1 files changed, 90 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-2724-pt3.patch b/gnu/packages/patches/icecat-CVE-2015-2724-pt3.patch
new file mode 100644
index 0000000000..4b31bf1c6e
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2724-pt3.patch
@@ -0,0 +1,90 @@
+From 5da8e2ffd63deac27c0faca7dabee3623867dd6e Mon Sep 17 00:00:00 2001
+From: Steven Michaud <smichaud@pobox.com>
+Date: Wed, 3 Jun 2015 11:18:25 -0500
+Subject: [PATCH] Bug 1154876 - Block calls to hooked methods off the plugin
+ thread. r=spohl a=abillings
+
+---
+ dom/plugins/ipc/PluginInterposeOSX.mm | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/dom/plugins/ipc/PluginInterposeOSX.mm b/dom/plugins/ipc/PluginInterposeOSX.mm
+index f43192b..cfd8e57 100644
+--- a/dom/plugins/ipc/PluginInterposeOSX.mm
++++ b/dom/plugins/ipc/PluginInterposeOSX.mm
+@@ -38,8 +38,7 @@
+ #import <objc/runtime.h>
+ #import <Carbon/Carbon.h>
+ 
+-using mozilla::plugins::PluginModuleChild;
+-using mozilla::plugins::AssertPluginThread;
++using namespace mozilla::plugins;
+ 
+ namespace mac_plugin_interposing {
+ 
+@@ -544,7 +543,7 @@ void NSCursorInfo::SetCustomImageData(uint8_t* aData, uint32_t aDataLength)
+ bool NSCursorInfo::GetNativeCursorsSupported()
+ {
+   if (mNativeCursorsSupported == -1) {
+-    AssertPluginThread();
++    ENSURE_PLUGIN_THREAD(false);
+     PluginModuleChild *pmc = PluginModuleChild::current();
+     if (pmc) {
+       bool result = pmc->GetNativeCursorsSupported();
+@@ -689,7 +688,7 @@ void FocusPluginProcess() {
+ 
+ void NotifyBrowserOfPluginShowWindow(uint32_t window_id, CGRect bounds,
+                                      bool modal) {
+-  AssertPluginThread();
++  ENSURE_PLUGIN_THREAD_VOID();
+ 
+   PluginModuleChild *pmc = PluginModuleChild::current();
+   if (pmc)
+@@ -697,7 +696,7 @@ void NotifyBrowserOfPluginShowWindow(uint32_t window_id, CGRect bounds,
+ }
+ 
+ void NotifyBrowserOfPluginHideWindow(uint32_t window_id, CGRect bounds) {
+-  AssertPluginThread();
++  ENSURE_PLUGIN_THREAD_VOID();
+ 
+   PluginModuleChild *pmc = PluginModuleChild::current();
+   if (pmc)
+@@ -706,7 +705,7 @@ void NotifyBrowserOfPluginHideWindow(uint32_t window_id, CGRect bounds) {
+ 
+ void NotifyBrowserOfSetCursor(NSCursorInfo& aCursorInfo)
+ {
+-  AssertPluginThread();
++  ENSURE_PLUGIN_THREAD_VOID();
+   PluginModuleChild *pmc = PluginModuleChild::current();
+   if (pmc) {
+     pmc->SetCursor(aCursorInfo);
+@@ -715,7 +714,7 @@ void NotifyBrowserOfSetCursor(NSCursorInfo& aCursorInfo)
+ 
+ void NotifyBrowserOfShowCursor(bool show)
+ {
+-  AssertPluginThread();
++  ENSURE_PLUGIN_THREAD_VOID();
+   PluginModuleChild *pmc = PluginModuleChild::current();
+   if (pmc) {
+     pmc->ShowCursor(show);
+@@ -724,7 +723,7 @@ void NotifyBrowserOfShowCursor(bool show)
+ 
+ void NotifyBrowserOfPushCursor(NSCursorInfo& aCursorInfo)
+ {
+-  AssertPluginThread();
++  ENSURE_PLUGIN_THREAD_VOID();
+   PluginModuleChild *pmc = PluginModuleChild::current();
+   if (pmc) {
+     pmc->PushCursor(aCursorInfo);
+@@ -733,7 +732,7 @@ void NotifyBrowserOfPushCursor(NSCursorInfo& aCursorInfo)
+ 
+ void NotifyBrowserOfPopCursor()
+ {
+-  AssertPluginThread();
++  ENSURE_PLUGIN_THREAD_VOID();
+   PluginModuleChild *pmc = PluginModuleChild::current();
+   if (pmc) {
+     pmc->PopCursor();
+-- 
+2.4.3
+