diff options
Diffstat (limited to 'gnu')
| -rw-r--r-- | gnu/local.mk | 9 | ||||
| -rw-r--r-- | gnu/packages/gnuzilla.scm | 11 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-2805.patch | 75 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch | 35 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch | 69 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch | 33 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch | 37 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch | 35 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-2808.patch | 389 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-2814.patch | 35 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-update-bundled-graphite2.patch | 2488 |
11 files changed, 3215 insertions, 1 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 80017ea354..9e31ef9a4b 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -530,6 +530,15 @@ dist_patch_DATA = \ gnu/packages/patches/hydra-disable-darcs-test.patch \ gnu/packages/patches/icecat-avoid-bundled-includes.patch \ gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch \ + gnu/packages/patches/icecat-update-bundled-graphite2.patch \ + gnu/packages/patches/icecat-CVE-2016-2805.patch \ + gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch \ + gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch \ + gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch \ + gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch \ + gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch \ + gnu/packages/patches/icecat-CVE-2016-2808.patch \ + gnu/packages/patches/icecat-CVE-2016-2814.patch \ gnu/packages/patches/icu4c-CVE-2014-6585.patch \ gnu/packages/patches/icu4c-CVE-2015-1270.patch \ gnu/packages/patches/icu4c-CVE-2015-4760.patch \ diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm index e774ed1ad2..abefd90304 100644 --- a/gnu/packages/gnuzilla.scm +++ b/gnu/packages/gnuzilla.scm @@ -299,7 +299,16 @@ standards.") "1wdmd6hasra36g86ha1dw8sl7a5mvr7c4jbjx4zyg9629y5gqr8g")) (patches (search-patches "icecat-avoid-bundled-includes.patch" - "icecat-re-enable-DHE-cipher-suites.patch")) + "icecat-re-enable-DHE-cipher-suites.patch" + "icecat-update-bundled-graphite2.patch" + "icecat-CVE-2016-2805.patch" + "icecat-CVE-2016-2807-pt1.patch" + "icecat-CVE-2016-2807-pt2.patch" + "icecat-CVE-2016-2807-pt3.patch" + "icecat-CVE-2016-2807-pt4.patch" + "icecat-CVE-2016-2807-pt5.patch" + "icecat-CVE-2016-2808.patch" + "icecat-CVE-2016-2814.patch")) (modules '((guix build utils))) (snippet '(begin diff --git a/gnu/packages/patches/icecat-CVE-2016-2805.patch b/gnu/packages/patches/icecat-CVE-2016-2805.patch new file mode 100644 index 0000000000..5e4150f00c --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-2805.patch @@ -0,0 +1,75 @@ +Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/bf34b97757b3 + +# HG changeset patch +# User Jon Coppeard <jcoppeard@mozilla.com> +# Date 1453890675 0 +# Node ID bf34b97757b334af1f9f53b9b59e0b6902e7ed6f +# Parent 228ca3f46cabaf3f388f6c6640690772aa13c1a5 +Bug 1241731 - Handle incomplete buffer in DiscardTransferables r=sfink a=abillings a=sylvestre + +diff --git a/js/src/jit-test/tests/gc/bug-1241731.js b/js/src/jit-test/tests/gc/bug-1241731.js +new file mode 100644 +--- /dev/null ++++ b/js/src/jit-test/tests/gc/bug-1241731.js +@@ -0,0 +1,4 @@ ++if (!('oomTest' in this)) ++ quit(); ++ ++oomTest(() => serialize(0, [{}])); +diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp +--- a/js/src/vm/StructuredClone.cpp ++++ b/js/src/vm/StructuredClone.cpp +@@ -379,39 +379,50 @@ ReadStructuredClone(JSContext* cx, uint6 + + // If the given buffer contains Transferables, free them. Note that custom + // Transferables will use the JSStructuredCloneCallbacks::freeTransfer() to + // delete their transferables. + static void + Discard(uint64_t* buffer, size_t nbytes, const JSStructuredCloneCallbacks* cb, void* cbClosure) + { + MOZ_ASSERT(nbytes % sizeof(uint64_t) == 0); +- if (nbytes < sizeof(uint64_t)) ++ uint64_t* end = buffer + nbytes / sizeof(uint64_t); ++ uint64_t* point = buffer; ++ if (point == end) + return; // Empty buffer + +- uint64_t* point = buffer; + uint32_t tag, data; + SCInput::getPair(point++, &tag, &data); + if (tag != SCTAG_TRANSFER_MAP_HEADER) + return; + + if (TransferableMapHeader(data) == SCTAG_TM_TRANSFERRED) + return; + + // freeTransfer should not GC + JS::AutoSuppressGCAnalysis nogc; + ++ if (point == end) ++ return; ++ + uint64_t numTransferables = LittleEndian::readUint64(point++); + while (numTransferables--) { ++ if (point == end) ++ return; ++ + uint32_t ownership; + SCInput::getPair(point++, &tag, &ownership); + MOZ_ASSERT(tag >= SCTAG_TRANSFER_MAP_PENDING_ENTRY); ++ if (point == end) ++ return; + + void* content; + SCInput::getPtr(point++, &content); ++ if (point == end) ++ return; + + uint64_t extraData = LittleEndian::readUint64(point++); + + if (ownership < JS::SCTAG_TMO_FIRST_OWNED) + continue; + + if (ownership == JS::SCTAG_TMO_ALLOC_DATA) { + js_free(content); + diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch new file mode 100644 index 0000000000..0a6bee378b --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-2807-pt1.patch @@ -0,0 +1,35 @@ +Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/e7c23c08bf84 + +# HG changeset patch +# User Randell Jesup <rjesup@jesup.org> +# Date 1458543433 14400 +# Node ID e7c23c08bf84a02d9154f31e0c5d121a45884a69 +# Parent a6de1f453712edabff597879398606708c191098 +Bug 1254876: assert windows recording is shut down r=pkerr a=ritu + +MozReview-Commit-ID: JRqxBb5TgrE + +diff --git a/media/webrtc/trunk/webrtc/modules/audio_device/win/audio_device_core_win.cc b/media/webrtc/trunk/webrtc/modules/audio_device/win/audio_device_core_win.cc +--- a/media/webrtc/trunk/webrtc/modules/audio_device/win/audio_device_core_win.cc ++++ b/media/webrtc/trunk/webrtc/modules/audio_device/win/audio_device_core_win.cc +@@ -567,16 +567,19 @@ AudioDeviceWindowsCore::AudioDeviceWindo + // ---------------------------------------------------------------------------- + + AudioDeviceWindowsCore::~AudioDeviceWindowsCore() + { + WEBRTC_TRACE(kTraceMemory, kTraceAudioDevice, _id, "%s destroyed", __FUNCTION__); + + Terminate(); + ++ // Recording thread should be shut down before this! ++ assert(_hRecThread == NULL); ++ + // The IMMDeviceEnumerator is created during construction. Must release + // it here and not in Terminate() since we don't recreate it in Init(). + SAFE_RELEASE(_ptrEnumerator); + + _ptrAudioBuffer = NULL; + + if (NULL != _hRenderSamplesReadyEvent) + { + diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch new file mode 100644 index 0000000000..f4b4c0d4eb --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-2807-pt2.patch @@ -0,0 +1,69 @@ +Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/3d2b62083a6a + +# HG changeset patch +# User Shu-yu Guo <shu@rfrn.org> +# Date 1459741387 -7200 +# Node ID 3d2b62083a6a4fb43cb330d77142f9dce0959a23 +# Parent 9d4364f6b55c6ee65c13c491292c3abe1ee2c993 +Bug 1254164 - Make aliasedBodyLevelLexicalBegin a uint32. r=Waldo, a=ritu + +diff --git a/js/src/jit-test/tests/parser/bug-1254164.js b/js/src/jit-test/tests/parser/bug-1254164.js +new file mode 100644 +--- /dev/null ++++ b/js/src/jit-test/tests/parser/bug-1254164.js +@@ -0,0 +1,6 @@ ++// |jit-test| slow; ++ ++var s = ''; ++for (var i = 0; i < 70000; i++) ++ s += 'function x' + i + '() { x' + i + '(); }\n'; ++eval("(function() { " + s + " })();"); +diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp +--- a/js/src/jsscript.cpp ++++ b/js/src/jsscript.cpp +@@ -111,17 +111,20 @@ Bindings::initWithTemporaryStorage(Exclu + // JITs when interpreting/compiling aliasedvar ops.) + + // Since unaliased variables are, by definition, only accessed by local + // operations and never through the scope chain, only give shapes to + // aliased variables. While the debugger may observe any scope object at + // any time, such accesses are mediated by DebugScopeProxy (see + // DebugScopeProxy::handleUnaliasedAccess). + uint32_t nslots = CallObject::RESERVED_SLOTS; +- uint32_t aliasedBodyLevelLexicalBegin = UINT16_MAX; ++ ++ // Unless there are aliased body-level lexical bindings at all, set the ++ // begin index to an impossible slot number. ++ uint32_t aliasedBodyLevelLexicalBegin = LOCALNO_LIMIT; + for (BindingIter bi(self); bi; bi++) { + if (bi->aliased()) { + // Per ES6, lexical bindings cannot be accessed until + // initialized. Remember the first aliased slot that is a + // body-level lexical, so that they may be initialized to sentinel + // magic values. + if (numBodyLevelLexicals > 0 && + nslots < aliasedBodyLevelLexicalBegin && +diff --git a/js/src/jsscript.h b/js/src/jsscript.h +--- a/js/src/jsscript.h ++++ b/js/src/jsscript.h +@@ -201,18 +201,18 @@ class Bindings + friend class BindingIter; + friend class AliasedFormalIter; + + RelocatablePtrShape callObjShape_; + uintptr_t bindingArrayAndFlag_; + uint16_t numArgs_; + uint16_t numBlockScoped_; + uint16_t numBodyLevelLexicals_; +- uint16_t aliasedBodyLevelLexicalBegin_; + uint16_t numUnaliasedBodyLevelLexicals_; ++ uint32_t aliasedBodyLevelLexicalBegin_; + uint32_t numVars_; + uint32_t numUnaliasedVars_; + + #if JS_BITS_PER_WORD == 32 + // Bindings is allocated inline inside JSScript, which needs to be + // gc::Cell aligned. + uint32_t padding_; + #endif + diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch new file mode 100644 index 0000000000..a5a4212c28 --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-2807-pt3.patch @@ -0,0 +1,33 @@ +Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/88f1eb2c3f4b + +# HG changeset patch +# User Timothy Nikkel <tnikkel@gmail.com> +# Date 1457637807 21600 +# Node ID 88f1eb2c3f4b4b57365ed88223cf8adc2bec4610 +# Parent bf34b97757b334af1f9f53b9b59e0b6902e7ed6f +Bug 1187420. r=drc r=jmuizelaar a=sylvestre + +MozReview-Commit-ID: Hh0Khqfj8Bf + +diff --git a/media/libjpeg/jstdhuff.c b/media/libjpeg/jstdhuff.c +--- a/media/libjpeg/jstdhuff.c ++++ b/media/libjpeg/jstdhuff.c +@@ -36,16 +36,17 @@ add_huff_table (j_common_ptr cinfo, + */ + nsymbols = 0; + for (len = 1; len <= 16; len++) + nsymbols += bits[len]; + if (nsymbols < 1 || nsymbols > 256) + ERREXIT(cinfo, JERR_BAD_HUFF_TABLE); + + MEMCOPY((*htblptr)->huffval, val, nsymbols * sizeof(UINT8)); ++ MEMZERO(&((*htblptr)->huffval[nsymbols]), (256 - nsymbols) * sizeof(UINT8)); + + /* Initialize sent_table FALSE so table will be written to JPEG file. */ + (*htblptr)->sent_table = FALSE; + } + + + LOCAL(void) + std_huff_tables (j_common_ptr cinfo) + diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch new file mode 100644 index 0000000000..5eff4fe99c --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-2807-pt4.patch @@ -0,0 +1,37 @@ +Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/5c312182da90 + +# HG changeset patch +# User Jan de Mooij <jdemooij@mozilla.com> +# Date 1458828581 -3600 +# Node ID 5c312182da9020504103aa329360abaffa7e232d +# Parent fa4efccde9b7efde8763a178a6cf422b6d37a0e9 +Bug 1254622 - Relookup group->newScript in CreateThisForFunctionWithGroup. r=bhackett a=sylvestre + +MozReview-Commit-ID: KXd7kB70f1Z + +diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp +--- a/js/src/jsobj.cpp ++++ b/js/src/jsobj.cpp +@@ -1574,18 +1574,19 @@ CreateThisForFunctionWithGroup(JSContext + // Not enough objects with this group have been created yet, so make a + // plain object and register it with the group. Use the maximum number + // of fixed slots, as is also required by the TypeNewScript. + gc::AllocKind allocKind = GuessObjectGCKind(NativeObject::MAX_FIXED_SLOTS); + PlainObject* res = NewObjectWithGroup<PlainObject>(cx, group, parent, allocKind, newKind); + if (!res) + return nullptr; + +- if (newKind != SingletonObject) +- newScript->registerNewObject(res); ++ // Make sure group->newScript is still there. ++ if (newKind != SingletonObject && group->newScript()) ++ group->newScript()->registerNewObject(res); + + return res; + } + + gc::AllocKind allocKind = NewObjectGCKind(&PlainObject::class_); + + if (newKind == SingletonObject) { + Rooted<TaggedProto> protoRoot(cx, group->proto()); + diff --git a/gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch b/gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch new file mode 100644 index 0000000000..00718ebaac --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-2807-pt5.patch @@ -0,0 +1,35 @@ +Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/3fdd280fa099 + +# HG changeset patch +# User Carsten "Tomcat" Book <cbook@mozilla.com> +# Date 1461123938 -7200 +# Node ID 3fdd280fa099b6453ce9fd9905af883bc2ebce24 +# Parent 52dfdd37150d62f708dc5bf61dd28f3967596788 +Bug 1252707 - a=sylvestre + +diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp +--- a/js/src/vm/Shape.cpp ++++ b/js/src/vm/Shape.cpp +@@ -382,18 +382,20 @@ NativeObject::getChildPropertyOnDictiona + + if (obj->inDictionaryMode()) { + MOZ_ASSERT(parent == obj->lastProperty()); + RootedGeneric<StackShape*> childRoot(cx, &child); + shape = childRoot->isAccessorShape() ? NewGCAccessorShape(cx) : NewGCShape(cx); + if (!shape) + return nullptr; + if (childRoot->hasSlot() && childRoot->slot() >= obj->lastProperty()->base()->slotSpan()) { +- if (!obj->setSlotSpan(cx, childRoot->slot() + 1)) ++ if (!obj->setSlotSpan(cx, childRoot->slot() + 1)) { ++ new (shape) Shape(obj->lastProperty()->base()->unowned(), 0); + return nullptr; ++ } + } + shape->initDictionaryShape(*childRoot, obj->numFixedSlots(), &obj->shape_); + } + + return shape; + } + + /* static */ Shape* + diff --git a/gnu/packages/patches/icecat-CVE-2016-2808.patch b/gnu/packages/patches/icecat-CVE-2016-2808.patch new file mode 100644 index 0000000000..ae190b8b4c --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-2808.patch @@ -0,0 +1,389 @@ +Copied from https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/71f611fd27c7 + +# HG changeset patch +# User Jeff Walden <jwalden@mit.edu> +# Date 1458941573 25200 +# Node ID 71f611fd27c7d6cb7d6dab9895c2922948042543 +# Parent 861f6b83ce1deade2a976cabe059776ad51ce370 +Bug 1246061. r=luke, r=froydnj, a=sylvestre + +diff --git a/js/public/HashTable.h b/js/public/HashTable.h +--- a/js/public/HashTable.h ++++ b/js/public/HashTable.h +@@ -8,16 +8,17 @@ + #define js_HashTable_h + + #include "mozilla/Alignment.h" + #include "mozilla/Assertions.h" + #include "mozilla/Attributes.h" + #include "mozilla/Casting.h" + #include "mozilla/MemoryReporting.h" + #include "mozilla/Move.h" ++#include "mozilla/Opaque.h" + #include "mozilla/PodOperations.h" + #include "mozilla/ReentrancyGuard.h" + #include "mozilla/TemplateLib.h" + #include "mozilla/TypeTraits.h" + + #include "js/Utility.h" + + namespace js { +@@ -27,16 +28,18 @@ template <class> struct DefaultHasher; + template <class, class> class HashMapEntry; + namespace detail { + template <class T> class HashTableEntry; + template <class T, class HashPolicy, class AllocPolicy> class HashTable; + } + + /*****************************************************************************/ + ++using Generation = mozilla::Opaque<uint64_t>; ++ + // A JS-friendly, STL-like container providing a hash-based map from keys to + // values. In particular, HashMap calls constructors and destructors of all + // objects added so non-PODs may be used safely. + // + // Key/Value requirements: + // - movable, destructible, assignable + // HashPolicy requirements: + // - see Hash Policy section below +@@ -200,17 +203,19 @@ class HashMap + return impl.sizeOfExcludingThis(mallocSizeOf); + } + size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const { + return mallocSizeOf(this) + impl.sizeOfExcludingThis(mallocSizeOf); + } + + // If |generation()| is the same before and after a HashMap operation, + // pointers into the table remain valid. +- uint32_t generation() const { return impl.generation(); } ++ Generation generation() const { ++ return impl.generation(); ++ } + + /************************************************** Shorthand operations */ + + bool has(const Lookup& l) const { + return impl.lookup(l).found(); + } + + // Overwrite existing value with v. Return false on oom. +@@ -431,17 +436,19 @@ class HashSet + return impl.sizeOfExcludingThis(mallocSizeOf); + } + size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const { + return mallocSizeOf(this) + impl.sizeOfExcludingThis(mallocSizeOf); + } + + // If |generation()| is the same before and after a HashSet operation, + // pointers into the table remain valid. +- uint32_t generation() const { return impl.generation(); } ++ Generation generation() const { ++ return impl.generation(); ++ } + + /************************************************** Shorthand operations */ + + bool has(const Lookup& l) const { + return impl.lookup(l).found(); + } + + // Add |u| if it is not present already. Return false on oom. +@@ -766,17 +773,17 @@ class HashTable : private AllocPolicy + // table operations unless |generation()| is tested. + class Ptr + { + friend class HashTable; + + Entry* entry_; + #ifdef JS_DEBUG + const HashTable* table_; +- uint32_t generation; ++ Generation generation; + #endif + + protected: + Ptr(Entry& entry, const HashTable& tableArg) + : entry_(&entry) + #ifdef JS_DEBUG + , table_(&tableArg) + , generation(tableArg.generation()) +@@ -873,17 +880,17 @@ class HashTable : private AllocPolicy + while (cur < end && !cur->isLive()) + ++cur; + } + + Entry* cur, *end; + #ifdef JS_DEBUG + const HashTable* table_; + uint64_t mutationCount; +- uint32_t generation; ++ Generation generation; + bool validEntry; + #endif + + public: + Range() + : cur(nullptr) + , end(nullptr) + #ifdef JS_DEBUG +@@ -1012,18 +1019,18 @@ class HashTable : private AllocPolicy + // HashTable is not copyable or assignable + HashTable(const HashTable&) = delete; + void operator=(const HashTable&) = delete; + + private: + static const size_t CAP_BITS = 24; + + public: +- Entry* table; // entry storage +- uint32_t gen; // entry storage generation number ++ uint64_t gen; // entry storage generation number ++ Entry* table; // entry storage + uint32_t entryCount; // number of entries in table + uint32_t removedCount:CAP_BITS; // removed entry sentinels in table + uint32_t hashShift:8; // multiplicative hash shift + + #ifdef JS_DEBUG + uint64_t mutationCount; + mutable bool mEntered; + mutable struct Stats +@@ -1097,18 +1104,18 @@ class HashTable : private AllocPolicy + for (Entry* e = oldTable, *end = e + capacity; e < end; ++e) + e->destroyIfLive(); + alloc.free_(oldTable); + } + + public: + explicit HashTable(AllocPolicy ap) + : AllocPolicy(ap) ++ , gen(0) + , table(nullptr) +- , gen(0) + , entryCount(0) + , removedCount(0) + , hashShift(sHashBits) + #ifdef JS_DEBUG + , mutationCount(0) + , mEntered(false) + #endif + {} +@@ -1524,20 +1531,20 @@ class HashTable : private AllocPolicy + } + + uint32_t capacity() const + { + MOZ_ASSERT(table); + return JS_BIT(sHashBits - hashShift); + } + +- uint32_t generation() const ++ Generation generation() const + { + MOZ_ASSERT(table); +- return gen; ++ return Generation(gen); + } + + size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const + { + return mallocSizeOf(table); + } + + size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const +diff --git a/js/src/jsapi.h b/js/src/jsapi.h +--- a/js/src/jsapi.h ++++ b/js/src/jsapi.h +@@ -270,20 +270,16 @@ class AutoHashMapRooter : protected Auto + + size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const { + return map.sizeOfExcludingThis(mallocSizeOf); + } + size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const { + return map.sizeOfIncludingThis(mallocSizeOf); + } + +- uint32_t generation() const { +- return map.generation(); +- } +- + /************************************************** Shorthand operations */ + + bool has(const Lookup& l) const { + return map.has(l); + } + + template<typename KeyInput, typename ValueInput> + bool put(const KeyInput& k, const ValueInput& v) { +@@ -385,20 +381,16 @@ class AutoHashSetRooter : protected Auto + + size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const { + return set.sizeOfExcludingThis(mallocSizeOf); + } + size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const { + return set.sizeOfIncludingThis(mallocSizeOf); + } + +- uint32_t generation() const { +- return set.generation(); +- } +- + /************************************************** Shorthand operations */ + + bool has(const Lookup& l) const { + return set.has(l); + } + + bool put(const T& t) { + return set.put(t); +diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h +--- a/js/src/jscntxt.h ++++ b/js/src/jscntxt.h +@@ -30,21 +30,21 @@ class DebugModeOSRVolatileJitFrameIterat + } + + typedef HashSet<JSObject*> ObjectSet; + typedef HashSet<Shape*> ShapeSet; + + /* Detects cycles when traversing an object graph. */ + class AutoCycleDetector + { ++ Generation hashsetGenerationAtInit; + JSContext* cx; + RootedObject obj; ++ ObjectSet::AddPtr hashsetAddPointer; + bool cyclic; +- uint32_t hashsetGenerationAtInit; +- ObjectSet::AddPtr hashsetAddPointer; + MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER + + public: + AutoCycleDetector(JSContext* cx, HandleObject objArg + MOZ_GUARD_OBJECT_NOTIFIER_PARAM) + : cx(cx), obj(cx, objArg), cyclic(true) + { + MOZ_GUARD_OBJECT_NOTIFIER_INIT; +diff --git a/js/src/jswatchpoint.cpp b/js/src/jswatchpoint.cpp +--- a/js/src/jswatchpoint.cpp ++++ b/js/src/jswatchpoint.cpp +@@ -22,25 +22,25 @@ DefaultHasher<WatchKey>::hash(const Look + { + return DefaultHasher<JSObject*>::hash(key.object.get()) ^ HashId(key.id.get()); + } + + namespace { + + class AutoEntryHolder { + typedef WatchpointMap::Map Map; ++ Generation gen; + Map& map; + Map::Ptr p; +- uint32_t gen; + RootedObject obj; + RootedId id; + + public: + AutoEntryHolder(JSContext* cx, Map& map, Map::Ptr p) +- : map(map), p(p), gen(map.generation()), obj(cx, p->key().object), id(cx, p->key().id) ++ : gen(map.generation()), map(map), p(p), obj(cx, p->key().object), id(cx, p->key().id) + { + MOZ_ASSERT(!p->value().held); + p->value().held = true; + } + + ~AutoEntryHolder() { + if (gen != map.generation()) + p = map.lookup(WatchKey(obj, id)); +diff --git a/js/src/shell/jsheaptools.cpp b/js/src/shell/jsheaptools.cpp +--- a/js/src/shell/jsheaptools.cpp ++++ b/js/src/shell/jsheaptools.cpp +@@ -267,17 +267,17 @@ HeapReverser::traverseEdge(void* cell, J + Map::AddPtr a = map.lookupForAdd(cell); + if (!a) { + /* + * We've never visited this cell before. Add it to the map (thus + * marking it as visited), and put it on the work stack, to be + * visited from the main loop. + */ + Node n(kind); +- uint32_t generation = map.generation(); ++ Generation generation = map.generation(); + if (!map.add(a, cell, Move(n)) || + !work.append(Child(cell, kind))) + return false; + /* If the map has been resized, re-check the pointer. */ + if (map.generation() != generation) + a = map.lookupForAdd(cell); + } + +diff --git a/mfbt/Opaque.h b/mfbt/Opaque.h +new file mode 100644 +--- /dev/null ++++ b/mfbt/Opaque.h +@@ -0,0 +1,44 @@ ++/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ ++/* vim: set ts=8 sts=2 et sw=2 tw=80: */ ++/* This Source Code Form is subject to the terms of the Mozilla Public ++ * License, v. 2.0. If a copy of the MPL was not distributed with this ++ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ ++ ++/* An opaque integral type supporting only comparison operators. */ ++ ++#ifndef mozilla_Opaque_h ++#define mozilla_Opaque_h ++ ++#include "mozilla/TypeTraits.h" ++ ++namespace mozilla { ++ ++/** ++ * Opaque<T> is a replacement for integral T in cases where only comparisons ++ * must be supported, and it's desirable to prevent accidental dependency on ++ * exact values. ++ */ ++template<typename T> ++class Opaque final ++{ ++ static_assert(mozilla::IsIntegral<T>::value, ++ "mozilla::Opaque only supports integral types"); ++ ++ T mValue; ++ ++public: ++ Opaque() {} ++ explicit Opaque(T aValue) : mValue(aValue) {} ++ ++ bool operator==(const Opaque& aOther) const { ++ return mValue == aOther.mValue; ++ } ++ ++ bool operator!=(const Opaque& aOther) const { ++ return !(*this == aOther); ++ } ++}; ++ ++} // namespace mozilla ++ ++#endif /* mozilla_Opaque_h */ +diff --git a/mfbt/moz.build b/mfbt/moz.build +--- a/mfbt/moz.build ++++ b/mfbt/moz.build +@@ -48,16 +48,17 @@ EXPORTS.mozilla = [ + 'MathAlgorithms.h', + 'Maybe.h', + 'MaybeOneOf.h', + 'MemoryChecking.h', + 'MemoryReporting.h', + 'Move.h', + 'NullPtr.h', + 'NumericLimits.h', ++ 'Opaque.h', + 'Pair.h', + 'PodOperations.h', + 'Poison.h', + 'Range.h', + 'RangedPtr.h', + 'RefCountType.h', + 'ReentrancyGuard.h', + 'RefPtr.h', + diff --git a/gnu/packages/patches/icecat-CVE-2016-2814.patch b/gnu/packages/patches/icecat-CVE-2016-2814.patch new file mode 100644 index 0000000000..5f197f25e6 --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-2814.patch @@ -0,0 +1,35 @@ + +# HG changeset patch +# User Jean-Yves Avenard <jyavenard@mozilla.com> +# Date 1460655260 25200 +# Node ID a13c0bc84d6eb132f4199f563fbe228d2d3b3a51 +# Parent 88f1eb2c3f4b4b57365ed88223cf8adc2bec4610 +Bug 1254721: Ensure consistency between Cenc offsets and sizes table. r=gerald a=sylvestre + +MozReview-Commit-ID: E1KbKIIBR87 + +diff --git a/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp b/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp +--- a/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp ++++ b/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp +@@ -612,18 +612,18 @@ status_t + SampleTable::parseSampleCencInfo() { + if ((!mCencDefaultSize && !mCencInfoCount) || mCencOffsets.isEmpty()) { + // We don't have all the cenc information we need yet. Quietly fail and + // hope we get the data we need later in the track header. + ALOGV("Got half of cenc saio/saiz pair. Deferring parse until we get the other half."); + return OK; + } + +- if (!mCencSizes.isEmpty() && mCencOffsets.size() > 1 && +- mCencSizes.size() != mCencOffsets.size()) { ++ if ((mCencOffsets.size() > 1 && mCencOffsets.size() < mCencInfoCount) || ++ (!mCencDefaultSize && mCencSizes.size() < mCencInfoCount)) { + return ERROR_MALFORMED; + } + + if (mCencInfoCount > kMAX_ALLOCATION / sizeof(SampleCencInfo)) { + // Avoid future OOM. + return ERROR_MALFORMED; + } + + diff --git a/gnu/packages/patches/icecat-update-bundled-graphite2.patch b/gnu/packages/patches/icecat-update-bundled-graphite2.patch new file mode 100644 index 0000000000..c3ab920335 --- /dev/null +++ b/gnu/packages/patches/icecat-update-bundled-graphite2.patch @@ -0,0 +1,2488 @@ + +# HG changeset patch +# User Jonathan Kew <jkew@mozilla.com> +# Date 1460660890 -3600 +# Node ID 7330633d20ffb33941e41ea0666c4099b6e6d317 +# Parent 5c312182da9020504103aa329360abaffa7e232d +Bug 1262846 (patch for ESR trees) - Update Graphite2 library to 1.3.8. r=jrmuizel a=sledru + +diff --git a/gfx/graphite2/README.mozilla b/gfx/graphite2/README.mozilla +--- a/gfx/graphite2/README.mozilla ++++ b/gfx/graphite2/README.mozilla +@@ -1,3 +1,3 @@ +-This directory contains the Graphite2 library release 1.3.6 from +-https://github.com/silnrsi/graphite/releases/download/1.3.6/graphite-minimal-1.3.6.tgz ++This directory contains the Graphite2 library release 1.3.8 from ++https://github.com/silnrsi/graphite/releases/download/1.3.8/graphite2-minimal-1.3.8.tgz + See gfx/graphite2/moz-gr-update.sh for update procedure. +diff --git a/gfx/graphite2/include/graphite2/Font.h b/gfx/graphite2/include/graphite2/Font.h +--- a/gfx/graphite2/include/graphite2/Font.h ++++ b/gfx/graphite2/include/graphite2/Font.h +@@ -25,17 +25,17 @@ + either version 2 of the License or (at your option) any later version. + */ + #pragma once + + #include "graphite2/Types.h" + + #define GR2_VERSION_MAJOR 1 + #define GR2_VERSION_MINOR 3 +-#define GR2_VERSION_BUGFIX 6 ++#define GR2_VERSION_BUGFIX 8 + + #ifdef __cplusplus + extern "C" + { + #endif + + typedef struct gr_face gr_face; + typedef struct gr_font gr_font; +diff --git a/gfx/graphite2/moz-gr-update.sh b/gfx/graphite2/moz-gr-update.sh +--- a/gfx/graphite2/moz-gr-update.sh ++++ b/gfx/graphite2/moz-gr-update.sh +@@ -14,17 +14,17 @@ + RELEASE=$1 + + if [ "x$RELEASE" == "x" ] + then + echo "Must provide the version number to be used." + exit 1 + fi + +-TARBALL="https://github.com/silnrsi/graphite/releases/download/$RELEASE/graphite-minimal-$RELEASE.tgz" ++TARBALL="https://github.com/silnrsi/graphite/releases/download/$RELEASE/graphite2-minimal-$RELEASE.tgz" + + foo=`basename $0` + TMPFILE=`mktemp -t ${foo}` || exit 1 + + curl -L "$TARBALL" -o "$TMPFILE" + tar -x -z -C gfx/graphite2/ --strip-components 1 -f "$TMPFILE" || exit 1 + rm "$TMPFILE" + +diff --git a/gfx/graphite2/src/CachedFace.cpp b/gfx/graphite2/src/CachedFace.cpp +--- a/gfx/graphite2/src/CachedFace.cpp ++++ b/gfx/graphite2/src/CachedFace.cpp +@@ -64,20 +64,20 @@ bool CachedFace::runGraphite(Segment *se + return false; + + assert(m_cacheStore); + // find where the segment can be broken + Slot * subSegStartSlot = seg->first(); + Slot * subSegEndSlot = subSegStartSlot; + uint16 cmapGlyphs[eMaxSpliceSize]; + int subSegStart = 0; +- for (unsigned int i = 0; i < seg->charInfoCount(); ++i) ++ for (unsigned int i = 0; i < seg->charInfoCount() && subSegEndSlot; ++i) + { + const unsigned int length = i - subSegStart + 1; +- if (length < eMaxSpliceSize) ++ if (length < eMaxSpliceSize && subSegEndSlot->gid() < m_cacheStore->maxCmapGid()) + cmapGlyphs[length-1] = subSegEndSlot->gid(); + else return false; + const bool spaceOnly = m_cacheStore->isSpaceGlyph(subSegEndSlot->gid()); + // at this stage the character to slot mapping is still 1 to 1 + const int breakWeight = seg->charinfo(i)->breakWeight(), + nextBreakWeight = (i + 1 < seg->charInfoCount())? + seg->charinfo(i+1)->breakWeight() : 0; + const uint8 f = seg->charinfo(i)->flags(); +diff --git a/gfx/graphite2/src/Code.cpp b/gfx/graphite2/src/Code.cpp +--- a/gfx/graphite2/src/Code.cpp ++++ b/gfx/graphite2/src/Code.cpp +@@ -61,93 +61,88 @@ inline bool is_return(const instr i) { + const instr pop_ret = *opmap[POP_RET].impl, + ret_zero = *opmap[RET_ZERO].impl, + ret_true = *opmap[RET_TRUE].impl; + return i == pop_ret || i == ret_zero || i == ret_true; + } + + struct context + { +- context(uint8 ref=0) : codeRef(ref) {flags.changed=false; flags.referenced=false; flags.inserted=false;} ++ context(uint8 ref=0) : codeRef(ref) {flags.changed=false; flags.referenced=false;} + struct { + uint8 changed:1, +- referenced:1, +- inserted:1; ++ referenced:1; + } flags; + uint8 codeRef; + }; + + } // end namespace + + + class Machine::Code::decoder + { + public: + struct limits; +- struct analysis +- { +- static const int NUMCONTEXTS = 256; +- uint8 slotref; +- context contexts[NUMCONTEXTS]; +- byte max_ref; +- +- analysis() : slotref(0), max_ref(0) {}; +- void set_ref(int index, bool incinsert=false) throw(); +- void set_noref(int index) throw(); +- void set_changed(int index) throw(); +- +- }; ++ static const int NUMCONTEXTS = 256; + + decoder(limits & lims, Code &code, enum passtype pt) throw(); + + bool load(const byte * bc_begin, const byte * bc_end); + void apply_analysis(instr * const code, instr * code_end); +- byte max_ref() { return _analysis.max_ref; } +- int pre_context() const { return _pre_context; } ++ byte max_ref() { return _max_ref; } ++ int out_index() const { return _out_index; } + + private: ++ void set_ref(int index) throw(); ++ void set_noref(int index) throw(); ++ void set_changed(int index) throw(); + opcode fetch_opcode(const byte * bc); + void analyse_opcode(const opcode, const int8 * const dp) throw(); + bool emit_opcode(opcode opc, const byte * & bc); +- bool validate_opcode(const opcode opc, const byte * const bc); ++ bool validate_opcode(const byte opc, const byte * const bc); + bool valid_upto(const uint16 limit, const uint16 x) const throw(); + bool test_context() const throw(); ++ bool test_ref(int8 index) const throw(); + void failure(const status_t s) const throw() { _code.failure(s); } + + Code & _code; +- int _pre_context; +- uint16 _rule_length; ++ int _out_index; ++ uint16 _out_length; + instr * _instr; + byte * _data; + limits & _max; +- analysis _analysis; + enum passtype _passtype; + int _stack_depth; + bool _in_ctxt_item; ++ int16 _slotref; ++ context _contexts[NUMCONTEXTS]; ++ byte _max_ref; + }; + + + struct Machine::Code::decoder::limits + { + const byte * bytecode; + const uint8 pre_context; + const uint16 rule_length, + classes, + glyf_attrs, + features; + const byte attrid[gr_slatMax]; + }; + + inline Machine::Code::decoder::decoder(limits & lims, Code &code, enum passtype pt) throw() + : _code(code), +- _pre_context(code._constraint ? 0 : lims.pre_context), +- _rule_length(code._constraint ? 1 : lims.rule_length), ++ _out_index(code._constraint ? 0 : lims.pre_context), ++ _out_length(code._constraint ? 1 : lims.rule_length), + _instr(code._code), _data(code._data), _max(lims), _passtype(pt), + _stack_depth(0), +- _in_ctxt_item(false) ++ _in_ctxt_item(false), ++ _slotref(0), ++ _max_ref(0) + { } + + + + Machine::Code::Code(bool is_constraint, const byte * bytecode_begin, const byte * const bytecode_end, + uint8 pre_context, uint16 rule_length, const Silf & silf, const Face & face, + enum passtype pt, byte * * const _out) + : _code(0), _data(0), _data_size(0), _instr_count(0), _max_ref(0), _status(loaded), +@@ -163,17 +158,17 @@ Machine::Code::Code(bool is_constraint, + return; + } + assert(bytecode_end > bytecode_begin); + const opcode_t * op_to_fn = Machine::getOpcodeTable(); + + // Allocate code and data target buffers, these sizes are a worst case + // estimate. Once we know their real sizes the we'll shrink them. + if (_out) _code = reinterpret_cast<instr *>(*_out); +- else _code = static_cast<instr *>(malloc(estimateCodeDataOut(bytecode_end-bytecode_begin))); ++ else _code = static_cast<instr *>(malloc(estimateCodeDataOut(bytecode_end-bytecode_begin, 1, is_constraint ? 0 : rule_length))); + _data = reinterpret_cast<byte *>(_code + (bytecode_end - bytecode_begin)); + + if (!_code || !_data) { + failure(alloc_failed); + return; + } + + decoder::limits lims = { +@@ -266,23 +261,23 @@ bool Machine::Code::decoder::load(const + return bool(_code); + } + + // Validation check and fixups. + // + + opcode Machine::Code::decoder::fetch_opcode(const byte * bc) + { +- const opcode opc = opcode(*bc++); ++ const byte opc = *bc++; + + // Do some basic sanity checks based on what we know about the opcode + if (!validate_opcode(opc, bc)) return MAX_OPCODE; + + // And check it's arguments as far as possible +- switch (opc) ++ switch (opcode(opc)) + { + case NOP : + break; + case PUSH_BYTE : + case PUSH_BYTEU : + case PUSH_SHORT : + case PUSH_SHORTU : + case PUSH_LONG : +@@ -319,47 +314,57 @@ opcode Machine::Code::decoder::fetch_opc + case COND : + _stack_depth -= 2; + if (_stack_depth <= 0) + failure(underfull_stack); + break; + case NEXT : + case NEXT_N : // runtime checked + case COPY_NEXT : +- test_context(); +- ++_pre_context; ++ ++_out_index; ++ if (_out_index < -1 || _out_index > _out_length || _slotref > _max.rule_length) ++ failure(out_of_range_data); + break; + case PUT_GLYPH_8BIT_OBS : + valid_upto(_max.classes, bc[0]); + test_context(); + break; + case PUT_SUBS_8BIT_OBS : +- valid_upto(_rule_length, _pre_context + int8(bc[0])); ++ test_ref(int8(bc[0])); + valid_upto(_max.classes, bc[1]); + valid_upto(_max.classes, bc[2]); + test_context(); + break; + case PUT_COPY : +- valid_upto(_rule_length, _pre_context + int8(bc[0])); ++ test_ref(int8(bc[0])); + test_context(); + break; + case INSERT : + if (_passtype >= PASS_TYPE_POSITIONING) + failure(invalid_opcode); +- else +- --_pre_context; ++ ++_out_length; ++ if (_out_index < 0) ++_out_index; ++ if (_out_index < -1 || _out_index >= _out_length) ++ failure(out_of_range_data); + break; + case DELETE : + if (_passtype >= PASS_TYPE_POSITIONING) + failure(invalid_opcode); +- test_context(); ++ if (_out_index < _max.pre_context) ++ failure(out_of_range_data); ++ --_out_index; ++ --_out_length; ++ if (_out_index < -1 || _out_index > _out_length) ++ failure(out_of_range_data); + break; + case ASSOC : ++ if (bc[0] == 0) ++ failure(out_of_range_data); + for (uint8 num = bc[0]; num; --num) +- valid_upto(_rule_length, _pre_context + int8(bc[num])); ++ test_ref(int8(bc[num])); + test_context(); + break; + case CNTXT_ITEM : + valid_upto(_max.rule_length, _max.pre_context + int8(bc[0])); + if (bc + 2 + bc[1] >= _max.bytecode) failure(jump_past_end); + if (_in_ctxt_item) failure(nested_context_item); + break; + case ATTR_SET : +@@ -378,52 +383,43 @@ opcode Machine::Code::decoder::fetch_opc + failure(underfull_stack); + if (valid_upto(gr_slatMax, bc[0])) + valid_upto(_max.attrid[bc[0]], bc[1]); + test_context(); + break; + case PUSH_SLOT_ATTR : + ++_stack_depth; + valid_upto(gr_slatMax, bc[0]); +- valid_upto(_rule_length, _pre_context + int8(bc[1])); ++ test_ref(int8(bc[1])); + if (attrCode(bc[0]) == gr_slatUserDefn) // use IATTR for user attributes + failure(out_of_range_data); + break; + case PUSH_GLYPH_ATTR_OBS : ++ case PUSH_ATT_TO_GATTR_OBS : + ++_stack_depth; + valid_upto(_max.glyf_attrs, bc[0]); +- valid_upto(_rule_length, _pre_context + int8(bc[1])); ++ test_ref(int8(bc[1])); + break; ++ case PUSH_ATT_TO_GLYPH_METRIC : + case PUSH_GLYPH_METRIC : + ++_stack_depth; + valid_upto(kgmetDescent, bc[0]); +- valid_upto(_rule_length, _pre_context + int8(bc[1])); ++ test_ref(int8(bc[1])); + // level: dp[2] no check necessary + break; + case PUSH_FEAT : + ++_stack_depth; + valid_upto(_max.features, bc[0]); +- valid_upto(_rule_length, _pre_context + int8(bc[1])); +- break; +- case PUSH_ATT_TO_GATTR_OBS : +- ++_stack_depth; +- valid_upto(_max.glyf_attrs, bc[0]); +- valid_upto(_rule_length, _pre_context + int8(bc[1])); +- break; +- case PUSH_ATT_TO_GLYPH_METRIC : +- ++_stack_depth; +- valid_upto(kgmetDescent, bc[0]); +- valid_upto(_rule_length, _pre_context + int8(bc[1])); +- // level: dp[2] no check necessary ++ test_ref(int8(bc[1])); + break; + case PUSH_ISLOT_ATTR : + ++_stack_depth; + if (valid_upto(gr_slatMax, bc[0])) + { +- valid_upto(_rule_length, _pre_context + int8(bc[1])); ++ test_ref(int8(bc[1])); + valid_upto(_max.attrid[bc[0]], bc[2]); + } + break; + case PUSH_IGLYPH_ATTR :// not implemented + ++_stack_depth; + break; + case POP_RET : + if (--_stack_depth < 0) +@@ -442,118 +438,107 @@ opcode Machine::Code::decoder::fetch_opc + valid_upto(_max.attrid[bc[0]], bc[1]); + test_context(); + break; + case PUSH_PROC_STATE : // dummy: dp[0] no check necessary + case PUSH_VERSION : + ++_stack_depth; + break; + case PUT_SUBS : +- valid_upto(_rule_length, _pre_context + int8(bc[0])); ++ test_ref(int8(bc[0])); + valid_upto(_max.classes, uint16(bc[1]<< 8) | bc[2]); + valid_upto(_max.classes, uint16(bc[3]<< 8) | bc[4]); + test_context(); + break; + case PUT_SUBS2 : // not implemented + case PUT_SUBS3 : // not implemented + break; + case PUT_GLYPH : + valid_upto(_max.classes, uint16(bc[0]<< 8) | bc[1]); + test_context(); + break; + case PUSH_GLYPH_ATTR : + case PUSH_ATT_TO_GLYPH_ATTR : + ++_stack_depth; + valid_upto(_max.glyf_attrs, uint16(bc[0]<< 8) | bc[1]); +- valid_upto(_rule_length, _pre_context + int8(bc[2])); ++ test_ref(int8(bc[2])); ++ break; ++ case SET_FEAT : ++ valid_upto(_max.features, bc[0]); ++ test_ref(int8(bc[1])); + break; + default: + failure(invalid_opcode); + break; + } + +- return bool(_code) ? opc : MAX_OPCODE; ++ return bool(_code) ? opcode(opc) : MAX_OPCODE; + } + + + void Machine::Code::decoder::analyse_opcode(const opcode opc, const int8 * arg) throw() + { +- if (_code._constraint) return; +- + switch (opc) + { + case DELETE : + _code._delete = true; + break; ++ case ASSOC : ++ set_changed(0); ++// for (uint8 num = arg[0]; num; --num) ++// _analysis.set_noref(num); ++ break; + case PUT_GLYPH_8BIT_OBS : + case PUT_GLYPH : + _code._modify = true; +- _analysis.set_changed(0); ++ set_changed(0); + break; + case ATTR_SET : + case ATTR_ADD : ++ case ATTR_SUB : + case ATTR_SET_SLOT : + case IATTR_SET_SLOT : + case IATTR_SET : + case IATTR_ADD : + case IATTR_SUB : +- _analysis.set_noref(0); ++ set_noref(0); + break; + case NEXT : + case COPY_NEXT : +- if (!_analysis.contexts[_analysis.slotref].flags.inserted) +- ++_analysis.slotref; +- _analysis.contexts[_analysis.slotref] = context(_code._instr_count+1); ++ ++_slotref; ++ _contexts[_slotref] = context(_code._instr_count+1); + // if (_analysis.slotref > _analysis.max_ref) _analysis.max_ref = _analysis.slotref; + break; + case INSERT : +- _analysis.contexts[_analysis.slotref].flags.inserted = true; ++ if (_slotref >= 0) --_slotref; + _code._modify = true; + break; + case PUT_SUBS_8BIT_OBS : // slotref on 1st parameter + case PUT_SUBS : + _code._modify = true; +- _analysis.set_changed(0); ++ set_changed(0); + GR_FALLTHROUGH; + // no break + case PUT_COPY : +- { +- if (arg[0] != 0) { _analysis.set_changed(0); _code._modify = true; } +- if (arg[0] <= 0 && -arg[0] <= _analysis.slotref - _analysis.contexts[_analysis.slotref].flags.inserted) +- _analysis.set_ref(arg[0], true); +- else if (arg[0] > 0) +- _analysis.set_ref(arg[0], true); ++ if (arg[0] != 0) { set_changed(0); _code._modify = true; } ++ set_ref(arg[0]); + break; +- } +- case PUSH_ATT_TO_GATTR_OBS : // slotref on 2nd parameter +- if (_code._constraint) return; +- GR_FALLTHROUGH; +- // no break + case PUSH_GLYPH_ATTR_OBS : + case PUSH_SLOT_ATTR : + case PUSH_GLYPH_METRIC : ++ case PUSH_ATT_TO_GATTR_OBS : + case PUSH_ATT_TO_GLYPH_METRIC : + case PUSH_ISLOT_ATTR : + case PUSH_FEAT : +- if (arg[1] <= 0 && -arg[1] <= _analysis.slotref - _analysis.contexts[_analysis.slotref].flags.inserted) +- _analysis.set_ref(arg[1], true); +- else if (arg[1] > 0) +- _analysis.set_ref(arg[1], true); ++ case SET_FEAT : ++ set_ref(arg[1]); + break; + case PUSH_ATT_TO_GLYPH_ATTR : +- if (_code._constraint) return; +- GR_FALLTHROUGH; +- // no break + case PUSH_GLYPH_ATTR : +- if (arg[2] <= 0 && -arg[2] <= _analysis.slotref - _analysis.contexts[_analysis.slotref].flags.inserted) +- _analysis.set_ref(arg[2], true); +- else if (arg[2] > 0) +- _analysis.set_ref(arg[2], true); +- break; +- case ASSOC : // slotrefs in varargs ++ set_ref(arg[2]); + break; + default: + break; + } + } + + + bool Machine::Code::decoder::emit_opcode(opcode opc, const byte * & bc) +@@ -579,81 +564,89 @@ bool Machine::Code::decoder::emit_opcode + _data += param_sz; + _code._data_size += param_sz; + } + + // recursively decode a context item so we can split the skip into + // instruction and data portions. + if (opc == CNTXT_ITEM) + { +- assert(_pre_context == 0); ++ assert(_out_index == 0); + _in_ctxt_item = true; +- _pre_context = _max.pre_context + int8(_data[-2]); +- _rule_length = _max.rule_length; ++ _out_index = _max.pre_context + int8(_data[-2]); ++ _slotref = int8(_data[-2]); ++ _out_length = _max.rule_length; + + const size_t ctxt_start = _code._instr_count; + byte & instr_skip = _data[-1]; + byte & data_skip = *_data++; + ++_code._data_size; + const byte *curr_end = _max.bytecode; + + if (load(bc, bc + instr_skip)) + { + bc += instr_skip; + data_skip = instr_skip - (_code._instr_count - ctxt_start); + instr_skip = _code._instr_count - ctxt_start; + _max.bytecode = curr_end; + +- _rule_length = 1; +- _pre_context = 0; ++ _out_length = 1; ++ _out_index = 0; ++ _slotref = 0; + _in_ctxt_item = false; + } + else + { +- _pre_context = 0; ++ _out_index = 0; ++ _slotref = 0; + return false; + } + } + + return bool(_code); + } + + + void Machine::Code::decoder::apply_analysis(instr * const code, instr * code_end) + { + // insert TEMP_COPY commands for slots that need them (that change and are referenced later) + int tempcount = 0; + if (_code._constraint) return; + + const instr temp_copy = Machine::getOpcodeTable()[TEMP_COPY].impl[0]; +- for (const context * c = _analysis.contexts, * const ce = c + _analysis.slotref; c != ce; ++c) ++ for (const context * c = _contexts, * const ce = c + _slotref; c < ce; ++c) + { + if (!c->flags.referenced || !c->flags.changed) continue; + + instr * const tip = code + c->codeRef + tempcount; + memmove(tip+1, tip, (code_end - tip) * sizeof(instr)); + *tip = temp_copy; + ++code_end; + ++tempcount; + _code._delete = true; + } + + _code._instr_count = code_end - code; + } + + + inline +-bool Machine::Code::decoder::validate_opcode(const opcode opc, const byte * const bc) ++bool Machine::Code::decoder::validate_opcode(const byte opc, const byte * const bc) + { + if (opc >= MAX_OPCODE) + { + failure(invalid_opcode); + return false; + } + const opcode_t & op = Machine::getOpcodeTable()[opc]; ++ if (op.impl[_code._constraint] == 0) ++ { ++ failure(unimplemented_opcode_used); ++ return false; ++ } + if (op.param_sz == VARARGS && bc >= _max.bytecode) + { + failure(arguments_exhausted); + return false; + } + const size_t param_sz = op.param_sz == VARARGS ? bc[0] + 1 : op.param_sz; + if (bc - 1 + param_sz >= _max.bytecode) + { +@@ -666,56 +659,69 @@ bool Machine::Code::decoder::validate_op + + bool Machine::Code::decoder::valid_upto(const uint16 limit, const uint16 x) const throw() + { + const bool t = (limit != 0) && (x < limit); + if (!t) failure(out_of_range_data); + return t; + } + ++inline ++bool Machine::Code::decoder::test_ref(int8 index) const throw() ++{ ++ if (_code._constraint && !_in_ctxt_item) ++ { ++ if (index > 0 || -index > _max.pre_context) ++ { ++ failure(out_of_range_data); ++ return false; ++ } ++ } ++ else ++ return valid_upto(_max.rule_length, _slotref + _max.pre_context + index); ++ return true; ++} ++ + bool Machine::Code::decoder::test_context() const throw() + { +- if (_pre_context >= _rule_length || _analysis.slotref >= analysis::NUMCONTEXTS - 1) ++ if (_out_index >= _out_length || _out_index < 0 || _slotref >= NUMCONTEXTS - 1) + { + failure(out_of_range_data); + return false; + } + return true; + } + + inline + void Machine::Code::failure(const status_t s) throw() { + release_buffers(); + _status = s; + } + + + inline +-void Machine::Code::decoder::analysis::set_ref(int index, bool incinsert) throw() { +- if (incinsert && contexts[slotref].flags.inserted) --index; +- if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return; +- contexts[index + slotref].flags.referenced = true; +- if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref; ++void Machine::Code::decoder::set_ref(int index) throw() { ++ if (index + _slotref < 0 || index + _slotref >= NUMCONTEXTS) return; ++ _contexts[index + _slotref].flags.referenced = true; ++ if (index + _slotref > _max_ref) _max_ref = index + _slotref; + } + + + inline +-void Machine::Code::decoder::analysis::set_noref(int index) throw() { +- if (contexts[slotref].flags.inserted) --index; +- if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return; +- if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref; ++void Machine::Code::decoder::set_noref(int index) throw() { ++ if (index + _slotref < 0 || index + _slotref >= NUMCONTEXTS) return; ++ if (index + _slotref > _max_ref) _max_ref = index + _slotref; + } + + + inline +-void Machine::Code::decoder::analysis::set_changed(int index) throw() { +- if (contexts[slotref].flags.inserted) --index; +- if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return; +- contexts[index + slotref].flags.changed = true; +- if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref; ++void Machine::Code::decoder::set_changed(int index) throw() { ++ if (index + _slotref < 0 || index + _slotref >= NUMCONTEXTS) return; ++ _contexts[index + _slotref].flags.changed= true; ++ if (index + _slotref > _max_ref) _max_ref = index + _slotref; + } + + + void Machine::Code::release_buffers() throw() + { + if (_own) + free(_code); + _code = 0; +diff --git a/gfx/graphite2/src/Collider.cpp b/gfx/graphite2/src/Collider.cpp +--- a/gfx/graphite2/src/Collider.cpp ++++ b/gfx/graphite2/src/Collider.cpp +@@ -21,17 +21,17 @@ + + Alternatively, the contents of this file may be used under the terms of the + Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public + License, as published by the Free Software Foundation, either version 2 + of the License or (at your option) any later version. + */ + #include <algorithm> + #include <limits> +-#include <math.h> ++#include <cmath> + #include <string> + #include <functional> + #include "inc/Collider.h" + #include "inc/Segment.h" + #include "inc/Slot.h" + #include "inc/GlyphCache.h" + #include "inc/Sparse.h" + +@@ -824,43 +824,43 @@ bool KernCollider::initSlot(Segment *seg + if (margin < 10) margin = 10; + + _limit = limit; + _offsetPrev = offsetPrev; // kern from a previous pass + + // Calculate the height of the glyph and how many horizontal slices to use. + if (_maxy >= 1e37f) + { +- _maxy = ymax; +- _miny = ymin; + _sliceWidth = margin / 1.5f; ++ _maxy = ymax + margin; ++ _miny = ymin - margin; + numSlices = int((_maxy - _miny + 2) / (_sliceWidth / 1.5f) + 1.f); // +2 helps with rounding errors + _edges.clear(); + _edges.insert(_edges.begin(), numSlices, (dir & 1) ? 1e38f : -1e38f); + _xbound = (dir & 1) ? (float)1e38f : (float)-1e38f; + } + else if (_maxy != ymax || _miny != ymin) + { + if (_miny != ymin) + { +- numSlices = int((ymin - _miny) / _sliceWidth - 1); ++ numSlices = int((ymin - margin - _miny) / _sliceWidth - 1); + _miny += numSlices * _sliceWidth; + if (numSlices < 0) + _edges.insert(_edges.begin(), -numSlices, (dir & 1) ? 1e38f : -1e38f); + else if ((unsigned)numSlices < _edges.size()) // this shouldn't fire since we always grow the range + { + Vector<float>::iterator e = _edges.begin(); + while (numSlices--) + ++e; + _edges.erase(_edges.begin(), e); + } + } + if (_maxy != ymax) + { +- numSlices = int((ymax - _miny) / _sliceWidth + 1); ++ numSlices = int((ymax + margin - _miny) / _sliceWidth + 1); + _maxy = numSlices * _sliceWidth + _miny; + if (numSlices > (int)_edges.size()) + _edges.insert(_edges.end(), numSlices - _edges.size(), (dir & 1) ? 1e38f : -1e38f); + else if (numSlices < (int)_edges.size()) // this shouldn't fire since we always grow the range + { + while ((int)_edges.size() > numSlices) + _edges.pop_back(); + } +@@ -930,53 +930,60 @@ bool KernCollider::initSlot(Segment *seg + // Return false if we know there is no collision, true if we think there might be one. + bool KernCollider::mergeSlot(Segment *seg, Slot *slot, const Position &currShift, float currSpace, int dir, GR_MAYBE_UNUSED json * const dbgout) + { + int rtl = (dir & 1) * 2 - 1; + if (!seg->getFace()->glyphs().check(slot->gid())) + return false; + const Rect &bb = seg->theGlyphBBoxTemporary(slot->gid()); + const float sx = slot->origin().x + currShift.x; +- float x = sx + (rtl > 0 ? bb.tr.x : bb.bl.x); ++ float x = (sx + (rtl > 0 ? bb.tr.x : bb.bl.x)) * rtl; + // this isn't going to reduce _mingap so skip +- if ((rtl > 0 && x < _xbound - _mingap - currSpace) || (rtl <= 0 && x > _xbound + _mingap + currSpace)) ++ if (x < rtl * (_xbound - _mingap - currSpace)) + return false; + + const float sy = slot->origin().y + currShift.y; +- int smin = max(0, int((bb.bl.y + (1 - _miny + sy)) / _sliceWidth + 1)); +- int smax = min((int)_edges.size() - 1, int((bb.tr.y + (1 - _miny + sy)) / _sliceWidth + 1)); ++ int smin = max(1, int((bb.bl.y + (1 - _miny + sy)) / _sliceWidth + 1)) - 1; ++ int smax = min((int)_edges.size() - 2, int((bb.tr.y + (1 - _miny + sy)) / _sliceWidth + 1)) + 1; ++ if (smin > smax) ++ return false; + bool collides = false; ++ float below = smin > 0 ? _edges[smin-1] * rtl : 1e38f; ++ float here = _edges[smin] * rtl; ++ float above = smin < (int)_edges.size() - 1 ? _edges[smin+1] * rtl : 1e38f; + + for (int i = smin; i <= smax; ++i) + { + float t; + float y = (float)(_miny - 1 + (i + .5f) * _sliceWidth); // vertical center of slice +- if (x * rtl > _edges[i] * rtl - _mingap - currSpace) ++ if ( (x > here - _mingap - currSpace) ++ || (x > below - _mingap - currSpace) ++ || (x > above - _mingap - currSpace)) + { + // 2 * currSpace to account for the space that is already separating them and the space we want to add +- float m = get_edge(seg, slot, currShift, y, _sliceWidth, rtl > 0) + 2 * rtl * currSpace; +- t = rtl * (_edges[i] - m); ++ float m = get_edge(seg, slot, currShift, y, _sliceWidth, rtl > 0) * rtl + 2 * currSpace; + // Check slices above and below (if any). +- if (i < (int)_edges.size() - 1) t = min(t, rtl * (_edges[i+1] - m)); +- if (i > 0) t = min(t, rtl * (_edges[i-1] - m)); ++ t = min(min(here, below), above) - m; + // _mingap is positive to shrink + if (t < _mingap) + { + _mingap = t; + collides = true; + } + #if !defined GRAPHITE2_NTRACING + // Debugging - remember the closest neighboring edge for this slice. +- if (rtl * m > rtl * _nearEdges[i]) ++ if (m > rtl * _nearEdges[i]) + { + _slotNear[i] = slot; +- _nearEdges[i] = m; ++ _nearEdges[i] = m * rtl; + } + #endif + } ++ below = here; here = above; ++ above = i < (int)_edges.size() - 2 ? _edges[i+2] * rtl : 1e38f; + } + return collides; // note that true is not a necessarily reliable value + + } // end of KernCollider::mergeSlot + + + // Return the amount to kern by. + Position KernCollider::resolve(GR_MAYBE_UNUSED Segment *seg, GR_MAYBE_UNUSED Slot *slot, +diff --git a/gfx/graphite2/src/Face.cpp b/gfx/graphite2/src/Face.cpp +--- a/gfx/graphite2/src/Face.cpp ++++ b/gfx/graphite2/src/Face.cpp +@@ -178,17 +178,18 @@ bool Face::runGraphite(Segment *seg, con + if ((seg->dir() & 3) == 3 && aSilf->bidiPass() == 0xFF) + seg->doMirror(aSilf->aMirror()); + bool res = aSilf->runGraphite(seg, 0, aSilf->positionPass(), true); + if (res) + { + seg->associateChars(0, seg->charInfoCount()); + if (aSilf->flags() & 0x20) + res &= seg->initCollisions(); +- res &= aSilf->runGraphite(seg, aSilf->positionPass(), aSilf->numPasses(), false); ++ if (res) ++ res &= aSilf->runGraphite(seg, aSilf->positionPass(), aSilf->numPasses(), false); + } + + #if !defined GRAPHITE2_NTRACING + if (dbgout) + { + seg->positionSlots(0, 0, 0, aSilf->dir()); + *dbgout << json::item + << json::close // Close up the passes array +@@ -226,17 +227,17 @@ const Silf *Face::chooseSilf(uint32 scri + return m_silfs; + } + + uint16 Face::findPseudo(uint32 uid) const + { + return (m_numSilf) ? m_silfs[0].findPseudo(uid) : 0; + } + +-uint16 Face::getGlyphMetric(uint16 gid, uint8 metric) const ++int32 Face::getGlyphMetric(uint16 gid, uint8 metric) const + { + switch (metrics(metric)) + { + case kgmetAscent : return m_ascent; + case kgmetDescent : return m_descent; + default: + if (gid >= glyphs().numGlyphs()) return 0; + return glyphs().glyph(gid)->getMetric(metric); +@@ -277,17 +278,17 @@ Face::Table::Table(const Face & face, co + : _f(&face), _compressed(false) + { + size_t sz = 0; + _p = static_cast<const byte *>((*_f->m_ops.get_table)(_f->m_appFaceHandle, n, &sz)); + _sz = uint32(sz); + + if (!TtfUtil::CheckTable(n, _p, _sz)) + { +- this->~Table(); // Make sure we release the table buffer even if the table filed it's checks ++ releaseBuffers(); // Make sure we release the table buffer even if the table failed it's checks + return; + } + + if (be::peek<uint32>(_p) >= version) + decompress(); + } + + void Face::Table::releaseBuffers() +@@ -324,17 +325,18 @@ Error Face::Table::decompress() + switch(compression(hdr >> 27)) + { + case NONE: return e; + + case LZ4: + { + uncompressed_size = hdr & 0x07ffffff; + uncompressed_table = gralloc<byte>(uncompressed_size); +- if (!e.test(!uncompressed_table, E_OUTOFMEM)) ++ if (!e.test(!uncompressed_table || uncompressed_size < 4, E_OUTOFMEM)) ++ memset(uncompressed_table, 0, 4); // make sure version number is initialised + // coverity[forward_null : FALSE] - uncompressed_table has been checked so can't be null + // coverity[checked_return : FALSE] - we test e later + e.test(lz4::decompress(p, _sz - 2*sizeof(uint32), uncompressed_table, uncompressed_size) != signed(uncompressed_size), E_SHRINKERFAILED); + break; + } + + default: + e.error(E_BADSCHEME); +diff --git a/gfx/graphite2/src/GlyphCache.cpp b/gfx/graphite2/src/GlyphCache.cpp +--- a/gfx/graphite2/src/GlyphCache.cpp ++++ b/gfx/graphite2/src/GlyphCache.cpp +@@ -111,18 +111,20 @@ private: + _num_glyphs_attributes, + _num_attrs; // number of glyph attributes per glyph + }; + + + + GlyphCache::GlyphCache(const Face & face, const uint32 face_options) + : _glyph_loader(new Loader(face, bool(face_options & gr_face_dumbRendering))), +- _glyphs(_glyph_loader && *_glyph_loader ? grzeroalloc<const GlyphFace *>(_glyph_loader->num_glyphs()) : 0), +- _boxes(_glyph_loader && _glyph_loader->has_boxes() ? grzeroalloc<GlyphBox *>(_glyph_loader->num_glyphs()) : 0), ++ _glyphs(_glyph_loader && *_glyph_loader && _glyph_loader->num_glyphs() ++ ? grzeroalloc<const GlyphFace *>(_glyph_loader->num_glyphs()) : 0), ++ _boxes(_glyph_loader && _glyph_loader->has_boxes() && _glyph_loader->num_glyphs() ++ ? grzeroalloc<GlyphBox *>(_glyph_loader->num_glyphs()) : 0), + _num_glyphs(_glyphs ? _glyph_loader->num_glyphs() : 0), + _num_attrs(_glyphs ? _glyph_loader->num_attrs() : 0), + _upem(_glyphs ? _glyph_loader->units_per_em() : 0) + { + if ((face_options & gr_face_preloadGlyphs) && _glyph_loader && _glyphs) + { + int numsubs = 0; + GlyphFace * const glyphs = new GlyphFace [_num_glyphs]; +@@ -139,17 +141,17 @@ GlyphCache::GlyphCache(const Face & face + for (uint16 gid = 1; loaded && gid != _num_glyphs; ++gid) + _glyphs[gid] = loaded = _glyph_loader->read_glyph(gid, glyphs[gid], &numsubs); + + if (!loaded) + { + _glyphs[0] = 0; + delete [] glyphs; + } +- else if (numsubs > 0) ++ else if (numsubs > 0 && _boxes) + { + GlyphBox * boxes = (GlyphBox *)gralloc<char>(_num_glyphs * sizeof(GlyphBox) + numsubs * 8 * sizeof(float)); + GlyphBox * currbox = boxes; + + for (uint16 gid = 0; currbox && gid != _num_glyphs; ++gid) + { + _boxes[gid] = currbox; + currbox = _glyph_loader->read_box(gid, currbox, *_glyphs[gid]); +@@ -204,16 +206,18 @@ GlyphCache::~GlyphCache() + free(_boxes[0]); + free(_boxes); + } + delete _glyph_loader; + } + + const GlyphFace *GlyphCache::glyph(unsigned short glyphid) const //result may be changed by subsequent call with a different glyphid + { ++ if (glyphid >= numGlyphs()) ++ return _glyphs[0]; + const GlyphFace * & p = _glyphs[glyphid]; + if (p == 0 && _glyph_loader) + { + int numsubs = 0; + GlyphFace * g = new GlyphFace(); + if (g) p = _glyph_loader->read_glyph(glyphid, *g, &numsubs); + if (!p) + { +@@ -280,26 +284,27 @@ GlyphCache::Loader::Loader(const Face & + _long_fmt = flags & 1; + int tmpnumgattrs = (m_pGloc.size() + - (p - m_pGloc) + - sizeof(uint16)*(flags & 0x2 ? _num_attrs : 0)) + / (_long_fmt ? sizeof(uint32) : sizeof(uint16)) - 1; + + if (version >= 0x00020000 || tmpnumgattrs < 0 || tmpnumgattrs > 65535 + || _num_attrs == 0 || _num_attrs > 0x3000 // is this hard limit appropriate? +- || _num_glyphs_graphics > tmpnumgattrs) ++ || _num_glyphs_graphics > tmpnumgattrs ++ || m_pGlat.size() < 4) + { + _head = Face::Table(); + return; + } + + _num_glyphs_attributes = static_cast<unsigned short>(tmpnumgattrs); + p = m_pGlat; + version = be::read<uint32>(p); +- if (version >= 0x00040000) // reject Glat tables that are too new ++ if (version >= 0x00040000 || (version >= 0x00030000 && m_pGlat.size() < 8)) // reject Glat tables that are too new + { + _head = Face::Table(); + return; + } + else if (version >= 0x00030000) + { + unsigned int glatflags = be::read<uint32>(p); + _has_boxes = glatflags & 1; +@@ -381,22 +386,24 @@ const GlyphFace * GlyphCache::Loader::re + } + else + { + be::skip<uint16>(gloc, glyphid); + glocs = be::read<uint16>(gloc); + gloce = be::peek<uint16>(gloc); + } + +- if (glocs >= m_pGlat.size() || gloce > m_pGlat.size()) ++ if (glocs >= m_pGlat.size() - 1 || gloce > m_pGlat.size()) + return 0; + + const uint32 glat_version = be::peek<uint32>(m_pGlat); +- if (glat_version == 0x00030000) ++ if (glat_version >= 0x00030000) + { ++ if (glocs >= gloce) ++ return 0; + const byte * p = m_pGlat + glocs; + uint16 bmap = be::read<uint16>(p); + int num = bit_set_count((uint32)bmap); + if (numsubs) *numsubs += num; + glocs += 6 + 8 * num; + if (glocs > gloce) + return 0; + } +@@ -449,29 +456,31 @@ GlyphBox * GlyphCache::Loader::read_box( + } + else + { + be::skip<uint16>(gloc, gid); + glocs = be::read<uint16>(gloc); + gloce = be::peek<uint16>(gloc); + } + +- if (glocs >= m_pGlat.size() || gloce > m_pGlat.size()) ++ if (gloce > m_pGlat.size() || glocs + 6 >= gloce) + return 0; + + const byte * p = m_pGlat + glocs; + uint16 bmap = be::read<uint16>(p); + int num = bit_set_count((uint32)bmap); + + Rect bbox = glyph.theBBox(); + Rect diamax(Position(bbox.bl.x + bbox.bl.y, bbox.bl.x - bbox.tr.y), + Position(bbox.tr.x + bbox.tr.y, bbox.tr.x - bbox.bl.y)); + Rect diabound = readbox(diamax, p[0], p[2], p[1], p[3]); + ::new (curr) GlyphBox(num, bmap, &diabound); + be::skip<uint8>(p, 4); ++ if (glocs + 6 + num * 8 >= gloce) ++ return 0; + + for (int i = 0; i < num * 2; ++i) + { + Rect box = readbox((i & 1) ? diamax : bbox, p[0], p[2], p[1], p[3]); + curr->addSubBox(i >> 1, i & 1, &box); + be::skip<uint8>(p, 4); + } + return (GlyphBox *)((char *)(curr) + sizeof(GlyphBox) + 2 * num * sizeof(Rect)); +diff --git a/gfx/graphite2/src/GlyphFace.cpp b/gfx/graphite2/src/GlyphFace.cpp +--- a/gfx/graphite2/src/GlyphFace.cpp ++++ b/gfx/graphite2/src/GlyphFace.cpp +@@ -24,25 +24,25 @@ Mozilla Public License (http://mozilla.o + License, as published by the Free Software Foundation, either version 2 + of the License or (at your option) any later version. + */ + #include "inc/GlyphFace.h" + + + using namespace graphite2; + +-uint16 GlyphFace::getMetric(uint8 metric) const ++int32 GlyphFace::getMetric(uint8 metric) const + { + switch (metrics(metric)) + { +- case kgmetLsb : return static_cast<uint16>(m_bbox.bl.x); +- case kgmetRsb : return static_cast<uint16>(m_advance.x - m_bbox.tr.x); +- case kgmetBbTop : return static_cast<uint16>(m_bbox.tr.y); +- case kgmetBbBottom : return static_cast<uint16>(m_bbox.bl.y); +- case kgmetBbLeft : return static_cast<uint16>(m_bbox.bl.x); +- case kgmetBbRight : return static_cast<uint16>(m_bbox.tr.x); +- case kgmetBbHeight : return static_cast<uint16>(m_bbox.tr.y - m_bbox.bl.y); +- case kgmetBbWidth : return static_cast<uint16>(m_bbox.tr.x - m_bbox.bl.x); +- case kgmetAdvWidth : return static_cast<uint16>(m_advance.x); +- case kgmetAdvHeight : return static_cast<uint16>(m_advance.y); ++ case kgmetLsb : return m_bbox.bl.x; ++ case kgmetRsb : return m_advance.x - m_bbox.tr.x; ++ case kgmetBbTop : return m_bbox.tr.y; ++ case kgmetBbBottom : return m_bbox.bl.y; ++ case kgmetBbLeft : return m_bbox.bl.x; ++ case kgmetBbRight : return m_bbox.tr.x; ++ case kgmetBbHeight : return m_bbox.tr.y - m_bbox.bl.y; ++ case kgmetBbWidth : return m_bbox.tr.x - m_bbox.bl.x; ++ case kgmetAdvWidth : return m_advance.x; ++ case kgmetAdvHeight : return m_advance.y; + default : return 0; + } + } +diff --git a/gfx/graphite2/src/Justifier.cpp b/gfx/graphite2/src/Justifier.cpp +--- a/gfx/graphite2/src/Justifier.cpp ++++ b/gfx/graphite2/src/Justifier.cpp +@@ -95,62 +95,63 @@ float Segment::justify(Slot *pSlot, cons + + end = pLast->nextSibling(); + pFirst = pFirst->nextSibling(); + + int icount = 0; + int numLevels = silf()->numJustLevels(); + if (!numLevels) + { +- for (s = pSlot; s != end; s = s->next()) ++ for (s = pSlot; s && s != end; s = s->nextSibling()) + { + CharInfo *c = charinfo(s->before()); + if (isWhitespace(c->unicodeChar())) + { + s->setJustify(this, 0, 3, 1); + s->setJustify(this, 0, 2, 1); + s->setJustify(this, 0, 0, -1); + ++icount; + } + } + if (!icount) + { +- for (s = pSlot; s != end; s = s->nextSibling()) ++ for (s = pSlot; s && s != end; s = s->nextSibling()) + { + s->setJustify(this, 0, 3, 1); + s->setJustify(this, 0, 2, 1); + s->setJustify(this, 0, 0, -1); + } + } + ++numLevels; + } + + Vector<JustifyTotal> stats(numLevels); +- for (s = pFirst; s != end; s = s->nextSibling()) ++ for (s = pFirst; s && s != end; s = s->nextSibling()) + { + float w = s->origin().x / scale + s->advance() - base; + if (w > currWidth) currWidth = w; + for (int j = 0; j < numLevels; ++j) + stats[j].accumulate(s, this, j); + s->just(0); + } + + for (int i = (width < 0.0f) ? -1 : numLevels - 1; i >= 0; --i) + { + float diff; + float error = 0.; + float diffpw; + int tWeight = stats[i].weight(); ++ if (tWeight == 0) continue; + + do { + error = 0.; + diff = width - currWidth; + diffpw = diff / tWeight; + tWeight = 0; +- for (s = pFirst; s != end; s = s->nextSibling()) // don't include final glyph ++ for (s = pFirst; s && s != end; s = s->nextSibling()) // don't include final glyph + { + int w = s->getJustify(this, i, 3); + float pref = diffpw * w + error; + int step = s->getJustify(this, i, 2); + if (!step) step = 1; // handle lazy font developers + if (pref > 0) + { + float max = uint16(s->getJustify(this, i, 0)); +diff --git a/gfx/graphite2/src/NameTable.cpp b/gfx/graphite2/src/NameTable.cpp +--- a/gfx/graphite2/src/NameTable.cpp ++++ b/gfx/graphite2/src/NameTable.cpp +@@ -42,25 +42,26 @@ NameTable::NameTable(const void* data, s + memcpy(pdata, data, length); + m_table = reinterpret_cast<const TtfUtil::Sfnt::FontNames*>(pdata); + + if ((length > sizeof(TtfUtil::Sfnt::FontNames)) && + (length > sizeof(TtfUtil::Sfnt::FontNames) + + sizeof(TtfUtil::Sfnt::NameRecord) * ( be::swap<uint16>(m_table->count) - 1))) + { + uint16 offset = be::swap<uint16>(m_table->string_offset); +- m_nameData = reinterpret_cast<const uint8*>(pdata) + offset; +- setPlatformEncoding(platformId, encodingID); +- m_nameDataLength = length - offset; ++ if (offset < length) ++ { ++ m_nameData = reinterpret_cast<const uint8*>(pdata) + offset; ++ setPlatformEncoding(platformId, encodingID); ++ m_nameDataLength = length - offset; ++ return; ++ } + } +- else +- { +- free(const_cast<TtfUtil::Sfnt::FontNames*>(m_table)); +- m_table = NULL; +- } ++ free(const_cast<TtfUtil::Sfnt::FontNames*>(m_table)); ++ m_table = NULL; + } + + uint16 NameTable::setPlatformEncoding(uint16 platformId, uint16 encodingID) + { + if (!m_nameData) return 0; + uint16 i = 0; + uint16 count = be::swap<uint16>(m_table->count); + for (; i < count; i++) +@@ -139,28 +140,36 @@ void* NameTable::getName(uint16& languag + uint16 offset = be::swap<uint16>(nameRecord.offset); + if(offset + utf16Length > m_nameDataLength) + { + languageId = 0; + length = 0; + return NULL; + } + utf16Length >>= 1; // in utf16 units +- utf16::codeunit_t * utf16Name = gralloc<utf16::codeunit_t>(utf16Length); ++ utf16::codeunit_t * utf16Name = gralloc<utf16::codeunit_t>(utf16Length + 1); + if (!utf16Name) + { + languageId = 0; + length = 0; + return NULL; + } + const uint8* pName = m_nameData + offset; + for (size_t i = 0; i < utf16Length; i++) + { + utf16Name[i] = be::read<uint16>(pName); + } ++ utf16Name[utf16Length] = 0; ++ if (!utf16::validate(utf16Name, utf16Name + utf16Length)) ++ { ++ free(utf16Name); ++ languageId = 0; ++ length = 0; ++ return NULL; ++ } + switch (enc) + { + case gr_utf8: + { + utf8::codeunit_t* uniBuffer = gralloc<utf8::codeunit_t>(3 * utf16Length + 1); + if (!uniBuffer) + { + free(utf16Name); +diff --git a/gfx/graphite2/src/Pass.cpp b/gfx/graphite2/src/Pass.cpp +--- a/gfx/graphite2/src/Pass.cpp ++++ b/gfx/graphite2/src/Pass.cpp +@@ -96,17 +96,17 @@ bool Pass::readPass(const byte * const p + const byte * p = pass_start, + * const pass_end = p + pass_length; + size_t numRanges; + + if (e.test(pass_length < 40, E_BADPASSLENGTH)) return face.error(e); + // Read in basic values + const byte flags = be::read<byte>(p); + if (e.test((flags & 0x1f) && +- (pt < PASS_TYPE_POSITIONING || !m_silf->aCollision() || !face.glyphs().hasBoxes()), ++ (pt < PASS_TYPE_POSITIONING || !m_silf->aCollision() || !face.glyphs().hasBoxes() || !(m_silf->flags() & 0x20)), + E_BADCOLLISIONPASS)) + return face.error(e); + m_numCollRuns = flags & 0x7; + m_kernColls = (flags >> 3) & 0x3; + m_isReverseDir = (flags >> 5) & 0x1; + m_iMaxLoop = be::read<byte>(p); + if (m_iMaxLoop < 1) m_iMaxLoop = 1; + be::skip<byte>(p,2); // skip maxContext & maxBackup +@@ -226,17 +226,21 @@ bool Pass::readRules(const byte * rule_m + // Load rules. + const byte * ac_begin = 0, * rc_begin = 0, + * ac_end = ac_data + be::peek<uint16>(o_action), + * rc_end = rc_data + be::peek<uint16>(o_constraint); + + // Allocate pools + m_rules = new Rule [m_numRules]; + m_codes = new Code [m_numRules*2]; +- const size_t prog_pool_sz = vm::Machine::Code::estimateCodeDataOut(ac_end - ac_data + rc_end - rc_data); ++ int totalSlots = 0; ++ const uint16 *tsort = sort_key; ++ for (int i = 0; i < m_numRules; ++i) ++ totalSlots += be::peek<uint16>(--tsort); ++ const size_t prog_pool_sz = vm::Machine::Code::estimateCodeDataOut(ac_end - ac_data + rc_end - rc_data, 2 * m_numRules, totalSlots); + m_progs = gralloc<byte>(prog_pool_sz); + byte * prog_pool_free = m_progs, + * prog_pool_end = m_progs + prog_pool_sz; + if (e.test(!(m_rules && m_codes && m_progs), E_OUTOFMEM)) return face.error(e); + + Rule * r = m_rules + m_numRules - 1; + for (size_t n = m_numRules; r >= m_rules; --n, --r, ac_end = ac_begin, rc_end = rc_begin) + { +@@ -249,17 +253,17 @@ bool Pass::readRules(const byte * rule_m + if (r->sort > 63 || r->preContext >= r->sort || r->preContext > m_maxPreCtxt || r->preContext < m_minPreCtxt) + return false; + ac_begin = ac_data + be::peek<uint16>(--o_action); + --o_constraint; + rc_begin = be::peek<uint16>(o_constraint) ? rc_data + be::peek<uint16>(o_constraint) : rc_end; + + if (ac_begin > ac_end || ac_begin > ac_data_end || ac_end > ac_data_end + || rc_begin > rc_end || rc_begin > rc_data_end || rc_end > rc_data_end +- || vm::Machine::Code::estimateCodeDataOut(ac_end - ac_begin + rc_end - rc_begin) > size_t(prog_pool_end - prog_pool_free)) ++ || vm::Machine::Code::estimateCodeDataOut(ac_end - ac_begin + rc_end - rc_begin, 2, r->sort) > size_t(prog_pool_end - prog_pool_free)) + return false; + r->action = new (m_codes+n*2-2) vm::Machine::Code(false, ac_begin, ac_end, r->preContext, r->sort, *m_silf, face, pt, &prog_pool_free); + r->constraint = new (m_codes+n*2-1) vm::Machine::Code(true, rc_begin, rc_end, r->preContext, r->sort, *m_silf, face, pt, &prog_pool_free); + + if (e.test(!r->action || !r->constraint, E_OUTOFMEM) + || e.test(r->action->status() != Code::loaded, r->action->status() + E_CODEFAILURE) + || e.test(r->constraint->status() != Code::loaded, r->constraint->status() + E_CODEFAILURE) + || e.test(!r->constraint->immutable(), E_MUTABLECCODE)) +@@ -330,17 +334,17 @@ bool Pass::readStates(const byte * start + + // load state transition table. + for (uint16 * t = m_transitions, + * const t_end = t + m_numTransition*m_numColumns; t != t_end; ++t) + { + *t = be::read<uint16>(states); + if (e.test(*t >= m_numStates, E_BADSTATE)) + { +- face.error_context((face.error_context() & 0xFFFF00) + EC_ATRANS + (((t - m_transitions) / m_numColumns) << 24)); ++ face.error_context((face.error_context() & 0xFFFF00) + EC_ATRANS + (((t - m_transitions) / m_numColumns) << 8)); + return face.error(e); + } + } + + State * s = m_states, + * const success_begin = m_states + m_numStates - m_numSuccess; + const RuleEntry * rule_map_end = m_ruleMap + be::peek<uint16>(o_rule_map + m_numSuccess*sizeof(uint16)); + for (size_t n = m_numStates; n; --n, ++s) +@@ -351,17 +355,18 @@ bool Pass::readStates(const byte * start + if (e.test(begin >= rule_map_end || end > rule_map_end || begin > end, E_BADRULEMAPPING)) + { + face.error_context((face.error_context() & 0xFFFF00) + EC_ARULEMAP + (n << 24)); + return face.error(e); + } + s->rules = begin; + s->rules_end = (end - begin <= FiniteStateMachine::MAX_RULES)? end : + begin + FiniteStateMachine::MAX_RULES; +- qsort(begin, end - begin, sizeof(RuleEntry), &cmpRuleEntry); ++ if (begin) // keep UBSan happy can't call qsort with null begin ++ qsort(begin, end - begin, sizeof(RuleEntry), &cmpRuleEntry); + } + + return true; + } + + bool Pass::readRanges(const byte * ranges, size_t num_ranges, Error &e) + { + m_cols = gralloc<uint16>(m_numGlyphs); +@@ -449,19 +454,19 @@ bool Pass::runFSM(FiniteStateMachine& fs + if (fsm.slots.context() < m_minPreCtxt) + return false; + + uint16 state = m_startStates[m_maxPreCtxt - fsm.slots.context()]; + uint8 free_slots = SlotMap::MAX_SLOTS; + do + { + fsm.slots.pushSlot(slot); +- if (--free_slots == 0 +- || slot->gid() >= m_numGlyphs ++ if (slot->gid() >= m_numGlyphs + || m_cols[slot->gid()] == 0xffffU ++ || --free_slots == 0 + || state >= m_numTransition) + return free_slots != 0; + + const uint16 * transitions = m_transitions + state*m_numColumns; + state = transitions[m_cols[slot->gid()]]; + if (state >= m_successStart) + fsm.rules.accumulate_rules(m_states[state]); + +@@ -627,37 +632,40 @@ bool Pass::testPassConstraint(Machine & + } + + + bool Pass::testConstraint(const Rule & r, Machine & m) const + { + const uint16 curr_context = m.slotMap().context(); + if (unsigned(r.sort - r.preContext) > m.slotMap().size() - curr_context + || curr_context - r.preContext < 0) return false; ++ ++ vm::slotref * map = m.slotMap().begin() + curr_context - r.preContext; ++ if (map[r.sort - 1] == 0) ++ return false; ++ + if (!*r.constraint) return true; + assert(r.constraint->constraint()); +- +- vm::slotref * map = m.slotMap().begin() + curr_context - r.preContext; + for (int n = r.sort; n && map; --n, ++map) + { + if (!*map) continue; + const int32 ret = r.constraint->run(m, map); + if (!ret || m.status() != Machine::finished) + return false; + } + + return true; + } + + + void SlotMap::collectGarbage(Slot * &aSlot) + { + for(Slot **s = begin(), *const *const se = end() - 1; s != se; ++s) { + Slot *& slot = *s; +- if(slot->isDeleted() || slot->isCopied()) ++ if(slot && (slot->isDeleted() || slot->isCopied())) + { + if (slot == aSlot) + aSlot = slot->prev() ? slot->prev() : slot->next(); + segment.freeSlot(slot); + } + } + } + +@@ -848,17 +856,16 @@ bool Pass::collisionShift(Segment *seg, + } + } + } + return true; + } + + bool Pass::collisionKern(Segment *seg, int dir, json * const dbgout) const + { +- KernCollider kerncoll(dbgout); + Slot *start = seg->first(); + float ymin = 1e38f; + float ymax = -1e38f; + const GlyphCache &gc = seg->getFace()->glyphs(); + + // phase 3 : handle kerning of clusters + #if !defined GRAPHITE2_NTRACING + if (dbgout) +@@ -871,17 +878,17 @@ bool Pass::collisionKern(Segment *seg, i + return false; + const SlotCollision * c = seg->collisionInfo(s); + const Rect &bbox = seg->theGlyphBBoxTemporary(s->gid()); + float y = s->origin().y + c->shift().y; + ymax = max(y + bbox.tr.y, ymax); + ymin = min(y + bbox.bl.y, ymin); + if (start && (c->flags() & (SlotCollision::COLL_KERN | SlotCollision::COLL_FIX)) + == (SlotCollision::COLL_KERN | SlotCollision::COLL_FIX)) +- resolveKern(seg, s, start, kerncoll, dir, ymin, ymax, dbgout); ++ resolveKern(seg, s, start, dir, ymin, ymax, dbgout); + if (c->flags() & SlotCollision::COLL_END) + start = NULL; + if (c->flags() & SlotCollision::COLL_START) + start = s; + } + + #if !defined GRAPHITE2_NTRACING + if (dbgout) +@@ -1010,17 +1017,17 @@ bool Pass::resolveCollisions(Segment *se + if (isCol) + { cFix->setFlags(cFix->flags() | SlotCollision::COLL_ISCOL | SlotCollision::COLL_KNOWN); } + else + { cFix->setFlags((cFix->flags() & ~SlotCollision::COLL_ISCOL) | SlotCollision::COLL_KNOWN); } + hasCol |= isCol; + return true; + } + +-float Pass::resolveKern(Segment *seg, Slot *slotFix, GR_MAYBE_UNUSED Slot *start, KernCollider &coll, int dir, ++float Pass::resolveKern(Segment *seg, Slot *slotFix, GR_MAYBE_UNUSED Slot *start, int dir, + float &ymin, float &ymax, json *const dbgout) const + { + Slot *nbor; // neighboring slot + float currSpace = 0.; + bool collides = false; + unsigned int space_count = 0; + Slot *base = slotFix; + while (base->attachedTo()) +@@ -1030,16 +1037,17 @@ float Pass::resolveKern(Segment *seg, Sl + + if (base != slotFix) + { + cFix->setFlags(cFix->flags() | SlotCollision::COLL_KERN | SlotCollision::COLL_FIX); + return 0; + } + bool seenEnd = (cFix->flags() & SlotCollision::COLL_END) != 0; + bool isInit = false; ++ KernCollider coll(dbgout); + + for (nbor = slotFix->next(); nbor; nbor = nbor->next()) + { + if (nbor->isChildOf(base)) + continue; + if (!gc.check(nbor->gid())) + return 0.; + const Rect &bb = seg->theGlyphBBoxTemporary(nbor->gid()); +diff --git a/gfx/graphite2/src/Segment.cpp b/gfx/graphite2/src/Segment.cpp +--- a/gfx/graphite2/src/Segment.cpp ++++ b/gfx/graphite2/src/Segment.cpp +@@ -419,16 +419,19 @@ Position Segment::positionSlots(const Fo + reverseSlots(); + temp = iStart; + iStart = iEnd; + iEnd = temp; + } + if (!iStart) iStart = m_first; + if (!iEnd) iEnd = m_last; + ++ if (!iStart || !iEnd) // only true for empty segments ++ return currpos; ++ + if (isRtl) + { + for (Slot * s = iEnd, * const end = iStart->prev(); s && s != end; s = s->prev()) + { + if (s->isBase()) + currpos = s->finalise(this, font, currpos, bbox, 0, clusterMin = currpos.x, isRtl, isFinal); + } + } +@@ -526,11 +529,14 @@ void Segment::doMirror(uint16 aMirror) + } + + bool Segment::initCollisions() + { + m_collisions = grzeroalloc<SlotCollision>(slotCount()); + if (!m_collisions) return false; + + for (Slot *p = m_first; p; p = p->next()) +- ::new (collisionInfo(p)) SlotCollision(this, p); ++ if (p->index() < slotCount()) ++ ::new (collisionInfo(p)) SlotCollision(this, p); ++ else ++ return false; + return true; + } +diff --git a/gfx/graphite2/src/Silf.cpp b/gfx/graphite2/src/Silf.cpp +--- a/gfx/graphite2/src/Silf.cpp ++++ b/gfx/graphite2/src/Silf.cpp +@@ -350,20 +350,20 @@ uint16 Silf::getClassGlyph(uint16 cid, u + } + return 0; + } + + + bool Silf::runGraphite(Segment *seg, uint8 firstPass, uint8 lastPass, int dobidi) const + { + assert(seg != 0); +- SlotMap map(*seg, m_dir); ++ unsigned int maxSize = seg->slotCount() * MAX_SEG_GROWTH_FACTOR; ++ SlotMap map(*seg, m_dir, maxSize); + FiniteStateMachine fsm(map, seg->getFace()->logger()); + vm::Machine m(map); +- unsigned int initSize = seg->slotCount(); + uint8 lbidi = m_bPass; + #if !defined GRAPHITE2_NTRACING + json * const dbgout = seg->getFace()->logger(); + #endif + + if (lastPass == 0) + { + if (firstPass == lastPass && lbidi == 0xFF) +@@ -419,13 +419,13 @@ bool Silf::runGraphite(Segment *seg, uin + + // test whether to reorder, prepare for positioning + bool reverse = (lbidi == 0xFF) && (seg->currdir() != ((m_dir & 1) ^ m_passes[i].reverseDir())); + if ((i >= 32 || (seg->passBits() & (1 << i)) == 0 || m_passes[i].collisionLoops()) + && !m_passes[i].runGraphite(m, fsm, reverse)) + return false; + // only subsitution passes can change segment length, cached subsegments are short for their text + if (m.status() != vm::Machine::finished +- || (seg->slotCount() && seg->slotCount() * MAX_SEG_GROWTH_FACTOR < initSize)) ++ || (seg->slotCount() && seg->slotCount() > maxSize)) + return false; + } + return true; + } +diff --git a/gfx/graphite2/src/Slot.cpp b/gfx/graphite2/src/Slot.cpp +--- a/gfx/graphite2/src/Slot.cpp ++++ b/gfx/graphite2/src/Slot.cpp +@@ -80,20 +80,20 @@ void Slot::set(const Slot & orig, int ch + + void Slot::update(int /*numGrSlots*/, int numCharInfo, Position &relpos) + { + m_before += numCharInfo; + m_after += numCharInfo; + m_position = m_position + relpos; + } + +-Position Slot::finalise(const Segment *seg, const Font *font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal) ++Position Slot::finalise(const Segment *seg, const Font *font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal, int depth) + { + SlotCollision *coll = NULL; +- if (attrLevel && m_attLevel > attrLevel) return Position(0, 0); ++ if (depth > 100 || (attrLevel && m_attLevel > attrLevel)) return Position(0, 0); + float scale = font ? font->scale() : 1.0f; + Position shift(m_shift.x * (rtl * -2 + 1) + m_just, m_shift.y); + float tAdvance = m_advance.x + m_just; + if (isFinal && (coll = seg->collisionInfo(this))) + { + const Position &collshift = coll->offset(); + if (!(coll->flags() & SlotCollision::COLL_KERN) || rtl) + shift = shift + collshift; +@@ -128,23 +128,23 @@ Position Slot::finalise(const Segment *s + if (glyphFace) + { + Rect ourBbox = glyphFace->theBBox() * scale + m_position; + bbox = bbox.widen(ourBbox); + } + + if (m_child && m_child != this && m_child->attachedTo() == this) + { +- Position tRes = m_child->finalise(seg, font, m_position, bbox, attrLevel, clusterMin, rtl, isFinal); ++ Position tRes = m_child->finalise(seg, font, m_position, bbox, attrLevel, clusterMin, rtl, isFinal, depth + 1); + if ((!m_parent || m_advance.x >= 0.5f) && tRes.x > res.x) res = tRes; + } + + if (m_parent && m_sibling && m_sibling != this && m_sibling->attachedTo() == m_parent) + { +- Position tRes = m_sibling->finalise(seg, font, base, bbox, attrLevel, clusterMin, rtl, isFinal); ++ Position tRes = m_sibling->finalise(seg, font, base, bbox, attrLevel, clusterMin, rtl, isFinal, depth + 1); + if (tRes.x > res.x) res = tRes; + } + + if (!m_parent && clusterMin < base.x) + { + Position adj = Position(m_position.x - clusterMin, 0.); + res += adj; + m_position += adj; +@@ -160,35 +160,35 @@ int32 Slot::clusterMetric(const Segment + return 0; + Rect bbox = seg->theGlyphBBoxTemporary(glyph()); + float clusterMin = 0.; + Position res = finalise(seg, NULL, base, bbox, attrLevel, clusterMin, rtl, false); + + switch (metrics(metric)) + { + case kgmetLsb : +- return static_cast<uint32>(bbox.bl.x); ++ return bbox.bl.x; + case kgmetRsb : +- return static_cast<uint32>(res.x - bbox.tr.x); ++ return res.x - bbox.tr.x; + case kgmetBbTop : +- return static_cast<uint32>(bbox.tr.y); ++ return bbox.tr.y; + case kgmetBbBottom : +- return static_cast<uint32>(bbox.bl.y); ++ return bbox.bl.y; + case kgmetBbLeft : +- return static_cast<uint32>(bbox.bl.x); ++ return bbox.bl.x; + case kgmetBbRight : +- return static_cast<uint32>(bbox.tr.x); ++ return bbox.tr.x; + case kgmetBbWidth : +- return static_cast<uint32>(bbox.tr.x - bbox.bl.x); ++ return bbox.tr.x - bbox.bl.x; + case kgmetBbHeight : +- return static_cast<uint32>(bbox.tr.y - bbox.bl.y); ++ return bbox.tr.y - bbox.bl.y; + case kgmetAdvWidth : +- return static_cast<uint32>(res.x); ++ return res.x; + case kgmetAdvHeight : +- return static_cast<uint32>(res.y); ++ return res.y; + default : + return 0; + } + } + + #define SLOTGETCOLATTR(x) { SlotCollision *c = seg->collisionInfo(this); return c ? int(c-> x) : 0; } + + int Slot::getAttr(const Segment *seg, attrCode ind, uint8 subindex) const +@@ -290,19 +290,32 @@ void Slot::setAttr(Segment *seg, attrCod + case gr_slatAdvX : m_advance.x = value; break; + case gr_slatAdvY : m_advance.y = value; break; + case gr_slatAttTo : + { + const uint16 idx = uint16(value); + if (idx < map.size() && map[idx]) + { + Slot *other = map[idx]; +- if (other == this || other == m_parent) break; +- if (m_parent) m_parent->removeChild(this); +- if (!other->isChildOf(this) && other->child(this)) ++ if (other == this || other == m_parent || other->isCopied()) break; ++ if (m_parent) { m_parent->removeChild(this); attachTo(NULL); } ++ Slot *pOther = other; ++ int count = 0; ++ bool foundOther = false; ++ while (pOther) ++ { ++ ++count; ++ if (pOther == this) foundOther = true; ++ pOther = pOther->attachedTo(); ++ } ++ for (pOther = m_child; pOther; pOther = pOther->m_child) ++ ++count; ++ for (pOther = m_sibling; pOther; pOther = pOther->m_sibling) ++ ++count; ++ if (count < 100 && !foundOther && other->child(this)) + { + attachTo(other); + if ((map.dir() != 0) ^ (idx > subindex)) + m_with = Position(advance(), 0); + else // normal match to previous root + m_attach = Position(other->advance(), 0); + } + } +@@ -416,41 +429,34 @@ bool Slot::sibling(Slot *ap) + m_sibling = ap; + else + return m_sibling->sibling(ap); + return true; + } + + bool Slot::removeChild(Slot *ap) + { +- if (this == ap || !m_child) return false; ++ if (this == ap || !m_child || !ap) return false; + else if (ap == m_child) + { + Slot *nSibling = m_child->nextSibling(); +- m_child->removeSibling(nSibling); ++ m_child->nextSibling(NULL); + m_child = nSibling; + return true; + } +- else +- return m_child->removeSibling(ap); +- return true; +-} +- +-bool Slot::removeSibling(Slot *ap) +-{ +- if (this == ap || !m_sibling) return false; +- else if (ap == m_sibling) ++ for (Slot *p = m_child; p; p = p->m_sibling) + { +- m_sibling = m_sibling->nextSibling(); +- if (m_sibling) ap->removeSibling(m_sibling); +- return true; ++ if (p->m_sibling && p->m_sibling == ap) ++ { ++ p->m_sibling = p->m_sibling->m_sibling; ++ ap->nextSibling(NULL); ++ return true; ++ } + } +- else +- return m_sibling->removeSibling(ap); +- return true; ++ return false; + } + + void Slot::setGlyph(Segment *seg, uint16 glyphid, const GlyphFace * theGlyph) + { + m_glyphid = glyphid; + m_bidiCls = -1; + if (!theGlyph) + { +@@ -475,21 +481,23 @@ void Slot::setGlyph(Segment *seg, uint16 + if (seg->silf()->aPassBits()) + { + seg->mergePassBits(theGlyph->attrs()[seg->silf()->aPassBits()]); + if (seg->silf()->numPasses() > 16) + seg->mergePassBits(theGlyph->attrs()[seg->silf()->aPassBits()+1] << 16); + } + } + +-void Slot::floodShift(Position adj) ++void Slot::floodShift(Position adj, int depth) + { ++ if (depth > 100) ++ return; + m_position += adj; +- if (m_child) m_child->floodShift(adj); +- if (m_sibling) m_sibling->floodShift(adj); ++ if (m_child) m_child->floodShift(adj, depth + 1); ++ if (m_sibling) m_sibling->floodShift(adj, depth + 1); + } + + void SlotJustify::LoadSlot(const Slot *s, const Segment *seg) + { + for (int i = seg->silf()->numJustLevels() - 1; i >= 0; --i) + { + Justinfo *justs = seg->silf()->justAttrs() + i; + int16 *v = values + i * NUMJUSTPARAMS; +@@ -514,15 +522,14 @@ Slot * Slot::nextInCluster(const Slot *s + return base->nextSibling(); + s = base; + } + return NULL; + } + + bool Slot::isChildOf(const Slot *base) const + { +- if (m_parent == base) +- return true; +- else if (!m_parent) +- return false; +- else +- return m_parent->isChildOf(base); ++ for (Slot *p = m_parent; p; p = p->m_parent) ++ if (p == base) ++ return true; ++ return false; + } ++ +diff --git a/gfx/graphite2/src/TtfUtil.cpp b/gfx/graphite2/src/TtfUtil.cpp +--- a/gfx/graphite2/src/TtfUtil.cpp ++++ b/gfx/graphite2/src/TtfUtil.cpp +@@ -891,25 +891,27 @@ const void * FindCmapSubtable(const void + ----------------------------------------------------------------------------------------------*/ + bool CheckCmapSubtable4(const void * pCmapSubtable4, const void * pCmapEnd /*, unsigned int maxgid*/) + { + size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable4; + if (!pCmapSubtable4) return false; + const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable4); + // Bob H say some freeware TT fonts have version 1 (eg, CALIGULA.TTF) + // so don't check subtable version. 21 Mar 2002 spec changes version to language. +- if (be::swap(pTable->format) != 4) return false; ++ if (table_len < sizeof(*pTable) || be::swap(pTable->format) != 4) return false; + const Sfnt::CmapSubTableFormat4 * pTable4 = reinterpret_cast<const Sfnt::CmapSubTableFormat4 *>(pCmapSubtable4); ++ if (table_len < sizeof(*pTable4)) ++ return false; + uint16 length = be::swap(pTable4->length); + if (length > table_len) + return false; + if (length < sizeof(Sfnt::CmapSubTableFormat4)) + return false; + uint16 nRanges = be::swap(pTable4->seg_count_x2) >> 1; +- if (length < sizeof(Sfnt::CmapSubTableFormat4) + 4 * nRanges * sizeof(uint16)) ++ if (!nRanges || length < sizeof(Sfnt::CmapSubTableFormat4) + 4 * nRanges * sizeof(uint16)) + return false; + // check last range is properly terminated + uint16 chEnd = be::peek<uint16>(pTable4->end_code + nRanges - 1); + if (chEnd != 0xFFFF) + return false; + #if 0 + int lastend = -1; + for (int i = 0; i < nRanges; ++i) +@@ -999,17 +1001,17 @@ gid16 CmapSubtable4Lookup(const void * p + uint16 idRangeOffset = be::peek<uint16>(pMid += nSeg); + + if (idRangeOffset == 0) + return (uint16)(idDelta + nUnicodeId); // must use modulus 2^16 + + // Look up value in glyphIdArray + const ptrdiff_t offset = (nUnicodeId - chStart) + (idRangeOffset >> 1) + + (pMid - reinterpret_cast<const uint16 *>(pTable)); +- if (offset * 2 >= be::swap<uint16>(pTable->length)) ++ if (offset * 2 + 1 >= be::swap<uint16>(pTable->length)) + return 0; + gid16 nGlyphId = be::peek<uint16>(reinterpret_cast<const uint16 *>(pTable)+offset); + // If this value is 0, return 0. Else add the idDelta + return nGlyphId ? nGlyphId + idDelta : 0; + } + + return 0; + } +@@ -1081,19 +1083,21 @@ unsigned int CmapSubtable4NextCodepoint( + /*---------------------------------------------------------------------------------------------- + Check the Microsoft UCS-4 subtable for expected values. + ----------------------------------------------------------------------------------------------*/ + bool CheckCmapSubtable12(const void *pCmapSubtable12, const void *pCmapEnd /*, unsigned int maxgid*/) + { + size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable12; + if (!pCmapSubtable12) return false; + const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable12); +- if (be::swap(pTable->format) != 12) ++ if (table_len < sizeof(*pTable) || be::swap(pTable->format) != 12) + return false; + const Sfnt::CmapSubTableFormat12 * pTable12 = reinterpret_cast<const Sfnt::CmapSubTableFormat12 *>(pCmapSubtable12); ++ if (table_len < sizeof(*pTable12)) ++ return false; + uint32 length = be::swap(pTable12->length); + if (length > table_len) + return false; + if (length < sizeof(Sfnt::CmapSubTableFormat12)) + return false; + uint32 num_groups = be::swap(pTable12->num_groups); + if (num_groups > 0x10000000 || length != (sizeof(Sfnt::CmapSubTableFormat12) + (num_groups - 1) * sizeof(uint32) * 3)) + return false; +diff --git a/gfx/graphite2/src/inc/Code.h b/gfx/graphite2/src/inc/Code.h +--- a/gfx/graphite2/src/inc/Code.h ++++ b/gfx/graphite2/src/inc/Code.h +@@ -81,17 +81,17 @@ private: + _modify, + _delete; + mutable bool _own; + + void release_buffers() throw (); + void failure(const status_t) throw(); + + public: +- static size_t estimateCodeDataOut(size_t num_bytecodes); ++ static size_t estimateCodeDataOut(size_t num_bytecodes, int nRules, int nSlots); + + Code() throw(); + Code(bool is_constraint, const byte * bytecode_begin, const byte * const bytecode_end, + uint8 pre_context, uint16 rule_length, const Silf &, const Face &, + enum passtype pt, byte * * const _out = 0); + Code(const Machine::Code &) throw(); + ~Code() throw(); + +@@ -107,19 +107,21 @@ public: + void externalProgramMoved(ptrdiff_t) throw(); + + int32 run(Machine &m, slotref * & map) const; + + CLASS_NEW_DELETE; + }; + + inline +-size_t Machine::Code::estimateCodeDataOut(size_t n_bc) ++size_t Machine::Code::estimateCodeDataOut(size_t n_bc, int nRules, int nSlots) + { +- return (n_bc + 1) * (sizeof(instr)+sizeof(byte)); ++ // max is: all codes are instructions + 1 for each rule + max tempcopies ++ // allocate space for separate maximal code and data then merge them later ++ return (n_bc + nRules + nSlots) * sizeof(instr) + n_bc * sizeof(byte); + } + + + inline Machine::Code::Code() throw() + : _code(0), _data(0), _data_size(0), _instr_count(0), _max_ref(0), + _status(loaded), _constraint(false), _modify(false), _delete(false), + _own(false) + { +diff --git a/gfx/graphite2/src/inc/Face.h b/gfx/graphite2/src/inc/Face.h +--- a/gfx/graphite2/src/inc/Face.h ++++ b/gfx/graphite2/src/inc/Face.h +@@ -82,17 +82,17 @@ public: + uint16 languageForLocale(const char * locale) const; + + // Features + uint16 numFeatures() const; + const FeatureRef * featureById(uint32 id) const; + const FeatureRef * feature(uint16 index) const; + + // Glyph related +- uint16 getGlyphMetric(uint16 gid, uint8 metric) const; ++ int32 getGlyphMetric(uint16 gid, uint8 metric) const; + uint16 findPseudo(uint32 uid) const; + + // Errors + unsigned int error() const { return m_error; } + bool error(Error e) { m_error = e.error(); return false; } + unsigned int error_context() const { return m_error; } + void error_context(unsigned int errcntxt) { m_errcntxt = errcntxt; } + +diff --git a/gfx/graphite2/src/inc/GlyphFace.h b/gfx/graphite2/src/inc/GlyphFace.h +--- a/gfx/graphite2/src/inc/GlyphFace.h ++++ b/gfx/graphite2/src/inc/GlyphFace.h +@@ -46,17 +46,17 @@ class GlyphFace + public: + GlyphFace(); + template<typename I> + GlyphFace(const Rect & bbox, const Position & adv, I first, const I last); + + const Position & theAdvance() const; + const Rect & theBBox() const { return m_bbox; } + const sparse & attrs() const { return m_attrs; } +- uint16 getMetric(uint8 metric) const; ++ int32 getMetric(uint8 metric) const; + + CLASS_NEW_DELETE; + private: + Rect m_bbox; // bounding box metrics in design units + Position m_advance; // Advance width and height in design units + sparse m_attrs; + }; + +diff --git a/gfx/graphite2/src/inc/Machine.h b/gfx/graphite2/src/inc/Machine.h +--- a/gfx/graphite2/src/inc/Machine.h ++++ b/gfx/graphite2/src/inc/Machine.h +@@ -179,17 +179,17 @@ inline SlotMap& Machine::slotMap() const + return _map; + } + + inline Machine::status_t Machine::status() const throw() + { + return _status; + } + +-inline void Machine::check_final_stack(const int32 * const sp) ++inline void Machine::check_final_stack(const stack_t * const sp) + { + stack_t const * const base = _stack + STACK_GUARD, + * const limit = base + STACK_MAX; + if (sp < base) _status = stack_underflow; // This should be impossible now. + else if (sp >= limit) _status = stack_overflow; // So should this. + else if (sp != base) _status = stack_not_empty; + } + +diff --git a/gfx/graphite2/src/inc/Pass.h b/gfx/graphite2/src/inc/Pass.h +--- a/gfx/graphite2/src/inc/Pass.h ++++ b/gfx/graphite2/src/inc/Pass.h +@@ -76,17 +76,17 @@ private: + void dumpRuleEventConsidered(const FiniteStateMachine & fsm, const RuleEntry & re) const; + void dumpRuleEventOutput(const FiniteStateMachine & fsm, vm::Machine & m, const Rule & r, Slot * os) const; + void adjustSlot(int delta, Slot * & slot_out, SlotMap &) const; + bool collisionShift(Segment *seg, int dir, json * const dbgout) const; + bool collisionKern(Segment *seg, int dir, json * const dbgout) const; + bool collisionFinish(Segment *seg, GR_MAYBE_UNUSED json * const dbgout) const; + bool resolveCollisions(Segment *seg, Slot *slot, Slot *start, ShiftCollider &coll, bool isRev, + int dir, bool &moved, bool &hasCol, json * const dbgout) const; +- float resolveKern(Segment *seg, Slot *slot, Slot *start, KernCollider &coll, int dir, ++ float resolveKern(Segment *seg, Slot *slot, Slot *start, int dir, + float &ymin, float &ymax, json *const dbgout) const; + + const Silf * m_silf; + uint16 * m_cols; + Rule * m_rules; // rules + RuleEntry * m_ruleMap; + uint16 * m_startStates; // prectxt length + uint16 * m_transitions; +diff --git a/gfx/graphite2/src/inc/Rule.h b/gfx/graphite2/src/inc/Rule.h +--- a/gfx/graphite2/src/inc/Rule.h ++++ b/gfx/graphite2/src/inc/Rule.h +@@ -97,17 +97,17 @@ bool State::empty() const + return rules_end == rules; + } + + + class SlotMap + { + public: + enum {MAX_SLOTS=64}; +- SlotMap(Segment & seg, uint8 direction); ++ SlotMap(Segment & seg, uint8 direction, int maxSize); + + Slot * * begin(); + Slot * * end(); + size_t size() const; + unsigned short context() const; + void reset(Slot &, unsigned short); + + Slot * const & operator[](int n) const; +@@ -116,23 +116,25 @@ public: + void collectGarbage(Slot *& aSlot); + + Slot * highwater() { return m_highwater; } + void highwater(Slot *s) { m_highwater = s; m_highpassed = false; } + bool highpassed() const { return m_highpassed; } + void highpassed(bool v) { m_highpassed = v; } + + uint8 dir() const { return m_dir; } ++ int decMax() { return --m_maxSize; } + + Segment & segment; + private: + Slot * m_slot_map[MAX_SLOTS+1]; + unsigned short m_size; + unsigned short m_precontext; + Slot * m_highwater; ++ int m_maxSize; + uint8 m_dir; + bool m_highpassed; + }; + + + class FiniteStateMachine + { + public: +@@ -237,18 +239,19 @@ void FiniteStateMachine::Rules::accumula + return; + } + } + while (rre != rrend && out != lrend) { *out++ = *rre++; } + m_end = out; + } + + inline +-SlotMap::SlotMap(Segment & seg, uint8 direction) +-: segment(seg), m_size(0), m_precontext(0), m_highwater(0), m_dir(direction), m_highpassed(false) ++SlotMap::SlotMap(Segment & seg, uint8 direction, int maxSize) ++: segment(seg), m_size(0), m_precontext(0), m_highwater(0), ++ m_maxSize(maxSize), m_dir(direction), m_highpassed(false) + { + m_slot_map[0] = 0; + } + + inline + Slot * * SlotMap::begin() + { + return &m_slot_map[1]; // allow map to go 1 before slot_map when inserting +diff --git a/gfx/graphite2/src/inc/Segment.h b/gfx/graphite2/src/inc/Segment.h +--- a/gfx/graphite2/src/inc/Segment.h ++++ b/gfx/graphite2/src/inc/Segment.h +@@ -35,17 +35,17 @@ of the License or (at your option) any l + #include "inc/FeatureVal.h" + #include "inc/GlyphCache.h" + #include "inc/GlyphFace.h" + #include "inc/Slot.h" + #include "inc/Position.h" + #include "inc/List.h" + #include "inc/Collider.h" + +-#define MAX_SEG_GROWTH_FACTOR 256 ++#define MAX_SEG_GROWTH_FACTOR 64 + + namespace graphite2 { + + typedef Vector<Features> FeatureList; + typedef Vector<Slot *> SlotRope; + typedef Vector<int16 *> AttributeRope; + typedef Vector<SlotJustify *> JustifyRope; + +@@ -154,17 +154,17 @@ public: + int8 getSlotBidiClass(Slot *s) const; + void doMirror(uint16 aMirror); + Slot *addLineEnd(Slot *nSlot); + void delLineEnd(Slot *s); + bool hasJustification() const { return m_justifies.size() != 0; } + void reverseSlots(); + + bool isWhitespace(const int cid) const; +- bool hasCollisionInfo() const { return (m_flags & SEG_HASCOLLISIONS); } ++ bool hasCollisionInfo() const { return (m_flags & SEG_HASCOLLISIONS) && m_collisions; } + SlotCollision *collisionInfo(const Slot *s) const { return m_collisions ? m_collisions + s->index() : 0; } + CLASS_NEW_DELETE + + public: //only used by: GrSegment* makeAndInitialize(const GrFont *font, const GrFace *face, uint32 script, const FeaturesHandle& pFeats/*must not be IsNull*/, encform enc, const void* pStart, size_t nChars, int dir); + bool read_text(const Face *face, const Features* pFeats/*must not be NULL*/, gr_encform enc, const void*pStart, size_t nChars); + void finalise(const Font *font, bool reverse=false); + float justify(Slot *pSlot, const Font *font, float width, enum justFlags flags, Slot *pFirst, Slot *pLast); + bool initCollisions(); +diff --git a/gfx/graphite2/src/inc/Slot.h b/gfx/graphite2/src/inc/Slot.h +--- a/gfx/graphite2/src/inc/Slot.h ++++ b/gfx/graphite2/src/inc/Slot.h +@@ -92,17 +92,17 @@ public: + void adjKern(const Position &pos) { m_shift = m_shift + pos; m_advance = m_advance + pos; } + void origin(const Position &pos) { m_position = pos + m_shift; } + void originate(int ind) { m_original = ind; } + int original() const { return m_original; } + void before(int ind) { m_before = ind; } + void after(int ind) { m_after = ind; } + bool isBase() const { return (!m_parent); } + void update(int numSlots, int numCharInfo, Position &relpos); +- Position finalise(const Segment* seg, const Font* font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal); ++ Position finalise(const Segment* seg, const Font* font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal, int depth = 0); + bool isDeleted() const { return (m_flags & DELETED) ? true : false; } + void markDeleted(bool state) { if (state) m_flags |= DELETED; else m_flags &= ~DELETED; } + bool isCopied() const { return (m_flags & COPIED) ? true : false; } + void markCopied(bool state) { if (state) m_flags |= COPIED; else m_flags &= ~COPIED; } + bool isPositioned() const { return (m_flags & POSITIONED) ? true : false; } + void markPositioned(bool state) { if (state) m_flags |= POSITIONED; else m_flags &= ~POSITIONED; } + bool isInsertBefore() const { return !(m_flags & INSERTED); } + uint8 getBidiLevel() const { return m_bidiLevel; } +@@ -123,20 +123,19 @@ public: + Position attachOffset() const { return m_attach - m_with; } + Slot* firstChild() const { return m_child; } + void firstChild(Slot *ap) { m_child = ap; } + bool child(Slot *ap); + Slot* nextSibling() const { return m_sibling; } + void nextSibling(Slot *ap) { m_sibling = ap; } + bool sibling(Slot *ap); + bool removeChild(Slot *ap); +- bool removeSibling(Slot *ap); + int32 clusterMetric(const Segment* seg, uint8 metric, uint8 attrLevel, bool rtl); + void positionShift(Position a) { m_position += a; } +- void floodShift(Position adj); ++ void floodShift(Position adj, int depth = 0); + float just() const { return m_just; } + void just(float j) { m_just = j; } + Slot *nextInCluster(const Slot *s) const; + bool isChildOf(const Slot *base) const; + + CLASS_NEW_DELETE + + private: +diff --git a/gfx/graphite2/src/inc/UtfCodec.h b/gfx/graphite2/src/inc/UtfCodec.h +--- a/gfx/graphite2/src/inc/UtfCodec.h ++++ b/gfx/graphite2/src/inc/UtfCodec.h +@@ -35,16 +35,17 @@ typedef uint32 uchar_t; + + template <int N> + struct _utf_codec + { + typedef uchar_t codeunit_t; + + static void put(codeunit_t * cp, const uchar_t , int8 & len) throw(); + static uchar_t get(const codeunit_t * cp, int8 & len) throw(); ++ static bool validate(const codeunit_t * s, const codeunit_t * e) throw(); + }; + + + template <> + struct _utf_codec<32> + { + private: + static const uchar_t limit = 0x110000; +@@ -58,16 +59,22 @@ public: + } + + inline + static uchar_t get(const codeunit_t * cp, int8 & l) throw() + { + if (cp[0] < limit) { l = 1; return cp[0]; } + else { l = -1; return 0xFFFD; } + } ++ ++ inline ++ static bool validate(codeunit_t * s, codeunit_t * e) throw() ++ { ++ return e > s; ++ } + }; + + + template <> + struct _utf_codec<16> + { + private: + static const int32 lead_offset = 0xD800 - (0x10000 >> 10); +@@ -88,22 +95,31 @@ public: + } + + inline + static uchar_t get(const codeunit_t * cp, int8 & l) throw() + { + const uint32 uh = cp[0]; + l = 1; + +- if (0xD800 > uh || uh > 0xDFFF) { return uh; } ++ if (uh < 0xD800|| uh > 0xDFFF) { return uh; } + const uint32 ul = cp[1]; +- if (uh > 0xDBFF || 0xDC00 > ul || ul > 0xDFFF) { l = -1; return 0xFFFD; } ++ if (uh > 0xDBFF || ul < 0xDC00 || ul > 0xDFFF) { l = -1; return 0xFFFD; } + ++l; + return (uh<<10) + ul + surrogate_offset; + } ++ ++ inline ++ static bool validate(codeunit_t * s, codeunit_t * e) throw() ++ { ++ const ptrdiff_t n = e-s; ++ if (n <= 0) return n == 0; ++ const uint32 u = *(s+(n-1)); // Get the last codepoint ++ return (u < 0xD800 || u > 0xDBFF); ++ } + }; + + + template <> + struct _utf_codec<8> + { + private: + static const int8 sz_lut[16]; +@@ -143,16 +159,34 @@ public: + + if (l != seq_sz || toolong) + { + l = -l; + return 0xFFFD; + } + return u; + } ++ ++ inline ++ static bool validate(codeunit_t * s, codeunit_t * e) throw() ++ { ++ const ptrdiff_t n = e-s; ++ if (n <= 0) return n == 0; ++ s += (n-1); ++ if (*s < 0x80) return true; ++ if (*s >= 0xC0) return false; ++ if (n == 1) return true; ++ if (*--s < 0x80) return true; ++ if (*s >= 0xe0) return false; ++ if (n == 2 || *s >= 0xC0) return true; ++ if (*--s < 0x80) return true; ++ if (*s >= 0xF0) return false; ++ return true; ++ } ++ + }; + + + template <typename C> + class _utf_iterator + { + typedef _utf_codec<sizeof(C)*8> codec; + +@@ -195,16 +229,21 @@ public: + + template <typename C> + struct utf + { + typedef typename _utf_codec<sizeof(C)*8>::codeunit_t codeunit_t; + + typedef _utf_iterator<C> iterator; + typedef _utf_iterator<const C> const_iterator; ++ ++ inline ++ static bool validate(codeunit_t * s, codeunit_t * e) throw() { ++ return _utf_codec<sizeof(C)*8>::validate(s,e); ++ } + }; + + + typedef utf<uint32> utf32; + typedef utf<uint16> utf16; + typedef utf<uint8> utf8; + + } // namespace graphite2 +diff --git a/gfx/graphite2/src/inc/opcode_table.h b/gfx/graphite2/src/inc/opcode_table.h +--- a/gfx/graphite2/src/inc/opcode_table.h ++++ b/gfx/graphite2/src/inc/opcode_table.h +@@ -113,13 +113,13 @@ static const opcode_t opcode_table[] = + {{NILOP,NILOP}, 0, "PUT_SUBS3"}, + {{do_(put_glyph), NILOP}, 2, "PUT_GLYPH"}, // output_class output_class + {{do2(push_glyph_attr)}, 3, "PUSH_GLYPH_ATTR"}, // gattrnum gattrnum slot + {{do2(push_att_to_glyph_attr)}, 3, "PUSH_ATT_TO_GLYPH_ATTR"}, // gattrnum gattrnum slot + {{do2(bor)}, 0, "BITOR"}, + {{do2(band)}, 0, "BITAND"}, + {{do2(bnot)}, 0, "BITNOT"}, // 0x40 + {{do2(setbits)}, 4, "BITSET"}, +- {{do2(set_feat)}, 2, "SET_FEAT"}, ++ {{do_(set_feat), NILOP}, 2, "SET_FEAT"}, // featidx slot + // private opcodes for internal use only, comes after all other on disk opcodes. + {{do_(temp_copy), NILOP}, 0, "TEMP_COPY"} + }; + +diff --git a/gfx/graphite2/src/inc/opcodes.h b/gfx/graphite2/src/inc/opcodes.h +--- a/gfx/graphite2/src/inc/opcodes.h ++++ b/gfx/graphite2/src/inc/opcodes.h +@@ -62,17 +62,18 @@ of the License or (at your option) any l + // ip = The current instruction pointer + // endPos = Position of advance of last cluster + // dir = writing system directionality of the font + + + // #define NOT_IMPLEMENTED assert(false) + #define NOT_IMPLEMENTED + +-#define binop(op) const int32 a = pop(); *sp = int32(*sp) op a ++#define binop(op) const uint32 a = pop(); *sp = uint32(*sp) op a ++#define sbinop(op) const int32 a = pop(); *sp = int32(*sp) op a + #define use_params(n) dp += n + + #define declare_params(n) const byte * param = dp; \ + use_params(n); + + #define push(n) { *++sp = n; } + #define pop() (*sp--) + #define slotat(x) (map[(x)]) +@@ -125,17 +126,17 @@ STARTOP(sub) + ENDOP + + STARTOP(mul) + binop(*); + ENDOP + + STARTOP(div_) + if (*sp == 0) DIE; +- binop(/); ++ sbinop(/); + ENDOP + + STARTOP(min_) + const int32 a = pop(), b = *sp; + if (a < b) *sp = a; + ENDOP + + STARTOP(max_) +@@ -176,29 +177,29 @@ STARTOP(equal) + binop(==); + ENDOP + + STARTOP(not_eq_) + binop(!=); + ENDOP + + STARTOP(less) +- binop(<); ++ sbinop(<); + ENDOP + + STARTOP(gtr) +- binop(>); ++ sbinop(>); + ENDOP + + STARTOP(less_eq) +- binop(<=); ++ sbinop(<=); + ENDOP + + STARTOP(gtr_eq) +- binop(>=); ++ sbinop(>=); + ENDOP + + STARTOP(next) + if (map - &smap[0] >= int(smap.size())) DIE + if (is) + { + if (is == smap.highwater()) + smap.highpassed(true); +@@ -237,17 +238,17 @@ STARTOP(put_subs_8bit_obs) + index = seg.findClassIndex(input_class, slot->gid()); + is->setGlyph(&seg, seg.getClassGlyph(output_class, index)); + } + ENDOP + + STARTOP(put_copy) + declare_params(1); + const int slot_ref = int8(*param); +- if (is) ++ if (is && !is->isDeleted()) + { + slotref ref = slotat(slot_ref); + if (ref && ref != is) + { + int16 *tempUserAttrs = is->userAttrs(); + if (is->attachedTo() || is->firstChild()) DIE + Slot *prev = is->prev(); + Slot *next = is->next(); +@@ -262,16 +263,17 @@ STARTOP(put_copy) + is->attachedTo()->child(is); + } + is->markCopied(false); + is->markDeleted(false); + } + ENDOP + + STARTOP(insert) ++ if (smap.decMax() <= 0) DIE; + Slot *newSlot = seg.newSlot(); + if (!newSlot) DIE; + Slot *iss = is; + while (iss && iss->isDeleted()) iss = iss->next(); + if (!iss) + { + if (seg.last()) + { +@@ -550,31 +552,31 @@ ENDOP + + STARTOP(iattr_add) + declare_params(2); + const attrCode slat = attrCode(uint8(param[0])); + const size_t idx = uint8(param[1]); + const int val = int(pop()); + if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0) + { +- seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir); ++ seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir()); + flags |= POSITIONED; + } + int res = is->getAttr(&seg, slat, idx); + is->setAttr(&seg, slat, idx, val + res, smap); + ENDOP + + STARTOP(iattr_sub) + declare_params(2); + const attrCode slat = attrCode(uint8(param[0])); + const size_t idx = uint8(param[1]); + const int val = int(pop()); + if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0) + { +- seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir); ++ seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir()); + flags |= POSITIONED; + } + int res = is->getAttr(&seg, slat, idx); + is->setAttr(&seg, slat, idx, res - val, smap); + ENDOP + + STARTOP(push_proc_state) + use_params(1); + |