www/waterfox: apply some FF61 fixes

3 files changed, 194 insertions, 1 deletions

diff --git a/www/waterfox/Makefile b/www/waterfox/Makefile
index d0ebaeca4e1..26318a9a993 100644
--- a/www/waterfox/Makefile
+++ b/www/waterfox/Makefile
@@ -3,7 +3,7 @@
 PORTNAME=	waterfox
 DISTVERSION=	56.2.0-13
 DISTVERSIONSUFFIX=	-gd2cdd42f4115b
-PORTREVISION=	4
+PORTREVISION=	5
 CATEGORIES=	www ipv6
 
 MAINTAINER=	jbeich@FreeBSD.org
diff --git a/www/waterfox/files/patch-bug1462682 b/www/waterfox/files/patch-bug1462682
new file mode 100644
index 00000000000..1580bb77741
--- /dev/null
+++ b/www/waterfox/files/patch-bug1462682
@@ -0,0 +1,32 @@
+commit dc5382e1b765
+Author: Lee Salzman <lsalzman@mozilla.com>
+Date:   Fri May 25 00:57:45 2018 -0400
+
+    Bug 1462682 - Skia path bounds rounding fix. r=rhunt, a=RyanVM
+    
+    MozReview-Commit-ID: Lm0XhyLLCCV
+    
+    --HG--
+    extra : source : 784deba1907770c8f4c3482509ae99d474c4439f
+---
+ gfx/skia/skia/src/core/SkScan_Path.cpp | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git gfx/skia/skia/src/core/SkScan_Path.cpp gfx/skia/skia/src/core/SkScan_Path.cpp
+index 2373e62d46ff2..90a22305260f1 100644
+--- gfx/skia/skia/src/core/SkScan_Path.cpp
++++ gfx/skia/skia/src/core/SkScan_Path.cpp
+@@ -564,7 +564,12 @@ static bool clip_to_limit(const SkRegion& orig, SkRegion* reduced) {
+ // Bias used for conservative rounding of float rects to int rects, to nudge the irects a little
+ // larger, so we don't "think" a path's bounds are inside a clip, when (due to numeric drift in
+ // the scan-converter) we might walk beyond the predicted limits.
+-static const double kConservativeRoundBias = 0.5 + 0.5 / SK_FDot6One;
++//
++// This value has been determined trial and error: pick the smallest value (after the 0.5) that
++// fixes any problematic cases (e.g. crbug.com/844457)
++// NOTE: cubics appear to be the main reason for needing this slop. If we could (perhaps) have a
++// more accurate walker for cubics, we may be able to reduce this fudge factor.
++static const double kConservativeRoundBias = 0.5 + 1.5 / SK_FDot6One;
+ 
+ /**
+  *  Round the value down. This is used to round the top and left of a rectangle,
diff --git a/www/waterfox/files/patch-bug1463244 b/www/waterfox/files/patch-bug1463244
new file mode 100644
index 00000000000..b1cdf82291e
--- /dev/null
+++ b/www/waterfox/files/patch-bug1463244
@@ -0,0 +1,161 @@
+commit 937a30033acb
+Author: Lee Salzman <lsalzman@mozilla.com>
+Date:   Fri May 25 00:56:22 2018 -0400
+
+    Bug 1463244 - Cleanup of swizzle stride calculations. r=rhunt, a=RyanVM
+    
+    MozReview-Commit-ID: GMXRKnu8zHB
+    
+    --HG--
+    extra : source : 2aaf8f2a1975c57f5467968734d110ac7becc7ee
+---
+ gfx/2d/DataSurfaceHelpers.cpp | 33 ++++++++++++++++++++++++---------
+ gfx/2d/Swizzle.cpp            | 34 +++++++++++++++++++++++++++-------
+ 2 files changed, 51 insertions(+), 16 deletions(-)
+
+diff --git gfx/2d/DataSurfaceHelpers.cpp gfx/2d/DataSurfaceHelpers.cpp
+index f13be059c8ba0..7af32ff005771 100644
+--- gfx/2d/DataSurfaceHelpers.cpp
++++ gfx/2d/DataSurfaceHelpers.cpp
+@@ -157,9 +157,16 @@ SurfaceToPackedBGRA(DataSourceSurface *aSurface)
+   }
+ 
+   IntSize size = aSurface->GetSize();
+-
+-  UniquePtr<uint8_t[]> imageBuffer(
+-    new (std::nothrow) uint8_t[size.width * size.height * sizeof(uint32_t)]);
++  if (size.width < 0 || size.width >= INT32_MAX / 4) {
++    return nullptr;
++  }
++  int32_t stride = size.width * 4;
++  CheckedInt<size_t> bufferSize =
++    CheckedInt<size_t>(stride) * CheckedInt<size_t>(size.height);
++  if (!bufferSize.isValid()) {
++    return nullptr;
++  }
++  UniquePtr<uint8_t[]> imageBuffer(new (std::nothrow) uint8_t[bufferSize.value()]);
+   if (!imageBuffer) {
+     return nullptr;
+   }
+@@ -170,14 +177,14 @@ SurfaceToPackedBGRA(DataSourceSurface *aSurface)
+   }
+ 
+   CopySurfaceDataToPackedArray(map.mData, imageBuffer.get(), size,
+-                               map.mStride, 4 * sizeof(uint8_t));
++                               map.mStride, 4);
+ 
+   aSurface->Unmap();
+ 
+   if (format == SurfaceFormat::B8G8R8X8) {
+     // Convert BGRX to BGRA by setting a to 255.
+-    SwizzleData(imageBuffer.get(), size.width * sizeof(uint32_t), SurfaceFormat::X8R8G8B8_UINT32,
+-                imageBuffer.get(), size.width * sizeof(uint32_t), SurfaceFormat::A8R8G8B8_UINT32,
++    SwizzleData(imageBuffer.get(), stride, SurfaceFormat::X8R8G8B8_UINT32,
++                imageBuffer.get(), stride, SurfaceFormat::A8R8G8B8_UINT32,
+                 size);
+   }
+ 
+@@ -196,8 +203,16 @@ SurfaceToPackedBGR(DataSourceSurface *aSurface)
+   }
+ 
+   IntSize size = aSurface->GetSize();
+-
+-  uint8_t* imageBuffer = new (std::nothrow) uint8_t[size.width * size.height * 3 * sizeof(uint8_t)];
++  if (size.width < 0 || size.width >= INT32_MAX / 3) {
++    return nullptr;
++  }
++  int32_t stride = size.width * 3;
++  CheckedInt<size_t> bufferSize =
++    CheckedInt<size_t>(stride) * CheckedInt<size_t>(size.height);
++  if (!bufferSize.isValid()) {
++    return nullptr;
++  }
++  uint8_t* imageBuffer = new (std::nothrow) uint8_t[bufferSize.value()];
+   if (!imageBuffer) {
+     return nullptr;
+   }
+@@ -209,7 +224,7 @@ SurfaceToPackedBGR(DataSourceSurface *aSurface)
+   }
+ 
+   SwizzleData(map.mData, map.mStride, SurfaceFormat::B8G8R8X8,
+-              imageBuffer, size.width * 3, SurfaceFormat::B8G8R8,
++              imageBuffer, stride, SurfaceFormat::B8G8R8,
+               size);
+ 
+   aSurface->Unmap();
+diff --git gfx/2d/Swizzle.cpp gfx/2d/Swizzle.cpp
+index 99bd1e17662c4..acbe2cabf9819 100644
+--- gfx/2d/Swizzle.cpp
++++ gfx/2d/Swizzle.cpp
+@@ -259,7 +259,8 @@ static inline IntSize
+ CollapseSize(const IntSize& aSize, int32_t aSrcStride, int32_t aDstStride)
+ {
+   if (aSrcStride == aDstStride &&
+-      aSrcStride == 4 * aSize.width) {
++      (aSrcStride & 3) == 0 &&
++      aSrcStride / 4 == aSize.width) {
+     CheckedInt32 area = CheckedInt32(aSize.width) * CheckedInt32(aSize.height);
+     if (area.isValid()) {
+       return IntSize(area.value(), 1);
+@@ -268,6 +269,16 @@ CollapseSize(const IntSize& aSize, int32_t aSrcStride, int32_t aDstStride)
+   return aSize;
+ }
+ 
++static inline int32_t
++GetStrideGap(int32_t aWidth, SurfaceFormat aFormat, int32_t aStride)
++{
++  CheckedInt32 used = CheckedInt32(aWidth) * BytesPerPixel(aFormat);
++  if (!used.isValid() || used.value() < 0) {
++    return -1;
++  }
++  return aStride - used.value();
++}
++
+ bool
+ PremultiplyData(const uint8_t* aSrc, int32_t aSrcStride, SurfaceFormat aSrcFormat,
+                 uint8_t* aDst, int32_t aDstStride, SurfaceFormat aDstFormat,
+@@ -278,9 +289,12 @@ PremultiplyData(const uint8_t* aSrc, int32_t aSrcStride, SurfaceFormat aSrcForma
+   }
+   IntSize size = CollapseSize(aSize, aSrcStride, aDstStride);
+   // Find gap from end of row to the start of the next row.
+-  int32_t srcGap = aSrcStride - BytesPerPixel(aSrcFormat) * aSize.width;
+-  int32_t dstGap = aDstStride - BytesPerPixel(aDstFormat) * aSize.width;
++  int32_t srcGap = GetStrideGap(aSize.width, aSrcFormat, aSrcStride);
++  int32_t dstGap = GetStrideGap(aSize.width, aDstFormat, aDstStride);
+   MOZ_ASSERT(srcGap >= 0 && dstGap >= 0);
++  if (srcGap < 0 || dstGap < 0) {
++    return false;
++  }
+ 
+ #define FORMAT_CASE_CALL(...) __VA_ARGS__(aSrc, srcGap, aDst, dstGap, size)
+ 
+@@ -404,9 +418,12 @@ UnpremultiplyData(const uint8_t* aSrc, int32_t aSrcStride, SurfaceFormat aSrcFor
+   }
+   IntSize size = CollapseSize(aSize, aSrcStride, aDstStride);
+   // Find gap from end of row to the start of the next row.
+-  int32_t srcGap = aSrcStride - BytesPerPixel(aSrcFormat) * aSize.width;
+-  int32_t dstGap = aDstStride - BytesPerPixel(aDstFormat) * aSize.width;
++  int32_t srcGap = GetStrideGap(aSize.width, aSrcFormat, aSrcStride);
++  int32_t dstGap = GetStrideGap(aSize.width, aDstFormat, aDstStride);
+   MOZ_ASSERT(srcGap >= 0 && dstGap >= 0);
++  if (srcGap < 0 || dstGap < 0) {
++    return false;
++  }
+ 
+ #define FORMAT_CASE_CALL(...) __VA_ARGS__(aSrc, srcGap, aDst, dstGap, size)
+ 
+@@ -702,9 +719,12 @@ SwizzleData(const uint8_t* aSrc, int32_t aSrcStride, SurfaceFormat aSrcFormat,
+   }
+   IntSize size = CollapseSize(aSize, aSrcStride, aDstStride);
+   // Find gap from end of row to the start of the next row.
+-  int32_t srcGap = aSrcStride - BytesPerPixel(aSrcFormat) * aSize.width;
+-  int32_t dstGap = aDstStride - BytesPerPixel(aDstFormat) * aSize.width;
++  int32_t srcGap = GetStrideGap(aSize.width, aSrcFormat, aSrcStride);
++  int32_t dstGap = GetStrideGap(aSize.width, aDstFormat, aDstStride);
+   MOZ_ASSERT(srcGap >= 0 && dstGap >= 0);
++  if (srcGap < 0 || dstGap < 0) {
++    return false;
++  }
+ 
+ #define FORMAT_CASE_CALL(...) __VA_ARGS__(aSrc, srcGap, aDst, dstGap, size)
+