1 files changed, 53 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch b/gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch
new file mode 100644
index 0000000000..4eeb2377b0
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch
@@ -0,0 +1,53 @@
+Copied from upstream:
+https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/9dd60e798819
+
+# HG changeset patch
+# User Olli Pettay <bugs@pettay.fi>
+# Date 1455204078 -3600
+# Node ID 9dd60e798819fe2ebf1e5bd36aa9006ecd2f82c9
+# Parent  c1d67bd4c993b9e344c68954e6f0392c82b81e38
+Bug 1244250 - r=mats, a=al
+
+diff --git a/layout/style/nsAnimationManager.cpp b/layout/style/nsAnimationManager.cpp
+--- a/layout/style/nsAnimationManager.cpp
++++ b/layout/style/nsAnimationManager.cpp
+@@ -715,16 +715,17 @@ nsAnimationManager::FlushAnimations(Flus
+   }
+ 
+   DispatchEvents(); // may destroy us
+ }
+ 
+ void
+ nsAnimationManager::DoDispatchEvents()
+ {
++  nsRefPtr<nsAnimationManager> kungFuDeathGrip(this);
+   EventArray events;
+   mPendingEvents.SwapElements(events);
+   for (uint32_t i = 0, i_end = events.Length(); i < i_end; ++i) {
+     AnimationEventInfo &info = events[i];
+     EventDispatcher::Dispatch(info.mElement, mPresContext, &info.mEvent);
+ 
+     if (!mPresContext) {
+       break;
+diff --git a/layout/style/nsTransitionManager.cpp b/layout/style/nsTransitionManager.cpp
+--- a/layout/style/nsTransitionManager.cpp
++++ b/layout/style/nsTransitionManager.cpp
+@@ -753,16 +753,17 @@ nsTransitionManager::FlushTransitions(Fl
+       }
+     }
+   }
+ 
+   if (didThrottle) {
+     mPresContext->Document()->SetNeedStyleFlush();
+   }
+ 
++  nsRefPtr<nsTransitionManager> kungFuDeathGrip(this);
+   for (uint32_t i = 0, i_end = events.Length(); i < i_end; ++i) {
+     TransitionEventInfo &info = events[i];
+     EventDispatcher::Dispatch(info.mElement, mPresContext, &info.mEvent);
+ 
+     if (!mPresContext) {
+       break;
+     }
+   }
+