAttachedWidgetListener : mWidgetListener;
 137 +    nsIWidgetListener *listener = GetListener();
 138      if (!listener)
 139          return FALSE;
 140
 141 @@ -2149,6 +2153,8 @@
 142          clientLayers->SendInvalidRegion(region);
 143      }
 144
 145 +    RefPtr<nsWindow> strongThis(this);
 146 +
 147      // Dispatch WillPaintWindow notification to allow scripts etc. to run
 148      // before we paint
 149      {
 150 @@ -2161,8 +2167,7 @@
 151
 152          // Re-get the listener since the will paint notification might have
 153          // killed it.
 154 -        listener =
 155 -            mAttachedWidgetListener ? mAttachedWidgetListener : mWidgetListener;
 156 +        listener = GetListener();
 157          if (!listener)
 158              return FALSE;
 159      }
 160 @@ -2223,6 +2228,13 @@
 161      // If this widget uses OMTC...
 162      if (GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_CLIENT) {
 163          listener->PaintWindow(this, region);
 164 +
 165 +        // Re-get the listener since the will paint notification might have
 166 +        // killed it.
 167 +        listener = GetListener();
 168 +        if (!listener)
 169 +            return TRUE;
 170 +
 171          listener->DidPaintWindow();
 172          return TRUE;
 173      }
 174 @@ -2307,6 +2319,13 @@
 175        if (GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_BASIC) {
 176          AutoLayerManagerSetup setupLayerManager(this, ctx, layerBuffering);
 177          painted = listener->PaintWindow(this, region);
 178 +
 179 +        // Re-get the listener since the will paint notification might have
 180 +        // killed it.
 181 +        listener = GetListener();
 182 +        if (!listener)
 183 +            return TRUE;
 184 +
 185        }
 186      }
 187
 188 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 widget/gtk/nsWindow.h
 189 --- a/widget/gtk/nsWindow.h     Tue May 10 22:58:47 2016 -0500
 190 +++ b/widget/gtk/nsWindow.h     Tue May 10 22:58:47 2016 -0500
 191 @@ -359,6 +359,7 @@
 192                                     GdkWindow** aWindow, gint* aButton,
 193                                     gint* aRootX, gint* aRootY);
 194      void               ClearCachedResources();
 195 +    nsIWidgetListener* GetListener();
 196
 197      GtkWidget          *mShell;
 198      MozContainer       *mContainer;
 199 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 widget/qt/nsWindow.cpp
 200 --- a/widget/qt/nsWindow.cpp    Tue May 10 22:58:47 2016 -0500
 201 +++ b/widget/qt/nsWindow.cpp    Tue May 10 22:58:47 2016 -0500
 202 @@ -857,18 +857,28 @@
 203
 204  // EVENTS
 205
 206 +nsIWidgetListener*
 207 +nsWindow::GetPaintListener()
 208 +{
 209 +    return mAttachedWidgetListener ? mAttachedWidgetListener : mWidgetListener;
 210 +}
 211 +
 212  void
 213  nsWindow::OnPaint()
 214  {
 215      LOGDRAW(("nsWindow::%s [%p]\n", __FUNCTION__, (void *)this));
 216 -    nsIWidgetListener* listener =
 217 -        mAttachedWidgetListener ? mAttachedWidgetListener : mWidgetListener;
 218 +    nsIWidgetListener* listener = GetPaintListener();
 219      if (!listener) {
 220          return;
 221      }
 222
 223      listener->WillPaintWindow(this);
 224
 225 +    nsIWidgetListener* listener = GetPaintListener();
 226 +    if (!listener) {
 227 +        return;
 228 +    }
 229 +
 230      switch (GetLayerManager()->GetBackendType()) {
 231          case mozilla::layers::LayersBackend::LAYERS_CLIENT: {
 232              nsIntRegion region(nsIntRect(0, 0, mWidget->width(), mWidget->height()));
 233 @@ -879,6 +889,11 @@
 234              NS_ERROR("Invalid layer manager");
 235      }
 236
 237 +    nsIWidgetListener* listener = GetPaintListener();
 238 +    if (!listener) {
 239 +        return;
 240 +    }
 241 +
 242      listener->DidPaintWindow();
 243  }
 244
 245 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 widget/qt/nsWindow.h
 246 --- a/widget/qt/nsWindow.h      Tue May 10 22:58:47 2016 -0500
 247 +++ b/widget/qt/nsWindow.h      Tue May 10 22:58:47 2016 -0500
 248 @@ -254,6 +254,7 @@
 249          bool needDispatch;
 250      } MozCachedMoveEvent;
 251
 252 +    nsIWidgetListener* GetPaintListener();
 253      bool               CheckForRollup(double aMouseX, double aMouseY, bool aIsWheel);
 254      void*              SetupPluginPort(void);
 255      nsresult           SetWindowIconList(const nsTArray<nsCString> &aIconList);
 256 diff -r 73cc9a2d8fc1 -r 3c2bd9158ad3 widget/windows/nsWindowGfx.cpp
 257 --- a/widget/windows/nsWindowGfx.cpp    Tue May 10 22:58:47 2016 -0500
 258 +++ b/widget/windows/nsWindowGfx.cpp    Tue May 10 22:58:47 2016 -0500
 259 @@ -298,6 +298,8 @@
 260      clientLayerManager->SendInvalidRegion(region);
 261    }
 262
 263 +  RefPtr<nsWindow> strongThis(this);
 264 +
 265    nsIWidgetListener* listener = GetPaintListener();
 266    if (listener) {
 267      listener->WillPaintWindow(this);