1 files changed, 73 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-2722-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2722-pt2.patch
new file mode 100644
index 0000000000..c82d0f7e6f
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2722-pt2.patch
@@ -0,0 +1,73 @@
+From 6eb772aa6a0c1b21aafcfa606cc3bf07659b53b9 Mon Sep 17 00:00:00 2001
+From: Wes Kocher <wkocher@mozilla.com>
+Date: Wed, 27 May 2015 14:33:22 -0700
+Subject: [PATCH] Bug 1166924 part 1 r=baku a=lizzard
+
+--HG--
+extra : source : 528d47773256bfee72e7adedc78b89c9fa573b7b
+---
+ dom/workers/XMLHttpRequest.cpp | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
+index 8e4200a..bf0cd3f 100644
+--- a/dom/workers/XMLHttpRequest.cpp
++++ b/dom/workers/XMLHttpRequest.cpp
+@@ -140,7 +140,7 @@ public:
+   Init();
+ 
+   void
+-  Teardown();
++  Teardown(bool aSendUnpin);
+ 
+   bool
+   AddRemoveEventListeners(bool aUpload, bool aAdd);
+@@ -308,7 +308,9 @@ private:
+   {
+     AssertIsOnMainThread();
+ 
+-    mProxy->Teardown();
++    // This means the XHR was GC'd, so we can't be pinned, and we don't need to
++    // try to unpin.
++    mProxy->Teardown(/* aSendUnpin */ false);
+     mProxy = nullptr;
+ 
+     return NS_OK;
+@@ -563,7 +565,7 @@ private:
+   virtual nsresult
+   MainThreadRun() MOZ_OVERRIDE
+   {
+-    mProxy->Teardown();
++    mProxy->Teardown(/* aSendUnpin */ true);
+     MOZ_ASSERT(!mProxy->mSyncLoopTarget);
+     return NS_OK;
+   }
+@@ -935,7 +937,7 @@ Proxy::Init()
+ }
+ 
+ void
+-Proxy::Teardown()
++Proxy::Teardown(bool aSendUnpin)
+ {
+   AssertIsOnMainThread();
+ 
+@@ -948,10 +950,12 @@ Proxy::Teardown()
+     mXHR->Abort();
+ 
+     if (mOutstandingSendCount) {
+-      nsRefPtr<XHRUnpinRunnable> runnable =
+-        new XHRUnpinRunnable(mWorkerPrivate, mXMLHttpRequestPrivate);
+-      if (!runnable->Dispatch(nullptr)) {
+-        NS_RUNTIMEABORT("We're going to hang at shutdown anyways.");
++      if (aSendUnpin) {
++        nsRefPtr<XHRUnpinRunnable> runnable =
++          new XHRUnpinRunnable(mWorkerPrivate, mXMLHttpRequestPrivate);
++        if (!runnable->Dispatch(nullptr)) {
++          NS_RUNTIMEABORT("We're going to hang at shutdown anyways.");
++        }
+       }
+ 
+       if (mSyncLoopTarget) {
+-- 
+2.4.3
+