1 files changed, 64 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-2710-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2710-pt2.patch
new file mode 100644
index 0000000000..26a10ca2e4
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-2710-pt2.patch
@@ -0,0 +1,64 @@
+From f7c0070831e72735c43beb426ac0c2ce33403f4f Mon Sep 17 00:00:00 2001
+From: Cameron McCormack <cam@mcc.id.au>
+Date: Mon, 6 Apr 2015 09:12:06 -0400
+Subject: [PATCH] Bug 1149542 - Part 2: Track undisplayed characters before
+ empty text frames properly. r=dholbert, a=sledru
+
+---
+ layout/svg/SVGTextFrame.cpp | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp
+index 45327881..9d331b8 100644
+--- a/layout/svg/SVGTextFrame.cpp
++++ b/layout/svg/SVGTextFrame.cpp
+@@ -290,22 +290,25 @@ GetNonEmptyTextFrameAndNode(nsIFrame* aFrame,
+                             nsTextNode*& aTextNode)
+ {
+   nsTextFrame* text = do_QueryFrame(aFrame);
+-  if (!text) {
+-    return false;
+-  }
++  bool isNonEmptyTextFrame = text && text->GetContentLength() != 0;
+ 
+-  nsIContent* content = text->GetContent();
+-  NS_ASSERTION(content && content->IsNodeOfType(nsINode::eTEXT),
+-               "unexpected content type for nsTextFrame");
++  if (isNonEmptyTextFrame) {
++    nsIContent* content = text->GetContent();
++    NS_ASSERTION(content && content->IsNodeOfType(nsINode::eTEXT),
++                 "unexpected content type for nsTextFrame");
+ 
+-  nsTextNode* node = static_cast<nsTextNode*>(content);
+-  if (node->TextLength() == 0) {
+-    return false;
++    nsTextNode* node = static_cast<nsTextNode*>(content);
++    MOZ_ASSERT(node->TextLength() != 0,
++               "frame's GetContentLength() should be 0 if the text node "
++               "has no content");
++
++    aTextFrame = text;
++    aTextNode = node;
+   }
+ 
+-  aTextFrame = text;
+-  aTextNode = node;
+-  return true;
++  MOZ_ASSERT(IsNonEmptyTextFrame(aFrame) == isNonEmptyTextFrame,
++             "our logic should agree with IsNonEmptyTextFrame");
++  return isNonEmptyTextFrame;
+ }
+ 
+ /**
+@@ -1298,7 +1301,7 @@ GetUndisplayedCharactersBeforeFrame(nsTextFrame* aFrame)
+ /**
+  * Traverses the nsTextFrames for an SVGTextFrame and records a
+  * TextNodeCorrespondenceProperty on each for the number of undisplayed DOM
+- * characters between each frame.  This is done by iterating simultaenously
++ * characters between each frame.  This is done by iterating simultaneously
+  * over the nsTextNodes and nsTextFrames and noting when nsTextNodes (or
+  * parts of them) are skipped when finding the next nsTextFrame.
+  */
+-- 
+2.2.1
+