1 files changed, 65 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-2724-pt4.patch b/gnu/packages/patches/icecat-CVE-2015-2724-pt4.patch
new file mode 100644
index 0000000000..90c15e663e
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2724-pt4.patch
@@ -0,0 +1,65 @@
+From 96dc9518fab0929293a8fc388f6a4a64d05b0f6f Mon Sep 17 00:00:00 2001
+From: Jan de Mooij <jdemooij@mozilla.com>
+Date: Wed, 10 Jun 2015 18:01:09 +0200
+Subject: [PATCH] Bug 1143679 - Make TryNoteIterIon behave more like
+ Baseline/interpreter iterators. r=shu, a=lizzard
+
+--HG--
+extra : transplant_source : W%D0%1FGe%29%2A%E2%BC%0C%09%3BH%92%2A%A0%5CO%FD%89
+---
+ js/src/jit/IonFrames.cpp | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
+index 51f4301..3e41c0a 100644
+--- a/js/src/jit/IonFrames.cpp
++++ b/js/src/jit/IonFrames.cpp
+@@ -356,14 +356,20 @@ JitFrameIterator::machineState() const
+     return machine;
+ }
+ 
++static uint32_t
++NumArgAndLocalSlots(const InlineFrameIterator& frame)
++{
++    JSScript* script = frame.script();
++    return CountArgSlots(script, frame.maybeCallee()) + script->nfixed();
++}
++
+ static void
+-CloseLiveIterator(JSContext* cx, const InlineFrameIterator& frame, uint32_t localSlot)
++CloseLiveIterator(JSContext* cx, const InlineFrameIterator& frame, uint32_t stackSlot)
+ {
+     SnapshotIterator si = frame.snapshotIterator();
+ 
+     // Skip stack slots until we reach the iterator object.
+-    uint32_t base = CountArgSlots(frame.script(), frame.maybeCallee()) + frame.script()->nfixed();
+-    uint32_t skipSlots = base + localSlot - 1;
++    uint32_t skipSlots = NumArgAndLocalSlots(frame) + stackSlot - 1;
+ 
+     for (unsigned i = 0; i < skipSlots; i++)
+         si.skip();
+@@ -407,6 +413,11 @@ HandleExceptionIon(JSContext* cx, const InlineFrameIterator& frame, ResumeFromEx
+     if (!script->hasTrynotes())
+         return;
+ 
++    uint32_t base = NumArgAndLocalSlots(frame);
++    SnapshotIterator si = frame.snapshotIterator();
++    JS_ASSERT(si.numAllocations() >= base);
++    const uint32_t stackDepth = si.numAllocations() - base;
++
+     JSTryNote* tn = script->trynotes()->vector;
+     JSTryNote* tnEnd = tn + script->trynotes()->length;
+ 
+@@ -417,6 +428,9 @@ HandleExceptionIon(JSContext* cx, const InlineFrameIterator& frame, ResumeFromEx
+         if (pcOffset >= tn->start + tn->length)
+             continue;
+ 
++        if (tn->stackDepth > stackDepth)
++            continue;
++
+         switch (tn->kind) {
+           case JSTRY_ITER: {
+             JS_ASSERT(JSOp(*(script->main() + tn->start + tn->length)) == JSOP_ENDITER);
+-- 
+2.4.3
+