1 files changed, 61 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2016-2818-pt4.patch b/gnu/packages/patches/icecat-CVE-2016-2818-pt4.patch
new file mode 100644
index 0000000000..0973203e0f
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-2818-pt4.patch
@@ -0,0 +1,61 @@
+  changeset:   312055:b74f1ab939d2
+  user:        Olli Pettay <Olli.Pettay@helsinki.fi>
+  Date:        Mon May 16 21:42:24 2016 +0300
+  summary:     Bug 1273202, make sure to not keep objects alive too long because of some useless event dispatching, r=jwatt a=ritu
+
+diff -r 072992bf176d -r b74f1ab939d2 dom/html/HTMLInputElement.cpp
+--- a/dom/html/HTMLInputElement.cpp	Sun May 15 17:03:06 2016 +0300
++++ b/dom/html/HTMLInputElement.cpp	Mon May 16 21:42:24 2016 +0300
+@@ -1168,7 +1168,7 @@
+     mFileList->Disconnect();
+   }
+   if (mNumberControlSpinnerIsSpinning) {
+-    StopNumberControlSpinnerSpin();
++    StopNumberControlSpinnerSpin(eDisallowDispatchingEvents);
+   }
+   DestroyImageLoadingContent();
+   FreeData();
+@@ -3721,7 +3721,7 @@
+ }
+ 
+ void
+-HTMLInputElement::StopNumberControlSpinnerSpin()
++HTMLInputElement::StopNumberControlSpinnerSpin(SpinnerStopState aState)
+ {
+   if (mNumberControlSpinnerIsSpinning) {
+     if (nsIPresShell::GetCapturingContent() == this) {
+@@ -3732,11 +3732,16 @@
+ 
+     mNumberControlSpinnerIsSpinning = false;
+ 
+-    FireChangeEventIfNeeded();
++    if (aState == eAllowDispatchingEvents) {
++      FireChangeEventIfNeeded();
++    }
+ 
+     nsNumberControlFrame* numberControlFrame =
+       do_QueryFrame(GetPrimaryFrame());
+     if (numberControlFrame) {
++      MOZ_ASSERT(aState == eAllowDispatchingEvents,
++                 "Shouldn't have primary frame for the element when we're not "
++                 "allowed to dispatch events to it anymore.");
+       numberControlFrame->SpinnerStateChanged();
+     }
+   }
+diff -r 072992bf176d -r b74f1ab939d2 dom/html/HTMLInputElement.h
+--- a/dom/html/HTMLInputElement.h	Sun May 15 17:03:06 2016 +0300
++++ b/dom/html/HTMLInputElement.h	Mon May 16 21:42:24 2016 +0300
+@@ -721,7 +721,12 @@
+   HTMLInputElement* GetOwnerNumberControl();
+ 
+   void StartNumberControlSpinnerSpin();
+-  void StopNumberControlSpinnerSpin();
++  enum SpinnerStopState {
++    eAllowDispatchingEvents,
++    eDisallowDispatchingEvents
++  };
++  void StopNumberControlSpinnerSpin(SpinnerStopState aState =
++                                      eAllowDispatchingEvents);
+   void StepNumberControlForUserEvent(int32_t aDirection);
+ 
+   /**