summary refs log tree commit diff
path: root/gnu
diff options
context:
space:
mode:
authorMark H Weaver <mhw@netris.org>2016-05-12 18:48:36 -0400
committerMark H Weaver <mhw@netris.org>2016-05-12 18:48:36 -0400
commit207c604637737408a3d4cd9214a9e69ce4b21bb3 (patch)
treec26225dd535e59866677b1dda1d1714b95f417a5 /gnu
parent11d7d7b5d399f38712eb68ab9a20e5dc0d6ef30e (diff)
parentef06d54a9b9ee4fb5015c78ab94f8df1d3a72f1d (diff)
downloadguix-207c604637737408a3d4cd9214a9e69ce4b21bb3.tar.gz
Merge branch 'gnome-updates'
Diffstat (limited to 'gnu')
-rw-r--r--gnu/local.mk18
-rw-r--r--gnu/packages/fontutils.scm29
-rw-r--r--gnu/packages/freedesktop.scm4
-rw-r--r--gnu/packages/game-development.scm10
-rw-r--r--gnu/packages/glib.scm138
-rw-r--r--gnu/packages/gnome.scm432
-rw-r--r--gnu/packages/gnuzilla.scm16
-rw-r--r--gnu/packages/gstreamer.scm3
-rw-r--r--gnu/packages/gtk.scm95
-rw-r--r--gnu/packages/inkscape.scm7
-rw-r--r--gnu/packages/key-mon.scm13
-rw-r--r--gnu/packages/music.scm12
-rw-r--r--gnu/packages/patches/glib-tests-desktop.patch138
-rw-r--r--gnu/packages/patches/glib-tests-gapplication.patch28
-rw-r--r--gnu/packages/patches/glib-tests-homedir.patch59
-rw-r--r--gnu/packages/patches/glib-tests-prlimit.patch14
-rw-r--r--gnu/packages/patches/glib-tests-timer.patch11
-rw-r--r--gnu/packages/patches/gtk2-theme-paths.patch41
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-2805.patch75
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch35
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch69
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch33
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch37
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch35
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-2808.patch389
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-2814.patch35
-rw-r--r--gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch24
-rw-r--r--gnu/packages/patches/icecat-update-bundled-graphite2.patch2488
-rw-r--r--gnu/packages/patches/inkscape-drop-wait-for-targets.patch68
-rw-r--r--gnu/packages/patches/poppler-CVE-2015-8868.patch30
-rw-r--r--gnu/packages/patches/totem-debug-format-fix.patch11
-rw-r--r--gnu/packages/pdf.scm24
-rw-r--r--gnu/packages/xdisorg.scm4
33 files changed, 539 insertions, 3886 deletions
diff --git a/gnu/local.mk b/gnu/local.mk
index e7001ec455..acb979067b 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -498,11 +498,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/ghostscript-CVE-2015-3228.patch		\
   gnu/packages/patches/ghostscript-runpath.patch		\
   gnu/packages/patches/glib-networking-ssl-cert-file.patch	\
-  gnu/packages/patches/glib-tests-desktop.patch			\
-  gnu/packages/patches/glib-tests-homedir.patch			\
-  gnu/packages/patches/glib-tests-prlimit.patch			\
   gnu/packages/patches/glib-tests-timer.patch			\
-  gnu/packages/patches/glib-tests-gapplication.patch		\
   gnu/packages/patches/glibc-CVE-2015-7547.patch		\
   gnu/packages/patches/glibc-bootstrap-system.patch		\
   gnu/packages/patches/glibc-hurd-extern-inline.patch		\
@@ -529,6 +525,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/guile-relocatable.patch			\
   gnu/packages/patches/guile-rsvg-pkgconfig.patch		\
   gnu/packages/patches/gtk2-respect-GUIX_GTK2_PATH.patch	\
+  gnu/packages/patches/gtk2-theme-paths.patch			\
   gnu/packages/patches/gtk3-respect-GUIX_GTK3_PATH.patch	\
   gnu/packages/patches/gtkglext-disable-disable-deprecated.patch \
   gnu/packages/patches/hdf5-config-date.patch			\
@@ -539,20 +536,11 @@ dist_patch_DATA =						\
   gnu/packages/patches/hypre-doc-tables.patch			\
   gnu/packages/patches/hypre-ldflags.patch			\
   gnu/packages/patches/icecat-avoid-bundled-includes.patch	\
-  gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch	\
-  gnu/packages/patches/icecat-update-bundled-graphite2.patch	\
-  gnu/packages/patches/icecat-CVE-2016-2805.patch		\
-  gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch		\
-  gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch		\
-  gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch		\
-  gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch		\
-  gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch		\
-  gnu/packages/patches/icecat-CVE-2016-2808.patch		\
-  gnu/packages/patches/icecat-CVE-2016-2814.patch		\
   gnu/packages/patches/icu4c-CVE-2014-6585.patch		\
   gnu/packages/patches/icu4c-CVE-2015-1270.patch		\
   gnu/packages/patches/icu4c-CVE-2015-4760.patch		\
   gnu/packages/patches/ilmbase-fix-tests.patch			\
+  gnu/packages/patches/inkscape-drop-wait-for-targets.patch	\
   gnu/packages/patches/irrlicht-mesa-10.patch			\
   gnu/packages/patches/jasper-CVE-2007-2721.patch		\
   gnu/packages/patches/jasper-CVE-2008-3520.patch		\
@@ -691,7 +679,6 @@ dist_patch_DATA =						\
   gnu/packages/patches/plink-1.07-unclobber-i.patch		\
   gnu/packages/patches/plotutils-libpng-jmpbuf.patch		\
   gnu/packages/patches/polkit-drop-test.patch			\
-  gnu/packages/patches/poppler-CVE-2015-8868.patch		\
   gnu/packages/patches/portaudio-audacity-compat.patch		\
   gnu/packages/patches/portmidi-modular-build.patch		\
   gnu/packages/patches/procmail-ambiguous-getline-debian.patch  \
@@ -752,6 +739,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/ttfautohint-source-date-epoch.patch	\
   gnu/packages/patches/tophat-build-with-later-seqan.patch	\
   gnu/packages/patches/torsocks-dns-test.patch			\
+  gnu/packages/patches/totem-debug-format-fix.patch		\
   gnu/packages/patches/unzip-CVE-2014-8139.patch		\
   gnu/packages/patches/unzip-CVE-2014-8140.patch		\
   gnu/packages/patches/unzip-CVE-2014-8141.patch		\
diff --git a/gnu/packages/fontutils.scm b/gnu/packages/fontutils.scm
index 5f6ff15935..05adc71212 100644
--- a/gnu/packages/fontutils.scm
+++ b/gnu/packages/fontutils.scm
@@ -46,23 +46,21 @@
 (define-public freetype
   (package
    (name "freetype")
-   (version "2.6")
+   (version "2.6.3")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://savannah/freetype/freetype-"
                                 version ".tar.bz2"))
             (sha256 (base32
-                     "0zilx15fwcpa8hmcxpc423jwb8ijw4qpq968kh18akvn4j0znsc4"))))
+                     "18k3b026762lmyrxfil5xv8qwnvj7hc12gz9bjqzbb12lmx707ip"))))
    (build-system gnu-build-system)
-   (arguments
-    `(#:phases
-       ;; This should not be necessary; reported upstream as
-       ;; https://savannah.nongnu.org/bugs/index.php?44261
-       (alist-cons-before
-        'configure 'set-paths
-        (lambda _
-          (setenv "CONFIG_SHELL" (which "bash")))
-        %standard-phases)))
+   (native-inputs
+    `(("pkg-config" ,pkg-config)))
+   (propagated-inputs
+    ;; These are all in the Requires.private field of freetype2.pc.
+    ;; XXX: add harfbuzz.
+    `(("libpng" ,libpng)
+      ("zlib" ,zlib)))
    (synopsis "Font rendering library")
    (description
     "Freetype is a library that can be used by applications to access the
@@ -361,16 +359,15 @@ applications should be.")
 (define-public graphite2
   (package
    (name "graphite2")
-   (version "1.3.6")
+   (version "1.3.8")
    (source
      (origin
        (method url-fetch)
-       (uri (string-append "https://github.com/silnrsi/graphite/archive/"
-                           version ".tar.gz"))
-       (file-name (string-append name "-" version ".tar.gz"))
+       (uri (string-append "https://github.com/silnrsi/graphite/releases/"
+                           "download/" version "/" name "-" version ".tgz"))
        (sha256
         (base32
-         "1frd9mjaqzvh9gs74ngc43igi53vzjzlwr5chbrs6ii1hc4aa23s"))))
+         "1hlc9j7w7gihy6gvzfa7902pr6yxq1sr1xkp5rwf0p29m2rjagwz"))))
    (build-system cmake-build-system)
    (native-inputs
     `(("python" ,python-2) ; because of "import imap" in tests
diff --git a/gnu/packages/freedesktop.scm b/gnu/packages/freedesktop.scm
index 24c4564689..0b4eca9a5a 100644
--- a/gnu/packages/freedesktop.scm
+++ b/gnu/packages/freedesktop.scm
@@ -338,14 +338,14 @@ Analysis and Reporting Technology) functionality.")
 (define-public udisks
   (package
     (name "udisks")
-    (version "2.1.6")
+    (version "2.1.7")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://udisks.freedesktop.org/releases/"
                                   name "-" version ".tar.bz2"))
               (sha256
                (base32
-                "0spl155k0g2l2hvqf8xyjv08i68gfyhzpjva6cwlzxx0bz4gbify"))))
+                "119pr2zbff8vkwlhghim7d7ir24c1dil9hp4q49wm4f6pnrjpbmb"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("glib:bin" ,glib "bin") ; for glib-mkenums
diff --git a/gnu/packages/game-development.scm b/gnu/packages/game-development.scm
index 86cbb2d41e..bc0051d4c6 100644
--- a/gnu/packages/game-development.scm
+++ b/gnu/packages/game-development.scm
@@ -374,15 +374,7 @@ etc.")
              "-DENABLE_UPDATER=0" ; no auto-updates
              (string-append "-DFREETYPE_INCLUDE_DIR="
                             (assoc-ref %build-inputs "freetype")
-                            "/include/freetype2"))
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'patch-freetype-utils
-           (lambda _
-             ;; Fix C preprocessor include directive.
-             (substitute* '("src/app/util/freetype_utils.cpp")
-               (("freetype/") ""))
-             #t)))))
+                            "/include/freetype2"))))
     (native-inputs
      `(("pkg-config" ,pkg-config)))
     ;; TODO: Use a patched Allegro 4 that supports window resizing.  This
diff --git a/gnu/packages/glib.scm b/gnu/packages/glib.scm
index e7e9df8dff..70020520eb 100644
--- a/gnu/packages/glib.scm
+++ b/gnu/packages/glib.scm
@@ -35,6 +35,7 @@
   #:use-module (gnu packages gettext)
   #:use-module (gnu packages gtk)
   #:use-module (gnu packages libffi)
+  #:use-module (gnu packages pcre)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
@@ -59,7 +60,7 @@
 (define dbus
   (package
     (name "dbus")
-    (version "1.10.0")
+    (version "1.10.8")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -67,7 +68,7 @@
                     version ".tar.gz"))
               (sha256
                (base32
-                "0jwj7wlrhq5y0fwfh8k2d9rgdpfax06lj8698g6iqbwrzd2rgyqx"))
+                "0560y3hxpgh346w6avcrcz79c8ansmn771y5xpcvvlr6m8mx5wxs"))
               (patches (search-patches "dbus-helper-search-path.patch"))))
     (build-system gnu-build-system)
     (arguments
@@ -129,7 +130,7 @@ shared NFS home directories.")
 (define glib
   (package
    (name "glib")
-   (version "2.46.1")
+   (version "2.48.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/"
@@ -137,16 +138,14 @@ shared NFS home directories.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "1yzxr1ip3l0m9ydk5nq32piq70c9f17p5f0jyvlsghzbaawh67ss"))
-            (patches (search-patches "glib-tests-homedir.patch"
-                                     "glib-tests-desktop.patch"
-                                     "glib-tests-prlimit.patch"
-                                     "glib-tests-timer.patch"
-                                     "glib-tests-gapplication.patch"))))
+              "0d3w2hblrw7vvpx60l1kbvb830ygn3v8zhwdz65cc5593j9ycjvl"))
+            (patches (search-patches "glib-tests-timer.patch"))))
    (build-system gnu-build-system)
    (outputs '("out"           ; everything
               "bin"           ; glib-mkenums, gtester, etc.; depends on Python
               "doc"))         ; 20 MiB of GTK-Doc reference
+   (propagated-inputs
+    `(("pcre" ,pcre))) ; in the Requires.private field of glib-2.0.pc
    (inputs
     `(("coreutils" ,coreutils)
       ("libffi" ,libffi)
@@ -160,29 +159,87 @@ shared NFS home directories.")
       ("perl" ,perl)                              ; needed by GIO tests
       ("bash" ,bash)))
    (arguments
-    '(#:phases (alist-cons-before
-                'build 'pre-build
-                (lambda* (#:key inputs outputs #:allow-other-keys)
-                  ;; For tests/gdatetime.c.
-                  (setenv "TZDIR"
-                          (string-append (assoc-ref inputs "tzdata")
-                                         "/share/zoneinfo"))
-
-                  ;; Some tests want write access there.
-                  (setenv "XDG_CACHE_HOME" (getcwd))
-
-                  (substitute* '("glib/gspawn.c"
-                                 "glib/tests/utils.c"
-                                 "tests/spawn-test.c")
-                    (("/bin/sh")
-                     (string-append (assoc-ref inputs "bash") "/bin/sh")))
-
-                  ;; Disable a test that requires dbus.
-                  (substitute* "gio/tests/gdbus-serialization.c"
-                    (("g_test_add_func \
-\\(\"/gdbus/message-serialize/double-array\", test_double_array\\);" all)
-                     (string-append "/* " all " */"))))
-                %standard-phases)
+    '(#:phases
+      (modify-phases %standard-phases
+        (add-before 'build 'pre-build
+          (lambda* (#:key inputs outputs #:allow-other-keys)
+            ;; For tests/gdatetime.c.
+            (setenv "TZDIR"
+                    (string-append (assoc-ref inputs "tzdata")
+                                   "/share/zoneinfo"))
+
+            ;; Some tests want write access there.
+            (setenv "HOME" (getcwd))
+            (setenv "XDG_CACHE_HOME" (getcwd))
+
+            (substitute* '("glib/gspawn.c"
+                           "glib/tests/utils.c"
+                           "tests/spawn-test.c")
+              (("/bin/sh")
+               (string-append (assoc-ref inputs "bash") "/bin/sh")))))
+        (add-before 'check 'disable-failing-tests
+          (lambda _
+            (let ((disable
+                   (lambda (test-file test-paths)
+                     (define pattern+procs
+                       (map (lambda (test-path)
+                              (cons
+                               ;; XXX: only works for single line statements.
+                               (format #f "g_test_add_func.*\"~a\".*" test-path)
+                               (const "")))
+                            test-paths))
+                     (substitute test-file pattern+procs)))
+                  (failing-tests
+                   '(("glib/tests/thread.c"
+                      (;; prlimit(2) returns ENOSYS on Linux 2.6.32-5-xen-amd64
+                       ;; as found on hydra.gnu.org, and strace(1) doesn't
+                       ;; recognize it.
+                       "/thread/thread4"))
+
+                     ("glib/tests/timer.c"
+                      (;; fails if compiler optimizations are enabled, which they
+                       ;; are by default.
+                       "/timer/stop"))
+
+                     ("gio/tests/gapplication.c"
+                      (;; XXX: proven to be unreliable.  See:
+                       ;;  <https://bugs.debian.org/756273>
+                       ;;  <http://bugs.gnu.org/18445>
+                       "/gapplication/quit"
+
+                       ;; XXX: fails randomly for unknown reason. See:
+                       ;;  <https://lists.gnu.org/archive/html/guix-devel/2016-04/msg00215.html>
+                       "/gapplication/local-actions"))
+
+                     ("gio/tests/contenttype.c"
+                      (;; XXX: requires shared-mime-info.
+                       "/contenttype/guess"
+                       "/contenttype/subtype"
+                       "/contenttype/list"
+                       "/contenttype/icon"
+                       "/contenttype/symbolic-icon"
+                       "/contenttype/tree"))
+
+                     ("gio/tests/appinfo.c"
+                      (;; XXX: requires update-desktop-database.
+                       "/appinfo/associations"))
+
+                     ("gio/tests/desktop-app-info.c"
+                      (;; XXX: requires update-desktop-database.
+                       "/desktop-app-info/delete"
+                       "/desktop-app-info/default"
+                       "/desktop-app-info/fallback"
+                       "/desktop-app-info/lastused"
+                       "/desktop-app-info/search"))
+
+                     ("gio/tests/gdbus-peer.c"
+                      (;; Requires /etc/machine-id.
+                       "/gdbus/codegen-peer-to-peer"))
+
+                     ("gio/tests/gdbus-unix-addresses.c"
+                      (;; Requires /etc/machine-id.
+                       "/gdbus/x11-autolaunch")))))
+              (and-map (lambda (x) (apply disable x)) failing-tests)))))
 
       ;; Note: `--docdir' and `--htmldir' are not honored, so work around it.
       #:configure-flags (list (string-append "--with-html-dir="
@@ -218,14 +275,14 @@ dynamic loading, and an object system.")
 (define gobject-introspection
   (package
     (name "gobject-introspection")
-    (version "1.46.0")
+    (version "1.48.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/"
                    "gobject-introspection/" (version-major+minor version)
                    "/gobject-introspection-" version ".tar.xz"))
              (sha256
-              (base32 "0cs27r18fga44ypp8icy62fwx6nh70r1bvhi4lzfn4w85cybsn36"))
+              (base32 "0xsqwxhfqzr79av89mg766kxpb2i41bd0vwspk01xjdzrnn5l9zs"))
              (modules '((guix build utils)))
              (snippet
               '(substitute* "tools/g-ir-tool-template.in"
@@ -237,7 +294,6 @@ dynamic loading, and an object system.")
     (build-system gnu-build-system)
     (inputs
      `(("bison" ,bison)
-       ("cairo" ,cairo)
        ("flex" ,flex)
        ("glib" ,glib)
        ("python-2" ,python-2)))
@@ -395,7 +451,7 @@ by GDBus included in Glib.")
 (define libsigc++
   (package
     (name "libsigc++")
-    (version "2.6.1")
+    (version "2.8.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/libsigc++/"
@@ -403,7 +459,7 @@ by GDBus included in Glib.")
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
-               "06xyvxaaxh3nbpjg86gcq5zcc2qnpx354wcfrqlhbndkq5kj2vqq"))))
+               "0lcnzzdq6718znfshs1hflpwqq6awbzwdyp4kv5lfaf54z880jbp"))))
     (build-system gnu-build-system)
     (native-inputs `(("pkg-config" ,pkg-config)
                      ("m4" ,m4)))
@@ -422,7 +478,7 @@ has an ease of use unmatched by other C++ callback libraries.")
 (define glibmm
   (package
     (name "glibmm")
-    (version "2.46.3")
+    (version "2.48.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/glibmm/"
@@ -430,7 +486,7 @@ has an ease of use unmatched by other C++ callback libraries.")
                                  "/glibmm-" version ".tar.xz"))
              (sha256
               (base32
-               "1kw65mlabwdjw86jybxslncbnnx40hcx4z6xpq9i4ymjvsnm91n7"))))
+               "1pvw2mrm03p51p03179rb6fk9p42iykkwj1jcdv7jr265xymy8nw"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases (alist-cons-before
@@ -503,7 +559,7 @@ useful for C++.")
 (define-public python-pygobject
   (package
     (name "python-pygobject")
-    (version "3.18.0")
+    (version "3.20.0")
     (source
      (origin
        (method url-fetch)
@@ -512,7 +568,7 @@ useful for C++.")
                            "/pygobject-" version ".tar.xz"))
        (sha256
         (base32
-         "1jbd2m39vcjh5h3m33l0317ziq8dxfzi40r6hrfcs4rp5l8s2fqw"))))
+         "0ikzh3l7g1gjh8jj8vg6mdvrb25svp63gxcam4m0i404yh0lgari"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("which" ,which)
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 5169368562..83e4f83163 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -187,7 +187,7 @@ commonly used macros.")
 (define-public gnome-desktop
   (package
     (name "gnome-desktop")
-    (version "3.18.1")
+    (version "3.20.1")
     (source
      (origin
       (method url-fetch)
@@ -196,7 +196,7 @@ commonly used macros.")
                           name "-" version ".tar.xz"))
       (sha256
        (base32
-        "0avpmyhzz5b3pyfpkp8iq5ym5r5w7zs3a396hqkdpdsiym0vrazc"))))
+        "0h6185lmkaf49dr43pb6gsb9yi25rc32n7dq5186hwln38mppb3f"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("gobject-introspection" ,gobject-introspection)
@@ -264,7 +264,7 @@ and keep up to date translations of documentation.")
 (define-public gcr
   (package
     (name "gcr")
-    (version "3.18.0")
+    (version "3.20.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/" name "/"
@@ -272,7 +272,7 @@ and keep up to date translations of documentation.")
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
-               "006f6xbd3jppkf9avg83mpqdld5d0z6mr0sm81lql52mmyjnvlfl"))))
+               "0ydk9dzxx6snxza7j5ps8x932hbr3x1b8hhcaqjq4w4admi2qmwh"))))
     (build-system gnu-build-system)
     (arguments
      '(#:tests? #f ;25 of 598 tests fail because /var/lib/dbus/machine-id does
@@ -341,7 +341,7 @@ GNOME Desktop.")
 (define-public gnome-keyring
   (package
     (name "gnome-keyring")
-    (version "3.18.3")
+    (version "3.20.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/" name "/"
@@ -349,7 +349,7 @@ GNOME Desktop.")
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
-               "167dq1yvm080g5s38hqjl0xx5cgpkcl1xqy9p5sxmgc92zb0srrz"))))
+               "16gcwwcg91ipxjmiyi4c4njvnxixmv1i278p0bilc3lafk6ww5xw"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f ;48 of 603 tests fail because /var/lib/dbus/machine-id does
@@ -409,7 +409,7 @@ forgotten when the session ends.")
 (define-public evince
   (package
     (name "evince")
-    (version "3.18.1")
+    (version "3.20.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/" name "/"
@@ -417,7 +417,7 @@ forgotten when the session ends.")
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
-               "0cccmbvl1b6d2976642iyfr8g3r69zf3mzl2ln6vjvvdbrv26l3v"))))
+               "1052lm4i5qq27sgk6ck5xc1cxh0qx4zzhifjhmzjlv38afj5i0yg"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      `(#:configure-flags '("--disable-nautilus")
@@ -473,7 +473,7 @@ on the GNOME Desktop with a single simple application.")
 (define-public gsettings-desktop-schemas
   (package
     (name "gsettings-desktop-schemas")
-    (version "3.18.0")
+    (version "3.20.0")
     (source
      (origin
       (method url-fetch)
@@ -482,7 +482,7 @@ on the GNOME Desktop with a single simple application.")
                           name "-" version ".tar.xz"))
       (sha256
        (base32
-        "1szc857f46spdhrbnq9ci3kwfqg5vwpikbf0hprq6vd94rr369xs"))))
+        "1hfrqqsmqscgbnaikmyq4yq8h72554wdg13algh5bf8a7i9ip92m"))))
     (build-system gnu-build-system)
     (inputs
      `(("glib" ,glib)))
@@ -598,7 +598,7 @@ update-desktop-database: updates the database containing a cache of MIME types
 (define-public adwaita-icon-theme
   (package (inherit gnome-icon-theme)
     (name "adwaita-icon-theme")
-    (version "3.18.0")
+    (version "3.20")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -606,19 +606,19 @@ update-desktop-database: updates the database containing a cache of MIME types
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0n0fqlg55krw8pgn4z2vxnxh65lyvcydqkrr7klqxp8z00kfg72y"))))))
+                "0ddfwwqx8s63qbqimmbb015lqsab4s0rvy1j81jdsh7k95rqh2ks"))))))
 
 (define-public shared-mime-info
   (package
     (name "shared-mime-info")
-    (version "1.2")
+    (version "1.6")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://freedesktop.org/~hadess/"
                                  "shared-mime-info-" version ".tar.xz"))
              (sha256
               (base32
-               "0y5vi0vr6rbhvfzcfg57cfskn362bpvcpca9cy598nmr87i6lld5"))))
+               "0k637g047gci8g69bg4g19akylpfraxm40hd30j3i4v7cidziy5j"))))
     (build-system gnu-build-system)
     (arguments
      ;; The build system appears not to be parallel-safe.
@@ -696,7 +696,7 @@ some form of information without getting in the user's way.")
 (define-public libpeas
   (package
     (name "libpeas")
-    (version "1.16.0")
+    (version "1.18.0")
     (source
      (origin
       (method url-fetch)
@@ -705,14 +705,14 @@ some form of information without getting in the user's way.")
                           name "-" version ".tar.xz"))
       (sha256
        (base32
-        "0kj5n5hz93xq7qdb2r7n86nibzwqjr88jxaih1fdbxv5rn7014xh"))))
+        "09jy2rwwgp0xx7cnypxl56m7zzxnj3j4v58xqjxjasf3chn88jdz"))))
     (build-system gnu-build-system)
     (inputs
-     `(("atk" ,atk)
-       ("gdk-pixbuf" ,gdk-pixbuf)
-       ("glib" ,glib)
-       ("gtk+" ,gtk+)
-       ("pango" ,pango)))
+     `(("gtk+" ,gtk+)
+       ("glade" ,glade3)
+       ("libxml2" ,libxml2) ; XXX: required by gladeui-2.0.pc
+       ("python" ,python)
+       ("python-pygobject" ,python-pygobject)))
     (native-inputs
      `(("pkg-config" ,pkg-config)
        ("glib:bin" ,glib "bin")
@@ -759,7 +759,7 @@ API add-ons to make GTK+ widgets OpenGL-capable.")
 (define-public glade3
   (package
     (name "glade")
-    (version "3.18.3")
+    (version "3.20.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -767,8 +767,8 @@ API add-ons to make GTK+ widgets OpenGL-capable.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0lk4nvd5s8px9i0pbq7bncikgn2lpx7vjh787d3cvzpvwx3cxnzc"))))
-    (build-system gnu-build-system)
+                "1zhqvhagy0m85p54jfiayfl0v9af7g0lj7glw8sfwh7cbp56vnc2"))))
+    (build-system glib-or-gtk-build-system)
     (arguments
      `(#:tests? #f ; needs X, GL, and software rendering
        #:phases
@@ -803,7 +803,7 @@ the GNOME desktop environment.")
 (define-public libcroco
   (package
     (name "libcroco")
-    (version "0.6.8")
+    (version "0.6.11")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -811,7 +811,7 @@ the GNOME desktop environment.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0w453f3nnkbkrly7spx5lx5pf6mwynzmd5qhszprq8amij2invpa"))))
+                "0mm0wldbi40am5qn0nv7psisbg01k42rwzjxl3gv11l5jj554aqk"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
@@ -833,7 +833,7 @@ XML/CSS rendering engine.")
 (define-public libgsf
   (package
     (name "libgsf")
-    (version "1.14.34")
+    (version "1.14.36")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -841,7 +841,7 @@ XML/CSS rendering engine.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0a5m1i5gp4m2z0cn2x1rrdm8wgrr04bzv65l8pgp6jipw13s9zph"))))
+                "0h19ssxzz0cmznwga2xy55kjibm24mwxqarnpd0w7xy0hrzm1dvi"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("intltool" ,intltool)
@@ -866,7 +866,7 @@ dealing with different structured file formats.")
 (define-public librsvg
   (package
     (name "librsvg")
-    (version "2.40.13")
+    (version "2.40.15")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -874,12 +874,12 @@ dealing with different structured file formats.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "014q7gz6mgfa7pfn0lr13qqv568ad8j1sw9d4vksnpazq0zajvjd"))))
+                "1x05vd2llpmskq3prkp7kbpmshmpp9whj4kfl99ybipf4fhw9jnr"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
        (alist-cons-before
-        'configure 'augment-gir-search-path
+        'configure 'pre-configure
         (lambda* (#:key inputs #:allow-other-keys)
           (substitute* "gdk-pixbuf-loader/Makefile.in"
             ;; By default the gdk-pixbuf loader is installed under
@@ -888,24 +888,10 @@ dealing with different structured file formats.")
              (string-append "gdk_pixbuf_moduledir = "
                             "$(prefix)/lib/gdk-pixbuf-2.0/2.10.0/"
                              "loaders\n"))
-            ;; Likewise, create a separate 'loaders.cache' file.
+            ;; Drop the 'loaders.cache' file, it's in gdk-pixbuf+svg.
             (("gdk_pixbuf_cache_file = .*$")
-             "gdk_pixbuf_cache_file = $(gdk_pixbuf_moduledir).cache\n")))
-        (alist-cons-after
-         'install 'generate-full-cache
-         (lambda* (#:key inputs outputs #:allow-other-keys)
-           (let ((loaders-directory
-                  (string-append (assoc-ref outputs "out")
-                                 "/lib/gdk-pixbuf-2.0/2.10.0/loaders")))
-             (zero?
-              (system
-               (string-append
-                "gdk-pixbuf-query-loaders "
-                loaders-directory "/libpixbufloader-svg.so "
-                (string-join (find-files (assoc-ref inputs "gdk-pixbuf")
-                                         "libpixbufloader-.*\\.so") " ")
-                "> " loaders-directory ".cache")))))
-         %standard-phases))))
+             "gdk_pixbuf_cache_file = $(TMPDIR)/loaders.cache\n")))
+        %standard-phases)))
     (native-inputs
      `(("pkg-config" ,pkg-config)
        ("glib" ,glib "bin")                               ; glib-mkenums, etc.
@@ -1338,14 +1324,7 @@ widgets built in the loading process.")
                                   name "-" version ".tar.bz2"))
               (sha256
                (base32
-                "129ka3nn8gx9dlfry17ib79azxk45wzfv5rgqzw6dwx2b5ns8phm"))
-              (modules '((guix build utils)))
-              (snippet
-               ;; Adapt to newer freetype. As the package is deprecated, there
-               ;; is no use in creating a patch and reporting it.
-               '(substitute* '("libgnomeprint/gnome-font-face.c"
-                               "libgnomeprint/gnome-rfont.c")
-                  (("freetype/") "freetype2/")))))
+                "129ka3nn8gx9dlfry17ib79azxk45wzfv5rgqzw6dwx2b5ns8phm"))))
     (build-system gnu-build-system)
     (inputs
      `(("popt" ,popt)
@@ -1442,14 +1421,14 @@ controls using the Bonobo component framework.")
 (define-public libwnck
   (package
     (name "libwnck")
-    (version "3.14.0")
+    (version "3.14.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
                                   (version-major+minor version) "/"
                                   name "-" version ".tar.xz"))
               (sha256
-               (base32 "074jww04z8g9r1acndqap79wx4kbm3rpkf4lcg1v82b66iv0027m"))))
+               (base32 "1ymya8gkjygvg0i901wr3q6ihfqxx5yf4g4pb6fag2iw8af3qr5v"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -1488,14 +1467,14 @@ Hints specification (EWMH).")
 (define-public goffice
   (package
     (name "goffice")
-    (version "0.10.24")
+    (version "0.10.28")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
                                   (version-major+minor version)  "/"
                                   name "-" version ".tar.xz"))
               (sha256
-               (base32 "0nmghi26dpjcw7knkviq031crhm0zjy4k650pv1jj3hb1fmhx9yd"))))
+               (base32 "12rsgxrixkfpk420gv026i74pnlgqjzsvm6vffrmih54w46hd3q6"))))
     (build-system gnu-build-system)
     (outputs '("out"
                "doc"))                            ;4.1 MiB of gtk-doc
@@ -1553,7 +1532,7 @@ Hints specification (EWMH).")
 (define-public gnumeric
   (package
     (name "gnumeric")
-    (version "1.12.24")
+    (version "1.12.28")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -1561,7 +1540,7 @@ Hints specification (EWMH).")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0lcm8k0jb8rd5y4ii803f21nv8rx6gc3mmdlrj5h0rkkn9qm57f5"))))
+                "1fsdp7r6fhc0m3fb4ly4xwh83v3hp2zrv9d0713g4lcy709svm02"))))
     (build-system gnu-build-system)
     (arguments
      `(;; The gnumeric developers don't worry much about failing tests.
@@ -1590,10 +1569,11 @@ Hints specification (EWMH).")
        ("libxml2" ,libxml2)
        ("libxslt" ,libxslt)
        ("python" ,python-2)
-       ("python2-pygobject" ,python2-pygobject-2)
+       ("python2-pygobject" ,python2-pygobject)
        ("zlib" ,zlib)))
     (native-inputs
-     `(("intltool" ,intltool)
+     `(("bison" ,bison)
+       ("intltool" ,intltool)
        ("glib:bin" ,glib "bin")
        ("pkg-config" ,pkg-config)))
     (home-page "http://www.gnumeric.org")
@@ -1611,7 +1591,7 @@ engineering.")
 (define-public gnome-themes-standard
   (package
     (name "gnome-themes-standard")
-    (version "3.18.0")
+    (version "3.20")
     (source
      (origin
        (method url-fetch)
@@ -1620,7 +1600,7 @@ engineering.")
                            version ".tar.xz"))
        (sha256
         (base32
-         "1jxss8kxszhf66vic9n1sagczm5amm0mgxpzyxyjna15q82fnip6"))))
+         "1p1vvmzfky1ax3yv9ld10xgqwydhmglxpgq3skrfc4539nrq9phw"))))
     (build-system gnu-build-system)
     (inputs
      `(("gtk+" ,gtk+)
@@ -1632,18 +1612,6 @@ engineering.")
      `(("intltool" ,intltool)
        ("glib:bin" ,glib "bin")
        ("pkg-config" ,pkg-config)))
-    (arguments
-     `(#:phases
-       (alist-cons-before
-        'build 'use-full-cache
-        ;; Use librsvg's loaders.cache instead of the one provided by
-        ;; gdk-pixbuf because the latter does not include support for SVG
-        ;; files.
-        (lambda* (#:key inputs #:allow-other-keys)
-          (setenv "GDK_PIXBUF_MODULE_FILE"
-                  (car (find-files (assoc-ref inputs "librsvg")
-                                   "loaders\\.cache"))))
-        %standard-phases)))
     (home-page "https://launchpad.net/gnome-themes-standard")
     (synopsis "Default GNOME 3 themes")
     (description
@@ -1653,7 +1621,7 @@ engineering.")
 (define-public seahorse
   (package
     (name "seahorse")
-    (version "3.18.0")
+    (version "3.20.0")
     (source
      (origin
        (method url-fetch)
@@ -1662,7 +1630,7 @@ engineering.")
                            version ".tar.xz"))
        (sha256
         (base32
-         "0rxnq47xcagmpqb63g49ay3lfiyjjnmmiay9yifx5jn406d8h32k"))))
+         "1py6fj19kb8aaxvg6yrpd0876azc2zjvis98aqz37a2lxmhp9c72"))))
     (build-system glib-or-gtk-build-system)
     (inputs
      `(("gtk+" ,gtk+)
@@ -1689,7 +1657,7 @@ passwords in the GNOME keyring.")
 (define-public vala
   (package
     (name "vala")
-    (version "0.30.0")
+    (version "0.32.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -1697,7 +1665,7 @@ passwords in the GNOME keyring.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1pyyhfw3zzbhxfscbn8xz70dg6vx0kh8gshzikpxczhg01xk7w31"))))
+                "0vpvq403vdd25irvgk7zibz3nw4x4i17m0dgnns8j1q4vr7am8h7"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -1729,7 +1697,7 @@ libraries written in C.")
 (define-public vte
   (package
     (name "vte")
-    (version "0.42.3")
+    (version "0.44.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -1737,8 +1705,16 @@ libraries written in C.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1832mrw2hhgjipbsfsv2fmdnwnar4rkx589ciz008bg8x908mscn"))))
+                "0kjxzqcwqxky0l7bl8ydn9hl6fm1f0k2pl91wbbhyq4z6d4dabbi"))))
     (build-system gnu-build-system)
+    (arguments
+     ;; XXX: fails to compile tests with the default flags.
+     ;; vteconv.cc:774:40:
+     ;;    error: missing sentinel in function call [-Werror=format=]
+     ;;    g_test_init (&argc, &argv, NULL);
+     ;;
+     ;; cc1plus: some warnings being treated as errors
+     '(#:configure-flags '("CXXFLAGS=-Wformat=0")))
     (native-inputs
      `(("pkg-config" ,pkg-config)
        ("intltool" ,intltool)
@@ -1805,7 +1781,7 @@ editors, IDEs, etc.")
 (define-public dconf
   (package
     (name "dconf")
-    (version "0.24.0")
+    (version "0.26.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -1814,7 +1790,7 @@ editors, IDEs, etc.")
                     name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1hpy6336f0pbkyranywm4872i5in0xn7jf40a66xdmzls77f0ws3"))))
+                "1jaqsr1r0grpd25rbsc2v3vb0sc51lia9w31wlqswgqsncp2k0w6"))))
     (build-system glib-or-gtk-build-system)
     (inputs
      `(("gtk+" ,gtk+)
@@ -1859,7 +1835,7 @@ configuration storage systems.")
 (define-public json-glib
   (package
     (name "json-glib")
-    (version "1.0.4")
+    (version "1.2.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -1867,7 +1843,7 @@ configuration storage systems.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1k85vvb2prmk8aa8hmr2rp9rnbhffjgnmr18b13g24xxnqy5kww0"))
+                "1lx7p1c7cl21byvfgw92n8dhm09vi6qxrs0zkx9dg3y096zdzmlr"))
               (modules '((guix build utils)))
               (snippet
                ;; Don't duplicate test names.
@@ -1966,7 +1942,7 @@ library.")
 (define-public glib-networking
   (package
     (name "glib-networking")
-    (version "2.46.1")
+    (version "2.48.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/glib-networking/"
@@ -1974,7 +1950,7 @@ library.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1cchmi08jpjypgmm9i7xzh5qfg2q5k61kry9ns8mhw3z44a440ym"))
+                "0jm4pr91kbq7rcyll08840zkagb9vfhhm2ymyrd1q0b0k2mj76fg"))
               (patches
                (search-patches "glib-networking-ssl-cert-file.patch"))))
     (build-system gnu-build-system)
@@ -2014,7 +1990,7 @@ library.")
 (define-public rest
   (package
     (name "rest")
-    (version "0.7.93")
+    (version "0.8.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/rest/"
@@ -2022,7 +1998,7 @@ library.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "05mj10hhiik23ai8w4wkk5vhsp7hcv24bih5q3fl82ilam268467"))))
+                "0iznvzhab1jq9z3nwy97dh2pid9azwkqm7kkxwx0f5ql1hh9pf77"))))
     (build-system gnu-build-system)
     (arguments
      '(#:tests? #f ; tests require internet connection
@@ -2048,7 +2024,7 @@ libxml to ease remote use of the RESTful API.")
 (define-public libsoup
   (package
     (name "libsoup")
-    (version "2.52.1")
+    (version "2.54.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/libsoup/"
@@ -2056,7 +2032,7 @@ libxml to ease remote use of the RESTful API.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0j6cnnpqqgnb9nj2r0j8j6898np4z503hrnpis7b4l5d8yhbq68f"))))
+                "0cyn5pq4xl1gb8413h2p4d5wrn558dc054zhwmk4swrl40ijrd27"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (arguments
@@ -2118,7 +2094,7 @@ and the GLib main loop, to integrate well with GNOME applications.")
 (define-public libsecret
   (package
     (name "libsecret")
-    (version "0.18.3")
+    (version "0.18.5")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -2127,7 +2103,7 @@ and the GLib main loop, to integrate well with GNOME applications.")
                     name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1jc4pw6pb5igwasj0ms1zx80w63c11myziz3ydj0cr5lb861vgzj"))))
+                "1cychxc3ff8fp857iikw0n2s13s2mhw2dn1mr632f7w3sn6vvrww"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (arguments
@@ -2166,7 +2142,7 @@ and other secrets.  It communicates with the \"Secret Service\" using DBus.")
 (define-public gnome-mines
   (package
     (name "gnome-mines")
-    (version "3.18.2")
+    (version "3.20.0")
     (source
      (origin
        (method url-fetch)
@@ -2175,7 +2151,7 @@ and other secrets.  It communicates with the \"Secret Service\" using DBus.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0izkcf81rji4dj9k0k93ij4lp5iza2bh6jwlcdhbjfv2xdw0f7ky"))))
+         "19khp4ckqbdgk6828gprxy52fsg8klf957dnwsin75nskk8whxbp"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      '(#:phases
@@ -2183,16 +2159,7 @@ and other secrets.  It communicates with the \"Secret Service\" using DBus.")
          (add-before 'configure 'patch-/bin/true
                      (lambda _
                        (substitute* "configure"
-                         (("/bin/true") (which "true")))))
-         (add-after 'install 'wrap-pixbuf
-                    ;; Use librsvg's loaders.cache to support SVG files.
-                    (lambda* (#:key inputs outputs #:allow-other-keys)
-                      (let* ((out    (assoc-ref outputs "out"))
-                             (prog   (string-append out "/bin/gnome-mines"))
-                             (rsvg   (assoc-ref inputs "librsvg"))
-                             (pixbuf (find-files rsvg "^loaders\\.cache$")))
-                        (wrap-program prog
-                          `("GDK_PIXBUF_MODULE_FILE" = ,pixbuf))))))))
+                         (("/bin/true") (which "true"))))))))
     (native-inputs
      `(("pkg-config" ,pkg-config)
        ("desktop-file-utils" ,desktop-file-utils)
@@ -2212,7 +2179,7 @@ floating in an ocean using only your brain and a little bit of luck.")
 (define-public gnome-sudoku
   (package
     (name "gnome-sudoku")
-    (version "3.18.2")
+    (version "3.20.0")
     (source
      (origin
        (method url-fetch)
@@ -2221,7 +2188,7 @@ floating in an ocean using only your brain and a little bit of luck.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "1b60z22fjrjzsz0kfhv0kfhvigzn54wvh9s31zrlp7sx2h2dxvsf"))))
+         "1n8hp3pl56p9s0c5kldk11zg1vg7ykhgn3ndp8nf375h1q49ldh8"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -2247,7 +2214,7 @@ more fun.")
 (define-public gnome-terminal
   (package
     (name "gnome-terminal")
-    (version "3.18.2")
+    (version "3.20.1")
     (source
      (origin
        (method url-fetch)
@@ -2256,7 +2223,7 @@ more fun.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "1ylyv0mla2ypms7iyxndbdjvha0q9jzglb4mhfmqn9cm2gxc0day"))))
+         "1508nm35znlfq9v1s2j4ypx5x608yq391c565b4hazxk2f5z9dwq"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      '(#:configure-flags
@@ -2361,7 +2328,7 @@ output devices.")
 (define-public geoclue
   (package
     (name "geoclue")
-    (version "2.2.0")
+    (version "2.4.3")
     (source
      (origin
        (method url-fetch)
@@ -2370,7 +2337,7 @@ output devices.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0inlqx0zar498fhi9hh92p2g4kp8qy3zdl4z3vw6bjwp9w6xx454"))
+         "0pk07k65dlw37nz8z5spksivsv5nh96xmbi336rf2yfxf2ldpadd"))
        (patches (search-patches "geoclue-config.patch"))))
     (build-system glib-or-gtk-build-system)
     (arguments
@@ -2391,7 +2358,8 @@ output devices.")
      `(("pkg-config" ,pkg-config)
        ("intltool" ,intltool)))
     (inputs
-     `(("glib" ,glib)
+     `(("avahi" ,avahi)
+       ("glib" ,glib)
        ("json-glib" ,json-glib)
        ("libsoup" ,libsoup)))
     (home-page "http://freedesktop.org/wiki/Software/GeoClue/")
@@ -2406,7 +2374,7 @@ permission from user.")
 (define-public geocode-glib
   (package
     (name "geocode-glib")
-    (version "3.18.0")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/geocode-glib/"
@@ -2414,7 +2382,7 @@ permission from user.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0pa9cgndycynipc6z8wzbvn2fi89ndf2gpqzm9m6krp3d7az1dwg"))))
+                "18iphsx3bybw7lssbb7rxc1rrnsc8vxai521zkqc535zr8rci7v6"))))
     (build-system gnu-build-system)
     (arguments
      `(;; The tests want to write to $HOME/.cache/geocode-glib, which doesn't
@@ -2497,7 +2465,7 @@ service via the system message bus.")
 (define-public libgweather
   (package
     (name "libgweather")
-    (version "3.18.1")
+    (version "3.20.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -2505,7 +2473,7 @@ service via the system message bus.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1l3sra84k5dnavbdbjyf1ar84xmjszpnnldih6mf45kniwpjkcll"))))
+                "1mmqg7wf0bhk450akyj0x71x75kh1v7j68isyivr75ydky79nqjj"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
@@ -2547,7 +2515,7 @@ services for numerous locations.")
 (define-public gnome-settings-daemon
   (package
     (name "gnome-settings-daemon")
-    (version "3.18.2")
+    (version "3.20.1")
     (source
      (origin
        (method url-fetch)
@@ -2556,7 +2524,7 @@ services for numerous locations.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0vzwf875csyqx04fnra6zicmzcjc3s13bxxpcizlys12iwjwfw9h"))))
+         "1rvqisrh3lridsb8rvm7spvncyq206ly0245zgpbm8swi5fhfjp8"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      `(;; Network manager not yet packaged.
@@ -2603,14 +2571,14 @@ settings, themes, mouse settings, and startup of other daemons.")
 (define-public totem-pl-parser
  (package
    (name "totem-pl-parser")
-   (version "3.10.5")
+   (version "3.10.6")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/totem-pl-parser/3.10/"
                                 "totem-pl-parser-" version ".tar.xz"))
             (sha256
              (base32
-              "0dw1kiwmjwdjrighri0j9nagsnj44dllm0mamnfh4y5nc47mhim7"))))
+              "0mv7aw9mw77w04zg95zjf0zmk6ckshpysbb9nap15h5is6zdk9cq"))))
    (build-system gnu-build-system)
    (arguments
     ;; FIXME: Tests require gvfs.
@@ -2638,7 +2606,7 @@ playlists in a variety of formats.")
 (define-public aisleriot
   (package
     (name "aisleriot")
-    (version "3.18.2")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -2646,7 +2614,7 @@ playlists in a variety of formats.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1qrgcj30hl0fgssspkwrad10lqy1bbsp7lfwxmxlwzp33jhqpb0b"))))
+                "1nipky336jj81mhm8wwxp96zilgcrarihf95dnyj3r1pw8kpg7gy"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      '(#:configure-flags
@@ -2674,7 +2642,7 @@ which are easy to play with the aid of a mouse.")
 (define-public devhelp
   (package
     (name "devhelp")
-    (version "3.18.1")
+    (version "3.20.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -2682,7 +2650,7 @@ which are easy to play with the aid of a mouse.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1vqsqpc51cir5qf801ibh6ljlpfw0qd513l9hjcnzp4ls8m1cfih"))))
+                "078zr92xs5ifp862v1vdmw1j9m6gr9zk5hjbk5065vxjwb17acx2"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("intltool" ,intltool)
@@ -2768,7 +2736,7 @@ without stepping on each others toes.")
 (define-public clutter
   (package
     (name "clutter")
-    (version "1.24.2")
+    (version "1.26.0")
     (source
      (origin
        (method url-fetch)
@@ -2777,7 +2745,7 @@ without stepping on each others toes.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0qyd0cw17wi8gl6y9z2j2lh2gwghxskfmsdvw4ayrgxwnj6cjccn"))))
+         "01nfjd4k7j2n3agpx2d9ncff86nfsqv4n23465rb9zmk4iw4wlb7"))))
     (build-system gnu-build-system)
     (outputs '("out"
                "doc"))                            ;9 MiB of gtk-doc HTML pages
@@ -2821,7 +2789,7 @@ presentations, kiosk style applications and so on.")
 (define-public clutter-gtk
   (package
     (name "clutter-gtk")
-    (version "1.6.6")
+    (version "1.8.0")
     (source
      (origin
        (method url-fetch)
@@ -2830,7 +2798,7 @@ presentations, kiosk style applications and so on.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0a2a8ci6in82l43zak3zj3cyms23i5rq6lzk1bz013gm023ach4l"))))
+         "07dzvx0b3fsswxnpxgk0adjgccnrvbxsd971naqwndnfivbgjbkl"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -2850,7 +2818,7 @@ presentations, kiosk style applications and so on.")
 (define-public clutter-gst
   (package
     (name "clutter-gst")
-    (version "3.0.14")
+    (version "3.0.18")
     (source
      (origin
        (method url-fetch)
@@ -2859,7 +2827,7 @@ presentations, kiosk style applications and so on.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "1qidm0q28q6w8gjd0gpqnk8fzqxv39dcp0vlzzawlncp8zfagj7p"))))
+         "14w0pi9myvcn1yxzmk9sk8dghj17m5ji3aqdpfjikk90c060vv0a"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("glib:bin" ,glib "bin")     ; for glib-mkenums
@@ -2881,7 +2849,7 @@ GL based interactive canvas library.")
 (define-public libchamplain
   (package
     (name "libchamplain")
-    (version "0.12.12")
+    (version "0.12.13")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -2889,7 +2857,7 @@ GL based interactive canvas library.")
                     version ".tar.xz"))
               (sha256
                (base32
-                "19jlhbgfn9c9g40b3fa2x373s6rfcwx5i9lbpl3vl7d901r7kpp7"))))
+                "1arzd1hsgq14rbiwa1ih2g250x6ljna2s2kiqfrw155c612s9cxk"))))
     (build-system gnu-build-system)
     (native-inputs `(("pkg-config" ,pkg-config)))
     (propagated-inputs
@@ -2913,7 +2881,7 @@ such as OpenStreetMap, OpenCycleMap, OpenAerialMap, and Maps for free.")
 (define-public gom
   (package
     (name "gom")
-    (version "0.3.1")
+    (version "0.3.2")
     (source
      (origin
        (method url-fetch)
@@ -2922,7 +2890,7 @@ such as OpenStreetMap, OpenCycleMap, OpenAerialMap, and Maps for free.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "1x9qgviszzh59d009jd13k0pdxzv9w4dmwp3wszbsk3qxr3fnlbr"))))
+         "1zaqqwwkyiswib3v1v8wafpbifpbpak0nn2kp13pizzn9bwz1s5w"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("intltool" ,intltool)
@@ -2942,10 +2910,46 @@ write applications that need to store structured data as well as make complex
 queries upon that data.")
     (license license:lgpl2.1+)))
 
+(define-public libgames-support
+  (package
+    (name "libgames-support")
+    (version "1.0.2")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnome/sources/" name "/"
+                                  (version-major+minor version) "/"
+                                  name "-" version ".tar.xz"))
+              (sha256
+               (base32
+                "0rms2ksiv7j9944km7r87q22nh05si1fisn5xm3z4zy5vpcfi5mh"))))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (add-before 'check 'pre-check
+           (lambda _
+             ;; tests require a writable HOME.
+             (setenv "HOME" (getcwd))
+             #t)))))
+    (native-inputs
+     `(("intltool" ,intltool)
+       ("pkg-config" ,pkg-config)
+       ("vala" ,vala)))
+    (propagated-inputs
+     ;; Required by libgames-support-1.0.pc
+     `(("gtk+" ,gtk+)
+       ("libgee" ,libgee)))
+    (home-page "https://www.gnome.org/")
+    (synopsis "Useful functionality shared among GNOME games")
+    (description
+     "libgames-support is a small library intended for internal use by
+GNOME Games, but it may be used by others.")
+    (license license:lgpl3+)))
+
 (define-public gnome-klotski
   (package
     (name "gnome-klotski")
-    (version "3.18.2")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -2953,7 +2957,7 @@ queries upon that data.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "14l1fji0860yam41x2cy72nd9bljph385ynfm6k1lsv4qhv72az2"))))
+                "1130v6sk9h74b3xgv0bq43anaw7xs9x8vdab3q7p9db6w0px02wj"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("desktop-file-utils" ,desktop-file-utils)
@@ -2963,6 +2967,7 @@ queries upon that data.")
        ("xmllint" ,libxml2)))
     (inputs
      `(("gtk+" ,gtk+)
+       ("libgames-support" ,libgames-support)
        ("librsvg" ,librsvg)))
     (home-page "https://wiki.gnome.org/Apps/Klotski")
     (synopsis "Sliding block puzzles")
@@ -2976,7 +2981,7 @@ as possible!")
 (define-public grilo
   (package
     (name "grilo")
-    (version "0.2.14")
+    (version "0.3.0")
     (source
      (origin
        (method url-fetch)
@@ -2985,7 +2990,7 @@ as possible!")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "1k8wj8f7xfaw5hxypnmwd34li3fq8h76dacach547rvsfjhjxj3r"))))
+         "0q5wcvnckpfks48hy0gvlfdmvqm67vnblm3912rssmkgc1ysil8z"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("glib:bin" ,glib "bin")         ; for glib-mkenums and glib-genmarshal
@@ -3027,7 +3032,7 @@ for application developers.")
 (define-public grilo-plugins
   (package
     (name "grilo-plugins")
-    (version "0.2.16")
+    (version "0.3.1")
     (source
      (origin
        (method url-fetch)
@@ -3036,7 +3041,7 @@ for application developers.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "00sjmkzxc8w4qn4lp5yj65c4y83mwhp0zlvk11ghvpxnklgmgd40"))))
+         "1akd7q6pqnkcnayrdfjb0qx5w5yyl06kxzwhqp2gxm4y1b208pb0"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("glib:bin" ,glib "bin")     ; for glib-mkenums and glib-genmarshal
@@ -3045,6 +3050,7 @@ for application developers.")
        ("pkg-config" ,pkg-config)))
     (inputs
      `(("grilo" ,grilo)
+       ("nettle" ,nettle) ; XXX: required by libgrlpls-0.3.la
        ("glib" ,glib)
        ("libxml2" ,libxml2)
        ("sqlite" ,sqlite)
@@ -3079,7 +3085,7 @@ for application developers.")
 (define-public totem
   (package
     (name "totem")
-    (version "3.18.1")
+    (version "3.20.1")
     (source
      (origin
        (method url-fetch)
@@ -3088,7 +3094,8 @@ for application developers.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "18h784c77m4h359j3xnlwqlfvnhbw7m052ahzm26r106jsp6x0fp"))))
+         "09swnhp46cyy2svqx02fzy555pjgc61lyjw56v9rz1mfc41lh8kg"))
+       (patches (search-patches "totem-debug-format-fix.patch"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -3245,7 +3252,7 @@ supports playlists, song ratings, and any codecs installed through gstreamer.")
 (define-public eog
  (package
    (name "eog")
-   (version "3.18.1")
+   (version "3.20.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3253,7 +3260,7 @@ supports playlists, song ratings, and any codecs installed through gstreamer.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "19wkawrcwjjcvlmizkj57qycnbgizhr8ck3j5qg70605d1xb8yvv"))))
+              "0ll3vz1kyjagiqmrpypk1a4nwjhrjsapiz45bxblsjxjy641j0jg"))))
    (build-system glib-or-gtk-build-system)
    (arguments
     `(#:phases
@@ -3323,7 +3330,7 @@ part of udev-extras, then udev, then systemd.  It's now a project on its own.")
 (define-public gvfs
   (package
     (name "gvfs")
-    (version "1.26.2")
+    (version "1.28.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3331,7 +3338,7 @@ part of udev-extras, then udev, then systemd.  It's now a project on its own.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "064dsjrdjcbi38zl38jhh4r9jcpiygg7x4c8s6s2rb757l7nwnv9"))))
+                "16bry61hg681bwb0pih86cjayzvc5f89ip5xd8fydcy16nnfbksf"))))
     (build-system gnu-build-system)
     (arguments
      '(#:tests? #f)) ; XXX: requiring `pidof'
@@ -3475,7 +3482,7 @@ work and the interface is well tested.")
 (define-public epiphany
   (package
     (name "epiphany")
-    (version "3.18.2")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3483,7 +3490,7 @@ work and the interface is well tested.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1hm6bpdcc6nf3zamzkvjhpvxnpaxzbnxnacfgl5v8swn643ifdl4"))))
+                "1ry9z6d51gjbv5n8kspwdyfrdai2hrin2ixdicmyiq6xbryzcwbi"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      ;; FIXME: tests run under Xvfb, but fail with:
@@ -3581,7 +3588,7 @@ of running programs and invoke methods on those interfaces.")
 (define-public yelp-xsl
   (package
     (name "yelp-xsl")
-    (version "3.18.1")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3589,7 +3596,7 @@ of running programs and invoke methods on those interfaces.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0qmsq7qkc06gmnkvbs84qj3jjzlihriy3z45nfbpgg51b6z0z1q0"))))
+                "183vz4aw8fcmw8k8q7r4zrm1p76gwg2cca1fsdrkaiyabng88qfw"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("intltool" ,intltool)
@@ -3605,7 +3612,7 @@ to format Docbook and Mallard documents.")
 (define-public yelp
   (package
     (name "yelp")
-    (version "3.18.1")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3613,7 +3620,7 @@ to format Docbook and Mallard documents.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "10384lr712xdr8zbi07vqh0cf4nd7ybg1vs05r5cy3kwf6s4wfms"))))
+                "1hh8yqbv0scn9nksk9mq94cb4sdczlzxplclv2wqr41jmm8v186x"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("glib:bin" ,glib "bin") ; for glib-genmarshal, etc.
@@ -3623,7 +3630,8 @@ to format Docbook and Mallard documents.")
     (propagated-inputs
      `(("dconf" ,dconf)))
     (inputs
-     `(("libxslt" ,libxslt)
+     `(("gsettings-desktop-schemas" ,gsettings-desktop-schemas)
+       ("libxslt" ,libxslt)
        ("sqlite" ,sqlite)
        ("webkitgtk" ,webkitgtk)
        ("yelp-xsl" ,yelp-xsl)))
@@ -3736,7 +3744,7 @@ metadata in photo and video files of various formats.")
 (define-public shotwell
   (package
     (name "shotwell")
-    (version "0.22.0")
+    (version "0.22.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3744,7 +3752,7 @@ metadata in photo and video files of various formats.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0cgqaaikrb10plhf6zxbgqy32zqpiwyi9dpx3g8yr261q72r5c81"))))
+                "1a9lx9a7p6fgaf838xlw98f73xxyxmg6jmm29830lsl8ynbhq9bk"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      `(#:tests? #f ;no "check" target
@@ -3791,7 +3799,7 @@ share them with others via social networking and more.")
 (define-public file-roller
   (package
     (name "file-roller")
-    (version "3.16.4")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3799,7 +3807,7 @@ share them with others via social networking and more.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "11a1g8f2700n2mz998wf40dz1rxjgap60mfns9iv0zlw5h5rhmal"))))
+                "0cx3d8mp0pxz9wcsb2ph7g1zy22m8z5x0a4f5vgfzl0jmrcxpcy8"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("intltool" ,intltool)
@@ -3824,7 +3832,7 @@ such as gzip tarballs.")
 (define-public gnome-session
   (package
     (name "gnome-session")
-    (version "3.18.1.2")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3832,7 +3840,7 @@ such as gzip tarballs.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0icajbzqf5llvp5s8nafwkhwz6a6jmwn4hhs81bk0bpzawyq4zdk"))))
+                "04w90gyl0kdx5vwmdcgfdk3qr9xhip00vgpgzci151agqwyzbs9a"))))
     (arguments
      '(#:phases
        (modify-phases %standard-phases
@@ -3851,6 +3859,8 @@ such as gzip tarballs.")
                (("#ifdef HAVE_SYSTEMD") "#if 0"))
              (substitute* "gnome-session/gsm-manager.c"
                (("#ifdef HAVE_SYSTEMD") "#if 0"))
+             (substitute* "gnome-session/gsm-autostart-app.c"
+               (("#ifdef HAVE_SYSTEMD") "#if 0"))
              #t))
          (add-after 'install 'wrap-gnome-session
            (lambda* (#:key inputs outputs #:allow-other-keys)
@@ -3922,6 +3932,12 @@ configuration program to choose applications starting on login.")
           (lambda _
             ;; For the missing /etc/machine-id.
             (setenv "DBUS_FATAL_WARNINGS" "0")
+
+            ;; XXX: fails with:
+            ;;   Failed to convert UTF-8 string to JS string: ...
+            ;; TODO: actually fix it.
+            (substitute* "installed-tests/js/testEverythingBasic.js"
+              ((".*test_utf8_inout.*") ""))
             #t)))))
     (native-inputs
      `(("glib:bin" ,glib "bin")       ; for glib-compile-resources
@@ -3948,7 +3964,7 @@ javascript engine and the GObject introspection framework.")
 (define-public gedit
   (package
     (name "gedit")
-    (version "3.18.3")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3956,19 +3972,23 @@ javascript engine and the GObject introspection framework.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1rrjdkvwwjyj05jc9icifjm9v8sgs0wqgy555m57a3rvg46sqqk7"))))
+                "1i0x1jd9x1vpv8lwdlzwf0ml8jxh3b3l6nlg6pbnfjw47w3y6iws"))))
     (build-system glib-or-gtk-build-system)
     (arguments
-     `(#:phases
+     `(#:configure-flags '("--disable-spell") ; XXX: gspell not packaged yet
+       #:phases
        (modify-phases %standard-phases
          (add-after
           'install 'wrap-gedit
           (lambda* (#:key inputs outputs #:allow-other-keys)
             (let ((out               (assoc-ref outputs "out"))
                   (gtksourceview     (assoc-ref inputs "gtksourceview"))
-                  (gi-typelib-path   (getenv "GI_TYPELIB_PATH")))
+                  (gi-typelib-path   (getenv "GI_TYPELIB_PATH"))
+                  (python-path       (getenv "PYTHONPATH")))
               (wrap-program (string-append out "/bin/gedit")
+                ;; For plugins.
                 `("GI_TYPELIB_PATH" ":" prefix (,gi-typelib-path))
+                `("PYTHONPATH" ":" prefix (,python-path))
                 ;; For language-specs.
                 `("XDG_DATA_DIRS" ":" prefix (,(string-append gtksourceview
                                                               "/share")))))
@@ -3986,7 +4006,6 @@ javascript engine and the GObject introspection framework.")
        ("gtksourceview" ,gtksourceview)
        ("libpeas" ,libpeas)
        ("libxml2" ,libxml2)
-       ("enchant" ,enchant)
        ("iso-codes" ,iso-codes)
        ("python-pygobject" ,python-pygobject)
        ("python" ,python)
@@ -4005,7 +4024,7 @@ powerful general purpose text editor.")
 (define-public zenity
   (package
     (name "zenity")
-    (version "3.18.1.1")
+    (version "3.20.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4013,7 +4032,7 @@ powerful general purpose text editor.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "02m88dfm1rziqk2ywakwib06wl1rxangbzih6cp8wllbyl1plcg6"))))
+                "0j2sy6imwp41l75hy3fwr68n35drvanbwgmr42kc04zqjy9pbs02"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("gettext" ,gnu-gettext)
@@ -4032,7 +4051,7 @@ to display dialog boxes from the commandline and shell scripts.")
 (define-public mutter
   (package
     (name "mutter")
-    (version "3.18.1")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4040,7 +4059,7 @@ to display dialog boxes from the commandline and shell scripts.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1ab959z5fgi4rq0ifxdqvpdbv99a2b1lfgvj327s9crdvk4ygpjg"))))
+                "0752vkkmaaay8ziczqrf7z3735bq3brx2djw36arqsdhwawh6jba"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags
@@ -4082,7 +4101,7 @@ window manager.")
 (define-public gnome-online-accounts
   (package
     (name "gnome-online-accounts")
-    (version "3.18.1")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4090,7 +4109,7 @@ window manager.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1hn2fvkr1f4qh4gix03avnvk7pklvv5272ns8ws56v4kcq4nppkc"))))
+                "14qcih1g136sn2aklzagv83jl82d3qc598rkdm8zac9gw70ynyn3"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("glib:bin" ,glib "bin") ; for glib-compile-schemas, etc.
@@ -4120,7 +4139,7 @@ Exchange, Last.fm, IMAP/SMTP, Jabber, SIP and Kerberos.")
 (define-public evolution-data-server
   (package
     (name "evolution-data-server")
-    (version "3.18.2")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4128,7 +4147,7 @@ Exchange, Last.fm, IMAP/SMTP, Jabber, SIP and Kerberos.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "16yfd2a00xqxikyf6pi2awfd0qfq4hwdhfar88axrb4mycfgqhjr"))))
+                "0lsbhzacr2bs90z8sx44vf403r0h2yqsy4l2svrh5hjnassgdyqx"))))
     (build-system gnu-build-system)
     (arguments
      '(;; XXX: fails with:
@@ -4140,6 +4159,7 @@ Exchange, Last.fm, IMAP/SMTP, Jabber, SIP and Kerberos.")
              (nspr (assoc-ref %build-inputs "nspr")))
          (list "--disable-uoa"    ; disable Ubuntu Online Accounts support
                "--disable-google" ; disable Google Contacts support
+               "--disable-google-auth" ; disable Google authentication
                (string-append "--with-nspr-includes=" nspr "/include/nspr")
                (string-append "--with-nss-includes=" nss "/include/nss")
                (string-append "--with-nss-libs=" nss "/lib/nss")))
@@ -4181,7 +4201,7 @@ Evolution (hence the name), but is now used by other packages as well.")
 (define-public caribou
   (package
     (name "caribou")
-    (version "0.4.19")
+    (version "0.4.20")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4189,7 +4209,7 @@ Evolution (hence the name), but is now used by other packages as well.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0i2s2xy9ami3wslam15cajhggpcsj4c70qm7qddcz52z9k0x02rg"))))
+                "1nahpfs5ap9f9wsvn93kg8isqffk60v785f1q6k64awcd7an8ris"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      '(#:phases
@@ -4246,7 +4266,7 @@ users.")
 (define-public network-manager
   (package
     (name "network-manager")
-    (version "1.0.12")
+    (version "1.2.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/NetworkManager/"
@@ -4254,7 +4274,7 @@ users.")
                                   "NetworkManager-" version ".tar.xz"))
               (sha256
                (base32
-                "17jan0g5jzp8mrpklyacwdgnnw016m1c5pc4az5im6qhc260yirs"))))
+                "101axwk3bc1pm9m98vwrnxyjna6w0qgzaskgivldq69xz8qcyiz9"))))
     (build-system gnu-build-system)
     (outputs '("out"
                "doc")) ; 8 MiB of gtk-doc HTML
@@ -4284,7 +4304,8 @@ users.")
              ;; cope with being already in the Guix build jail as that jail
              ;; lacks some features that they would like to proxy over (like
              ;; a /sys mount).
-             (substitute* '("src/platform/Makefile.in")
+             (substitute* '("src/platform/Makefile.in"
+                            "src/devices/Makefile.in")
                (("SUBDIRS = tests") ""))
              (substitute* '("src/tests/Makefile.in")
                (("\ttest-route-manager-linux") "\t")
@@ -4299,7 +4320,8 @@ users.")
            (lambda _
              (zero? (system* "make"
                              "sysconfdir=/tmp"
-                             "localstatedir=/tmp"
+                             "rundir=/tmp"
+                             "statedir=/tmp"
                              "install")))))))
     (native-inputs
      `(("glib:bin" ,glib "bin") ; for gdbus-codegen
@@ -4321,6 +4343,7 @@ users.")
        ("libndp" ,libndp)
        ("libnl" ,libnl)
        ("libsoup" ,libsoup)
+       ("modem-manager" ,modem-manager)
        ("polkit" ,polkit)
        ("ppp" ,ppp)
        ("readline" ,readline)
@@ -4338,7 +4361,7 @@ services.")
 (define-public network-manager-applet
   (package
     (name "network-manager-applet")
-    (version "1.0.10")
+    (version "1.2.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4346,7 +4369,7 @@ services.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1szh5jyijxm6z55irkp5s44pwah0nikss40mx7pvpk38m8zaqidh"))))
+                "0dhvk3dvy6djn6blpkv46dn6yfh28wsh6mpl0v53qxfip97j8kwk"))))
     (build-system glib-or-gtk-build-system)
     (arguments '(#:configure-flags '("--disable-migration")))
     (native-inputs
@@ -4400,7 +4423,7 @@ libxml2.")
 (define-public gdm
   (package
     (name "gdm")
-    (version "3.18.2")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4408,7 +4431,7 @@ libxml2.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "08pqhslwd487nh9w0jp4d0s4s2imm4ds0jjsbl6lzmqifqj3b4jl"))))
+                "17vqcnqnwx7s5xzgn358gsgbmpz7k90sh1qrwrh3wnj5r0pm38hh"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags
@@ -4460,7 +4483,7 @@ providing graphical log-ins and managing local and remote displays.")
 (define-public libgtop
   (package
     (name "libgtop")
-    (version "2.32.0")
+    (version "2.34.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4468,7 +4491,7 @@ providing graphical log-ins and managing local and remote displays.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "13hpml2vfm23816qggr5fvxj75ndb1dq4rgmi7ik6azj69ij8hw4"))))
+                "0apfnh9k6vmbdm8ms5wxyhagrrl8r88fv48k7q5qq70df2gf72ld"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("gobject-introspection" ,gobject-introspection)
@@ -4487,7 +4510,7 @@ usage and information about running processes.")
 (define-public gnome-bluetooth
   (package
     (name "gnome-bluetooth")
-    (version "3.18.1")
+    (version "3.18.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4495,7 +4518,7 @@ usage and information about running processes.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0jaa9nbygdvcqp9k4p4iy2g8x3684s4x9k5nbcmmm11jdn4mn7f5"))))
+                "1qwc9q7x22sc71zhqv4db78rqzxl6fqfw6d978ydqap54c2bg0g4"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("glib:bin" ,glib "bin") ; for gdbus-codegen, etc.
@@ -4520,7 +4543,7 @@ devices using the GNOME desktop.")
 (define-public gnome-control-center
   (package
     (name "gnome-control-center")
-    (version "3.18.2")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4528,7 +4551,7 @@ devices using the GNOME desktop.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1bgqg1sl3cp2azrwrjgwx3jzk9n3w76xpcyvk257qavx4ibn3zin"))))
+                "1vd1h31vwyq7ss5f1151gx1vdsy35sjmapjmmz7x73ppc3y78r6f"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      '(#:phases
@@ -4590,7 +4613,7 @@ properties, screen resolution, and other GNOME parameters.")
 (define-public gnome-shell
   (package
     (name "gnome-shell")
-    (version "3.18.3")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4598,7 +4621,7 @@ properties, screen resolution, and other GNOME parameters.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "16sicxdp08yfaj4hiyzvbspb5jk3fpmi291272zhx5vgc3wbl5w5"))))
+                "08cgbr15cim3rgcngrv98rm48pkdxwj4nqx5za1lsnv376m4x5bs"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      '(#:phases
@@ -4710,7 +4733,7 @@ as SASL, TLS and VeNCrypt.  Additionally it supports encoding extensions.")
 (define-public nautilus
   (package
     (name "nautilus")
-    (version "3.18.2") ; XXX: later version require gtk+-3.0 >= 3.18.5
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4718,10 +4741,11 @@ as SASL, TLS and VeNCrypt.  Additionally it supports encoding extensions.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0jj23n8vmmyc4gp5xhiz7slsxwksydp26blxi5m154yaw9lgdp38"))))
+                "1s41bsihacs7cywm60vqgv46m22gmga4b0bwxnki4r02jjwhgagj"))))
     (build-system glib-or-gtk-build-system)
     (arguments
-     '(#:configure-flags '("--disable-tracker") ; XXX: not packaged
+     '(#:configure-flags
+       '("--disable-tracker" "--disable-selinux") ; XXX: not packaged
        ;; XXX: FAIL: check-nautilus
        ;;   Settings schema 'org.gnome.nautilus.preferences' is not installed
        #:tests? #f))
@@ -4754,7 +4778,7 @@ files.")
 (define-public baobab
   (package
     (name "baobab")
-    (version "3.18.1")
+    (version "3.20.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -4763,7 +4787,7 @@ files.")
                     name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1da4bdkw5bnxansl1xr4lb03d6f4h0a0qaba8i3p3rwhcd191b62"))))
+                "07wx4jb3nmipd4caybv21hl8h0gb282qc5a24b731mxhfqmg3pz9"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("intltool" ,intltool)
@@ -4786,7 +4810,7 @@ is complete it provides a graphical representation of each selected folder.")
 (define-public gnome-backgrounds
   (package
     (name "gnome-backgrounds")
-    (version "3.18.0")
+    (version "3.20")
     (source
      (origin
        (method url-fetch)
@@ -4795,7 +4819,7 @@ is complete it provides a graphical representation of each selected folder.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "1fd7y8dh3iy88ayb8irgsihvssli6bzjzb5a6vfhi8qjbw70ymma"))))
+         "09viag7q53lfwrp074a1w7j0r8izlwpi10xbwjgbf5jwbqb6wv6n"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("intltool" ,intltool)))
@@ -4845,7 +4869,7 @@ beautifying border effects.")
 (define-public dconf-editor
   (package
     (name "dconf-editor")
-    (version "3.18.2")
+    (version "3.20.1")
     (source
      (origin
        (method url-fetch)
@@ -4854,7 +4878,7 @@ beautifying border effects.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0xdwi7g1xdmgrc9m8ii62fp2zj114gsfpmgazlnhrcmmfi97z5d7"))))
+         "0pfpmvpv57a01nsd1fah3np33avihm5ic43fi6b60dyw6c5z953p"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("glib:bin" ,glib "bin") ; for glib-compile-schemas, gio-2.0.
@@ -4883,15 +4907,18 @@ software that do not provide their own configuration interface.")
      ;; TODO: Add more packages according to:
      ;;       <https://packages.debian.org/jessie/gnome-core>.
      `(("adwaita-icon-theme"        ,adwaita-icon-theme)
+       ("baobab"                    ,baobab)
        ("font-cantarell"            ,font-cantarell)
        ("at-spi2-core"              ,at-spi2-core)
        ("dbus"                      ,dbus)
        ("dconf"                     ,dconf)
+       ("desktop-file-utils"        ,desktop-file-utils)
        ("eog"                       ,eog)
        ("epiphany"                  ,epiphany)
        ("evince"                    ,evince)
        ("gedit"                     ,gedit)
        ("glib-networking"           ,glib-networking)
+       ("gnome-backgrounds"         ,gnome-backgrounds)
        ("gnome-control-center"      ,gnome-control-center)
        ("gnome-keyring"             ,gnome-keyring)
        ("gnome-session"             ,gnome-session)
@@ -4899,6 +4926,7 @@ software that do not provide their own configuration interface.")
        ("gnome-shell"               ,gnome-shell)
        ("gnome-terminal"            ,gnome-terminal)
        ("gnome-themes-standard"     ,gnome-themes-standard)
+       ("gvfs"                      ,gvfs)
        ("hicolor-icon-theme"        ,hicolor-icon-theme)
        ("nautilus"                  ,nautilus)
        ("pulseaudio"                ,pulseaudio)
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index abefd90304..df1075c370 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -287,7 +287,7 @@ standards.")
 (define-public icecat
   (package
     (name "icecat")
-    (version "38.7.1-gnu1")
+    (version "38.8.0-gnu1")
     (source
      (origin
       (method url-fetch)
@@ -296,19 +296,9 @@ standards.")
                           name "-" version ".tar.bz2"))
       (sha256
        (base32
-        "1wdmd6hasra36g86ha1dw8sl7a5mvr7c4jbjx4zyg9629y5gqr8g"))
+        "0v4k47ziqsyfksv9sn4v1xvk4q414rc883hb1qzld63grj2nxxwp"))
       (patches (search-patches
-                "icecat-avoid-bundled-includes.patch"
-                "icecat-re-enable-DHE-cipher-suites.patch"
-                "icecat-update-bundled-graphite2.patch"
-                "icecat-CVE-2016-2805.patch"
-                "icecat-CVE-2016-2807-pt1.patch"
-                "icecat-CVE-2016-2807-pt2.patch"
-                "icecat-CVE-2016-2807-pt3.patch"
-                "icecat-CVE-2016-2807-pt4.patch"
-                "icecat-CVE-2016-2807-pt5.patch"
-                "icecat-CVE-2016-2808.patch"
-                "icecat-CVE-2016-2814.patch"))
+                "icecat-avoid-bundled-includes.patch"))
       (modules '((guix build utils)))
       (snippet
        '(begin
diff --git a/gnu/packages/gstreamer.scm b/gnu/packages/gstreamer.scm
index 97900958c8..483710f6fe 100644
--- a/gnu/packages/gstreamer.scm
+++ b/gnu/packages/gstreamer.scm
@@ -244,6 +244,9 @@ for the GStreamer multimedia library.")
             ;; XXX FIXME: Try removing this for version > 1.8.0.
             (substitute* "tests/check/elements/rtprtx.c"
               (("tcase_add_test \\(tc_chain, test_push_forward_seq\\);" all)
+               (string-append "/* " all " */"))
+              (("tcase_add_test \
+\\(tc_chain, test_rtxreceive_data_reconstruction\\);" all)
                (string-append "/* " all " */")))
             (substitute* "tests/check/elements/splitmux.c"
               (("tcase_add_test \\(tc_chain, test_splitmuxsink\\);" all)
diff --git a/gnu/packages/gtk.scm b/gnu/packages/gtk.scm
index 255d885b27..7e81a81986 100644
--- a/gnu/packages/gtk.scm
+++ b/gnu/packages/gtk.scm
@@ -63,7 +63,7 @@
 (define-public atk
   (package
    (name "atk")
-   (version "2.18.0")
+   (version "2.20.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -71,7 +71,7 @@
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0ay9s137x49f0akx658p7kznz0rdapfrd8ym54q0hlgrggblhv6f"))))
+              "1w1q29yfxcq67j7fyqrfm0l0n1vy4zn539c0sf4ga9d0qkv50fj9"))))
    (build-system gnu-build-system)
    (outputs '("out" "doc"))
    (arguments
@@ -95,14 +95,14 @@ tools have full access to view and control running applications.")
 (define-public cairo
   (package
    (name "cairo")
-   (version "1.14.2")
+   (version "1.14.6")
    (source (origin
             (method url-fetch)
             (uri (string-append "http://cairographics.org/releases/cairo-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "1sycbq0agbwmg1bj9lhkgsf0glmblaf2jrdy9g6vxfxivncxj6f9"))))
+              "0lmjlzmghmr27y615px9hkm552x7ap6pmq9mfbzr6smp8y2b6g31"))))
    (build-system gnu-build-system)
    (propagated-inputs
     `(("fontconfig" ,fontconfig)
@@ -147,7 +147,7 @@ affine transformation (scale, rotation, shear, etc.).")
 (define-public harfbuzz
   (package
    (name "harfbuzz")
-   (version "1.0.6")
+   (version "1.2.4")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://www.freedesktop.org/software/"
@@ -155,7 +155,7 @@ affine transformation (scale, rotation, shear, etc.).")
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "09ivk5m4y09ar4zi9r6db7gp234cy05h0ach7w22g9kqvkxsf5pn"))))
+               "14g4kpph8hgplkm954daxiymxx0vicfq7b7svvdsx54g5bqvv7a4"))))
    (build-system gnu-build-system)
    (outputs '("out"
               "bin")) ; 160K, only hb-view depend on cairo
@@ -185,7 +185,7 @@ affine transformation (scale, rotation, shear, etc.).")
 (define-public pango
   (package
    (name "pango")
-   (version "1.38.1")
+   (version "1.40.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/pango/"
@@ -193,7 +193,7 @@ affine transformation (scale, rotation, shear, etc.).")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "1dsf45m51i4rcyvh5wlxxrjfhvn5b67d5ckjc6vdcxbddjgmc80k"))))
+              "0h0sbh0b5kh3lvrxrb82bs86rqakf33a9jakpv33lay7f90zayp2"))))
    (build-system gnu-build-system)
    (propagated-inputs
     `(("cairo" ,cairo)
@@ -339,7 +339,7 @@ printing and other features typical of a source code editor.")
 (define-public gtksourceview
  (package
    (name "gtksourceview")
-   (version "3.18.2")
+   (version "3.20.2")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/" name "/"
@@ -347,7 +347,7 @@ printing and other features typical of a source code editor.")
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
-               "1cmplnqbyd1js5bkpi9cfc3gljilyxg5nngwh4i3mq9r02gmmxv0"))))
+               "03vxirdbjpgjrkl5ph0p9b1saq17xxr4kvhz1ijpg40a9jf3ci4y"))))
    (build-system gnu-build-system)
    (arguments
     '(#:phases
@@ -387,7 +387,7 @@ highlighting and other features typical of a source code editor.")
 (define-public gdk-pixbuf
   (package
    (name "gdk-pixbuf")
-   (version "2.32.3")
+   (version "2.34.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -395,7 +395,7 @@ highlighting and other features typical of a source code editor.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0cfh87aqyqbfcwpbv1ihgmgfcn66il5q2n8yjyl8gxkjmkqp2rrb"))))
+              "0yc8indbl3hf18z6x6kjg59xp9sngm1d8vmz4c7bs6g27qw5npnm"))))
    (build-system gnu-build-system)
    (arguments
     '(#:configure-flags '("--with-x11")
@@ -415,9 +415,12 @@ highlighting and other features typical of a source code editor.")
              ;; (gdk-pixbuf-error-quark, 0)
              (("pixbuf-jpeg\\$\\(EXEEXT\\) ") ""))
            #t)))))
-   (propagated-inputs ; required by gdk-pixbuf-2.0.pc
-    `(("glib" ,glib)
-      ("libpng" ,libpng)))
+   (propagated-inputs
+    `(;; Required by gdk-pixbuf-2.0.pc
+      ("glib" ,glib)
+      ("libpng" ,libpng)
+      ;; Used for testing and required at runtime.
+      ("shared-mime-info" ,shared-mime-info)))
    (inputs
     `(("libjpeg" ,libjpeg)
       ("libtiff" ,libtiff)
@@ -465,7 +468,7 @@ in the GNOME project.")
 (define-public at-spi2-core
   (package
    (name "at-spi2-core")
-   (version "2.18.1")
+   (version "2.20.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -473,7 +476,7 @@ in the GNOME project.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "1kq17w4fm51d49vzmglkxqdm6s0yvjvrpgw78r2hajf69jz5bmap"))))
+              "0039y6bj1zfzhmfjbj5g830dlczphbpvbgmkcab9mapmh7kmin3f"))))
    (build-system gnu-build-system)
    (outputs '("out" "doc"))
    (arguments
@@ -510,7 +513,7 @@ is part of the GNOME accessibility project.")
 (define-public at-spi2-atk
   (package
    (name "at-spi2-atk")
-   (version "2.18.1")
+   (version "2.20.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -518,7 +521,7 @@ is part of the GNOME accessibility project.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0bf1g5cj84rmx7p1q547vwbc0hlpcs2wrxnmv96lckfkhs9mzcf4"))))
+              "13mzfwra0izmkzn7dsdgy5zj19n8izp0wdy7w1yg9s0qx6aafn13"))))
    (build-system gnu-build-system)
    (arguments
     '(#:phases
@@ -545,7 +548,7 @@ is part of the GNOME accessibility project.")
 (define-public gtk+-2
   (package
    (name "gtk+")
-   (version "2.24.28")
+   (version "2.24.30")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -553,13 +556,14 @@ is part of the GNOME accessibility project.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0mj6xn40py9r9lvzg633fal81xfwfm89d9mvz7jk4lmwk0g49imj"))
-            (patches (search-patches "gtk2-respect-GUIX_GTK2_PATH.patch"))))
+              "0l6aqk86aw5w132ygy6hv6nlxvd1h6xg7c85qbm60p6mnv1ww58d"))
+            (patches (search-patches "gtk2-respect-GUIX_GTK2_PATH.patch"
+                                     "gtk2-theme-paths.patch"))))
    (build-system gnu-build-system)
    (outputs '("out" "doc"))
    (propagated-inputs
     `(("atk" ,atk)
-      ("gdk-pixbuf" ,gdk-pixbuf)
+      ("gdk-pixbuf" ,gdk-pixbuf+svg)
       ("pango" ,pango)))
    (inputs
     `(("cups" ,cups)
@@ -606,7 +610,7 @@ application suites.")
 (define-public gtk+
   (package (inherit gtk+-2)
    (name "gtk+")
-   (version "3.18.2")
+   (version "3.20.3")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -614,12 +618,12 @@ application suites.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0lp1hn0qydxx03bianzzr0a4maqzsvylrkzr7c3p0050qihwbgjx"))
+              "157nh9gg0p2avw765hrnkvr8lsh2w811397yxgjv6q5j4fzz6d1q"))
             (patches (search-patches "gtk3-respect-GUIX_GTK3_PATH.patch"))))
    (propagated-inputs
     `(("at-spi2-atk" ,at-spi2-atk)
       ("atk" ,atk)
-      ("gdk-pixbuf" ,gdk-pixbuf)
+      ("gdk-pixbuf" ,gdk-pixbuf+svg)
       ("libepoxy" ,libepoxy)
       ("libxcursor" ,libxcursor)
       ("libxi" ,libxi)
@@ -627,8 +631,7 @@ application suites.")
       ("libxdamage" ,libxdamage)
       ("pango" ,pango)))
    (inputs
-    `(("librsvg" ,librsvg)                        ;for gtk-encode-symbolic-svg
-      ("libxml2" ,libxml2)
+    `(("libxml2" ,libxml2)
       ;; XXX: colord depends on mozjs (through polkit), which fails on
       ;;      on non-intel systems now.
       ;;("colord" ,colord)
@@ -663,18 +666,7 @@ application suites.")
            (("SUBDIRS = gdk gtk a11y css reftests")
             "SUBDIRS = gdk"))
          #t)
-       (alist-cons-after
-        'install 'wrap-gtk-encode-symbolic-svg
-        ;; By using GdkPixbuf, gtk-encode-symbolic-svg needs to know
-        ;; librsvg's loaders.cache to handle SVG files.
-        (lambda* (#:key inputs outputs #:allow-other-keys)
-          (let* ((out (assoc-ref outputs "out"))
-                 (prog (string-append out "/bin/gtk-encode-symbolic-svg"))
-                 (librsvg (assoc-ref inputs "librsvg"))
-                 (loaders.cache (find-files librsvg "^loaders\\.cache$")))
-            (wrap-program prog
-              `("GDK_PIXBUF_MODULE_FILE" = ,loaders.cache))))
-        %standard-phases))))
+       %standard-phases)))
    (native-search-paths
     (list (search-path-specification
            (variable "GUIX_GTK3_PATH")
@@ -864,7 +856,7 @@ library.")
 (define-public pangomm
   (package
     (name "pangomm")
-    (version "2.38.1")
+    (version "2.40.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/" name "/"
@@ -872,7 +864,7 @@ library.")
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
-               "12xwjvqfxhqblcv7641k0l6r8n3qifnrx8w9571izn1nbd81iyzg"))))
+               "03fpqdjp7plybf4zsgszbm8yhgl28vmajzfpmaqcsmyfvjlszl3x"))))
     (build-system gnu-build-system)
     (native-inputs `(("pkg-config" ,pkg-config)))
     (propagated-inputs
@@ -913,7 +905,7 @@ toolkit.")
 (define-public gtkmm
   (package
     (name "gtkmm")
-    (version "3.18.0")
+    (version "3.20.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/" name "/"
@@ -921,16 +913,29 @@ toolkit.")
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
-               "0sxq700invkjpksn790gbnl8px8751kvgwn39663jx7dv89s37w2"))))
+               "04n631a127pyidaz82ypdy9syq1hzj636r32y9hyr9kcfnwf2785"))))
     (build-system gnu-build-system)
     (native-inputs `(("pkg-config" ,pkg-config)
-                     ("glib" ,glib "bin")))      ;for 'glib-compile-resources'
+                     ("glib" ,glib "bin")        ;for 'glib-compile-resources'
+                     ("xorg-server" ,xorg-server)))
     (propagated-inputs
      `(("pangomm" ,pangomm)
        ("cairomm" ,cairomm)
        ("atkmm" ,atkmm)
        ("gtk+" ,gtk+)
        ("glibmm" ,glibmm)))
+    (arguments
+     '(#:phases (modify-phases %standard-phases
+                  (add-before 'check 'run-xvfb
+                    (lambda* (#:key inputs #:allow-other-keys)
+                      (let ((xorg-server (assoc-ref inputs "xorg-server")))
+                        ;; Tests such as 'object_move/test' require a running
+                        ;; X server.
+                        (system (string-append xorg-server "/bin/Xvfb :1 &"))
+                        (setenv "DISPLAY" ":1")
+                        ;; Don't fail because of the missing /etc/machine-id.
+                        (setenv "DBUS_FATAL_WARNINGS" "0")
+                        #t))))))
     (home-page "http://gtkmm.org/")
     (synopsis
      "C++ interface to the GTK+ graphical user interface library")
diff --git a/gnu/packages/inkscape.scm b/gnu/packages/inkscape.scm
index b09e84ee08..16f83fc474 100644
--- a/gnu/packages/inkscape.scm
+++ b/gnu/packages/inkscape.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014 John Darrington <jmd@gnu.org>
-;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2014, 2016 Mark H Weaver <mhw@netris.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -52,7 +52,10 @@
                                   version ".tar.gz"))
               (sha256
                (base32
-                "086v01jy896dj86bq7plrf6si4p6gh6ga2v5417llgmminycz8rc"))))
+                "086v01jy896dj86bq7plrf6si4p6gh6ga2v5417llgmminycz8rc"))
+              (patch-flags '("-p0"))
+              (patches
+               (search-patches "inkscape-drop-wait-for-targets.patch"))))
     (build-system gnu-build-system)
     (inputs
      `(("aspell" ,aspell)
diff --git a/gnu/packages/key-mon.scm b/gnu/packages/key-mon.scm
index dbfee050a9..c76360ce08 100644
--- a/gnu/packages/key-mon.scm
+++ b/gnu/packages/key-mon.scm
@@ -41,25 +41,12 @@
     (build-system python-build-system)
     (arguments
      `(#:python ,python-2                    ;uses the Python 2 'print' syntax
-       #:phases (modify-phases %standard-phases
-                  (add-after 'install 'wrap
-                             (lambda* (#:key inputs outputs #:allow-other-keys)
-                               (let* ((out  (assoc-ref outputs "out"))
-                                      (bin  (string-append out "/bin"))
-                                      (rsvg (assoc-ref inputs "librsvg"))
-                                      (pixbuf (find-files
-                                               rsvg "^loaders\\.cache$")))
-                                 ;; Allow key-mon to load SVGs.
-                                 (wrap-program (string-append bin "/key-mon")
-                                   `("GDK_PIXBUF_MODULE_FILE" ":"
-                                     prefix ,pixbuf))))))
        #:tests? #f))                         ;no tests
     (native-inputs
      `(("python2-setuptools" ,python2-setuptools)))
     (inputs
      `(("python2-xlib" ,python2-xlib)
        ("python2-pygtk" ,python2-pygtk)
-       ("librsvg" ,librsvg)
        ("python2-rsvg" ,python2-rsvg)))
     (home-page "http://code.google.com/p/key-mon")
     (synopsis "Show keyboard and mouse status")
diff --git a/gnu/packages/music.scm b/gnu/packages/music.scm
index 7e0ea6210e..9a958a37ae 100644
--- a/gnu/packages/music.scm
+++ b/gnu/packages/music.scm
@@ -551,15 +551,11 @@ for path in [path for path in sys.path if 'site-packages' in path]: site.addsite
            (alist-cons-after
             'install 'wrap-program
             (lambda* (#:key inputs outputs #:allow-other-keys)
-              ;; Make sure 'solfege' runs with the correct PYTHONPATH.  We
-              ;; also need to modify GDK_PIXBUF_MODULE_FILE for SVG support.
+              ;; Make sure 'solfege' runs with the correct PYTHONPATH.
               (let* ((out (assoc-ref outputs "out"))
-                     (path (getenv "PYTHONPATH"))
-                     (rsvg (assoc-ref inputs "librsvg"))
-                     (pixbuf (find-files rsvg "^loaders\\.cache$")))
+                     (path (getenv "PYTHONPATH")))
                 (wrap-program (string-append out "/bin/solfege")
-                  `("PYTHONPATH" ":" prefix (,path))
-                  `("GDK_PIXBUF_MODULE_FILE" ":" prefix ,pixbuf))))
+                  `("PYTHONPATH" ":" prefix (,path)))))
             %standard-phases)))))))
     (inputs
      `(("python" ,python-2)
@@ -567,8 +563,6 @@ for path in [path for path in sys.path if 'site-packages' in path]: site.addsite
        ("gettext" ,gnu-gettext)
        ("gtk" ,gtk+)
        ("lilypond" ,lilypond)
-       ("librsvg" ,librsvg) ; needed at runtime for icons
-       ("libpng" ,libpng) ; needed at runtime for icons
        ;; players needed at runtime
        ("aplay" ,alsa-utils)
        ("csound" ,csound) ; optional, needed for some exercises
diff --git a/gnu/packages/patches/glib-tests-desktop.patch b/gnu/packages/patches/glib-tests-desktop.patch
deleted file mode 100644
index 642234ebbc..0000000000
--- a/gnu/packages/patches/glib-tests-desktop.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-Some GLib tests expect desktop things, such as an xterm, a MIME
-database, the `update-desktop-database' program, which we don't provide.
-
---- glib-2.37.1/gio/tests/appinfo.c	2013-06-07 23:44:44.000000000 +0200
-+++ glib-2.37.1/gio/tests/appinfo.c	2013-06-07 23:44:56.000000000 +0200
-@@ -497,16 +497,10 @@ main (int argc, char *argv[])
- 
-   g_test_add_func ("/appinfo/basic", test_basic);
-   g_test_add_func ("/appinfo/text", test_text);
--  g_test_add_func ("/appinfo/launch", test_launch);
-   g_test_add_func ("/appinfo/show-in", test_show_in);
-   g_test_add_func ("/appinfo/commandline", test_commandline);
--  g_test_add_func ("/appinfo/launch-context", test_launch_context);
--  g_test_add_func ("/appinfo/launch-context-signals", test_launch_context_signals);
-   g_test_add_func ("/appinfo/tryexec", test_tryexec);
--  g_test_add_func ("/appinfo/associations", test_associations);
-   g_test_add_func ("/appinfo/environment", test_environment);
--  g_test_add_func ("/appinfo/startup-wm-class", test_startup_wm_class);
--  g_test_add_func ("/appinfo/supported-types", test_supported_types);
-   g_test_add_func ("/appinfo/from-keyfile", test_from_keyfile);
- 
-   return g_test_run ();
-
---- glib-2.40.0/gio/tests/contenttype.c	2013-01-16 21:22:29.000000000 +0100
-+++ glib-2.40.0/gio/tests/contenttype.c	2013-01-16 21:22:33.000000000 +0100
-@@ -207,15 +207,6 @@ main (int argc, char *argv[])
- {
-   g_test_init (&argc, &argv, NULL);
- 
--  g_test_add_func ("/contenttype/guess", test_guess);
--  g_test_add_func ("/contenttype/unknown", test_unknown);
--  g_test_add_func ("/contenttype/subtype", test_subtype);
--  g_test_add_func ("/contenttype/list", test_list);
--  g_test_add_func ("/contenttype/executable", test_executable);
--  g_test_add_func ("/contenttype/description", test_description);
--  g_test_add_func ("/contenttype/icon", test_icon);
--  g_test_add_func ("/contenttype/symbolic-icon", test_symbolic_icon);
--  g_test_add_func ("/contenttype/tree", test_tree);
- 
-   return g_test_run ();
- }
-
-
---- glib-2.40.0/gio/tests/desktop-app-info.c	2014-03-19 22:50:45.000000000 -0500
-+++ glib-2.40.0/gio/tests/desktop-app-info.c	2014-06-30 14:27:52.543358331 -0500
-@@ -708,6 +708,8 @@
-   g_setenv ("XDG_DATA_HOME", basedir, TRUE);
-   cleanup_subdirs (basedir);
- 
-+  result = g_test_run ();
-+  return result;
-   g_test_add_func ("/desktop-app-info/delete", test_delete);
-   g_test_add_func ("/desktop-app-info/default", test_default);
-   g_test_add_func ("/desktop-app-info/fallback", test_fallback);
-
-
------------------------------
-The hunk below removes tests that depend on `gdbus-testserver.py',
-because that script depends on python-gobject.  The second hunk
-disables a test that expects /etc/machine-id in the build environment.
- 
---- glib-2.46.0/gio/tests/Makefile.in	2015-10-14 14:11:00.928809504 +0200
-+++ glib-2.46.0/gio/tests/Makefile.in	2015-10-14 14:12:13.157291092 +0200
-@@ -186,20 +186,13 @@ check_PROGRAMS = $(am__EXEEXT_16)
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-auth				\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-bz627724				\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-close-pending			\
--@HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-connection			\
--@HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-connection-loss			\
--@HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-connection-slow			\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-error				\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-exit-on-close			\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-export				\
--@HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-introspection			\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-names				\
--@HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-proxy				\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-proxy-threads			\
--@HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-proxy-well-known-name		\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-test-codegen			\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-test-codegen-old			\
--@HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-threading				\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gmenumodel				\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gnotification				\
- @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	$(NULL)
-@@ -321,8 +314,7 @@ libresourceplugin_la_LINK = $(LIBTOOL) $
- am__EXEEXT_1 =
- @OS_UNIX_TRUE@am__EXEEXT_2 = contenttype$(EXEEXT) file$(EXEEXT) \
- @OS_UNIX_TRUE@	gdbus-peer-object-manager$(EXEEXT) \
--@OS_UNIX_TRUE@	gdbus-unix-addresses$(EXEEXT) \
- @OS_UNIX_TRUE@	live-g-file$(EXEEXT) socket-address$(EXEEXT) \
- @OS_UNIX_TRUE@	stream-rw_all$(EXEEXT) unix-fd$(EXEEXT) \
- @OS_UNIX_TRUE@	unix-streams$(EXEEXT) $(am__EXEEXT_1) \
-  
-
-The test below depends on the availability /etc/passwd to dbus-daemon.
-
---- glib-2.40.0/gio/tests/gdbus-auth.c	2014-02-03 11:40:41.000000000 -0600
-+++ glib-2.40.0/gio/tests/gdbus-auth.c	2014-06-30 15:08:43.719421893 -0500
-@@ -286,6 +286,8 @@
- {
-   gint ret;
- 
-+  g_test_init (&argc, &argv, NULL);
-+  return g_test_run();
-   setlocale (LC_ALL, "C");
- 
-   temp_dbus_keyrings_setup ();
-
-
-The test dbus-appinfo is dropped as it hangs indefinitely since 2.37.5, see
-   https://launchpad.net/ubuntu/+source/glib2.0/2.37.5-1ubuntu1
-
---- glib-2.40.0/gio/tests/dbus-appinfo.c	2014-02-03 11:40:41.000000000 -0600
-+++ glib-2.40.0/gio/tests/dbus-appinfo.c	2014-06-30 14:44:08.215383632 -0500
-@@ -278,7 +278,7 @@
- {
-   g_test_init (&argc, &argv, NULL);
- 
--  g_test_add_func ("/appinfo/dbusappinfo", test_dbus_appinfo);
-+  return g_test_run();
- 
-   return session_bus_run ();
- }
-
-
-The test below fails for unknown reasons (!).
-
---- glib-2.39.1/gio/tests/gsettings.c.orig	2014-01-20 00:45:04.000000000 +0100
-+++ glib-2.39.1/gio/tests/gsettings.c	2014-01-20 00:45:10.000000000 +0100
-@@ -2489,7 +2489,6 @@ main (int argc, char *argv[])
-   g_test_add_func ("/gsettings/range/subprocess/high", test_range_high);
-   g_test_add_func ("/gsettings/range/subprocess/low", test_range_low);
-   g_test_add_func ("/gsettings/list-items", test_list_items);
--  g_test_add_func ("/gsettings/list-schemas", test_list_schemas);
-   g_test_add_func ("/gsettings/mapped", test_get_mapped);
-   g_test_add_func ("/gsettings/get-range", test_get_range);
-   g_test_add_func ("/gsettings/schema-source", test_schema_source);
-
diff --git a/gnu/packages/patches/glib-tests-gapplication.patch b/gnu/packages/patches/glib-tests-gapplication.patch
deleted file mode 100644
index 1845fcb9b8..0000000000
--- a/gnu/packages/patches/glib-tests-gapplication.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-This test has proven to be unreliable, often leading to things like this
-in gapplication.log:
-
-  PASS: gapplication 3 /gapplication/properties
-  Failed to register: The connection is closed
-  **
-  GLib-GIO:ERROR:gapplication.c:564:test_quit: assertion failed: (activated)
-  ok 4 /gapplication/app-id
-  PASS: gapplication 4 /gapplication/app-id
-  ../../tap-test: line 5: 24133 Aborted                 $1 -k --tap
-  # GLib-GIO:ERROR:gapplication.c:564:test_quit: assertion failed: (activated)
-  cleaning up pid 24154
-  ERROR: gapplication - missing test plan
-  ERROR: gapplication - exited with status 134 (terminated by signal 6?)
-
-See <https://bugs.debian.org/756273> and <http://bugs.gnu.org/18445>.
-
-
---- glib-2.40.2/gio/tests/gapplication.c	2014-12-03 22:34:44.566667649 +0100
-+++ glib-2.40.2/gio/tests/gapplication.c	2014-12-03 22:34:45.346674179 +0100
-@@ -685,7 +685,6 @@ main (int argc, char **argv)
- /*  g_test_add_func ("/gapplication/non-unique", test_nonunique); */
-   g_test_add_func ("/gapplication/properties", properties);
-   g_test_add_func ("/gapplication/app-id", appid);
--  g_test_add_func ("/gapplication/quit", test_quit);
-   g_test_add_func ("/gapplication/local-actions", test_local_actions);
- /*  g_test_add_func ("/gapplication/remote-actions", test_remote_actions); */
-   g_test_add_func ("/gapplication/local-command-line", test_local_command_line);
diff --git a/gnu/packages/patches/glib-tests-homedir.patch b/gnu/packages/patches/glib-tests-homedir.patch
deleted file mode 100644
index 0a2bcf1a23..0000000000
--- a/gnu/packages/patches/glib-tests-homedir.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-`g_get_home_dir' looks at /etc/passwd first, which fails in chroot builds.
-The gdbus tests use it to lookup .dbus-keyrings, so they cannot run in our
-chroot build environment.  Thus, disable them.
-
---- glib-2.34.3/gio/tests/gdbus-connection-flush.c	2013-01-16 17:29:46.000000000 +0100
-+++ glib-2.34.3/gio/tests/gdbus-connection-flush.c	2013-01-16 17:29:47.000000000 +0100
-@@ -373,10 +373,6 @@ main (int   argc,
-   g_type_init ();
-   g_test_init (&argc, &argv, NULL);
- 
--  g_test_add ("/gdbus/connection/flush/busy", Fixture, NULL,
--              setup, test_flush_busy, teardown);
--  g_test_add ("/gdbus/connection/flush/idle", Fixture, NULL,
--              setup, test_flush_idle, teardown);
- 
-   ret = g_test_run();
-
---- glib-2.38.0.orig/gio/tests/gdbus-peer.c     2013-08-08 12:00:40.000000000 +0200
-+++ glib-2.38.0/gio/tests/gdbus-peer.c  2013-09-30 19:36:40.000000000 +0200
-@@ -1746,11 +1746,6 @@
-
-   g_test_add_func ("/gdbus/peer-to-peer", test_peer);
-   g_test_add_func ("/gdbus/delayed-message-processing", delayed_message_processing);
--  g_test_add_func ("/gdbus/nonce-tcp", test_nonce_tcp);
--
--  g_test_add_func ("/gdbus/tcp-anonymous", test_tcp_anonymous);
--  g_test_add_func ("/gdbus/credentials", test_credentials);
--  g_test_add_func ("/gdbus/codegen-peer-to-peer", codegen_test_peer);
-
-   ret = g_test_run();
- 
---- glib-2.37.1/gio/tests/gdbus-exit-on-close.c	2013-06-07 23:41:34.000000000 +0200
-+++ glib-2.37.1/gio/tests/gdbus-exit-on-close.c	2013-06-07 23:41:40.000000000 +0200
-@@ -211,6 +211,7 @@ main (int   argc,
- 
-   g_test_init (&argc, &argv, NULL);
- 
-+  return g_test_run();
-   for (i = 0; cases[i].name != NULL; i++)
-     {
-       gchar *name;
-@@ -224,5 +225,4 @@ main (int   argc,
-       g_free (name);
-     }
- 
--  return g_test_run();
- }
-
---- glib-2.34.3/gio/tests/gdbus-non-socket.c	2013-01-16 18:13:25.000000000 +0100
-+++ glib-2.34.3/gio/tests/gdbus-non-socket.c	2013-01-16 18:13:27.000000000 +0100
-@@ -294,7 +294,6 @@ main (int   argc,
-   g_type_init ();
-   g_test_init (&argc, &argv, NULL);
- 
--  g_test_add_func ("/gdbus/non-socket", test_non_socket);
- 
-   ret = g_test_run();
- 
-
diff --git a/gnu/packages/patches/glib-tests-prlimit.patch b/gnu/packages/patches/glib-tests-prlimit.patch
deleted file mode 100644
index f2b2a61bee..0000000000
--- a/gnu/packages/patches/glib-tests-prlimit.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-prlimit(2) returns ENOSYS on Linux 2.6.32-5-xen-amd64 as found on
-hydra.gnu.org, and strace(1) doesn't recognize it.
-
---- glib-2.34.3/glib/tests/thread.c	2012-11-20 15:27:12.000000000 +0100
-+++ glib-2.34.3/glib/tests/thread.c	2013-03-27 14:48:31.000000000 +0100
-@@ -130,7 +130,7 @@ test_thread3 (void)
- static void
- test_thread4 (void)
- {
--#ifdef HAVE_PRLIMIT
-+#if 0
-   struct rlimit ol, nl;
-   GThread *thread;
-   GError *error;
diff --git a/gnu/packages/patches/glib-tests-timer.patch b/gnu/packages/patches/glib-tests-timer.patch
index 1ac364fcc1..e37425c0c8 100644
--- a/gnu/packages/patches/glib-tests-timer.patch
+++ b/gnu/packages/patches/glib-tests-timer.patch
@@ -2,9 +2,6 @@
   fail depending on the elapsed microseconds.  Improve rounding by adding a
   fractional bit.
 
-* The /timer/stop test fails if compiler optimizations are enabled, which they
-  are by default.  Disable that test.
-
 --- glib-2.40.0/glib/tests/timer.c	2014-03-05 08:05:42.000000000 -0600
 +++ glib-2.40.0/glib/tests/timer.c	2014-07-10 16:33:12.746862822 -0500
 @@ -35,7 +35,7 @@
@@ -16,11 +13,3 @@
  
    g_timer_destroy (timer);
  }
-@@ -204,7 +204,6 @@
-   g_test_init (&argc, &argv, NULL);
- 
-   g_test_add_func ("/timer/basic", test_timer_basic);
--  g_test_add_func ("/timer/stop", test_timer_stop);
-   g_test_add_func ("/timer/continue", test_timer_continue);
-   g_test_add_func ("/timer/reset", test_timer_reset);
-   g_test_add_func ("/timeval/add", test_timeval_add);
diff --git a/gnu/packages/patches/gtk2-theme-paths.patch b/gnu/packages/patches/gtk2-theme-paths.patch
new file mode 100644
index 0000000000..6c1351e516
--- /dev/null
+++ b/gnu/packages/patches/gtk2-theme-paths.patch
@@ -0,0 +1,41 @@
+From: Jookia <166291@gmail.com>
+Subject: [PATCHv2] gtk: Patch GTK+ to look for themes in profiles.
+To: guix-devel@gnu.org
+Date: Sun, 13 Mar 2016 15:17:37 +1100
+Url: https://lists.gnu.org/archive/html/guix-devel/2016-03/msg00492.html
+
+diff -Naur gtk+-2.24.28.new/gtk/gtkrc.c gtk+-2.24.28/gtk/gtkrc.c
+--- gtk+-2.24.28.new/gtk/gtkrc.c	2016-03-13 10:31:14.413644362 +1100
++++ gtk+-2.24.28/gtk/gtkrc.c	2016-03-13 12:51:34.723398423 +1100
+@@ -808,6 +808,8 @@
+   gchar *path = NULL;
+   const gchar *home_dir;
+   gchar *subpath;
++  const gchar * const *xdg_data_dirs;
++  gint i;
+ 
+   if (type)
+     subpath = g_strconcat ("gtk-2.0-", type,
+@@ -830,6 +832,22 @@
+     }
+ 
+   if (!path)
++    {
++      xdg_data_dirs = g_get_system_data_dirs ();
++      for (i = 0; xdg_data_dirs[i]; i++)
++        {
++          path = g_build_filename (xdg_data_dirs[i], "themes", name, subpath, NULL);
++          if (g_file_test (path, G_FILE_TEST_EXISTS))
++            break;
++          else
++            {
++              g_free (path);
++              path = NULL;
++            }
++        }
++    }
++
++  if (!path)
+     {
+       gchar *theme_dir = gtk_rc_get_theme_dir ();
+       path = g_build_filename (theme_dir, name, subpath, NULL);
diff --git a/gnu/packages/patches/icecat-CVE-2016-2805.patch b/gnu/packages/patches/icecat-CVE-2016-2805.patch
deleted file mode 100644
index 5e4150f00c..0000000000
--- a/gnu/packages/patches/icecat-CVE-2016-2805.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/bf34b97757b3
-
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1453890675 0
-# Node ID bf34b97757b334af1f9f53b9b59e0b6902e7ed6f
-# Parent  228ca3f46cabaf3f388f6c6640690772aa13c1a5
-Bug 1241731 - Handle incomplete buffer in DiscardTransferables r=sfink a=abillings a=sylvestre
-
-diff --git a/js/src/jit-test/tests/gc/bug-1241731.js b/js/src/jit-test/tests/gc/bug-1241731.js
-new file mode 100644
---- /dev/null
-+++ b/js/src/jit-test/tests/gc/bug-1241731.js
-@@ -0,0 +1,4 @@
-+if (!('oomTest' in this))
-+    quit();
-+
-+oomTest(() => serialize(0, [{}]));
-diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
---- a/js/src/vm/StructuredClone.cpp
-+++ b/js/src/vm/StructuredClone.cpp
-@@ -379,39 +379,50 @@ ReadStructuredClone(JSContext* cx, uint6
- 
- // If the given buffer contains Transferables, free them. Note that custom
- // Transferables will use the JSStructuredCloneCallbacks::freeTransfer() to
- // delete their transferables.
- static void
- Discard(uint64_t* buffer, size_t nbytes, const JSStructuredCloneCallbacks* cb, void* cbClosure)
- {
-     MOZ_ASSERT(nbytes % sizeof(uint64_t) == 0);
--    if (nbytes < sizeof(uint64_t))
-+    uint64_t* end = buffer + nbytes / sizeof(uint64_t);
-+    uint64_t* point = buffer;
-+    if (point == end)
-         return; // Empty buffer
- 
--    uint64_t* point = buffer;
-     uint32_t tag, data;
-     SCInput::getPair(point++, &tag, &data);
-     if (tag != SCTAG_TRANSFER_MAP_HEADER)
-         return;
- 
-     if (TransferableMapHeader(data) == SCTAG_TM_TRANSFERRED)
-         return;
- 
-     // freeTransfer should not GC
-     JS::AutoSuppressGCAnalysis nogc;
- 
-+    if (point == end)
-+        return;
-+
-     uint64_t numTransferables = LittleEndian::readUint64(point++);
-     while (numTransferables--) {
-+        if (point == end)
-+            return;
-+
-         uint32_t ownership;
-         SCInput::getPair(point++, &tag, &ownership);
-         MOZ_ASSERT(tag >= SCTAG_TRANSFER_MAP_PENDING_ENTRY);
-+        if (point == end)
-+            return;
- 
-         void* content;
-         SCInput::getPtr(point++, &content);
-+        if (point == end)
-+            return;
- 
-         uint64_t extraData = LittleEndian::readUint64(point++);
- 
-         if (ownership < JS::SCTAG_TMO_FIRST_OWNED)
-             continue;
- 
-         if (ownership == JS::SCTAG_TMO_ALLOC_DATA) {
-             js_free(content);
-
diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch
deleted file mode 100644
index 0a6bee378b..0000000000
--- a/gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/e7c23c08bf84
-
-# HG changeset patch
-# User Randell Jesup <rjesup@jesup.org>
-# Date 1458543433 14400
-# Node ID e7c23c08bf84a02d9154f31e0c5d121a45884a69
-# Parent  a6de1f453712edabff597879398606708c191098
-Bug 1254876: assert windows recording is shut down r=pkerr a=ritu
-
-MozReview-Commit-ID: JRqxBb5TgrE
-
-diff --git a/media/webrtc/trunk/webrtc/modules/audio_device/win/audio_device_core_win.cc b/media/webrtc/trunk/webrtc/modules/audio_device/win/audio_device_core_win.cc
---- a/media/webrtc/trunk/webrtc/modules/audio_device/win/audio_device_core_win.cc
-+++ b/media/webrtc/trunk/webrtc/modules/audio_device/win/audio_device_core_win.cc
-@@ -567,16 +567,19 @@ AudioDeviceWindowsCore::AudioDeviceWindo
- // ----------------------------------------------------------------------------
- 
- AudioDeviceWindowsCore::~AudioDeviceWindowsCore()
- {
-     WEBRTC_TRACE(kTraceMemory, kTraceAudioDevice, _id, "%s destroyed", __FUNCTION__);
- 
-     Terminate();
- 
-+    // Recording thread should be shut down before this!
-+    assert(_hRecThread == NULL);
-+
-     // The IMMDeviceEnumerator is created during construction. Must release
-     // it here and not in Terminate() since we don't recreate it in Init().
-     SAFE_RELEASE(_ptrEnumerator);
- 
-     _ptrAudioBuffer = NULL;
- 
-     if (NULL != _hRenderSamplesReadyEvent)
-     {
-
diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch
deleted file mode 100644
index f4b4c0d4eb..0000000000
--- a/gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/3d2b62083a6a
-
-# HG changeset patch
-# User Shu-yu Guo <shu@rfrn.org>
-# Date 1459741387 -7200
-# Node ID 3d2b62083a6a4fb43cb330d77142f9dce0959a23
-# Parent  9d4364f6b55c6ee65c13c491292c3abe1ee2c993
-Bug 1254164 - Make aliasedBodyLevelLexicalBegin a uint32. r=Waldo, a=ritu
-
-diff --git a/js/src/jit-test/tests/parser/bug-1254164.js b/js/src/jit-test/tests/parser/bug-1254164.js
-new file mode 100644
---- /dev/null
-+++ b/js/src/jit-test/tests/parser/bug-1254164.js
-@@ -0,0 +1,6 @@
-+// |jit-test| slow;
-+
-+var s = '';
-+for (var i = 0; i < 70000; i++)
-+    s += 'function x' + i + '() { x' + i + '(); }\n';
-+eval("(function() { " + s + " })();");
-diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
---- a/js/src/jsscript.cpp
-+++ b/js/src/jsscript.cpp
-@@ -111,17 +111,20 @@ Bindings::initWithTemporaryStorage(Exclu
-     // JITs when interpreting/compiling aliasedvar ops.)
- 
-     // Since unaliased variables are, by definition, only accessed by local
-     // operations and never through the scope chain, only give shapes to
-     // aliased variables. While the debugger may observe any scope object at
-     // any time, such accesses are mediated by DebugScopeProxy (see
-     // DebugScopeProxy::handleUnaliasedAccess).
-     uint32_t nslots = CallObject::RESERVED_SLOTS;
--    uint32_t aliasedBodyLevelLexicalBegin = UINT16_MAX;
-+
-+    // Unless there are aliased body-level lexical bindings at all, set the
-+    // begin index to an impossible slot number.
-+    uint32_t aliasedBodyLevelLexicalBegin = LOCALNO_LIMIT;
-     for (BindingIter bi(self); bi; bi++) {
-         if (bi->aliased()) {
-             // Per ES6, lexical bindings cannot be accessed until
-             // initialized. Remember the first aliased slot that is a
-             // body-level lexical, so that they may be initialized to sentinel
-             // magic values.
-             if (numBodyLevelLexicals > 0 &&
-                 nslots < aliasedBodyLevelLexicalBegin &&
-diff --git a/js/src/jsscript.h b/js/src/jsscript.h
---- a/js/src/jsscript.h
-+++ b/js/src/jsscript.h
-@@ -201,18 +201,18 @@ class Bindings
-     friend class BindingIter;
-     friend class AliasedFormalIter;
- 
-     RelocatablePtrShape callObjShape_;
-     uintptr_t bindingArrayAndFlag_;
-     uint16_t numArgs_;
-     uint16_t numBlockScoped_;
-     uint16_t numBodyLevelLexicals_;
--    uint16_t aliasedBodyLevelLexicalBegin_;
-     uint16_t numUnaliasedBodyLevelLexicals_;
-+    uint32_t aliasedBodyLevelLexicalBegin_;
-     uint32_t numVars_;
-     uint32_t numUnaliasedVars_;
- 
- #if JS_BITS_PER_WORD == 32
-     // Bindings is allocated inline inside JSScript, which needs to be
-     // gc::Cell aligned.
-     uint32_t padding_;
- #endif
-
diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch
deleted file mode 100644
index a5a4212c28..0000000000
--- a/gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/88f1eb2c3f4b
-
-# HG changeset patch
-# User Timothy Nikkel <tnikkel@gmail.com>
-# Date 1457637807 21600
-# Node ID 88f1eb2c3f4b4b57365ed88223cf8adc2bec4610
-# Parent  bf34b97757b334af1f9f53b9b59e0b6902e7ed6f
-Bug 1187420. r=drc r=jmuizelaar a=sylvestre
-
-MozReview-Commit-ID: Hh0Khqfj8Bf
-
-diff --git a/media/libjpeg/jstdhuff.c b/media/libjpeg/jstdhuff.c
---- a/media/libjpeg/jstdhuff.c
-+++ b/media/libjpeg/jstdhuff.c
-@@ -36,16 +36,17 @@ add_huff_table (j_common_ptr cinfo,
-    */
-   nsymbols = 0;
-   for (len = 1; len <= 16; len++)
-     nsymbols += bits[len];
-   if (nsymbols < 1 || nsymbols > 256)
-     ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
- 
-   MEMCOPY((*htblptr)->huffval, val, nsymbols * sizeof(UINT8));
-+  MEMZERO(&((*htblptr)->huffval[nsymbols]), (256 - nsymbols) * sizeof(UINT8));
- 
-   /* Initialize sent_table FALSE so table will be written to JPEG file. */
-   (*htblptr)->sent_table = FALSE;
- }
- 
- 
- LOCAL(void)
- std_huff_tables (j_common_ptr cinfo)
-
diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch
deleted file mode 100644
index 5eff4fe99c..0000000000
--- a/gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/5c312182da90
-
-# HG changeset patch
-# User Jan de Mooij <jdemooij@mozilla.com>
-# Date 1458828581 -3600
-# Node ID 5c312182da9020504103aa329360abaffa7e232d
-# Parent  fa4efccde9b7efde8763a178a6cf422b6d37a0e9
-Bug 1254622 - Relookup group->newScript in CreateThisForFunctionWithGroup. r=bhackett a=sylvestre
-
-MozReview-Commit-ID: KXd7kB70f1Z
-
-diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
---- a/js/src/jsobj.cpp
-+++ b/js/src/jsobj.cpp
-@@ -1574,18 +1574,19 @@ CreateThisForFunctionWithGroup(JSContext
-         // Not enough objects with this group have been created yet, so make a
-         // plain object and register it with the group. Use the maximum number
-         // of fixed slots, as is also required by the TypeNewScript.
-         gc::AllocKind allocKind = GuessObjectGCKind(NativeObject::MAX_FIXED_SLOTS);
-         PlainObject* res = NewObjectWithGroup<PlainObject>(cx, group, parent, allocKind, newKind);
-         if (!res)
-             return nullptr;
- 
--        if (newKind != SingletonObject)
--            newScript->registerNewObject(res);
-+        // Make sure group->newScript is still there.
-+        if (newKind != SingletonObject && group->newScript())
-+            group->newScript()->registerNewObject(res);
- 
-         return res;
-     }
- 
-     gc::AllocKind allocKind = NewObjectGCKind(&PlainObject::class_);
- 
-     if (newKind == SingletonObject) {
-         Rooted<TaggedProto> protoRoot(cx, group->proto());
-
diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch
deleted file mode 100644
index 00718ebaac..0000000000
--- a/gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/3fdd280fa099
-
-# HG changeset patch
-# User Carsten "Tomcat" Book <cbook@mozilla.com>
-# Date 1461123938 -7200
-# Node ID 3fdd280fa099b6453ce9fd9905af883bc2ebce24
-# Parent  52dfdd37150d62f708dc5bf61dd28f3967596788
-Bug 1252707 - a=sylvestre
-
-diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp
---- a/js/src/vm/Shape.cpp
-+++ b/js/src/vm/Shape.cpp
-@@ -382,18 +382,20 @@ NativeObject::getChildPropertyOnDictiona
- 
-     if (obj->inDictionaryMode()) {
-         MOZ_ASSERT(parent == obj->lastProperty());
-         RootedGeneric<StackShape*> childRoot(cx, &child);
-         shape = childRoot->isAccessorShape() ? NewGCAccessorShape(cx) : NewGCShape(cx);
-         if (!shape)
-             return nullptr;
-         if (childRoot->hasSlot() && childRoot->slot() >= obj->lastProperty()->base()->slotSpan()) {
--            if (!obj->setSlotSpan(cx, childRoot->slot() + 1))
-+            if (!obj->setSlotSpan(cx, childRoot->slot() + 1)) {
-+                new (shape) Shape(obj->lastProperty()->base()->unowned(), 0);
-                 return nullptr;
-+            }
-         }
-         shape->initDictionaryShape(*childRoot, obj->numFixedSlots(), &obj->shape_);
-     }
- 
-     return shape;
- }
- 
- /* static */ Shape*
-
diff --git a/gnu/packages/patches/icecat-CVE-2016-2808.patch b/gnu/packages/patches/icecat-CVE-2016-2808.patch
deleted file mode 100644
index ae190b8b4c..0000000000
--- a/gnu/packages/patches/icecat-CVE-2016-2808.patch
+++ /dev/null
@@ -1,389 +0,0 @@
-Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/71f611fd27c7
-
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1458941573 25200
-# Node ID 71f611fd27c7d6cb7d6dab9895c2922948042543
-# Parent  861f6b83ce1deade2a976cabe059776ad51ce370
-Bug 1246061.  r=luke, r=froydnj, a=sylvestre
-
-diff --git a/js/public/HashTable.h b/js/public/HashTable.h
---- a/js/public/HashTable.h
-+++ b/js/public/HashTable.h
-@@ -8,16 +8,17 @@
- #define js_HashTable_h
- 
- #include "mozilla/Alignment.h"
- #include "mozilla/Assertions.h"
- #include "mozilla/Attributes.h"
- #include "mozilla/Casting.h"
- #include "mozilla/MemoryReporting.h"
- #include "mozilla/Move.h"
-+#include "mozilla/Opaque.h"
- #include "mozilla/PodOperations.h"
- #include "mozilla/ReentrancyGuard.h"
- #include "mozilla/TemplateLib.h"
- #include "mozilla/TypeTraits.h"
- 
- #include "js/Utility.h"
- 
- namespace js {
-@@ -27,16 +28,18 @@ template <class> struct DefaultHasher;
- template <class, class> class HashMapEntry;
- namespace detail {
-     template <class T> class HashTableEntry;
-     template <class T, class HashPolicy, class AllocPolicy> class HashTable;
- }
- 
- /*****************************************************************************/
- 
-+using Generation = mozilla::Opaque<uint64_t>;
-+
- // A JS-friendly, STL-like container providing a hash-based map from keys to
- // values. In particular, HashMap calls constructors and destructors of all
- // objects added so non-PODs may be used safely.
- //
- // Key/Value requirements:
- //  - movable, destructible, assignable
- // HashPolicy requirements:
- //  - see Hash Policy section below
-@@ -200,17 +203,19 @@ class HashMap
-         return impl.sizeOfExcludingThis(mallocSizeOf);
-     }
-     size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const {
-         return mallocSizeOf(this) + impl.sizeOfExcludingThis(mallocSizeOf);
-     }
- 
-     // If |generation()| is the same before and after a HashMap operation,
-     // pointers into the table remain valid.
--    uint32_t generation() const                       { return impl.generation(); }
-+    Generation generation() const {
-+        return impl.generation();
-+    }
- 
-     /************************************************** Shorthand operations */
- 
-     bool has(const Lookup& l) const {
-         return impl.lookup(l).found();
-     }
- 
-     // Overwrite existing value with v. Return false on oom.
-@@ -431,17 +436,19 @@ class HashSet
-         return impl.sizeOfExcludingThis(mallocSizeOf);
-     }
-     size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const {
-         return mallocSizeOf(this) + impl.sizeOfExcludingThis(mallocSizeOf);
-     }
- 
-     // If |generation()| is the same before and after a HashSet operation,
-     // pointers into the table remain valid.
--    uint32_t generation() const                       { return impl.generation(); }
-+    Generation generation() const {
-+        return impl.generation();
-+    }
- 
-     /************************************************** Shorthand operations */
- 
-     bool has(const Lookup& l) const {
-         return impl.lookup(l).found();
-     }
- 
-     // Add |u| if it is not present already. Return false on oom.
-@@ -766,17 +773,17 @@ class HashTable : private AllocPolicy
-     // table operations unless |generation()| is tested.
-     class Ptr
-     {
-         friend class HashTable;
- 
-         Entry* entry_;
- #ifdef JS_DEBUG
-         const HashTable* table_;
--        uint32_t generation;
-+        Generation generation;
- #endif
- 
-       protected:
-         Ptr(Entry& entry, const HashTable& tableArg)
-           : entry_(&entry)
- #ifdef JS_DEBUG
-           , table_(&tableArg)
-           , generation(tableArg.generation())
-@@ -873,17 +880,17 @@ class HashTable : private AllocPolicy
-             while (cur < end && !cur->isLive())
-                 ++cur;
-         }
- 
-         Entry* cur, *end;
- #ifdef JS_DEBUG
-         const HashTable* table_;
-         uint64_t mutationCount;
--        uint32_t generation;
-+        Generation generation;
-         bool validEntry;
- #endif
- 
-       public:
-         Range()
-           : cur(nullptr)
-           , end(nullptr)
- #ifdef JS_DEBUG
-@@ -1012,18 +1019,18 @@ class HashTable : private AllocPolicy
-     // HashTable is not copyable or assignable
-     HashTable(const HashTable&) = delete;
-     void operator=(const HashTable&) = delete;
- 
-   private:
-     static const size_t CAP_BITS = 24;
- 
-   public:
--    Entry*      table;                 // entry storage
--    uint32_t    gen;                    // entry storage generation number
-+    uint64_t    gen;                    // entry storage generation number
-+    Entry*      table;                  // entry storage
-     uint32_t    entryCount;             // number of entries in table
-     uint32_t    removedCount:CAP_BITS;  // removed entry sentinels in table
-     uint32_t    hashShift:8;            // multiplicative hash shift
- 
- #ifdef JS_DEBUG
-     uint64_t     mutationCount;
-     mutable bool mEntered;
-     mutable struct Stats
-@@ -1097,18 +1104,18 @@ class HashTable : private AllocPolicy
-         for (Entry* e = oldTable, *end = e + capacity; e < end; ++e)
-             e->destroyIfLive();
-         alloc.free_(oldTable);
-     }
- 
-   public:
-     explicit HashTable(AllocPolicy ap)
-       : AllocPolicy(ap)
-+      , gen(0)
-       , table(nullptr)
--      , gen(0)
-       , entryCount(0)
-       , removedCount(0)
-       , hashShift(sHashBits)
- #ifdef JS_DEBUG
-       , mutationCount(0)
-       , mEntered(false)
- #endif
-     {}
-@@ -1524,20 +1531,20 @@ class HashTable : private AllocPolicy
-     }
- 
-     uint32_t capacity() const
-     {
-         MOZ_ASSERT(table);
-         return JS_BIT(sHashBits - hashShift);
-     }
- 
--    uint32_t generation() const
-+    Generation generation() const
-     {
-         MOZ_ASSERT(table);
--        return gen;
-+        return Generation(gen);
-     }
- 
-     size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const
-     {
-         return mallocSizeOf(table);
-     }
- 
-     size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const
-diff --git a/js/src/jsapi.h b/js/src/jsapi.h
---- a/js/src/jsapi.h
-+++ b/js/src/jsapi.h
-@@ -270,20 +270,16 @@ class AutoHashMapRooter : protected Auto
- 
-     size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const {
-         return map.sizeOfExcludingThis(mallocSizeOf);
-     }
-     size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const {
-         return map.sizeOfIncludingThis(mallocSizeOf);
-     }
- 
--    uint32_t generation() const {
--        return map.generation();
--    }
--
-     /************************************************** Shorthand operations */
- 
-     bool has(const Lookup& l) const {
-         return map.has(l);
-     }
- 
-     template<typename KeyInput, typename ValueInput>
-     bool put(const KeyInput& k, const ValueInput& v) {
-@@ -385,20 +381,16 @@ class AutoHashSetRooter : protected Auto
- 
-     size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const {
-         return set.sizeOfExcludingThis(mallocSizeOf);
-     }
-     size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const {
-         return set.sizeOfIncludingThis(mallocSizeOf);
-     }
- 
--    uint32_t generation() const {
--        return set.generation();
--    }
--
-     /************************************************** Shorthand operations */
- 
-     bool has(const Lookup& l) const {
-         return set.has(l);
-     }
- 
-     bool put(const T& t) {
-         return set.put(t);
-diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
---- a/js/src/jscntxt.h
-+++ b/js/src/jscntxt.h
-@@ -30,21 +30,21 @@ class DebugModeOSRVolatileJitFrameIterat
- }
- 
- typedef HashSet<JSObject*> ObjectSet;
- typedef HashSet<Shape*> ShapeSet;
- 
- /* Detects cycles when traversing an object graph. */
- class AutoCycleDetector
- {
-+    Generation hashsetGenerationAtInit;
-     JSContext* cx;
-     RootedObject obj;
-+    ObjectSet::AddPtr hashsetAddPointer;
-     bool cyclic;
--    uint32_t hashsetGenerationAtInit;
--    ObjectSet::AddPtr hashsetAddPointer;
-     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
- 
-   public:
-     AutoCycleDetector(JSContext* cx, HandleObject objArg
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-       : cx(cx), obj(cx, objArg), cyclic(true)
-     {
-         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-diff --git a/js/src/jswatchpoint.cpp b/js/src/jswatchpoint.cpp
---- a/js/src/jswatchpoint.cpp
-+++ b/js/src/jswatchpoint.cpp
-@@ -22,25 +22,25 @@ DefaultHasher<WatchKey>::hash(const Look
- {
-     return DefaultHasher<JSObject*>::hash(key.object.get()) ^ HashId(key.id.get());
- }
- 
- namespace {
- 
- class AutoEntryHolder {
-     typedef WatchpointMap::Map Map;
-+    Generation gen;
-     Map& map;
-     Map::Ptr p;
--    uint32_t gen;
-     RootedObject obj;
-     RootedId id;
- 
-   public:
-     AutoEntryHolder(JSContext* cx, Map& map, Map::Ptr p)
--      : map(map), p(p), gen(map.generation()), obj(cx, p->key().object), id(cx, p->key().id)
-+      : gen(map.generation()), map(map), p(p), obj(cx, p->key().object), id(cx, p->key().id)
-     {
-         MOZ_ASSERT(!p->value().held);
-         p->value().held = true;
-     }
- 
-     ~AutoEntryHolder() {
-         if (gen != map.generation())
-             p = map.lookup(WatchKey(obj, id));
-diff --git a/js/src/shell/jsheaptools.cpp b/js/src/shell/jsheaptools.cpp
---- a/js/src/shell/jsheaptools.cpp
-+++ b/js/src/shell/jsheaptools.cpp
-@@ -267,17 +267,17 @@ HeapReverser::traverseEdge(void* cell, J
-     Map::AddPtr a = map.lookupForAdd(cell);
-     if (!a) {
-         /*
-          * We've never visited this cell before. Add it to the map (thus
-          * marking it as visited), and put it on the work stack, to be
-          * visited from the main loop.
-          */
-         Node n(kind);
--        uint32_t generation = map.generation();
-+        Generation generation = map.generation();
-         if (!map.add(a, cell, Move(n)) ||
-             !work.append(Child(cell, kind)))
-             return false;
-         /* If the map has been resized, re-check the pointer. */
-         if (map.generation() != generation)
-             a = map.lookupForAdd(cell);
-     }
- 
-diff --git a/mfbt/Opaque.h b/mfbt/Opaque.h
-new file mode 100644
---- /dev/null
-+++ b/mfbt/Opaque.h
-@@ -0,0 +1,44 @@
-+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-+/* This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+
-+/* An opaque integral type supporting only comparison operators. */
-+
-+#ifndef mozilla_Opaque_h
-+#define mozilla_Opaque_h
-+
-+#include "mozilla/TypeTraits.h"
-+
-+namespace mozilla {
-+
-+/**
-+ * Opaque<T> is a replacement for integral T in cases where only comparisons
-+ * must be supported, and it's desirable to prevent accidental dependency on
-+ * exact values.
-+ */
-+template<typename T>
-+class Opaque final
-+{
-+  static_assert(mozilla::IsIntegral<T>::value,
-+                "mozilla::Opaque only supports integral types");
-+
-+  T mValue;
-+
-+public:
-+  Opaque() {}
-+  explicit Opaque(T aValue) : mValue(aValue) {}
-+
-+  bool operator==(const Opaque& aOther) const {
-+    return mValue == aOther.mValue;
-+  }
-+
-+  bool operator!=(const Opaque& aOther) const {
-+    return !(*this == aOther);
-+  }
-+};
-+
-+} // namespace mozilla
-+
-+#endif /* mozilla_Opaque_h */
-diff --git a/mfbt/moz.build b/mfbt/moz.build
---- a/mfbt/moz.build
-+++ b/mfbt/moz.build
-@@ -48,16 +48,17 @@ EXPORTS.mozilla = [
-     'MathAlgorithms.h',
-     'Maybe.h',
-     'MaybeOneOf.h',
-     'MemoryChecking.h',
-     'MemoryReporting.h',
-     'Move.h',
-     'NullPtr.h',
-     'NumericLimits.h',
-+    'Opaque.h',
-     'Pair.h',
-     'PodOperations.h',
-     'Poison.h',
-     'Range.h',
-     'RangedPtr.h',
-     'RefCountType.h',
-     'ReentrancyGuard.h',
-     'RefPtr.h',
-
diff --git a/gnu/packages/patches/icecat-CVE-2016-2814.patch b/gnu/packages/patches/icecat-CVE-2016-2814.patch
deleted file mode 100644
index 5f197f25e6..0000000000
--- a/gnu/packages/patches/icecat-CVE-2016-2814.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-
-# HG changeset patch
-# User Jean-Yves Avenard <jyavenard@mozilla.com>
-# Date 1460655260 25200
-# Node ID a13c0bc84d6eb132f4199f563fbe228d2d3b3a51
-# Parent  88f1eb2c3f4b4b57365ed88223cf8adc2bec4610
-Bug 1254721: Ensure consistency between Cenc offsets and sizes table. r=gerald a=sylvestre
-
-MozReview-Commit-ID: E1KbKIIBR87
-
-diff --git a/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp b/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp
---- a/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp
-+++ b/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp
-@@ -612,18 +612,18 @@ status_t
- SampleTable::parseSampleCencInfo() {
-     if ((!mCencDefaultSize && !mCencInfoCount) || mCencOffsets.isEmpty()) {
-         // We don't have all the cenc information we need yet. Quietly fail and
-         // hope we get the data we need later in the track header.
-         ALOGV("Got half of cenc saio/saiz pair. Deferring parse until we get the other half.");
-         return OK;
-     }
- 
--    if (!mCencSizes.isEmpty() && mCencOffsets.size() > 1 &&
--        mCencSizes.size() != mCencOffsets.size()) {
-+    if ((mCencOffsets.size() > 1 && mCencOffsets.size() < mCencInfoCount) ||
-+        (!mCencDefaultSize && mCencSizes.size() < mCencInfoCount)) {
-         return ERROR_MALFORMED;
-     }
- 
-     if (mCencInfoCount > kMAX_ALLOCATION / sizeof(SampleCencInfo)) {
-         // Avoid future OOM.
-         return ERROR_MALFORMED;
-     }
- 
-
diff --git a/gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch b/gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch
deleted file mode 100644
index 5c869bf510..0000000000
--- a/gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-Re-enable the DHE (Ephemeral Diffie-Hellman) cipher suites, which IceCat
-38.6.0 disabled by default to avoid the Logjam attack.  This issue was
-fixed in NSS version 3.19.1 by limiting the lower strength of supported
-DHE keys to use 1023 bit primes, so we can enable these cipher suites
-safely.  The DHE cipher suites are needed to allow IceCat to connect to
-many sites, including https://gnupg.org/.
-
-Patch by Mark H Weaver <mhw@netris.org>
-
---- icecat-38.6.0/browser/app/profile/icecat.js.orig	1969-12-31 19:00:00.000000000 -0500
-+++ icecat-38.6.0/browser/app/profile/icecat.js	2016-02-06 00:48:23.826170154 -0500
-@@ -2061,12 +2061,6 @@
- pref("security.ssl3.rsa_des_ede3_sha", false);
- pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false);
- pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false);
--// https://directory.fsf.org/wiki/Disable_DHE
--// Avoid logjam attack
--pref("security.ssl3.dhe_rsa_aes_128_sha", false);
--pref("security.ssl3.dhe_rsa_aes_256_sha", false);
--pref("security.ssl3.dhe_dss_aes_128_sha", false);
--pref("security.ssl3.dhe_rsa_des_ede3_sha", false);
- //Optional
- //Perfect forward secrecy
- // pref("security.ssl3.rsa_aes_256_sha", false);
diff --git a/gnu/packages/patches/icecat-update-bundled-graphite2.patch b/gnu/packages/patches/icecat-update-bundled-graphite2.patch
deleted file mode 100644
index c3ab920335..0000000000
--- a/gnu/packages/patches/icecat-update-bundled-graphite2.patch
+++ /dev/null
@@ -1,2488 +0,0 @@
-
-# HG changeset patch
-# User Jonathan Kew <jkew@mozilla.com>
-# Date 1460660890 -3600
-# Node ID 7330633d20ffb33941e41ea0666c4099b6e6d317
-# Parent  5c312182da9020504103aa329360abaffa7e232d
-Bug 1262846 (patch for ESR trees) - Update Graphite2 library to 1.3.8. r=jrmuizel a=sledru
-
-diff --git a/gfx/graphite2/README.mozilla b/gfx/graphite2/README.mozilla
---- a/gfx/graphite2/README.mozilla
-+++ b/gfx/graphite2/README.mozilla
-@@ -1,3 +1,3 @@
--This directory contains the Graphite2 library release 1.3.6 from
--https://github.com/silnrsi/graphite/releases/download/1.3.6/graphite-minimal-1.3.6.tgz
-+This directory contains the Graphite2 library release 1.3.8 from
-+https://github.com/silnrsi/graphite/releases/download/1.3.8/graphite2-minimal-1.3.8.tgz
- See gfx/graphite2/moz-gr-update.sh for update procedure.
-diff --git a/gfx/graphite2/include/graphite2/Font.h b/gfx/graphite2/include/graphite2/Font.h
---- a/gfx/graphite2/include/graphite2/Font.h
-+++ b/gfx/graphite2/include/graphite2/Font.h
-@@ -25,17 +25,17 @@
-     either version 2 of the License or (at your option) any later version.
- */
- #pragma once
- 
- #include "graphite2/Types.h"
- 
- #define GR2_VERSION_MAJOR   1
- #define GR2_VERSION_MINOR   3
--#define GR2_VERSION_BUGFIX  6
-+#define GR2_VERSION_BUGFIX  8
- 
- #ifdef __cplusplus
- extern "C"
- {
- #endif
- 
- typedef struct gr_face          gr_face;
- typedef struct gr_font          gr_font;
-diff --git a/gfx/graphite2/moz-gr-update.sh b/gfx/graphite2/moz-gr-update.sh
---- a/gfx/graphite2/moz-gr-update.sh
-+++ b/gfx/graphite2/moz-gr-update.sh
-@@ -14,17 +14,17 @@
- RELEASE=$1
- 
- if [ "x$RELEASE" == "x" ]
- then
-     echo "Must provide the version number to be used."
-     exit 1
- fi
- 
--TARBALL="https://github.com/silnrsi/graphite/releases/download/$RELEASE/graphite-minimal-$RELEASE.tgz"
-+TARBALL="https://github.com/silnrsi/graphite/releases/download/$RELEASE/graphite2-minimal-$RELEASE.tgz"
- 
- foo=`basename $0`
- TMPFILE=`mktemp -t ${foo}` || exit 1
- 
- curl -L "$TARBALL" -o "$TMPFILE"
- tar -x -z -C gfx/graphite2/ --strip-components 1 -f "$TMPFILE" || exit 1
- rm "$TMPFILE"
- 
-diff --git a/gfx/graphite2/src/CachedFace.cpp b/gfx/graphite2/src/CachedFace.cpp
---- a/gfx/graphite2/src/CachedFace.cpp
-+++ b/gfx/graphite2/src/CachedFace.cpp
-@@ -64,20 +64,20 @@ bool CachedFace::runGraphite(Segment *se
-         return false;
- 
-     assert(m_cacheStore);
-     // find where the segment can be broken
-     Slot * subSegStartSlot = seg->first();
-     Slot * subSegEndSlot = subSegStartSlot;
-     uint16 cmapGlyphs[eMaxSpliceSize];
-     int subSegStart = 0;
--    for (unsigned int i = 0; i < seg->charInfoCount(); ++i)
-+    for (unsigned int i = 0; i < seg->charInfoCount() && subSegEndSlot; ++i)
-     {
-         const unsigned int length = i - subSegStart + 1;
--        if (length < eMaxSpliceSize)
-+        if (length < eMaxSpliceSize && subSegEndSlot->gid() < m_cacheStore->maxCmapGid())
-             cmapGlyphs[length-1] = subSegEndSlot->gid();
-         else return false;
-         const bool spaceOnly = m_cacheStore->isSpaceGlyph(subSegEndSlot->gid());
-         // at this stage the character to slot mapping is still 1 to 1
-         const int   breakWeight = seg->charinfo(i)->breakWeight(),
-                     nextBreakWeight = (i + 1 < seg->charInfoCount())?
-                             seg->charinfo(i+1)->breakWeight() : 0;
-         const uint8 f = seg->charinfo(i)->flags();
-diff --git a/gfx/graphite2/src/Code.cpp b/gfx/graphite2/src/Code.cpp
---- a/gfx/graphite2/src/Code.cpp
-+++ b/gfx/graphite2/src/Code.cpp
-@@ -61,93 +61,88 @@ inline bool is_return(const instr i) {
-     const instr pop_ret  = *opmap[POP_RET].impl,
-                 ret_zero = *opmap[RET_ZERO].impl,
-                 ret_true = *opmap[RET_TRUE].impl;
-     return i == pop_ret || i == ret_zero || i == ret_true;
- }
- 
- struct context
- {
--    context(uint8 ref=0) : codeRef(ref) {flags.changed=false; flags.referenced=false; flags.inserted=false;}
-+    context(uint8 ref=0) : codeRef(ref) {flags.changed=false; flags.referenced=false;}
-     struct { 
-         uint8   changed:1,
--                referenced:1,
--                inserted:1;
-+                referenced:1;
-     } flags;
-     uint8       codeRef;
- };
- 
- } // end namespace
- 
- 
- class Machine::Code::decoder
- {
- public:
-     struct limits;
--    struct analysis
--    {
--        static const int NUMCONTEXTS = 256;
--        uint8     slotref;
--        context   contexts[NUMCONTEXTS];
--        byte      max_ref;
--        
--        analysis() : slotref(0), max_ref(0) {};
--        void set_ref(int index, bool incinsert=false) throw();
--        void set_noref(int index) throw();
--        void set_changed(int index) throw();
--
--    };
-+    static const int NUMCONTEXTS = 256;
-     
-     decoder(limits & lims, Code &code, enum passtype pt) throw();
-     
-     bool        load(const byte * bc_begin, const byte * bc_end);
-     void        apply_analysis(instr * const code, instr * code_end);
--    byte        max_ref() { return _analysis.max_ref; }
--    int         pre_context() const { return _pre_context; }
-+    byte        max_ref() { return _max_ref; }
-+    int         out_index() const { return _out_index; }
-     
- private:
-+    void        set_ref(int index) throw();
-+    void        set_noref(int index) throw();
-+    void        set_changed(int index) throw();
-     opcode      fetch_opcode(const byte * bc);
-     void        analyse_opcode(const opcode, const int8 * const dp) throw();
-     bool        emit_opcode(opcode opc, const byte * & bc);
--    bool        validate_opcode(const opcode opc, const byte * const bc);
-+    bool        validate_opcode(const byte opc, const byte * const bc);
-     bool        valid_upto(const uint16 limit, const uint16 x) const throw();
-     bool        test_context() const throw();
-+    bool        test_ref(int8 index) const throw();
-     void        failure(const status_t s) const throw() { _code.failure(s); }
-     
-     Code              & _code;
--    int                 _pre_context;
--    uint16              _rule_length;
-+    int                 _out_index;
-+    uint16              _out_length;
-     instr             * _instr;
-     byte              * _data;
-     limits            & _max;
--    analysis            _analysis;
-     enum passtype       _passtype;
-     int                 _stack_depth;
-     bool                _in_ctxt_item;
-+    int16               _slotref;
-+    context             _contexts[NUMCONTEXTS];
-+    byte                _max_ref;
- };
- 
- 
- struct Machine::Code::decoder::limits
- {
-   const byte       * bytecode;
-   const uint8        pre_context;
-   const uint16       rule_length,
-                      classes,
-                      glyf_attrs,
-                      features;
-   const byte         attrid[gr_slatMax];
- };
-    
- inline Machine::Code::decoder::decoder(limits & lims, Code &code, enum passtype pt) throw()
- : _code(code),
--  _pre_context(code._constraint ? 0 : lims.pre_context), 
--  _rule_length(code._constraint ? 1 : lims.rule_length), 
-+  _out_index(code._constraint ? 0 : lims.pre_context), 
-+  _out_length(code._constraint ? 1 : lims.rule_length), 
-   _instr(code._code), _data(code._data), _max(lims), _passtype(pt),
-   _stack_depth(0),
--  _in_ctxt_item(false)
-+  _in_ctxt_item(false),
-+  _slotref(0),
-+  _max_ref(0)
- { }
-     
- 
- 
- Machine::Code::Code(bool is_constraint, const byte * bytecode_begin, const byte * const bytecode_end,
-            uint8 pre_context, uint16 rule_length, const Silf & silf, const Face & face,
-            enum passtype pt, byte * * const _out)
-  :  _code(0), _data(0), _data_size(0), _instr_count(0), _max_ref(0), _status(loaded),
-@@ -163,17 +158,17 @@ Machine::Code::Code(bool is_constraint, 
-       return;
-     }
-     assert(bytecode_end > bytecode_begin);
-     const opcode_t *    op_to_fn = Machine::getOpcodeTable();
-     
-     // Allocate code and data target buffers, these sizes are a worst case
-     // estimate.  Once we know their real sizes the we'll shrink them.
-     if (_out)   _code = reinterpret_cast<instr *>(*_out);
--    else        _code = static_cast<instr *>(malloc(estimateCodeDataOut(bytecode_end-bytecode_begin)));
-+    else        _code = static_cast<instr *>(malloc(estimateCodeDataOut(bytecode_end-bytecode_begin, 1, is_constraint ? 0 : rule_length)));
-     _data = reinterpret_cast<byte *>(_code + (bytecode_end - bytecode_begin));
-     
-     if (!_code || !_data) {
-         failure(alloc_failed);
-         return;
-     }
-     
-     decoder::limits lims = {
-@@ -266,23 +261,23 @@ bool Machine::Code::decoder::load(const 
-     return bool(_code);
- }
- 
- // Validation check and fixups.
- //
- 
- opcode Machine::Code::decoder::fetch_opcode(const byte * bc)
- {
--    const opcode opc = opcode(*bc++);
-+    const byte opc = *bc++;
- 
-     // Do some basic sanity checks based on what we know about the opcode
-     if (!validate_opcode(opc, bc))  return MAX_OPCODE;
- 
-     // And check it's arguments as far as possible
--    switch (opc)
-+    switch (opcode(opc))
-     {
-         case NOP :
-             break;
-         case PUSH_BYTE :
-         case PUSH_BYTEU :
-         case PUSH_SHORT :
-         case PUSH_SHORTU :
-         case PUSH_LONG :
-@@ -319,47 +314,57 @@ opcode Machine::Code::decoder::fetch_opc
-         case COND :
-             _stack_depth -= 2;
-             if (_stack_depth <= 0)
-                 failure(underfull_stack);
-             break;
-         case NEXT :
-         case NEXT_N :           // runtime checked
-         case COPY_NEXT :
--            test_context();
--            ++_pre_context;
-+            ++_out_index;
-+            if (_out_index < -1 || _out_index > _out_length || _slotref > _max.rule_length)
-+                failure(out_of_range_data);
-             break;
-         case PUT_GLYPH_8BIT_OBS :
-             valid_upto(_max.classes, bc[0]);
-             test_context();
-             break;
-         case PUT_SUBS_8BIT_OBS :
--            valid_upto(_rule_length, _pre_context + int8(bc[0]));
-+            test_ref(int8(bc[0]));
-             valid_upto(_max.classes, bc[1]);
-             valid_upto(_max.classes, bc[2]);
-             test_context();
-             break;
-         case PUT_COPY :
--            valid_upto(_rule_length, _pre_context + int8(bc[0]));
-+            test_ref(int8(bc[0]));
-             test_context();
-             break;
-         case INSERT :
-             if (_passtype >= PASS_TYPE_POSITIONING)
-                 failure(invalid_opcode);
--            else
--                --_pre_context;
-+            ++_out_length;
-+            if (_out_index < 0) ++_out_index;
-+            if (_out_index < -1 || _out_index >= _out_length)
-+                failure(out_of_range_data);
-             break;
-         case DELETE :
-             if (_passtype >= PASS_TYPE_POSITIONING)
-                 failure(invalid_opcode);
--            test_context();
-+            if (_out_index < _max.pre_context)
-+                failure(out_of_range_data);
-+            --_out_index;
-+            --_out_length;
-+            if (_out_index < -1 || _out_index > _out_length)
-+                failure(out_of_range_data);
-             break;
-         case ASSOC :
-+            if (bc[0] == 0)
-+                failure(out_of_range_data);
-             for (uint8 num = bc[0]; num; --num)
--                valid_upto(_rule_length, _pre_context + int8(bc[num]));
-+                test_ref(int8(bc[num]));
-             test_context();
-             break;
-         case CNTXT_ITEM :
-             valid_upto(_max.rule_length, _max.pre_context + int8(bc[0]));
-             if (bc + 2 + bc[1] >= _max.bytecode)    failure(jump_past_end);
-             if (_in_ctxt_item)                      failure(nested_context_item);
-             break;
-         case ATTR_SET :
-@@ -378,52 +383,43 @@ opcode Machine::Code::decoder::fetch_opc
-                 failure(underfull_stack);
-             if (valid_upto(gr_slatMax, bc[0]))
-                 valid_upto(_max.attrid[bc[0]], bc[1]);
-             test_context();
-             break;
-         case PUSH_SLOT_ATTR :
-             ++_stack_depth;
-             valid_upto(gr_slatMax, bc[0]);
--            valid_upto(_rule_length, _pre_context + int8(bc[1]));
-+            test_ref(int8(bc[1]));
-             if (attrCode(bc[0]) == gr_slatUserDefn)     // use IATTR for user attributes
-                 failure(out_of_range_data);
-             break;
-         case PUSH_GLYPH_ATTR_OBS :
-+        case PUSH_ATT_TO_GATTR_OBS :
-             ++_stack_depth;
-             valid_upto(_max.glyf_attrs, bc[0]);
--            valid_upto(_rule_length, _pre_context + int8(bc[1]));
-+            test_ref(int8(bc[1]));
-             break;
-+        case PUSH_ATT_TO_GLYPH_METRIC :
-         case PUSH_GLYPH_METRIC :
-             ++_stack_depth;
-             valid_upto(kgmetDescent, bc[0]);
--            valid_upto(_rule_length, _pre_context + int8(bc[1]));
-+            test_ref(int8(bc[1]));
-             // level: dp[2] no check necessary
-             break;
-         case PUSH_FEAT :
-             ++_stack_depth;
-             valid_upto(_max.features, bc[0]);
--            valid_upto(_rule_length, _pre_context + int8(bc[1]));
--            break;
--        case PUSH_ATT_TO_GATTR_OBS :
--            ++_stack_depth;
--            valid_upto(_max.glyf_attrs, bc[0]);
--            valid_upto(_rule_length, _pre_context + int8(bc[1]));
--            break;
--        case PUSH_ATT_TO_GLYPH_METRIC :
--            ++_stack_depth;
--            valid_upto(kgmetDescent, bc[0]);
--            valid_upto(_rule_length, _pre_context + int8(bc[1]));
--            // level: dp[2] no check necessary
-+            test_ref(int8(bc[1]));
-             break;
-         case PUSH_ISLOT_ATTR :
-             ++_stack_depth;
-             if (valid_upto(gr_slatMax, bc[0]))
-             {
--                valid_upto(_rule_length, _pre_context + int8(bc[1]));
-+                test_ref(int8(bc[1]));
-                 valid_upto(_max.attrid[bc[0]], bc[2]);
-             }
-             break;
-         case PUSH_IGLYPH_ATTR :// not implemented
-             ++_stack_depth;
-             break;
-         case POP_RET :
-             if (--_stack_depth < 0)
-@@ -442,118 +438,107 @@ opcode Machine::Code::decoder::fetch_opc
-                 valid_upto(_max.attrid[bc[0]], bc[1]);
-             test_context();
-             break;
-         case PUSH_PROC_STATE :  // dummy: dp[0] no check necessary
-         case PUSH_VERSION :
-             ++_stack_depth;
-             break;
-         case PUT_SUBS :
--            valid_upto(_rule_length, _pre_context + int8(bc[0]));
-+            test_ref(int8(bc[0]));
-             valid_upto(_max.classes, uint16(bc[1]<< 8) | bc[2]);
-             valid_upto(_max.classes, uint16(bc[3]<< 8) | bc[4]);
-             test_context();
-             break;
-         case PUT_SUBS2 :        // not implemented
-         case PUT_SUBS3 :        // not implemented
-             break;
-         case PUT_GLYPH :
-             valid_upto(_max.classes, uint16(bc[0]<< 8) | bc[1]);
-             test_context();
-             break;
-         case PUSH_GLYPH_ATTR :
-         case PUSH_ATT_TO_GLYPH_ATTR :
-             ++_stack_depth;
-             valid_upto(_max.glyf_attrs, uint16(bc[0]<< 8) | bc[1]);
--            valid_upto(_rule_length, _pre_context + int8(bc[2]));
-+            test_ref(int8(bc[2]));
-+            break;
-+        case SET_FEAT :
-+            valid_upto(_max.features, bc[0]);
-+            test_ref(int8(bc[1]));
-             break;
-         default:
-             failure(invalid_opcode);
-             break;
-     }
- 
--    return bool(_code) ? opc : MAX_OPCODE;
-+    return bool(_code) ? opcode(opc) : MAX_OPCODE;
- }
- 
- 
- void Machine::Code::decoder::analyse_opcode(const opcode opc, const int8  * arg) throw()
- {
--  if (_code._constraint) return;
--  
-   switch (opc)
-   {
-     case DELETE :
-       _code._delete = true;
-       break;
-+    case ASSOC :
-+      set_changed(0);
-+//      for (uint8 num = arg[0]; num; --num)
-+//        _analysis.set_noref(num);
-+      break;
-     case PUT_GLYPH_8BIT_OBS :
-     case PUT_GLYPH :
-       _code._modify = true;
--      _analysis.set_changed(0);
-+      set_changed(0);
-       break;
-     case ATTR_SET :
-     case ATTR_ADD :
-+    case ATTR_SUB :
-     case ATTR_SET_SLOT :
-     case IATTR_SET_SLOT :
-     case IATTR_SET :
-     case IATTR_ADD :
-     case IATTR_SUB :
--      _analysis.set_noref(0);
-+      set_noref(0);
-       break;
-     case NEXT :
-     case COPY_NEXT :
--      if (!_analysis.contexts[_analysis.slotref].flags.inserted)
--        ++_analysis.slotref;
--      _analysis.contexts[_analysis.slotref] = context(_code._instr_count+1);
-+      ++_slotref;
-+      _contexts[_slotref] = context(_code._instr_count+1);
-       // if (_analysis.slotref > _analysis.max_ref) _analysis.max_ref = _analysis.slotref;
-       break;
-     case INSERT :
--      _analysis.contexts[_analysis.slotref].flags.inserted = true;
-+      if (_slotref >= 0) --_slotref;
-       _code._modify = true;
-       break;
-     case PUT_SUBS_8BIT_OBS :    // slotref on 1st parameter
-     case PUT_SUBS : 
-       _code._modify = true;
--      _analysis.set_changed(0);
-+      set_changed(0);
-       GR_FALLTHROUGH;
-       // no break
-     case PUT_COPY :
--    {
--      if (arg[0] != 0) { _analysis.set_changed(0); _code._modify = true; }
--      if (arg[0] <= 0 && -arg[0] <= _analysis.slotref - _analysis.contexts[_analysis.slotref].flags.inserted)
--        _analysis.set_ref(arg[0], true);
--      else if (arg[0] > 0)
--        _analysis.set_ref(arg[0], true);
-+      if (arg[0] != 0) { set_changed(0); _code._modify = true; }
-+      set_ref(arg[0]);
-       break;
--    }
--    case PUSH_ATT_TO_GATTR_OBS : // slotref on 2nd parameter
--        if (_code._constraint) return;
--        GR_FALLTHROUGH;
--        // no break
-     case PUSH_GLYPH_ATTR_OBS :
-     case PUSH_SLOT_ATTR :
-     case PUSH_GLYPH_METRIC :
-+    case PUSH_ATT_TO_GATTR_OBS :
-     case PUSH_ATT_TO_GLYPH_METRIC :
-     case PUSH_ISLOT_ATTR :
-     case PUSH_FEAT :
--      if (arg[1] <= 0 && -arg[1] <= _analysis.slotref - _analysis.contexts[_analysis.slotref].flags.inserted)
--        _analysis.set_ref(arg[1], true);
--      else if (arg[1] > 0)
--        _analysis.set_ref(arg[1], true);
-+    case SET_FEAT :
-+      set_ref(arg[1]);
-       break;
-     case PUSH_ATT_TO_GLYPH_ATTR :
--        if (_code._constraint) return;
--        GR_FALLTHROUGH;
--        // no break
-     case PUSH_GLYPH_ATTR :
--      if (arg[2] <= 0 && -arg[2] <= _analysis.slotref - _analysis.contexts[_analysis.slotref].flags.inserted)
--        _analysis.set_ref(arg[2], true);
--      else if (arg[2] > 0)
--        _analysis.set_ref(arg[2], true);
--      break;
--    case ASSOC :                // slotrefs in varargs
-+      set_ref(arg[2]);
-       break;
-     default:
-         break;
-   }
- }
- 
- 
- bool Machine::Code::decoder::emit_opcode(opcode opc, const byte * & bc)
-@@ -579,81 +564,89 @@ bool Machine::Code::decoder::emit_opcode
-         _data            += param_sz;
-         _code._data_size += param_sz;
-     }
-     
-     // recursively decode a context item so we can split the skip into 
-     // instruction and data portions.
-     if (opc == CNTXT_ITEM)
-     {
--        assert(_pre_context == 0);
-+        assert(_out_index == 0);
-         _in_ctxt_item = true;
--        _pre_context = _max.pre_context + int8(_data[-2]);
--        _rule_length = _max.rule_length;
-+        _out_index = _max.pre_context + int8(_data[-2]);
-+        _slotref = int8(_data[-2]);
-+        _out_length = _max.rule_length;
- 
-         const size_t ctxt_start = _code._instr_count;
-         byte & instr_skip = _data[-1];
-         byte & data_skip  = *_data++;
-         ++_code._data_size;
-         const byte *curr_end = _max.bytecode;
- 
-         if (load(bc, bc + instr_skip))
-         {
-             bc += instr_skip;
-             data_skip  = instr_skip - (_code._instr_count - ctxt_start);
-             instr_skip = _code._instr_count - ctxt_start;
-             _max.bytecode = curr_end;
- 
--            _rule_length = 1;
--            _pre_context = 0;
-+            _out_length = 1;
-+            _out_index = 0;
-+            _slotref = 0;
-             _in_ctxt_item = false;
-         }
-         else
-         {
--            _pre_context = 0;
-+            _out_index = 0;
-+            _slotref = 0;
-             return false;
-         }
-     }
-     
-     return bool(_code);
- }
- 
- 
- void Machine::Code::decoder::apply_analysis(instr * const code, instr * code_end)
- {
-     // insert TEMP_COPY commands for slots that need them (that change and are referenced later)
-     int tempcount = 0;
-     if (_code._constraint) return;
- 
-     const instr temp_copy = Machine::getOpcodeTable()[TEMP_COPY].impl[0];
--    for (const context * c = _analysis.contexts, * const ce = c + _analysis.slotref; c != ce; ++c)
-+    for (const context * c = _contexts, * const ce = c + _slotref; c < ce; ++c)
-     {
-         if (!c->flags.referenced || !c->flags.changed) continue;
-         
-         instr * const tip = code + c->codeRef + tempcount;        
-         memmove(tip+1, tip, (code_end - tip) * sizeof(instr));
-         *tip = temp_copy;
-         ++code_end;
-         ++tempcount;
-         _code._delete = true;
-     }
-     
-     _code._instr_count = code_end - code;
- }
- 
- 
- inline
--bool Machine::Code::decoder::validate_opcode(const opcode opc, const byte * const bc)
-+bool Machine::Code::decoder::validate_opcode(const byte opc, const byte * const bc)
- {
-     if (opc >= MAX_OPCODE)
-     {
-         failure(invalid_opcode);
-         return false;
-     }
-     const opcode_t & op = Machine::getOpcodeTable()[opc];
-+    if (op.impl[_code._constraint] == 0)
-+    {
-+        failure(unimplemented_opcode_used);
-+        return false;
-+    }
-     if (op.param_sz == VARARGS && bc >= _max.bytecode)
-     {
-         failure(arguments_exhausted);
-         return false;
-     }
-     const size_t param_sz = op.param_sz == VARARGS ? bc[0] + 1 : op.param_sz;
-     if (bc - 1 + param_sz >= _max.bytecode)
-     {
-@@ -666,56 +659,69 @@ bool Machine::Code::decoder::validate_op
- 
- bool Machine::Code::decoder::valid_upto(const uint16 limit, const uint16 x) const throw()
- {
-     const bool t = (limit != 0) && (x < limit);
-     if (!t) failure(out_of_range_data);
-     return t;
- }
- 
-+inline
-+bool Machine::Code::decoder::test_ref(int8 index) const throw()
-+{
-+    if (_code._constraint && !_in_ctxt_item)
-+    {
-+        if (index > 0 || -index > _max.pre_context)
-+        {
-+            failure(out_of_range_data);
-+            return false;
-+        }
-+    }
-+    else
-+        return valid_upto(_max.rule_length, _slotref + _max.pre_context + index);
-+    return true;
-+}
-+
- bool Machine::Code::decoder::test_context() const throw()
- {
--    if (_pre_context >= _rule_length || _analysis.slotref >= analysis::NUMCONTEXTS - 1)
-+    if (_out_index >= _out_length || _out_index < 0 || _slotref >= NUMCONTEXTS - 1)
-     {
-         failure(out_of_range_data);
-         return false;
-     }
-     return true;
- }
- 
- inline 
- void Machine::Code::failure(const status_t s) throw() {
-     release_buffers();
-     _status = s;
- }
- 
- 
- inline
--void Machine::Code::decoder::analysis::set_ref(int index, bool incinsert) throw() {
--    if (incinsert && contexts[slotref].flags.inserted) --index;
--    if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
--    contexts[index + slotref].flags.referenced = true;
--    if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
-+void Machine::Code::decoder::set_ref(int index) throw() {
-+    if (index + _slotref < 0 || index + _slotref >= NUMCONTEXTS) return;
-+    _contexts[index + _slotref].flags.referenced = true;
-+    if (index + _slotref > _max_ref) _max_ref = index + _slotref;
- }
- 
- 
- inline
--void Machine::Code::decoder::analysis::set_noref(int index) throw() {
--    if (contexts[slotref].flags.inserted) --index;
--    if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
--    if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
-+void Machine::Code::decoder::set_noref(int index) throw() {
-+    if (index + _slotref < 0 || index + _slotref >= NUMCONTEXTS) return;
-+    if (index + _slotref > _max_ref) _max_ref = index + _slotref;
- }
- 
- 
- inline
--void Machine::Code::decoder::analysis::set_changed(int index) throw() {
--    if (contexts[slotref].flags.inserted) --index;
--    if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
--    contexts[index + slotref].flags.changed = true;
--    if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
-+void Machine::Code::decoder::set_changed(int index) throw() {
-+    if (index + _slotref < 0 || index + _slotref >= NUMCONTEXTS) return;
-+    _contexts[index + _slotref].flags.changed= true;
-+    if (index + _slotref > _max_ref) _max_ref = index + _slotref;
- }
- 
- 
- void Machine::Code::release_buffers() throw()
- {
-     if (_own)
-         free(_code);
-     _code = 0;
-diff --git a/gfx/graphite2/src/Collider.cpp b/gfx/graphite2/src/Collider.cpp
---- a/gfx/graphite2/src/Collider.cpp
-+++ b/gfx/graphite2/src/Collider.cpp
-@@ -21,17 +21,17 @@
- 
- Alternatively, the contents of this file may be used under the terms of the
- Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
- License, as published by the Free Software Foundation, either version 2
- of the License or (at your option) any later version.
- */
- #include <algorithm>
- #include <limits>
--#include <math.h>
-+#include <cmath>
- #include <string>
- #include <functional>
- #include "inc/Collider.h"
- #include "inc/Segment.h"
- #include "inc/Slot.h"
- #include "inc/GlyphCache.h"
- #include "inc/Sparse.h"
- 
-@@ -824,43 +824,43 @@ bool KernCollider::initSlot(Segment *seg
-     if (margin < 10) margin = 10;
- 
-     _limit = limit;
-     _offsetPrev = offsetPrev; // kern from a previous pass
-     
-     // Calculate the height of the glyph and how many horizontal slices to use.
-     if (_maxy >= 1e37f)
-     {
--        _maxy = ymax;
--        _miny = ymin;
-         _sliceWidth = margin / 1.5f;
-+        _maxy = ymax + margin;
-+        _miny = ymin - margin;
-         numSlices = int((_maxy - _miny + 2) / (_sliceWidth / 1.5f) + 1.f);  // +2 helps with rounding errors
-         _edges.clear();
-         _edges.insert(_edges.begin(), numSlices, (dir & 1) ? 1e38f : -1e38f);
-         _xbound = (dir & 1) ? (float)1e38f : (float)-1e38f;
-     }
-     else if (_maxy != ymax || _miny != ymin)
-     {
-         if (_miny != ymin)
-         {
--            numSlices = int((ymin - _miny) / _sliceWidth - 1);
-+            numSlices = int((ymin - margin - _miny) / _sliceWidth - 1);
-             _miny += numSlices * _sliceWidth;
-             if (numSlices < 0)
-                 _edges.insert(_edges.begin(), -numSlices, (dir & 1) ? 1e38f : -1e38f);
-             else if ((unsigned)numSlices < _edges.size())    // this shouldn't fire since we always grow the range
-             {
-                 Vector<float>::iterator e = _edges.begin();
-                 while (numSlices--)
-                     ++e;
-                 _edges.erase(_edges.begin(), e);
-             }
-         }
-         if (_maxy != ymax)
-         {
--            numSlices = int((ymax - _miny) / _sliceWidth + 1);
-+            numSlices = int((ymax + margin - _miny) / _sliceWidth + 1);
-             _maxy = numSlices * _sliceWidth + _miny;
-             if (numSlices > (int)_edges.size())
-                 _edges.insert(_edges.end(), numSlices - _edges.size(), (dir & 1) ? 1e38f : -1e38f);
-             else if (numSlices < (int)_edges.size())   // this shouldn't fire since we always grow the range
-             {
-                 while ((int)_edges.size() > numSlices)
-                     _edges.pop_back();
-             }
-@@ -930,53 +930,60 @@ bool KernCollider::initSlot(Segment *seg
- // Return false if we know there is no collision, true if we think there might be one.
- bool KernCollider::mergeSlot(Segment *seg, Slot *slot, const Position &currShift, float currSpace, int dir, GR_MAYBE_UNUSED json * const dbgout)
- {
-     int rtl = (dir & 1) * 2 - 1;
-     if (!seg->getFace()->glyphs().check(slot->gid()))
-         return false;
-     const Rect &bb = seg->theGlyphBBoxTemporary(slot->gid());
-     const float sx = slot->origin().x + currShift.x;
--    float x = sx + (rtl > 0 ? bb.tr.x : bb.bl.x);
-+    float x = (sx + (rtl > 0 ? bb.tr.x : bb.bl.x)) * rtl;
-     // this isn't going to reduce _mingap so skip
--    if ((rtl > 0 && x < _xbound - _mingap - currSpace) || (rtl <= 0 && x > _xbound + _mingap + currSpace))
-+    if (x < rtl * (_xbound - _mingap - currSpace))
-         return false;
- 
-     const float sy = slot->origin().y + currShift.y;
--    int smin = max(0, int((bb.bl.y + (1 - _miny + sy)) / _sliceWidth + 1));
--    int smax = min((int)_edges.size() - 1, int((bb.tr.y + (1 - _miny + sy)) / _sliceWidth + 1));
-+    int smin = max(1, int((bb.bl.y + (1 - _miny + sy)) / _sliceWidth + 1)) - 1;
-+    int smax = min((int)_edges.size() - 2, int((bb.tr.y + (1 - _miny + sy)) / _sliceWidth + 1)) + 1;
-+    if (smin > smax)
-+        return false;
-     bool collides = false;
-+    float below = smin > 0 ? _edges[smin-1] * rtl : 1e38f;
-+    float here = _edges[smin] * rtl;
-+    float above = smin < (int)_edges.size() - 1 ? _edges[smin+1] * rtl : 1e38f;
- 
-     for (int i = smin; i <= smax; ++i)
-     {
-         float t;
-         float y = (float)(_miny - 1 + (i + .5f) * _sliceWidth);  // vertical center of slice
--        if (x * rtl > _edges[i] * rtl - _mingap - currSpace)
-+        if (    (x > here - _mingap - currSpace)
-+             || (x > below - _mingap - currSpace)
-+             || (x > above - _mingap - currSpace))
-         {
-             // 2 * currSpace to account for the space that is already separating them and the space we want to add
--            float m = get_edge(seg, slot, currShift, y, _sliceWidth, rtl > 0) + 2 * rtl * currSpace;
--            t = rtl * (_edges[i] - m);
-+            float m = get_edge(seg, slot, currShift, y, _sliceWidth, rtl > 0) * rtl + 2 * currSpace;
-             // Check slices above and below (if any).
--            if (i < (int)_edges.size() - 1) t = min(t, rtl * (_edges[i+1] - m));
--            if (i > 0) t = min(t, rtl * (_edges[i-1] - m));
-+            t = min(min(here, below), above) - m;
-             // _mingap is positive to shrink
-             if (t < _mingap)
-             {
-                 _mingap = t;
-                 collides = true;
-             }
- #if !defined GRAPHITE2_NTRACING
-             // Debugging - remember the closest neighboring edge for this slice.
--            if (rtl * m > rtl * _nearEdges[i])
-+            if (m > rtl * _nearEdges[i])
-             {
-                 _slotNear[i] = slot;
--                _nearEdges[i] = m;
-+                _nearEdges[i] = m * rtl;
-             }
- #endif
-         }
-+        below = here; here = above;
-+        above = i < (int)_edges.size() - 2 ? _edges[i+2] * rtl : 1e38f;
-     }
-     return collides;   // note that true is not a necessarily reliable value
-     
- }   // end of KernCollider::mergeSlot
- 
- 
- // Return the amount to kern by.
- Position KernCollider::resolve(GR_MAYBE_UNUSED Segment *seg, GR_MAYBE_UNUSED Slot *slot,
-diff --git a/gfx/graphite2/src/Face.cpp b/gfx/graphite2/src/Face.cpp
---- a/gfx/graphite2/src/Face.cpp
-+++ b/gfx/graphite2/src/Face.cpp
-@@ -178,17 +178,18 @@ bool Face::runGraphite(Segment *seg, con
-     if ((seg->dir() & 3) == 3 && aSilf->bidiPass() == 0xFF)
-         seg->doMirror(aSilf->aMirror());
-     bool res = aSilf->runGraphite(seg, 0, aSilf->positionPass(), true);
-     if (res)
-     {
-         seg->associateChars(0, seg->charInfoCount());
-         if (aSilf->flags() & 0x20)
-             res &= seg->initCollisions();
--        res &= aSilf->runGraphite(seg, aSilf->positionPass(), aSilf->numPasses(), false);
-+        if (res)
-+            res &= aSilf->runGraphite(seg, aSilf->positionPass(), aSilf->numPasses(), false);
-     }
- 
- #if !defined GRAPHITE2_NTRACING
-     if (dbgout)
- {
-         seg->positionSlots(0, 0, 0, aSilf->dir());
-         *dbgout             << json::item
-                             << json::close // Close up the passes array
-@@ -226,17 +227,17 @@ const Silf *Face::chooseSilf(uint32 scri
-         return m_silfs;
- }
- 
- uint16 Face::findPseudo(uint32 uid) const
- {
-     return (m_numSilf) ? m_silfs[0].findPseudo(uid) : 0;
- }
- 
--uint16 Face::getGlyphMetric(uint16 gid, uint8 metric) const
-+int32 Face::getGlyphMetric(uint16 gid, uint8 metric) const
- {
-     switch (metrics(metric))
-     {
-         case kgmetAscent : return m_ascent;
-         case kgmetDescent : return m_descent;
-         default: 
-             if (gid >= glyphs().numGlyphs()) return 0;
-             return glyphs().glyph(gid)->getMetric(metric);
-@@ -277,17 +278,17 @@ Face::Table::Table(const Face & face, co
- : _f(&face), _compressed(false)
- {
-     size_t sz = 0;
-     _p = static_cast<const byte *>((*_f->m_ops.get_table)(_f->m_appFaceHandle, n, &sz));
-     _sz = uint32(sz);
- 
-     if (!TtfUtil::CheckTable(n, _p, _sz))
-     {
--        this->~Table();     // Make sure we release the table buffer even if the table filed it's checks
-+        releaseBuffers();     // Make sure we release the table buffer even if the table failed it's checks
-         return;
-     }
- 
-     if (be::peek<uint32>(_p) >= version)
-         decompress();
- }
- 
- void Face::Table::releaseBuffers()
-@@ -324,17 +325,18 @@ Error Face::Table::decompress()
-     switch(compression(hdr >> 27))
-     {
-     case NONE: return e;
- 
-     case LZ4:
-     {
-         uncompressed_size  = hdr & 0x07ffffff;
-         uncompressed_table = gralloc<byte>(uncompressed_size);
--        if (!e.test(!uncompressed_table, E_OUTOFMEM))
-+        if (!e.test(!uncompressed_table || uncompressed_size < 4, E_OUTOFMEM))
-+            memset(uncompressed_table, 0, 4);   // make sure version number is initialised
-             // coverity[forward_null : FALSE] - uncompressed_table has been checked so can't be null
-             // coverity[checked_return : FALSE] - we test e later
-             e.test(lz4::decompress(p, _sz - 2*sizeof(uint32), uncompressed_table, uncompressed_size) != signed(uncompressed_size), E_SHRINKERFAILED);
-         break;
-     }
- 
-     default:
-         e.error(E_BADSCHEME);
-diff --git a/gfx/graphite2/src/GlyphCache.cpp b/gfx/graphite2/src/GlyphCache.cpp
---- a/gfx/graphite2/src/GlyphCache.cpp
-+++ b/gfx/graphite2/src/GlyphCache.cpp
-@@ -111,18 +111,20 @@ private:
-                     _num_glyphs_attributes,
-                     _num_attrs;                    // number of glyph attributes per glyph
- };
- 
- 
- 
- GlyphCache::GlyphCache(const Face & face, const uint32 face_options)
- : _glyph_loader(new Loader(face, bool(face_options & gr_face_dumbRendering))),
--  _glyphs(_glyph_loader && *_glyph_loader ? grzeroalloc<const GlyphFace *>(_glyph_loader->num_glyphs()) : 0),
--  _boxes(_glyph_loader && _glyph_loader->has_boxes() ? grzeroalloc<GlyphBox *>(_glyph_loader->num_glyphs()) : 0),
-+  _glyphs(_glyph_loader && *_glyph_loader && _glyph_loader->num_glyphs()
-+        ? grzeroalloc<const GlyphFace *>(_glyph_loader->num_glyphs()) : 0),
-+  _boxes(_glyph_loader && _glyph_loader->has_boxes() && _glyph_loader->num_glyphs()
-+        ? grzeroalloc<GlyphBox *>(_glyph_loader->num_glyphs()) : 0),
-   _num_glyphs(_glyphs ? _glyph_loader->num_glyphs() : 0),
-   _num_attrs(_glyphs ? _glyph_loader->num_attrs() : 0),
-   _upem(_glyphs ? _glyph_loader->units_per_em() : 0)
- {
-     if ((face_options & gr_face_preloadGlyphs) && _glyph_loader && _glyphs)
-     {
-         int numsubs = 0;
-         GlyphFace * const glyphs = new GlyphFace [_num_glyphs];
-@@ -139,17 +141,17 @@ GlyphCache::GlyphCache(const Face & face
-         for (uint16 gid = 1; loaded && gid != _num_glyphs; ++gid)
-             _glyphs[gid] = loaded = _glyph_loader->read_glyph(gid, glyphs[gid], &numsubs);
- 
-         if (!loaded)
-         {
-             _glyphs[0] = 0;
-             delete [] glyphs;
-         }
--        else if (numsubs > 0)
-+        else if (numsubs > 0 && _boxes)
-         {
-             GlyphBox * boxes = (GlyphBox *)gralloc<char>(_num_glyphs * sizeof(GlyphBox) + numsubs * 8 * sizeof(float));
-             GlyphBox * currbox = boxes;
- 
-             for (uint16 gid = 0; currbox && gid != _num_glyphs; ++gid)
-             {
-                 _boxes[gid] = currbox;
-                 currbox = _glyph_loader->read_box(gid, currbox, *_glyphs[gid]);
-@@ -204,16 +206,18 @@ GlyphCache::~GlyphCache()
-             free(_boxes[0]);
-         free(_boxes);
-     }
-     delete _glyph_loader;
- }
- 
- const GlyphFace *GlyphCache::glyph(unsigned short glyphid) const      //result may be changed by subsequent call with a different glyphid
- { 
-+    if (glyphid >= numGlyphs())
-+        return _glyphs[0];
-     const GlyphFace * & p = _glyphs[glyphid];
-     if (p == 0 && _glyph_loader)
-     {
-         int numsubs = 0;
-         GlyphFace * g = new GlyphFace();
-         if (g)  p = _glyph_loader->read_glyph(glyphid, *g, &numsubs);
-         if (!p)
-         {
-@@ -280,26 +284,27 @@ GlyphCache::Loader::Loader(const Face & 
-         _long_fmt              = flags & 1;
-         int tmpnumgattrs       = (m_pGloc.size()
-                                    - (p - m_pGloc)
-                                    - sizeof(uint16)*(flags & 0x2 ? _num_attrs : 0))
-                                        / (_long_fmt ? sizeof(uint32) : sizeof(uint16)) - 1;
- 
-         if (version >= 0x00020000 || tmpnumgattrs < 0 || tmpnumgattrs > 65535
-             || _num_attrs == 0 || _num_attrs > 0x3000  // is this hard limit appropriate?
--            || _num_glyphs_graphics > tmpnumgattrs)
-+            || _num_glyphs_graphics > tmpnumgattrs
-+            || m_pGlat.size() < 4)
-         {
-             _head = Face::Table();
-             return;
-         }
- 
-         _num_glyphs_attributes = static_cast<unsigned short>(tmpnumgattrs);
-         p = m_pGlat;
-         version = be::read<uint32>(p);
--        if (version >= 0x00040000)       // reject Glat tables that are too new
-+        if (version >= 0x00040000 || (version >= 0x00030000 && m_pGlat.size() < 8))       // reject Glat tables that are too new
-         {
-             _head = Face::Table();
-             return;
-         }
-         else if (version >= 0x00030000)
-         {
-             unsigned int glatflags = be::read<uint32>(p);
-             _has_boxes = glatflags & 1;
-@@ -381,22 +386,24 @@ const GlyphFace * GlyphCache::Loader::re
-         }
-         else
-         {
-             be::skip<uint16>(gloc, glyphid);
-             glocs = be::read<uint16>(gloc);
-             gloce = be::peek<uint16>(gloc);
-         }
- 
--        if (glocs >= m_pGlat.size() || gloce > m_pGlat.size())
-+        if (glocs >= m_pGlat.size() - 1 || gloce > m_pGlat.size())
-             return 0;
- 
-         const uint32 glat_version = be::peek<uint32>(m_pGlat);
--        if (glat_version == 0x00030000)
-+        if (glat_version >= 0x00030000)
-         {
-+            if (glocs >= gloce)
-+                return 0;
-             const byte * p = m_pGlat + glocs;
-             uint16 bmap = be::read<uint16>(p);
-             int num = bit_set_count((uint32)bmap);
-             if (numsubs) *numsubs += num;
-             glocs += 6 + 8 * num;
-             if (glocs > gloce)
-                 return 0;
-         }
-@@ -449,29 +456,31 @@ GlyphBox * GlyphCache::Loader::read_box(
-     }
-     else
-     {
-         be::skip<uint16>(gloc, gid);
-         glocs = be::read<uint16>(gloc);
-         gloce = be::peek<uint16>(gloc);
-     }
- 
--    if (glocs >= m_pGlat.size() || gloce > m_pGlat.size())
-+    if (gloce > m_pGlat.size() || glocs + 6 >= gloce)
-         return 0;
- 
-     const byte * p = m_pGlat + glocs;
-     uint16 bmap = be::read<uint16>(p);
-     int num = bit_set_count((uint32)bmap);
- 
-     Rect bbox = glyph.theBBox();
-     Rect diamax(Position(bbox.bl.x + bbox.bl.y, bbox.bl.x - bbox.tr.y),
-                 Position(bbox.tr.x + bbox.tr.y, bbox.tr.x - bbox.bl.y));
-     Rect diabound = readbox(diamax, p[0], p[2], p[1], p[3]);
-     ::new (curr) GlyphBox(num, bmap, &diabound);
-     be::skip<uint8>(p, 4);
-+    if (glocs + 6 + num * 8 >= gloce)
-+        return 0;
- 
-     for (int i = 0; i < num * 2; ++i)
-     {
-         Rect box = readbox((i & 1) ? diamax : bbox, p[0], p[2], p[1], p[3]);
-         curr->addSubBox(i >> 1, i & 1, &box);
-         be::skip<uint8>(p, 4);
-     } 
-     return (GlyphBox *)((char *)(curr) + sizeof(GlyphBox) + 2 * num * sizeof(Rect));
-diff --git a/gfx/graphite2/src/GlyphFace.cpp b/gfx/graphite2/src/GlyphFace.cpp
---- a/gfx/graphite2/src/GlyphFace.cpp
-+++ b/gfx/graphite2/src/GlyphFace.cpp
-@@ -24,25 +24,25 @@ Mozilla Public License (http://mozilla.o
- License, as published by the Free Software Foundation, either version 2
- of the License or (at your option) any later version.
- */
- #include "inc/GlyphFace.h"
- 
- 
- using namespace graphite2;
- 
--uint16 GlyphFace::getMetric(uint8 metric) const
-+int32 GlyphFace::getMetric(uint8 metric) const
- {
-     switch (metrics(metric))
-     {
--        case kgmetLsb       : return static_cast<uint16>(m_bbox.bl.x);
--        case kgmetRsb       : return static_cast<uint16>(m_advance.x - m_bbox.tr.x);
--        case kgmetBbTop     : return static_cast<uint16>(m_bbox.tr.y);
--        case kgmetBbBottom  : return static_cast<uint16>(m_bbox.bl.y);
--        case kgmetBbLeft    : return static_cast<uint16>(m_bbox.bl.x);
--        case kgmetBbRight   : return static_cast<uint16>(m_bbox.tr.x);
--        case kgmetBbHeight  : return static_cast<uint16>(m_bbox.tr.y - m_bbox.bl.y);
--        case kgmetBbWidth   : return static_cast<uint16>(m_bbox.tr.x - m_bbox.bl.x);
--        case kgmetAdvWidth  : return static_cast<uint16>(m_advance.x);
--        case kgmetAdvHeight : return static_cast<uint16>(m_advance.y);
-+        case kgmetLsb       : return m_bbox.bl.x;
-+        case kgmetRsb       : return m_advance.x - m_bbox.tr.x;
-+        case kgmetBbTop     : return m_bbox.tr.y;
-+        case kgmetBbBottom  : return m_bbox.bl.y;
-+        case kgmetBbLeft    : return m_bbox.bl.x;
-+        case kgmetBbRight   : return m_bbox.tr.x;
-+        case kgmetBbHeight  : return m_bbox.tr.y - m_bbox.bl.y;
-+        case kgmetBbWidth   : return m_bbox.tr.x - m_bbox.bl.x;
-+        case kgmetAdvWidth  : return m_advance.x;
-+        case kgmetAdvHeight : return m_advance.y;
-         default : return 0;
-     }
- }
-diff --git a/gfx/graphite2/src/Justifier.cpp b/gfx/graphite2/src/Justifier.cpp
---- a/gfx/graphite2/src/Justifier.cpp
-+++ b/gfx/graphite2/src/Justifier.cpp
-@@ -95,62 +95,63 @@ float Segment::justify(Slot *pSlot, cons
- 
-     end = pLast->nextSibling();
-     pFirst = pFirst->nextSibling();
- 
-     int icount = 0;
-     int numLevels = silf()->numJustLevels();
-     if (!numLevels)
-     {
--        for (s = pSlot; s != end; s = s->next())
-+        for (s = pSlot; s && s != end; s = s->nextSibling())
-         {
-             CharInfo *c = charinfo(s->before());
-             if (isWhitespace(c->unicodeChar()))
-             {
-                 s->setJustify(this, 0, 3, 1);
-                 s->setJustify(this, 0, 2, 1);
-                 s->setJustify(this, 0, 0, -1);
-                 ++icount;
-             }
-         }
-         if (!icount)
-         {
--            for (s = pSlot; s != end; s = s->nextSibling())
-+            for (s = pSlot; s && s != end; s = s->nextSibling())
-             {
-                 s->setJustify(this, 0, 3, 1);
-                 s->setJustify(this, 0, 2, 1);
-                 s->setJustify(this, 0, 0, -1);
-             }
-         }
-         ++numLevels;
-     }
- 
-     Vector<JustifyTotal> stats(numLevels);
--    for (s = pFirst; s != end; s = s->nextSibling())
-+    for (s = pFirst; s && s != end; s = s->nextSibling())
-     {
-         float w = s->origin().x / scale + s->advance() - base;
-         if (w > currWidth) currWidth = w;
-         for (int j = 0; j < numLevels; ++j)
-             stats[j].accumulate(s, this, j);
-         s->just(0);
-     }
- 
-     for (int i = (width < 0.0f) ? -1 : numLevels - 1; i >= 0; --i)
-     {
-         float diff;
-         float error = 0.;
-         float diffpw;
-         int tWeight = stats[i].weight();
-+        if (tWeight == 0) continue;
- 
-         do {
-             error = 0.;
-             diff = width - currWidth;
-             diffpw = diff / tWeight;
-             tWeight = 0;
--            for (s = pFirst; s != end; s = s->nextSibling()) // don't include final glyph
-+            for (s = pFirst; s && s != end; s = s->nextSibling()) // don't include final glyph
-             {
-                 int w = s->getJustify(this, i, 3);
-                 float pref = diffpw * w + error;
-                 int step = s->getJustify(this, i, 2);
-                 if (!step) step = 1;        // handle lazy font developers
-                 if (pref > 0)
-                 {
-                     float max = uint16(s->getJustify(this, i, 0));
-diff --git a/gfx/graphite2/src/NameTable.cpp b/gfx/graphite2/src/NameTable.cpp
---- a/gfx/graphite2/src/NameTable.cpp
-+++ b/gfx/graphite2/src/NameTable.cpp
-@@ -42,25 +42,26 @@ NameTable::NameTable(const void* data, s
-     memcpy(pdata, data, length);
-     m_table = reinterpret_cast<const TtfUtil::Sfnt::FontNames*>(pdata);
- 
-     if ((length > sizeof(TtfUtil::Sfnt::FontNames)) &&
-         (length > sizeof(TtfUtil::Sfnt::FontNames) +
-          sizeof(TtfUtil::Sfnt::NameRecord) * ( be::swap<uint16>(m_table->count) - 1)))
-     {
-         uint16 offset = be::swap<uint16>(m_table->string_offset);
--        m_nameData = reinterpret_cast<const uint8*>(pdata) + offset;
--        setPlatformEncoding(platformId, encodingID);
--        m_nameDataLength = length - offset;
-+        if (offset < length)
-+        {
-+            m_nameData = reinterpret_cast<const uint8*>(pdata) + offset;
-+            setPlatformEncoding(platformId, encodingID);
-+            m_nameDataLength = length - offset;
-+            return;
-+        }
-     }
--    else
--    {
--        free(const_cast<TtfUtil::Sfnt::FontNames*>(m_table));
--        m_table = NULL;
--    }
-+    free(const_cast<TtfUtil::Sfnt::FontNames*>(m_table));
-+    m_table = NULL;
- }
- 
- uint16 NameTable::setPlatformEncoding(uint16 platformId, uint16 encodingID)
- {
-     if (!m_nameData) return 0;
-     uint16 i = 0;
-     uint16 count = be::swap<uint16>(m_table->count);
-     for (; i < count; i++)
-@@ -139,28 +140,36 @@ void* NameTable::getName(uint16& languag
-     uint16 offset = be::swap<uint16>(nameRecord.offset);
-     if(offset + utf16Length > m_nameDataLength)
-     {
-         languageId = 0;
-         length = 0;
-         return NULL;
-     }
-     utf16Length >>= 1; // in utf16 units
--    utf16::codeunit_t * utf16Name = gralloc<utf16::codeunit_t>(utf16Length);
-+    utf16::codeunit_t * utf16Name = gralloc<utf16::codeunit_t>(utf16Length + 1);
-     if (!utf16Name)
-     {
-         languageId = 0;
-         length = 0;
-         return NULL;
-     }
-     const uint8* pName = m_nameData + offset;
-     for (size_t i = 0; i < utf16Length; i++)
-     {
-         utf16Name[i] = be::read<uint16>(pName);
-     }
-+    utf16Name[utf16Length] = 0;
-+    if (!utf16::validate(utf16Name, utf16Name + utf16Length))
-+    {
-+        free(utf16Name);
-+        languageId = 0;
-+        length = 0;
-+        return NULL;
-+    }
-     switch (enc)
-     {
-     case gr_utf8:
-     {
-         utf8::codeunit_t* uniBuffer = gralloc<utf8::codeunit_t>(3 * utf16Length + 1);
-         if (!uniBuffer)
-         {
-             free(utf16Name);
-diff --git a/gfx/graphite2/src/Pass.cpp b/gfx/graphite2/src/Pass.cpp
---- a/gfx/graphite2/src/Pass.cpp
-+++ b/gfx/graphite2/src/Pass.cpp
-@@ -96,17 +96,17 @@ bool Pass::readPass(const byte * const p
-     const byte * p              = pass_start,
-                * const pass_end = p + pass_length;
-     size_t numRanges;
- 
-     if (e.test(pass_length < 40, E_BADPASSLENGTH)) return face.error(e); 
-     // Read in basic values
-     const byte flags = be::read<byte>(p);
-     if (e.test((flags & 0x1f) && 
--            (pt < PASS_TYPE_POSITIONING || !m_silf->aCollision() || !face.glyphs().hasBoxes()),
-+            (pt < PASS_TYPE_POSITIONING || !m_silf->aCollision() || !face.glyphs().hasBoxes() || !(m_silf->flags() & 0x20)),
-             E_BADCOLLISIONPASS))
-         return face.error(e);
-     m_numCollRuns = flags & 0x7;
-     m_kernColls   = (flags >> 3) & 0x3;
-     m_isReverseDir = (flags >> 5) & 0x1;
-     m_iMaxLoop = be::read<byte>(p);
-     if (m_iMaxLoop < 1) m_iMaxLoop = 1;
-     be::skip<byte>(p,2); // skip maxContext & maxBackup
-@@ -226,17 +226,21 @@ bool Pass::readRules(const byte * rule_m
-     // Load rules.
-     const byte * ac_begin = 0, * rc_begin = 0,
-                * ac_end = ac_data + be::peek<uint16>(o_action),
-                * rc_end = rc_data + be::peek<uint16>(o_constraint);
- 
-     // Allocate pools
-     m_rules = new Rule [m_numRules];
-     m_codes = new Code [m_numRules*2];
--    const size_t prog_pool_sz = vm::Machine::Code::estimateCodeDataOut(ac_end - ac_data + rc_end - rc_data);
-+    int totalSlots = 0;
-+    const uint16 *tsort = sort_key;
-+    for (int i = 0; i < m_numRules; ++i)
-+        totalSlots += be::peek<uint16>(--tsort);
-+    const size_t prog_pool_sz = vm::Machine::Code::estimateCodeDataOut(ac_end - ac_data + rc_end - rc_data, 2 * m_numRules, totalSlots);
-     m_progs = gralloc<byte>(prog_pool_sz);
-     byte * prog_pool_free = m_progs,
-          * prog_pool_end  = m_progs + prog_pool_sz;
-     if (e.test(!(m_rules && m_codes && m_progs), E_OUTOFMEM)) return face.error(e);
- 
-     Rule * r = m_rules + m_numRules - 1;
-     for (size_t n = m_numRules; r >= m_rules; --n, --r, ac_end = ac_begin, rc_end = rc_begin)
-     {
-@@ -249,17 +253,17 @@ bool Pass::readRules(const byte * rule_m
-         if (r->sort > 63 || r->preContext >= r->sort || r->preContext > m_maxPreCtxt || r->preContext < m_minPreCtxt)
-             return false;
-         ac_begin      = ac_data + be::peek<uint16>(--o_action);
-         --o_constraint;
-         rc_begin      = be::peek<uint16>(o_constraint) ? rc_data + be::peek<uint16>(o_constraint) : rc_end;
- 
-         if (ac_begin > ac_end || ac_begin > ac_data_end || ac_end > ac_data_end
-                 || rc_begin > rc_end || rc_begin > rc_data_end || rc_end > rc_data_end
--                || vm::Machine::Code::estimateCodeDataOut(ac_end - ac_begin + rc_end - rc_begin) > size_t(prog_pool_end - prog_pool_free))
-+                || vm::Machine::Code::estimateCodeDataOut(ac_end - ac_begin + rc_end - rc_begin, 2, r->sort) > size_t(prog_pool_end - prog_pool_free))
-             return false;
-         r->action     = new (m_codes+n*2-2) vm::Machine::Code(false, ac_begin, ac_end, r->preContext, r->sort, *m_silf, face, pt, &prog_pool_free);
-         r->constraint = new (m_codes+n*2-1) vm::Machine::Code(true,  rc_begin, rc_end, r->preContext, r->sort, *m_silf, face, pt, &prog_pool_free);
- 
-         if (e.test(!r->action || !r->constraint, E_OUTOFMEM)
-                 || e.test(r->action->status() != Code::loaded, r->action->status() + E_CODEFAILURE)
-                 || e.test(r->constraint->status() != Code::loaded, r->constraint->status() + E_CODEFAILURE)
-                 || e.test(!r->constraint->immutable(), E_MUTABLECCODE))
-@@ -330,17 +334,17 @@ bool Pass::readStates(const byte * start
- 
-     // load state transition table.
-     for (uint16 * t = m_transitions,
-                 * const t_end = t + m_numTransition*m_numColumns; t != t_end; ++t)
-     {
-         *t = be::read<uint16>(states);
-         if (e.test(*t >= m_numStates, E_BADSTATE))
-         {
--            face.error_context((face.error_context() & 0xFFFF00) + EC_ATRANS + (((t - m_transitions) / m_numColumns) << 24));
-+            face.error_context((face.error_context() & 0xFFFF00) + EC_ATRANS + (((t - m_transitions) / m_numColumns) << 8));
-             return face.error(e);
-         }
-     }
- 
-     State * s = m_states,
-           * const success_begin = m_states + m_numStates - m_numSuccess;
-     const RuleEntry * rule_map_end = m_ruleMap + be::peek<uint16>(o_rule_map + m_numSuccess*sizeof(uint16));
-     for (size_t n = m_numStates; n; --n, ++s)
-@@ -351,17 +355,18 @@ bool Pass::readStates(const byte * start
-         if (e.test(begin >= rule_map_end || end > rule_map_end || begin > end, E_BADRULEMAPPING))
-         {
-             face.error_context((face.error_context() & 0xFFFF00) + EC_ARULEMAP + (n << 24));
-             return face.error(e);
-         }
-         s->rules = begin;
-         s->rules_end = (end - begin <= FiniteStateMachine::MAX_RULES)? end :
-             begin + FiniteStateMachine::MAX_RULES;
--        qsort(begin, end - begin, sizeof(RuleEntry), &cmpRuleEntry);
-+        if (begin)      // keep UBSan happy can't call qsort with null begin
-+            qsort(begin, end - begin, sizeof(RuleEntry), &cmpRuleEntry);
-     }
- 
-     return true;
- }
- 
- bool Pass::readRanges(const byte * ranges, size_t num_ranges, Error &e)
- {
-     m_cols = gralloc<uint16>(m_numGlyphs);
-@@ -449,19 +454,19 @@ bool Pass::runFSM(FiniteStateMachine& fs
-     if (fsm.slots.context() < m_minPreCtxt)
-         return false;
- 
-     uint16 state = m_startStates[m_maxPreCtxt - fsm.slots.context()];
-     uint8  free_slots = SlotMap::MAX_SLOTS;
-     do
-     {
-         fsm.slots.pushSlot(slot);
--        if (--free_slots == 0
--         || slot->gid() >= m_numGlyphs
-+        if (slot->gid() >= m_numGlyphs
-          || m_cols[slot->gid()] == 0xffffU
-+         || --free_slots == 0
-          || state >= m_numTransition)
-             return free_slots != 0;
- 
-         const uint16 * transitions = m_transitions + state*m_numColumns;
-         state = transitions[m_cols[slot->gid()]];
-         if (state >= m_successStart)
-             fsm.rules.accumulate_rules(m_states[state]);
- 
-@@ -627,37 +632,40 @@ bool Pass::testPassConstraint(Machine & 
- }
- 
- 
- bool Pass::testConstraint(const Rule & r, Machine & m) const
- {
-     const uint16 curr_context = m.slotMap().context();
-     if (unsigned(r.sort - r.preContext) > m.slotMap().size() - curr_context
-         || curr_context - r.preContext < 0) return false;
-+
-+    vm::slotref * map = m.slotMap().begin() + curr_context - r.preContext;
-+    if (map[r.sort - 1] == 0)
-+        return false;
-+
-     if (!*r.constraint) return true;
-     assert(r.constraint->constraint());
--
--    vm::slotref * map = m.slotMap().begin() + curr_context - r.preContext;
-     for (int n = r.sort; n && map; --n, ++map)
-     {
-         if (!*map) continue;
-         const int32 ret = r.constraint->run(m, map);
-         if (!ret || m.status() != Machine::finished)
-             return false;
-     }
- 
-     return true;
- }
- 
- 
- void SlotMap::collectGarbage(Slot * &aSlot)
- {
-     for(Slot **s = begin(), *const *const se = end() - 1; s != se; ++s) {
-         Slot *& slot = *s;
--        if(slot->isDeleted() || slot->isCopied())
-+        if(slot && (slot->isDeleted() || slot->isCopied()))
-         {
-             if (slot == aSlot)
-                 aSlot = slot->prev() ? slot->prev() : slot->next();
-             segment.freeSlot(slot);
-         }
-     }
- }
- 
-@@ -848,17 +856,16 @@ bool Pass::collisionShift(Segment *seg, 
-             }
-         }
-     }
-     return true;
- }
- 
- bool Pass::collisionKern(Segment *seg, int dir, json * const dbgout) const
- {
--    KernCollider kerncoll(dbgout);
-     Slot *start = seg->first();
-     float ymin = 1e38f;
-     float ymax = -1e38f;
-     const GlyphCache &gc = seg->getFace()->glyphs();
- 
-     // phase 3 : handle kerning of clusters
- #if !defined GRAPHITE2_NTRACING
-     if (dbgout)
-@@ -871,17 +878,17 @@ bool Pass::collisionKern(Segment *seg, i
-             return false;
-         const SlotCollision * c = seg->collisionInfo(s);
-         const Rect &bbox = seg->theGlyphBBoxTemporary(s->gid());
-         float y = s->origin().y + c->shift().y;
-         ymax = max(y + bbox.tr.y, ymax);
-         ymin = min(y + bbox.bl.y, ymin);
-         if (start && (c->flags() & (SlotCollision::COLL_KERN | SlotCollision::COLL_FIX))
-                         == (SlotCollision::COLL_KERN | SlotCollision::COLL_FIX))
--            resolveKern(seg, s, start, kerncoll, dir, ymin, ymax, dbgout);
-+            resolveKern(seg, s, start, dir, ymin, ymax, dbgout);
-         if (c->flags() & SlotCollision::COLL_END)
-             start = NULL;
-         if (c->flags() & SlotCollision::COLL_START)
-             start = s;
-     }
- 
- #if !defined GRAPHITE2_NTRACING
-     if (dbgout)
-@@ -1010,17 +1017,17 @@ bool Pass::resolveCollisions(Segment *se
-     if (isCol)
-     { cFix->setFlags(cFix->flags() | SlotCollision::COLL_ISCOL | SlotCollision::COLL_KNOWN); }
-     else
-     { cFix->setFlags((cFix->flags() & ~SlotCollision::COLL_ISCOL) | SlotCollision::COLL_KNOWN); }
-     hasCol |= isCol;
-     return true;
- }
- 
--float Pass::resolveKern(Segment *seg, Slot *slotFix, GR_MAYBE_UNUSED Slot *start, KernCollider &coll, int dir,
-+float Pass::resolveKern(Segment *seg, Slot *slotFix, GR_MAYBE_UNUSED Slot *start, int dir,
-     float &ymin, float &ymax, json *const dbgout) const
- {
-     Slot *nbor; // neighboring slot
-     float currSpace = 0.;
-     bool collides = false;
-     unsigned int space_count = 0;
-     Slot *base = slotFix;
-     while (base->attachedTo())
-@@ -1030,16 +1037,17 @@ float Pass::resolveKern(Segment *seg, Sl
- 
-     if (base != slotFix)
-     {
-         cFix->setFlags(cFix->flags() | SlotCollision::COLL_KERN | SlotCollision::COLL_FIX);
-         return 0;
-     }
-     bool seenEnd = (cFix->flags() & SlotCollision::COLL_END) != 0;
-     bool isInit = false;
-+    KernCollider coll(dbgout);
- 
-     for (nbor = slotFix->next(); nbor; nbor = nbor->next())
-     {
-         if (nbor->isChildOf(base))
-             continue;
-         if (!gc.check(nbor->gid()))
-             return 0.;
-         const Rect &bb = seg->theGlyphBBoxTemporary(nbor->gid());
-diff --git a/gfx/graphite2/src/Segment.cpp b/gfx/graphite2/src/Segment.cpp
---- a/gfx/graphite2/src/Segment.cpp
-+++ b/gfx/graphite2/src/Segment.cpp
-@@ -419,16 +419,19 @@ Position Segment::positionSlots(const Fo
-         reverseSlots();
-         temp = iStart;
-         iStart = iEnd;
-         iEnd = temp;
-     }
-     if (!iStart)    iStart = m_first;
-     if (!iEnd)      iEnd   = m_last;
- 
-+    if (!iStart || !iEnd)   // only true for empty segments
-+        return currpos;
-+
-     if (isRtl)
-     {
-         for (Slot * s = iEnd, * const end = iStart->prev(); s && s != end; s = s->prev())
-         {
-             if (s->isBase())
-                 currpos = s->finalise(this, font, currpos, bbox, 0, clusterMin = currpos.x, isRtl, isFinal);
-         }
-     }
-@@ -526,11 +529,14 @@ void Segment::doMirror(uint16 aMirror)
- }
- 
- bool Segment::initCollisions()
- {
-     m_collisions = grzeroalloc<SlotCollision>(slotCount());
-     if (!m_collisions) return false;
- 
-     for (Slot *p = m_first; p; p = p->next())
--        ::new (collisionInfo(p)) SlotCollision(this, p);
-+        if (p->index() < slotCount())
-+            ::new (collisionInfo(p)) SlotCollision(this, p);
-+        else
-+            return false;
-     return true;
- }
-diff --git a/gfx/graphite2/src/Silf.cpp b/gfx/graphite2/src/Silf.cpp
---- a/gfx/graphite2/src/Silf.cpp
-+++ b/gfx/graphite2/src/Silf.cpp
-@@ -350,20 +350,20 @@ uint16 Silf::getClassGlyph(uint16 cid, u
-     }
-     return 0;
- }
- 
- 
- bool Silf::runGraphite(Segment *seg, uint8 firstPass, uint8 lastPass, int dobidi) const
- {
-     assert(seg != 0);
--    SlotMap            map(*seg, m_dir);
-+    unsigned int       maxSize = seg->slotCount() * MAX_SEG_GROWTH_FACTOR;
-+    SlotMap            map(*seg, m_dir, maxSize);
-     FiniteStateMachine fsm(map, seg->getFace()->logger());
-     vm::Machine        m(map);
--    unsigned int       initSize = seg->slotCount();
-     uint8              lbidi = m_bPass;
- #if !defined GRAPHITE2_NTRACING
-     json * const dbgout = seg->getFace()->logger();
- #endif
- 
-     if (lastPass == 0)
-     {
-         if (firstPass == lastPass && lbidi == 0xFF)
-@@ -419,13 +419,13 @@ bool Silf::runGraphite(Segment *seg, uin
- 
-         // test whether to reorder, prepare for positioning
-         bool reverse = (lbidi == 0xFF) && (seg->currdir() != ((m_dir & 1) ^ m_passes[i].reverseDir()));
-         if ((i >= 32 || (seg->passBits() & (1 << i)) == 0 || m_passes[i].collisionLoops())
-                 && !m_passes[i].runGraphite(m, fsm, reverse))
-             return false;
-         // only subsitution passes can change segment length, cached subsegments are short for their text
-         if (m.status() != vm::Machine::finished
--            || (seg->slotCount() && seg->slotCount() * MAX_SEG_GROWTH_FACTOR < initSize))
-+            || (seg->slotCount() && seg->slotCount() > maxSize))
-             return false;
-     }
-     return true;
- }
-diff --git a/gfx/graphite2/src/Slot.cpp b/gfx/graphite2/src/Slot.cpp
---- a/gfx/graphite2/src/Slot.cpp
-+++ b/gfx/graphite2/src/Slot.cpp
-@@ -80,20 +80,20 @@ void Slot::set(const Slot & orig, int ch
- 
- void Slot::update(int /*numGrSlots*/, int numCharInfo, Position &relpos)
- {
-     m_before += numCharInfo;
-     m_after += numCharInfo;
-     m_position = m_position + relpos;
- }
- 
--Position Slot::finalise(const Segment *seg, const Font *font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal)
-+Position Slot::finalise(const Segment *seg, const Font *font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal, int depth)
- {
-     SlotCollision *coll = NULL;
--    if (attrLevel && m_attLevel > attrLevel) return Position(0, 0);
-+    if (depth > 100 || (attrLevel && m_attLevel > attrLevel)) return Position(0, 0);
-     float scale = font ? font->scale() : 1.0f;
-     Position shift(m_shift.x * (rtl * -2 + 1) + m_just, m_shift.y);
-     float tAdvance = m_advance.x + m_just;
-     if (isFinal && (coll = seg->collisionInfo(this)))
-     {
-         const Position &collshift = coll->offset();
-         if (!(coll->flags() & SlotCollision::COLL_KERN) || rtl)
-             shift = shift + collshift;
-@@ -128,23 +128,23 @@ Position Slot::finalise(const Segment *s
-     if (glyphFace)
-     {
-         Rect ourBbox = glyphFace->theBBox() * scale + m_position;
-         bbox = bbox.widen(ourBbox);
-     }
- 
-     if (m_child && m_child != this && m_child->attachedTo() == this)
-     {
--        Position tRes = m_child->finalise(seg, font, m_position, bbox, attrLevel, clusterMin, rtl, isFinal);
-+        Position tRes = m_child->finalise(seg, font, m_position, bbox, attrLevel, clusterMin, rtl, isFinal, depth + 1);
-         if ((!m_parent || m_advance.x >= 0.5f) && tRes.x > res.x) res = tRes;
-     }
- 
-     if (m_parent && m_sibling && m_sibling != this && m_sibling->attachedTo() == m_parent)
-     {
--        Position tRes = m_sibling->finalise(seg, font, base, bbox, attrLevel, clusterMin, rtl, isFinal);
-+        Position tRes = m_sibling->finalise(seg, font, base, bbox, attrLevel, clusterMin, rtl, isFinal, depth + 1);
-         if (tRes.x > res.x) res = tRes;
-     }
-     
-     if (!m_parent && clusterMin < base.x)
-     {
-         Position adj = Position(m_position.x - clusterMin, 0.);
-         res += adj;
-         m_position += adj;
-@@ -160,35 +160,35 @@ int32 Slot::clusterMetric(const Segment 
-         return 0;
-     Rect bbox = seg->theGlyphBBoxTemporary(glyph());
-     float clusterMin = 0.;
-     Position res = finalise(seg, NULL, base, bbox, attrLevel, clusterMin, rtl, false);
- 
-     switch (metrics(metric))
-     {
-     case kgmetLsb :
--        return static_cast<uint32>(bbox.bl.x);
-+        return bbox.bl.x;
-     case kgmetRsb :
--        return static_cast<uint32>(res.x - bbox.tr.x);
-+        return res.x - bbox.tr.x;
-     case kgmetBbTop :
--        return static_cast<uint32>(bbox.tr.y);
-+        return bbox.tr.y;
-     case kgmetBbBottom :
--        return static_cast<uint32>(bbox.bl.y);
-+        return bbox.bl.y;
-     case kgmetBbLeft :
--        return static_cast<uint32>(bbox.bl.x);
-+        return bbox.bl.x;
-     case kgmetBbRight :
--        return static_cast<uint32>(bbox.tr.x);
-+        return bbox.tr.x;
-     case kgmetBbWidth :
--        return static_cast<uint32>(bbox.tr.x - bbox.bl.x);
-+        return bbox.tr.x - bbox.bl.x;
-     case kgmetBbHeight :
--        return static_cast<uint32>(bbox.tr.y - bbox.bl.y);
-+        return bbox.tr.y - bbox.bl.y;
-     case kgmetAdvWidth :
--        return static_cast<uint32>(res.x);
-+        return res.x;
-     case kgmetAdvHeight :
--        return static_cast<uint32>(res.y);
-+        return res.y;
-     default :
-         return 0;
-     }
- }
- 
- #define SLOTGETCOLATTR(x) { SlotCollision *c = seg->collisionInfo(this); return c ? int(c-> x) : 0; }
- 
- int Slot::getAttr(const Segment *seg, attrCode ind, uint8 subindex) const
-@@ -290,19 +290,32 @@ void Slot::setAttr(Segment *seg, attrCod
-     case gr_slatAdvX :  m_advance.x = value; break;
-     case gr_slatAdvY :  m_advance.y = value; break;
-     case gr_slatAttTo :
-     {
-         const uint16 idx = uint16(value);
-         if (idx < map.size() && map[idx])
-         {
-             Slot *other = map[idx];
--            if (other == this || other == m_parent) break;
--            if (m_parent) m_parent->removeChild(this);
--            if (!other->isChildOf(this) && other->child(this))
-+            if (other == this || other == m_parent || other->isCopied()) break;
-+            if (m_parent) { m_parent->removeChild(this); attachTo(NULL); }
-+            Slot *pOther = other;
-+            int count = 0;
-+            bool foundOther = false;
-+            while (pOther)
-+            {
-+                ++count;
-+                if (pOther == this) foundOther = true;
-+                pOther = pOther->attachedTo();
-+            }
-+            for (pOther = m_child; pOther; pOther = pOther->m_child)
-+                ++count;
-+            for (pOther = m_sibling; pOther; pOther = pOther->m_sibling)
-+                ++count;
-+            if (count < 100 && !foundOther && other->child(this))
-             {
-                 attachTo(other);
-                 if ((map.dir() != 0) ^ (idx > subindex))
-                     m_with = Position(advance(), 0);
-                 else        // normal match to previous root
-                     m_attach = Position(other->advance(), 0);
-             }
-         }
-@@ -416,41 +429,34 @@ bool Slot::sibling(Slot *ap)
-         m_sibling = ap;
-     else
-         return m_sibling->sibling(ap);
-     return true;
- }
- 
- bool Slot::removeChild(Slot *ap)
- {
--    if (this == ap || !m_child) return false;
-+    if (this == ap || !m_child || !ap) return false;
-     else if (ap == m_child)
-     {
-         Slot *nSibling = m_child->nextSibling();
--        m_child->removeSibling(nSibling);
-+        m_child->nextSibling(NULL);
-         m_child = nSibling;
-         return true;
-     }
--    else
--        return m_child->removeSibling(ap);
--    return true;
--}
--
--bool Slot::removeSibling(Slot *ap)
--{
--    if (this == ap || !m_sibling) return false;
--    else if (ap == m_sibling)
-+    for (Slot *p = m_child; p; p = p->m_sibling)
-     {
--        m_sibling = m_sibling->nextSibling();
--        if (m_sibling) ap->removeSibling(m_sibling);
--        return true;
-+        if (p->m_sibling && p->m_sibling == ap)
-+        {
-+            p->m_sibling = p->m_sibling->m_sibling;
-+            ap->nextSibling(NULL);
-+            return true;
-+        }
-     }
--    else
--        return m_sibling->removeSibling(ap);
--    return true;
-+    return false;
- }
- 
- void Slot::setGlyph(Segment *seg, uint16 glyphid, const GlyphFace * theGlyph)
- {
-     m_glyphid = glyphid;
-     m_bidiCls = -1;
-     if (!theGlyph)
-     {
-@@ -475,21 +481,23 @@ void Slot::setGlyph(Segment *seg, uint16
-     if (seg->silf()->aPassBits())
-     {
-         seg->mergePassBits(theGlyph->attrs()[seg->silf()->aPassBits()]);
-         if (seg->silf()->numPasses() > 16)
-             seg->mergePassBits(theGlyph->attrs()[seg->silf()->aPassBits()+1] << 16);
-     }
- }
- 
--void Slot::floodShift(Position adj)
-+void Slot::floodShift(Position adj, int depth)
- {
-+    if (depth > 100)
-+        return;
-     m_position += adj;
--    if (m_child) m_child->floodShift(adj);
--    if (m_sibling) m_sibling->floodShift(adj);
-+    if (m_child) m_child->floodShift(adj, depth + 1);
-+    if (m_sibling) m_sibling->floodShift(adj, depth + 1);
- }
- 
- void SlotJustify::LoadSlot(const Slot *s, const Segment *seg)
- {
-     for (int i = seg->silf()->numJustLevels() - 1; i >= 0; --i)
-     {
-         Justinfo *justs = seg->silf()->justAttrs() + i;
-         int16 *v = values + i * NUMJUSTPARAMS;
-@@ -514,15 +522,14 @@ Slot * Slot::nextInCluster(const Slot *s
-             return base->nextSibling();
-         s = base;
-     }
-     return NULL;
- }
- 
- bool Slot::isChildOf(const Slot *base) const
- {
--    if (m_parent == base)
--        return true;
--    else if (!m_parent)
--        return false;
--    else
--        return m_parent->isChildOf(base);
-+    for (Slot *p = m_parent; p; p = p->m_parent)
-+        if (p == base)
-+            return true;
-+    return false;
- }
-+
-diff --git a/gfx/graphite2/src/TtfUtil.cpp b/gfx/graphite2/src/TtfUtil.cpp
---- a/gfx/graphite2/src/TtfUtil.cpp
-+++ b/gfx/graphite2/src/TtfUtil.cpp
-@@ -891,25 +891,27 @@ const void * FindCmapSubtable(const void
- ----------------------------------------------------------------------------------------------*/
- bool CheckCmapSubtable4(const void * pCmapSubtable4, const void * pCmapEnd /*, unsigned int maxgid*/)
- {
-     size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable4;
-     if (!pCmapSubtable4) return false;
-     const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable4);
-     // Bob H say some freeware TT fonts have version 1 (eg, CALIGULA.TTF) 
-     // so don't check subtable version. 21 Mar 2002 spec changes version to language.
--    if (be::swap(pTable->format) != 4) return false;
-+    if (table_len < sizeof(*pTable) || be::swap(pTable->format) != 4) return false;
-     const Sfnt::CmapSubTableFormat4 * pTable4 = reinterpret_cast<const Sfnt::CmapSubTableFormat4 *>(pCmapSubtable4);
-+    if (table_len < sizeof(*pTable4))
-+        return false;
-     uint16 length = be::swap(pTable4->length);
-     if (length > table_len)
-         return false;
-     if (length < sizeof(Sfnt::CmapSubTableFormat4))
-         return false;
-     uint16 nRanges = be::swap(pTable4->seg_count_x2) >> 1;
--    if (length < sizeof(Sfnt::CmapSubTableFormat4) + 4 * nRanges * sizeof(uint16))
-+    if (!nRanges || length < sizeof(Sfnt::CmapSubTableFormat4) + 4 * nRanges * sizeof(uint16))
-         return false;
-     // check last range is properly terminated
-     uint16 chEnd = be::peek<uint16>(pTable4->end_code + nRanges - 1);
-     if (chEnd != 0xFFFF)
-         return false;
- #if 0
-     int lastend = -1;
-     for (int i = 0; i < nRanges; ++i)
-@@ -999,17 +1001,17 @@ gid16 CmapSubtable4Lookup(const void * p
-         uint16 idRangeOffset = be::peek<uint16>(pMid += nSeg);
- 
-         if (idRangeOffset == 0)
-             return (uint16)(idDelta + nUnicodeId); // must use modulus 2^16
- 
-         // Look up value in glyphIdArray
-         const ptrdiff_t offset = (nUnicodeId - chStart) + (idRangeOffset >> 1) +
-                 (pMid - reinterpret_cast<const uint16 *>(pTable));
--        if (offset * 2 >= be::swap<uint16>(pTable->length))
-+        if (offset * 2 + 1 >= be::swap<uint16>(pTable->length))
-             return 0;
-         gid16 nGlyphId = be::peek<uint16>(reinterpret_cast<const uint16 *>(pTable)+offset);
-         // If this value is 0, return 0. Else add the idDelta
-         return nGlyphId ? nGlyphId + idDelta : 0;
-     }
- 
-     return 0;
- }
-@@ -1081,19 +1083,21 @@ unsigned int CmapSubtable4NextCodepoint(
- /*----------------------------------------------------------------------------------------------
-     Check the Microsoft UCS-4 subtable for expected values.
- ----------------------------------------------------------------------------------------------*/
- bool CheckCmapSubtable12(const void *pCmapSubtable12, const void *pCmapEnd /*, unsigned int maxgid*/)
- {
-     size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable12;
-     if (!pCmapSubtable12)  return false;
-     const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable12);
--    if (be::swap(pTable->format) != 12)
-+    if (table_len < sizeof(*pTable) || be::swap(pTable->format) != 12)
-         return false;
-     const Sfnt::CmapSubTableFormat12 * pTable12 = reinterpret_cast<const Sfnt::CmapSubTableFormat12 *>(pCmapSubtable12);
-+    if (table_len < sizeof(*pTable12))
-+        return false;
-     uint32 length = be::swap(pTable12->length);
-     if (length > table_len)
-         return false;
-     if (length < sizeof(Sfnt::CmapSubTableFormat12))
-         return false;
-     uint32 num_groups = be::swap(pTable12->num_groups);
-     if (num_groups > 0x10000000 || length != (sizeof(Sfnt::CmapSubTableFormat12) + (num_groups - 1) * sizeof(uint32) * 3))
-         return false;
-diff --git a/gfx/graphite2/src/inc/Code.h b/gfx/graphite2/src/inc/Code.h
---- a/gfx/graphite2/src/inc/Code.h
-+++ b/gfx/graphite2/src/inc/Code.h
-@@ -81,17 +81,17 @@ private:
-                 _modify,
-                 _delete;
-     mutable bool _own;
- 
-     void release_buffers() throw ();
-     void failure(const status_t) throw();
- 
- public:
--    static size_t estimateCodeDataOut(size_t num_bytecodes);
-+    static size_t estimateCodeDataOut(size_t num_bytecodes, int nRules, int nSlots);
- 
-     Code() throw();
-     Code(bool is_constraint, const byte * bytecode_begin, const byte * const bytecode_end,
-          uint8 pre_context, uint16 rule_length, const Silf &, const Face &,
-          enum passtype pt, byte * * const _out = 0);
-     Code(const Machine::Code &) throw();
-     ~Code() throw();
-     
-@@ -107,19 +107,21 @@ public:
-     void          externalProgramMoved(ptrdiff_t) throw();
- 
-     int32 run(Machine &m, slotref * & map) const;
-     
-     CLASS_NEW_DELETE;
- };
- 
- inline
--size_t  Machine::Code::estimateCodeDataOut(size_t n_bc)
-+size_t  Machine::Code::estimateCodeDataOut(size_t n_bc, int nRules, int nSlots)
- {
--    return (n_bc + 1) * (sizeof(instr)+sizeof(byte));
-+    // max is: all codes are instructions + 1 for each rule + max tempcopies
-+    // allocate space for separate maximal code and data then merge them later
-+    return (n_bc + nRules + nSlots) * sizeof(instr) + n_bc * sizeof(byte);
- }
- 
- 
- inline Machine::Code::Code() throw()
- : _code(0), _data(0), _data_size(0), _instr_count(0), _max_ref(0),
-   _status(loaded), _constraint(false), _modify(false), _delete(false),
-   _own(false)
- {
-diff --git a/gfx/graphite2/src/inc/Face.h b/gfx/graphite2/src/inc/Face.h
---- a/gfx/graphite2/src/inc/Face.h
-+++ b/gfx/graphite2/src/inc/Face.h
-@@ -82,17 +82,17 @@ public:
-     uint16              languageForLocale(const char * locale) const;
- 
-     // Features
-     uint16              numFeatures() const;
-     const FeatureRef  * featureById(uint32 id) const;
-     const FeatureRef  * feature(uint16 index) const;
- 
-     // Glyph related
--    uint16 getGlyphMetric(uint16 gid, uint8 metric) const;
-+    int32  getGlyphMetric(uint16 gid, uint8 metric) const;
-     uint16 findPseudo(uint32 uid) const;
- 
-     // Errors
-     unsigned int        error() const { return m_error; }
-     bool                error(Error e) { m_error = e.error(); return false; }
-     unsigned int        error_context() const { return m_error; }
-     void                error_context(unsigned int errcntxt) { m_errcntxt = errcntxt; }
- 
-diff --git a/gfx/graphite2/src/inc/GlyphFace.h b/gfx/graphite2/src/inc/GlyphFace.h
---- a/gfx/graphite2/src/inc/GlyphFace.h
-+++ b/gfx/graphite2/src/inc/GlyphFace.h
-@@ -46,17 +46,17 @@ class GlyphFace
- public:
-     GlyphFace();
-     template<typename I>
-     GlyphFace(const Rect & bbox, const Position & adv, I first, const I last);
- 
-     const Position    & theAdvance() const;
-     const Rect        & theBBox() const { return m_bbox; }
-     const sparse      & attrs() const { return m_attrs; }
--    uint16              getMetric(uint8 metric) const;
-+    int32               getMetric(uint8 metric) const;
- 
-     CLASS_NEW_DELETE;
- private:
-     Rect     m_bbox;        // bounding box metrics in design units
-     Position m_advance;     // Advance width and height in design units
-     sparse   m_attrs;
- };
- 
-diff --git a/gfx/graphite2/src/inc/Machine.h b/gfx/graphite2/src/inc/Machine.h
---- a/gfx/graphite2/src/inc/Machine.h
-+++ b/gfx/graphite2/src/inc/Machine.h
-@@ -179,17 +179,17 @@ inline SlotMap& Machine::slotMap() const
-     return _map;
- }
- 
- inline Machine::status_t Machine::status() const throw()
- {
-     return _status;
- }
- 
--inline void Machine::check_final_stack(const int32 * const sp)
-+inline void Machine::check_final_stack(const stack_t * const sp)
- {
-     stack_t const * const base  = _stack + STACK_GUARD,
-                   * const limit = base + STACK_MAX;
-     if      (sp <  base)    _status = stack_underflow;       // This should be impossible now.
-     else if (sp >= limit)   _status = stack_overflow;        // So should this.
-     else if (sp != base)    _status = stack_not_empty;
- }
- 
-diff --git a/gfx/graphite2/src/inc/Pass.h b/gfx/graphite2/src/inc/Pass.h
---- a/gfx/graphite2/src/inc/Pass.h
-+++ b/gfx/graphite2/src/inc/Pass.h
-@@ -76,17 +76,17 @@ private:
-     void    dumpRuleEventConsidered(const FiniteStateMachine & fsm, const RuleEntry & re) const;
-     void    dumpRuleEventOutput(const FiniteStateMachine & fsm, vm::Machine & m, const Rule & r, Slot * os) const;
-     void    adjustSlot(int delta, Slot * & slot_out, SlotMap &) const;
-     bool    collisionShift(Segment *seg, int dir, json * const dbgout) const;
-     bool    collisionKern(Segment *seg, int dir, json * const dbgout) const;
-     bool    collisionFinish(Segment *seg, GR_MAYBE_UNUSED json * const dbgout) const;
-     bool    resolveCollisions(Segment *seg, Slot *slot, Slot *start, ShiftCollider &coll, bool isRev,
-                      int dir, bool &moved, bool &hasCol, json * const dbgout) const;
--    float   resolveKern(Segment *seg, Slot *slot, Slot *start, KernCollider &coll, int dir,
-+    float   resolveKern(Segment *seg, Slot *slot, Slot *start, int dir,
-                      float &ymin, float &ymax, json *const dbgout) const;
- 
-     const Silf        * m_silf;
-     uint16            * m_cols;
-     Rule              * m_rules; // rules
-     RuleEntry         * m_ruleMap;
-     uint16            * m_startStates; // prectxt length
-     uint16            * m_transitions;
-diff --git a/gfx/graphite2/src/inc/Rule.h b/gfx/graphite2/src/inc/Rule.h
---- a/gfx/graphite2/src/inc/Rule.h
-+++ b/gfx/graphite2/src/inc/Rule.h
-@@ -97,17 +97,17 @@ bool State::empty() const
-     return rules_end == rules;
- }
- 
- 
- class SlotMap
- {
- public:
-   enum {MAX_SLOTS=64};
--  SlotMap(Segment & seg, uint8 direction);
-+  SlotMap(Segment & seg, uint8 direction, int maxSize);
-   
-   Slot       * * begin();
-   Slot       * * end();
-   size_t         size() const;
-   unsigned short context() const;
-   void           reset(Slot &, unsigned short);
-   
-   Slot * const & operator[](int n) const;
-@@ -116,23 +116,25 @@ public:
-   void           collectGarbage(Slot *& aSlot);
- 
-   Slot         * highwater() { return m_highwater; }
-   void           highwater(Slot *s) { m_highwater = s; m_highpassed = false; }
-   bool           highpassed() const { return m_highpassed; }
-   void           highpassed(bool v) { m_highpassed = v; }
- 
-   uint8          dir() const { return m_dir; }
-+  int            decMax() { return --m_maxSize; }
- 
-   Segment &    segment;
- private:
-   Slot         * m_slot_map[MAX_SLOTS+1];
-   unsigned short m_size;
-   unsigned short m_precontext;
-   Slot         * m_highwater;
-+  int            m_maxSize;
-   uint8          m_dir;
-   bool           m_highpassed;
- };
- 
- 
- class FiniteStateMachine
- {
- public:
-@@ -237,18 +239,19 @@ void FiniteStateMachine::Rules::accumula
-       return;
-     }
-   }
-   while (rre != rrend && out != lrend) { *out++ = *rre++; }
-   m_end = out;
- }
- 
- inline
--SlotMap::SlotMap(Segment & seg, uint8 direction)
--: segment(seg), m_size(0), m_precontext(0), m_highwater(0), m_dir(direction), m_highpassed(false)
-+SlotMap::SlotMap(Segment & seg, uint8 direction, int maxSize)
-+: segment(seg), m_size(0), m_precontext(0), m_highwater(0),
-+    m_maxSize(maxSize), m_dir(direction), m_highpassed(false)
- {
-     m_slot_map[0] = 0;
- }
- 
- inline
- Slot * * SlotMap::begin()
- {
-   return &m_slot_map[1]; // allow map to go 1 before slot_map when inserting
-diff --git a/gfx/graphite2/src/inc/Segment.h b/gfx/graphite2/src/inc/Segment.h
---- a/gfx/graphite2/src/inc/Segment.h
-+++ b/gfx/graphite2/src/inc/Segment.h
-@@ -35,17 +35,17 @@ of the License or (at your option) any l
- #include "inc/FeatureVal.h"
- #include "inc/GlyphCache.h"
- #include "inc/GlyphFace.h"
- #include "inc/Slot.h"
- #include "inc/Position.h"
- #include "inc/List.h"
- #include "inc/Collider.h"
- 
--#define MAX_SEG_GROWTH_FACTOR  256
-+#define MAX_SEG_GROWTH_FACTOR  64
- 
- namespace graphite2 {
- 
- typedef Vector<Features>        FeatureList;
- typedef Vector<Slot *>          SlotRope;
- typedef Vector<int16 *>         AttributeRope;
- typedef Vector<SlotJustify *>   JustifyRope;
- 
-@@ -154,17 +154,17 @@ public:
-     int8 getSlotBidiClass(Slot *s) const;
-     void doMirror(uint16 aMirror);
-     Slot *addLineEnd(Slot *nSlot);
-     void delLineEnd(Slot *s);
-     bool hasJustification() const { return m_justifies.size() != 0; }
-     void reverseSlots();
- 
-     bool isWhitespace(const int cid) const;
--    bool hasCollisionInfo() const { return (m_flags & SEG_HASCOLLISIONS); }
-+    bool hasCollisionInfo() const { return (m_flags & SEG_HASCOLLISIONS) && m_collisions; }
-     SlotCollision *collisionInfo(const Slot *s) const { return m_collisions ? m_collisions + s->index() : 0; }
-     CLASS_NEW_DELETE
- 
- public:       //only used by: GrSegment* makeAndInitialize(const GrFont *font, const GrFace *face, uint32 script, const FeaturesHandle& pFeats/*must not be IsNull*/, encform enc, const void* pStart, size_t nChars, int dir);
-     bool read_text(const Face *face, const Features* pFeats/*must not be NULL*/, gr_encform enc, const void*pStart, size_t nChars);
-     void finalise(const Font *font, bool reverse=false);
-     float justify(Slot *pSlot, const Font *font, float width, enum justFlags flags, Slot *pFirst, Slot *pLast);
-     bool initCollisions();
-diff --git a/gfx/graphite2/src/inc/Slot.h b/gfx/graphite2/src/inc/Slot.h
---- a/gfx/graphite2/src/inc/Slot.h
-+++ b/gfx/graphite2/src/inc/Slot.h
-@@ -92,17 +92,17 @@ public:
-     void adjKern(const Position &pos) { m_shift = m_shift + pos; m_advance = m_advance + pos; }
-     void origin(const Position &pos) { m_position = pos + m_shift; }
-     void originate(int ind) { m_original = ind; }
-     int original() const { return m_original; }
-     void before(int ind) { m_before = ind; }
-     void after(int ind) { m_after = ind; }
-     bool isBase() const { return (!m_parent); }
-     void update(int numSlots, int numCharInfo, Position &relpos);
--    Position finalise(const Segment* seg, const Font* font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal);
-+    Position finalise(const Segment* seg, const Font* font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal, int depth = 0);
-     bool isDeleted() const { return (m_flags & DELETED) ? true : false; }
-     void markDeleted(bool state) { if (state) m_flags |= DELETED; else m_flags &= ~DELETED; }
-     bool isCopied() const { return (m_flags & COPIED) ? true : false; }
-     void markCopied(bool state) { if (state) m_flags |= COPIED; else m_flags &= ~COPIED; }
-     bool isPositioned() const { return (m_flags & POSITIONED) ? true : false; }
-     void markPositioned(bool state) { if (state) m_flags |= POSITIONED; else m_flags &= ~POSITIONED; }
-     bool isInsertBefore() const { return !(m_flags & INSERTED); }
-     uint8 getBidiLevel() const { return m_bidiLevel; }
-@@ -123,20 +123,19 @@ public:
-     Position attachOffset() const { return m_attach - m_with; }
-     Slot* firstChild() const { return m_child; }
-     void firstChild(Slot *ap) { m_child = ap; }
-     bool child(Slot *ap);
-     Slot* nextSibling() const { return m_sibling; }
-     void nextSibling(Slot *ap) { m_sibling = ap; }
-     bool sibling(Slot *ap);
-     bool removeChild(Slot *ap);
--    bool removeSibling(Slot *ap);
-     int32 clusterMetric(const Segment* seg, uint8 metric, uint8 attrLevel, bool rtl);
-     void positionShift(Position a) { m_position += a; }
--    void floodShift(Position adj);
-+    void floodShift(Position adj, int depth = 0);
-     float just() const { return m_just; }
-     void just(float j) { m_just = j; }
-     Slot *nextInCluster(const Slot *s) const;
-     bool isChildOf(const Slot *base) const;
- 
-     CLASS_NEW_DELETE
- 
- private:
-diff --git a/gfx/graphite2/src/inc/UtfCodec.h b/gfx/graphite2/src/inc/UtfCodec.h
---- a/gfx/graphite2/src/inc/UtfCodec.h
-+++ b/gfx/graphite2/src/inc/UtfCodec.h
-@@ -35,16 +35,17 @@ typedef uint32  uchar_t;
- 
- template <int N>
- struct _utf_codec
- {
-     typedef uchar_t codeunit_t;
- 
-     static void     put(codeunit_t * cp, const uchar_t , int8 & len) throw();
-     static uchar_t  get(const codeunit_t * cp, int8 & len) throw();
-+    static bool     validate(const codeunit_t * s, const codeunit_t * e) throw();
- };
- 
- 
- template <>
- struct _utf_codec<32>
- {
- private:
-     static const uchar_t    limit = 0x110000;
-@@ -58,16 +59,22 @@ public:
-     }
- 
-     inline
-     static uchar_t get(const codeunit_t * cp, int8 & l) throw()
-     {
-         if (cp[0] < limit)  { l = 1;  return cp[0]; }
-         else                { l = -1; return 0xFFFD; }
-     }
-+
-+    inline
-+    static bool validate(codeunit_t * s, codeunit_t * e) throw()
-+    {
-+        return e > s;
-+    }
- };
- 
- 
- template <>
- struct _utf_codec<16>
- {
- private:
-     static const int32  lead_offset      = 0xD800 - (0x10000 >> 10);
-@@ -88,22 +95,31 @@ public:
-     }
- 
-     inline
-     static uchar_t get(const codeunit_t * cp, int8 & l) throw()
-     {
-         const uint32    uh = cp[0];
-         l = 1;
- 
--        if (0xD800 > uh || uh > 0xDFFF) { return uh; }
-+        if (uh < 0xD800|| uh > 0xDFFF) { return uh; }
-         const uint32 ul = cp[1];
--        if (uh > 0xDBFF || 0xDC00 > ul || ul > 0xDFFF) { l = -1; return 0xFFFD; }
-+        if (uh > 0xDBFF || ul < 0xDC00 || ul > 0xDFFF) { l = -1; return 0xFFFD; }
-         ++l;
-         return (uh<<10) + ul + surrogate_offset;
-     }
-+
-+    inline
-+    static bool validate(codeunit_t * s, codeunit_t * e) throw()
-+    {
-+        const ptrdiff_t n = e-s;
-+        if (n <= 0) return n == 0;
-+        const uint32 u = *(s+(n-1)); // Get the last codepoint
-+        return (u < 0xD800 || u > 0xDBFF);
-+    }
- };
- 
- 
- template <>
- struct _utf_codec<8>
- {
- private:
-     static const int8 sz_lut[16];
-@@ -143,16 +159,34 @@ public:
- 
-         if (l != seq_sz || toolong)
-         {
-             l = -l;
-             return 0xFFFD;
-         }
-         return u;
-     }
-+
-+    inline
-+    static bool validate(codeunit_t * s, codeunit_t * e) throw()
-+    {
-+        const ptrdiff_t n = e-s;
-+        if (n <= 0) return n == 0;
-+        s += (n-1);
-+        if (*s < 0x80) return true;
-+        if (*s >= 0xC0) return false;
-+        if (n == 1) return true;
-+        if (*--s < 0x80) return true;
-+        if (*s >= 0xe0) return false;
-+        if (n == 2 || *s >= 0xC0) return true;
-+        if (*--s < 0x80) return true;
-+        if (*s >= 0xF0) return false;
-+        return true;
-+    }
-+
- };
- 
- 
- template <typename C>
- class _utf_iterator
- {
-     typedef _utf_codec<sizeof(C)*8> codec;
- 
-@@ -195,16 +229,21 @@ public:
- 
- template <typename C>
- struct utf
- {
-     typedef typename _utf_codec<sizeof(C)*8>::codeunit_t codeunit_t;
- 
-     typedef _utf_iterator<C>        iterator;
-     typedef _utf_iterator<const C>  const_iterator;
-+
-+    inline
-+    static bool validate(codeunit_t * s, codeunit_t * e) throw() {
-+        return _utf_codec<sizeof(C)*8>::validate(s,e);
-+    }
- };
- 
- 
- typedef utf<uint32> utf32;
- typedef utf<uint16> utf16;
- typedef utf<uint8>  utf8;
- 
- } // namespace graphite2
-diff --git a/gfx/graphite2/src/inc/opcode_table.h b/gfx/graphite2/src/inc/opcode_table.h
---- a/gfx/graphite2/src/inc/opcode_table.h
-+++ b/gfx/graphite2/src/inc/opcode_table.h
-@@ -113,13 +113,13 @@ static const opcode_t opcode_table[] =
-     {{NILOP,NILOP},                                 0, "PUT_SUBS3"},
-     {{do_(put_glyph), NILOP},                       2, "PUT_GLYPH"},                // output_class output_class
-     {{do2(push_glyph_attr)},                        3, "PUSH_GLYPH_ATTR"},          // gattrnum gattrnum slot
-     {{do2(push_att_to_glyph_attr)},                 3, "PUSH_ATT_TO_GLYPH_ATTR"},   // gattrnum gattrnum slot
-     {{do2(bor)},                                    0, "BITOR"},
-     {{do2(band)},                                   0, "BITAND"},
-     {{do2(bnot)},                                   0, "BITNOT"},   // 0x40
-     {{do2(setbits)},                                4, "BITSET"},
--    {{do2(set_feat)},                               2, "SET_FEAT"},
-+    {{do_(set_feat), NILOP},                        2, "SET_FEAT"},                 // featidx slot
-     // private opcodes for internal use only, comes after all other on disk opcodes.
-     {{do_(temp_copy), NILOP},                       0, "TEMP_COPY"}
- };
- 
-diff --git a/gfx/graphite2/src/inc/opcodes.h b/gfx/graphite2/src/inc/opcodes.h
---- a/gfx/graphite2/src/inc/opcodes.h
-+++ b/gfx/graphite2/src/inc/opcodes.h
-@@ -62,17 +62,18 @@ of the License or (at your option) any l
- //        ip        = The current instruction pointer
- //        endPos    = Position of advance of last cluster
- //        dir       = writing system directionality of the font
-      
- 
- // #define NOT_IMPLEMENTED     assert(false)
- #define NOT_IMPLEMENTED
- 
--#define binop(op)           const int32 a = pop(); *sp = int32(*sp) op a
-+#define binop(op)           const uint32 a = pop(); *sp = uint32(*sp) op a
-+#define sbinop(op)          const int32 a = pop(); *sp = int32(*sp) op a
- #define use_params(n)       dp += n
- 
- #define declare_params(n)   const byte * param = dp; \
-                             use_params(n);
- 
- #define push(n)             { *++sp = n; }
- #define pop()               (*sp--)
- #define slotat(x)           (map[(x)])
-@@ -125,17 +126,17 @@ STARTOP(sub)
- ENDOP
- 
- STARTOP(mul)
-     binop(*);
- ENDOP
- 
- STARTOP(div_)
-     if (*sp == 0) DIE;
--    binop(/);
-+    sbinop(/);
- ENDOP
- 
- STARTOP(min_)
-     const int32 a = pop(), b = *sp;
-     if (a < b) *sp = a;
- ENDOP
- 
- STARTOP(max_)
-@@ -176,29 +177,29 @@ STARTOP(equal)
-     binop(==);
- ENDOP
- 
- STARTOP(not_eq_)
-     binop(!=);
- ENDOP
- 
- STARTOP(less)
--    binop(<);
-+    sbinop(<);
- ENDOP
- 
- STARTOP(gtr)
--    binop(>);
-+    sbinop(>);
- ENDOP
- 
- STARTOP(less_eq)
--    binop(<=);
-+    sbinop(<=);
- ENDOP
- 
- STARTOP(gtr_eq)
--    binop(>=);
-+    sbinop(>=);
- ENDOP
- 
- STARTOP(next)
-     if (map - &smap[0] >= int(smap.size())) DIE
-     if (is)
-     {
-         if (is == smap.highwater())
-             smap.highpassed(true);
-@@ -237,17 +238,17 @@ STARTOP(put_subs_8bit_obs)
-         index = seg.findClassIndex(input_class, slot->gid());
-         is->setGlyph(&seg, seg.getClassGlyph(output_class, index));
-     }
- ENDOP
- 
- STARTOP(put_copy)
-     declare_params(1);
-     const int  slot_ref = int8(*param);
--    if (is)
-+    if (is && !is->isDeleted())
-     {
-         slotref ref = slotat(slot_ref);
-         if (ref && ref != is)
-         {
-             int16 *tempUserAttrs = is->userAttrs();
-             if (is->attachedTo() || is->firstChild()) DIE
-             Slot *prev = is->prev();
-             Slot *next = is->next();
-@@ -262,16 +263,17 @@ STARTOP(put_copy)
-                 is->attachedTo()->child(is);
-         }
-         is->markCopied(false);
-         is->markDeleted(false);
-     }
- ENDOP
- 
- STARTOP(insert)
-+    if (smap.decMax() <= 0) DIE;
-     Slot *newSlot = seg.newSlot();
-     if (!newSlot) DIE;
-     Slot *iss = is;
-     while (iss && iss->isDeleted()) iss = iss->next();
-     if (!iss)
-     {
-         if (seg.last())
-         {
-@@ -550,31 +552,31 @@ ENDOP
- 
- STARTOP(iattr_add)
-     declare_params(2);
-     const attrCode      slat = attrCode(uint8(param[0]));
-     const size_t        idx  = uint8(param[1]);
-     const          int  val  = int(pop());
-     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
-     {
--        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
-+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
-         flags |= POSITIONED;
-     }
-     int res = is->getAttr(&seg, slat, idx);
-     is->setAttr(&seg, slat, idx, val + res, smap);
- ENDOP
- 
- STARTOP(iattr_sub)
-     declare_params(2);
-     const attrCode      slat = attrCode(uint8(param[0]));
-     const size_t        idx  = uint8(param[1]);
-     const          int  val  = int(pop());
-     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
-     {
--        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
-+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
-         flags |= POSITIONED;
-     }
-     int res = is->getAttr(&seg, slat, idx);
-     is->setAttr(&seg, slat, idx, res - val, smap);
- ENDOP
- 
- STARTOP(push_proc_state)
-     use_params(1);
-
diff --git a/gnu/packages/patches/inkscape-drop-wait-for-targets.patch b/gnu/packages/patches/inkscape-drop-wait-for-targets.patch
new file mode 100644
index 0000000000..3dbe6641e2
--- /dev/null
+++ b/gnu/packages/patches/inkscape-drop-wait-for-targets.patch
@@ -0,0 +1,68 @@
+Copied from Fedora.
+
+http://pkgs.fedoraproject.org/cgit/rpms/inkscape.git/plain/inkscape-0.91-drop-wait-for-targets.patch?id=eb5340800b563d6b05aa5f11a2f24f2cc0d8c80e
+
+=== modified file 'src/ui/clipboard.cpp'
+--- src/ui/clipboard.cpp	2016-04-02 15:15:43 +0000
++++ src/ui/clipboard.cpp	2016-04-07 16:30:32 +0000
+@@ -146,8 +146,6 @@
+     void _setClipboardColor(guint32);
+     void _userWarn(SPDesktop *, char const *);
+ 
+-    void _inkscape_wait_for_targets(std::list<Glib::ustring> &);
+-
+     // private properites
+     SPDocument *_clipboardSPDoc; ///< Document that stores the clipboard until someone requests it
+     Inkscape::XML::Node *_defs; ///< Reference to the clipboard document's defs node
+@@ -1302,9 +1300,7 @@
+  */
+ Glib::ustring ClipboardManagerImpl::_getBestTarget()
+ {
+-    // GTKmm's wait_for_targets() is broken, see the comment in _inkscape_wait_for_targets()
+-    std::list<Glib::ustring> targets; // = _clipboard->wait_for_targets();
+-    _inkscape_wait_for_targets(targets);
++    std::list<Glib::ustring> targets = _clipboard->wait_for_targets();
+ 
+     // clipboard target debugging snippet
+     /*
+@@ -1456,39 +1452,6 @@
+     desktop->messageStack()->flash(Inkscape::WARNING_MESSAGE, msg);
+ }
+ 
+-
+-// GTKMM's clipboard::wait_for_targets is buggy and might return bogus, see
+-//
+-// https://bugs.launchpad.net/inkscape/+bug/296778
+-// http://mail.gnome.org/archives/gtk-devel-list/2009-June/msg00062.html
+-//
+-// for details. Until this has been fixed upstream we will use our own implementation
+-// of this method, as copied from /gtkmm-2.16.0/gtk/gtkmm/clipboard.cc.
+-void ClipboardManagerImpl::_inkscape_wait_for_targets(std::list<Glib::ustring> &listTargets)
+-{
+-    //Get a newly-allocated array of atoms:
+-    GdkAtom* targets = NULL;
+-    gint n_targets = 0;
+-    gboolean test = gtk_clipboard_wait_for_targets( gtk_clipboard_get(GDK_SELECTION_CLIPBOARD), &targets, &n_targets );
+-    if (!test || (targets == NULL)) {
+-        return;
+-    }
+-
+-    //Add the targets to the C++ container:
+-    for (int i = 0; i < n_targets; i++)
+-    {
+-        //Convert the atom to a string:
+-        gchar* const atom_name = gdk_atom_name(targets[i]);
+-
+-        Glib::ustring target;
+-        if (atom_name) {
+-            target = Glib::ScopedPtr<char>(atom_name).get(); //This frees the gchar*.
+-        }
+-
+-        listTargets.push_back(target);
+-    }
+-}
+-
+ /* #######################################
+           ClipboardManager class
+    ####################################### */
+
diff --git a/gnu/packages/patches/poppler-CVE-2015-8868.patch b/gnu/packages/patches/poppler-CVE-2015-8868.patch
deleted file mode 100644
index ac78d32ffa..0000000000
--- a/gnu/packages/patches/poppler-CVE-2015-8868.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-Fixes CVE-2015-8868 (heap overflow).
-
-Upstream source:
-https://cgit.freedesktop.org/poppler/poppler/commit/?id=b3425dd3261679958cd56c0f71995c15d2124433
-
-From b3425dd3261679958cd56c0f71995c15d2124433 Mon Sep 17 00:00:00 2001
-From: Albert Astals Cid <aacid@kde.org>
-Date: Tue, 22 Dec 2015 22:50:33 +0100
-Subject: Do not crash on invalid files
-
-Bug #93476
-
-diff --git a/poppler/Function.cc b/poppler/Function.cc
-index 67283df..ee5afc1 100644
---- a/poppler/Function.cc
-+++ b/poppler/Function.cc
-@@ -577,6 +577,10 @@ ExponentialFunction::ExponentialFunction(Object *funcObj, Dict *dict) {
-       goto err2;
-     }
-     n = obj1.arrayGetLength();
-+    if (unlikely(n > funcMaxOutputs)) {
-+      error(errSyntaxError, -1, "Function's C0 array is wrong length");
-+      n = funcMaxOutputs;
-+    }
-     for (i = 0; i < n; ++i) {
-       obj1.arrayGet(i, &obj2);
-       if (!obj2.isNum()) {
--- 
-cgit v0.10.2
-
diff --git a/gnu/packages/patches/totem-debug-format-fix.patch b/gnu/packages/patches/totem-debug-format-fix.patch
new file mode 100644
index 0000000000..7ddd31ee10
--- /dev/null
+++ b/gnu/packages/patches/totem-debug-format-fix.patch
@@ -0,0 +1,11 @@
+--- totem-3.20.1/src/backend/bacon-video-widget.c.orig	2016-03-22 12:45:32.000000000 -0400
++++ totem-3.20.1/src/backend/bacon-video-widget.c	2016-05-11 02:49:55.299109551 -0400
+@@ -2334,7 +2334,7 @@
+     if (!gst_toc_entry_get_start_stop_times (entry, &start, &stop)) {
+       GST_DEBUG ("Chapter #%d (couldn't get times)", i);
+     } else {
+-      GST_DEBUG ("Chapter #%d (start: %li stop: %li)", i, start, stop);
++      GST_DEBUG ("Chapter #%d (start: %li stop: %li)", i, (long) start, (long) stop);
+     }
+   }
+ 
diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm
index 8f9f5dd503..ef05def693 100644
--- a/gnu/packages/pdf.scm
+++ b/gnu/packages/pdf.scm
@@ -52,20 +52,16 @@
 (define-public poppler
   (package
    (name "poppler")
-   (version "0.37.0")
-   (replacement poppler/fixed)
+   (version "0.43.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "https://poppler.freedesktop.org/poppler-"
                                 version ".tar.xz"))
-            (sha256 (base32
-                     "1vjvd0md8y37hlq3lsj0l01a3v3mzm572rzpn1311frvmrg9r7xq"))))
+            (sha256
+             (base32
+              "0mi4zf0pz3x3fx3ir7szz1n57nywgbpd4mp2r7mvf47f4rmf4867"))))
    (build-system gnu-build-system)
-   ;; FIXME: more dependencies could  be added
-   ;;  cairo output:       no (requires cairo >= 1.10.0)
-   ;;  qt4 wrapper:        no
-   ;;    introspection:    no
-   ;;  use gtk-doc:        no
+   ;; FIXME:
    ;;  use libcurl:        no
    (inputs `(("fontconfig" ,fontconfig)
              ("freetype" ,freetype)
@@ -84,7 +80,8 @@
              ("glib" ,glib)))
    (native-inputs
       `(("pkg-config" ,pkg-config)
-        ("glib" ,glib "bin")))                    ; glib-mkenums, etc.
+        ("glib" ,glib "bin")                      ; glib-mkenums, etc.
+        ("gobject-introspection" ,gobject-introspection)))
    (arguments
     `(#:tests? #f ; no test data provided with the tarball
       #:configure-flags
@@ -105,13 +102,6 @@
    (license license:gpl2+)
    (home-page "http://poppler.freedesktop.org/")))
 
-(define poppler/fixed
-  (package
-    (inherit poppler)
-    (source (origin
-              (inherit (package-source poppler))
-              (patches (search-patches "poppler-CVE-2015-8868.patch"))))))
-
 (define-public poppler-qt4
   (package (inherit poppler)
    (name "poppler-qt4")
diff --git a/gnu/packages/xdisorg.scm b/gnu/packages/xdisorg.scm
index e69e6d98d4..4f508ad8c7 100644
--- a/gnu/packages/xdisorg.scm
+++ b/gnu/packages/xdisorg.scm
@@ -234,7 +234,7 @@ following the mouse.")
 (define-public pixman
   (package
     (name "pixman")
-    (version "0.32.8")
+    (version "0.34.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -242,7 +242,7 @@ following the mouse.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "0pfn0247sjsi95kwjih0wwqpp28wadihqk1bn28x6iqbqhbxwnjp"))))
+                "13m842m9ffac3m9r0b4lvwjhwzg3w4353djkjpf00s0wnm4v5di1"))))
     (build-system gnu-build-system)
     (inputs
      `(("libpng" ,libpng)