rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV

Initialize string in SQLiteStatement before using it

.gitignore

@@ -1,18 +1 @@
 /webkitgtk-*.tar.xz
-/webkitgtk-2.37.1.tar.xz.asc
-/webkitgtk-2.37.90.tar.xz.asc
-/webkitgtk-2.37.91.tar.xz.asc
-/webkitgtk-2.38.0.tar.xz.asc
-/webkitgtk-2.38.1.tar.xz.asc
-/webkitgtk-2.38.2.tar.xz.asc
-/webkitgtk-2.39.1.tar.xz.asc
-/webkitgtk-2.39.2.tar.xz.asc
-/webkitgtk-2.39.3.tar.xz.asc
-/webkitgtk-2.39.4.tar.xz.asc
-/webkitgtk-2.39.5.tar.xz.asc
-/webkitgtk-2.39.6.tar.xz.asc
-/webkitgtk-2.39.7.tar.xz.asc
-/webkitgtk-2.39.90.tar.xz.asc
-/webkitgtk-2.39.91.tar.xz.asc
-/webkitgtk-2.40.0.tar.xz.asc
-/webkitgtk-2.41.1.tar.xz.asc

build.patch

@@ -1,149 +0,0 @@
-From fd977228c791d5cf767a1e5b4ed3596add8ed6d5 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C5=BDan=20Dober=C5=A1ek?= <zdobersek@igalia.com>
-Date: Thu, 30 Mar 2023 10:36:24 -0700
-Subject: [PATCH] Build fix around std::variant in SourceBrush for
- Clang/libstdc++ https://bugs.webkit.org/show_bug.cgi?id=254742
-
-Unreviewed, build fix for the SourceBrush::Brush std::variant construction when
-using Clang with libstdc++.
-
-Things get mixed up when using Ref<Pattern> for constructing the variant, with
-the compiler using it as initialization for the LogicalGradient type, the other
-possible type in the variant, which ends up in a compile-time error.
-
-This can be avoided by using the in-place tag when constructing the variant in
-the SourceBrush::setPattern() method, specifying which variant-alternative type
-should be used.
-
-Similar fix for the same reasons is also needed in the decoding part of the
-ArgumentCoder<std::variant<>> specialization, this being problematic due to the
-SourceBrush::Brush decoding produced for the generated serializers purpose.
-There the variant is constructed with the in-place tag that's based on the index
-value of the alternative.
-
-* Source/WebCore/platform/graphics/SourceBrush.cpp:
-(WebCore::SourceBrush::setPattern):
-* Source/WebCore/platform/graphics/SourceBrush.h:
-* Source/WebKit/Platform/IPC/ArgumentCoders.h:
-
-Canonical link: https://commits.webkit.org/262339@main
----
- Source/WebCore/platform/graphics/SourceBrush.cpp | 2 +-
- Source/WebCore/platform/graphics/SourceBrush.h   | 3 ++-
- Source/WebKit/Platform/IPC/ArgumentCoders.h      | 2 +-
- 3 files changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/Source/WebCore/platform/graphics/SourceBrush.cpp b/Source/WebCore/platform/graphics/SourceBrush.cpp
-index f42e0d42f534..44135b7706ad 100644
---- a/Source/WebCore/platform/graphics/SourceBrush.cpp
-+++ b/Source/WebCore/platform/graphics/SourceBrush.cpp
-@@ -91,7 +91,7 @@ void SourceBrush::setGradient(Ref<Gradient>&& gradient, const AffineTransform& s
- 
- void SourceBrush::setPattern(Ref<Pattern>&& pattern)
- {
--    m_brush = { WTFMove(pattern) };
-+    m_brush = { Brush::Variant { std::in_place_type<Ref<Pattern>>, WTFMove(pattern) } };
- }
- 
- WTF::TextStream& operator<<(TextStream& ts, const SourceBrush& brush)
-diff --git a/Source/WebCore/platform/graphics/SourceBrush.h b/Source/WebCore/platform/graphics/SourceBrush.h
-index 176b9fc85c18..cd97b82c7444 100644
---- a/Source/WebCore/platform/graphics/SourceBrush.h
-+++ b/Source/WebCore/platform/graphics/SourceBrush.h
-@@ -42,7 +42,8 @@ class SourceBrush {
-             template<typename Decoder> static std::optional<LogicalGradient> decode(Decoder&);
-         };
- 
--        std::variant<LogicalGradient, Ref<Pattern>> brush;
-+        using Variant = std::variant<LogicalGradient, Ref<Pattern>>;
-+        Variant brush;
-     };
- 
-     SourceBrush() = default;
-diff --git a/Source/WebKit/Platform/IPC/ArgumentCoders.h b/Source/WebKit/Platform/IPC/ArgumentCoders.h
-index ae37b2145fc2..2d93984e3f36 100644
---- a/Source/WebKit/Platform/IPC/ArgumentCoders.h
-+++ b/Source/WebKit/Platform/IPC/ArgumentCoders.h
-@@ -743,7 +743,7 @@ template<typename... Types> struct ArgumentCoder<std::variant<Types...>> {
-                 auto optional = decoder.template decode<typename std::variant_alternative_t<index, std::variant<Types...>>>();
-                 if (!optional)
-                     return std::nullopt;
--                return std::make_optional<std::variant<Types...>>(WTFMove(*optional));
-+                return std::make_optional<std::variant<Types...>>(std::in_place_index<index>, WTFMove(*optional));
-             }
-             return decode(decoder, std::make_index_sequence<index + 1> { }, i);
-         } else
-
-From 93920b55f52ff8b883296f4845269e2ed746acb3 Mon Sep 17 00:00:00 2001
-From: Michael Catanzaro <mcatanzaro@redhat.com>
-Date: Fri, 31 Mar 2023 12:24:09 -0700
-Subject: [PATCH] Fix build of SourceBrush.cpp
- https://bugs.webkit.org/show_bug.cgi?id=254821
-
-Unreviewed build fix.
-
-* Source/WebCore/platform/graphics/SourceBrush.cpp:
-(WebCore::SourceBrush::setGradient):
-(WebCore::SourceBrush::setPattern):
-
-Canonical link: https://commits.webkit.org/262434@main
----
- Source/WebCore/platform/graphics/SourceBrush.cpp | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Source/WebCore/platform/graphics/SourceBrush.cpp b/Source/WebCore/platform/graphics/SourceBrush.cpp
-index 44135b7706ad..5377831d7902 100644
---- a/Source/WebCore/platform/graphics/SourceBrush.cpp
-+++ b/Source/WebCore/platform/graphics/SourceBrush.cpp
-@@ -86,12 +86,12 @@ Pattern* SourceBrush::pattern() const
- 
- void SourceBrush::setGradient(Ref<Gradient>&& gradient, const AffineTransform& spaceTransform)
- {
--    m_brush = { Brush::LogicalGradient { { WTFMove(gradient) }, spaceTransform } };
-+    m_brush = Brush { Brush::LogicalGradient { { WTFMove(gradient) }, spaceTransform } };
- }
- 
- void SourceBrush::setPattern(Ref<Pattern>&& pattern)
- {
--    m_brush = { Brush::Variant { std::in_place_type<Ref<Pattern>>, WTFMove(pattern) } };
-+    m_brush = Brush { Brush::Variant { std::in_place_type<Ref<Pattern>>, WTFMove(pattern) } };
- }
- 
- WTF::TextStream& operator<<(TextStream& ts, const SourceBrush& brush)
-
-From 2fd83187cbe7cf7f57f4d6834f6060b00703683b Mon Sep 17 00:00:00 2001
-From: Michael Catanzaro <mcatanzaro@redhat.com>
-Date: Fri, 31 Mar 2023 13:23:45 -0500
-Subject: [PATCH] [GTK] AcceleratedSurfaceDMABuf.cpp does not build on i368
- https://bugs.webkit.org/show_bug.cgi?id=254828
-
-Reviewed by NOBODY (OOPS!).
-
-* Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceDMABuf.cpp:
-(WebKit::AcceleratedSurfaceDMABuf::clientResize):
----
- .../WebPage/gtk/AcceleratedSurfaceDMABuf.cpp           | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceDMABuf.cpp b/Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceDMABuf.cpp
-index 2aa33586b317..34cca9f11d62 100644
---- a/Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceDMABuf.cpp
-+++ b/Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceDMABuf.cpp
-@@ -130,12 +130,12 @@ void AcceleratedSurfaceDMABuf::clientResize(const WebCore::IntSize& size)
-     }
-     UnixFileDescriptor backFD(gbm_bo_get_fd(backObject), UnixFileDescriptor::Adopt);
-     Vector<EGLAttrib> attributes = {
--        EGL_WIDTH, gbm_bo_get_width(backObject),
--        EGL_HEIGHT, gbm_bo_get_height(backObject),
--        EGL_LINUX_DRM_FOURCC_EXT, gbm_bo_get_format(backObject),
-+        EGL_WIDTH, static_cast<EGLAttrib>(gbm_bo_get_width(backObject)),
-+        EGL_HEIGHT, static_cast<EGLAttrib>(gbm_bo_get_height(backObject)),
-+        EGL_LINUX_DRM_FOURCC_EXT, static_cast<EGLAttrib>(gbm_bo_get_format(backObject)),
-         EGL_DMA_BUF_PLANE0_FD_EXT, backFD.value(),
--        EGL_DMA_BUF_PLANE0_OFFSET_EXT, gbm_bo_get_offset(backObject, 0),
--        EGL_DMA_BUF_PLANE0_PITCH_EXT, gbm_bo_get_stride(backObject),
-+        EGL_DMA_BUF_PLANE0_OFFSET_EXT, static_cast<EGLAttrib>(gbm_bo_get_offset(backObject, 0)),
-+        EGL_DMA_BUF_PLANE0_PITCH_EXT, static_cast<EGLAttrib>(gbm_bo_get_stride(backObject)),
-         EGL_NONE
-     };
-     m_backImage = display.createEGLImage(EGL_NO_CONTEXT, EGL_LINUX_DMA_BUF_EXT, nullptr, attributes);

changelog

@@ -1,2 +0,0 @@
-* Thu Aug 04 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.37.1-12
-- Initial import. This manual changelog entry hides the repo's long git history from rpm-autospec.

crashy-jit.patch

@@ -1,155 +0,0 @@
-From 63f0b2d0c54093bfea054cc6b302e578260d0fcc Mon Sep 17 00:00:00 2001
-From: Yusuke Suzuki <ysuzuki@apple.com>
-Date: Thu, 30 Mar 2023 19:47:10 -0700
-Subject: [PATCH] [JSC] Reduce # of parameters of function#bind operations
- https://bugs.webkit.org/show_bug.cgi?id=254752 rdar://problem/107427493
-
-Reviewed by Ross Kirsling.
-
-Let's reconstruct boundArgsLength via passed args to reduce # of parameters of operations,
-to mitigate issues on x64 Windows (Windows x64 does not have appropriate implementation for more parameters).
-
-* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
-(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
-* Source/JavaScriptCore/dfg/DFGOperations.cpp:
-(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
-* Source/JavaScriptCore/dfg/DFGOperations.h:
-* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
-(JSC::DFG::SpeculativeJIT::compileFunctionBind):
-(JSC::DFG::SpeculativeJIT::compileNewBoundFunction):
-* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
-(JSC::FTL::DFG::LowerDFGToB3::compileNewBoundFunction):
-(JSC::FTL::DFG::LowerDFGToB3::compileFunctionBind):
-
-Canonical link: https://commits.webkit.org/262385@main
----
- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp   |  2 +-
- Source/JavaScriptCore/dfg/DFGOperations.cpp       | 13 +++++++++++--
- Source/JavaScriptCore/dfg/DFGOperations.h         |  4 ++--
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp |  6 ++----
- Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp     |  5 ++---
- 5 files changed, 18 insertions(+), 12 deletions(-)
-
-diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
-index fc1cd9e88efc..ae1265bb4bc8 100644
---- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
-+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
-@@ -3886,7 +3886,7 @@ auto ByteCodeParser::handleIntrinsicCall(Node* callee, Operand result, CallVaria
-             for (; index < argumentCountIncludingThis; ++index)
-                 addVarArgChild(get(virtualRegisterForArgumentIncludingThis(index, registerOffset)));
-             for (; index < numChildren; ++index)
--                addVarArgChild(jsConstant(jsUndefined()));
-+                addVarArgChild(jsConstant(JSValue()));
-             Node* resultNode = addToGraph(Node::VarArg, FunctionBind, OpInfo(0), OpInfo(static_cast<unsigned>(argumentCountIncludingThis >= 2 ? argumentCountIncludingThis - 2 : 0)));
-             setResult(resultNode);
-             return CallOptimizationResult::Inlined;
-diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
-index ca316e1bd6d2..f19fcd7df41c 100644
---- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
-+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
-@@ -2818,7 +2818,7 @@ JSC_DEFINE_JIT_OPERATION(operationFunctionToString, JSString*, (JSGlobalObject*
-     return function->toString(globalObject);
- }
- 
--JSC_DEFINE_JIT_OPERATION(operationFunctionBind, JSBoundFunction*, (JSGlobalObject* globalObject, JSObject* target, unsigned boundArgsLength, EncodedJSValue boundThisValue, EncodedJSValue arg0Value, EncodedJSValue arg1Value, EncodedJSValue arg2Value))
-+JSC_DEFINE_JIT_OPERATION(operationFunctionBind, JSBoundFunction*, (JSGlobalObject* globalObject, JSObject* target, EncodedJSValue boundThisValue, EncodedJSValue arg0Value, EncodedJSValue arg1Value, EncodedJSValue arg2Value))
- {
-     VM& vm = globalObject->vm();
-     CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
-@@ -2830,6 +2830,11 @@ JSC_DEFINE_JIT_OPERATION(operationFunctionBind, JSBoundFunction*, (JSGlobalObjec
-         return { };
-     }
- 
-+    unsigned boundArgsLength = 0;
-+    boundArgsLength += !!(JSValue::decode(arg0Value));
-+    boundArgsLength += !!(JSValue::decode(arg1Value));
-+    boundArgsLength += !!(JSValue::decode(arg2Value));
-+
-     JSValue boundThis = JSValue::decode(boundThisValue);
-     EncodedJSValue arguments[JSBoundFunction::maxEmbeddedArgs] {
-         arg0Value,
-@@ -2871,7 +2876,7 @@ JSC_DEFINE_JIT_OPERATION(operationFunctionBind, JSBoundFunction*, (JSGlobalObjec
-     RELEASE_AND_RETURN(scope, JSBoundFunction::create(vm, globalObject, target, boundThis, boundArgs, length, name));
- }
- 
--JSC_DEFINE_JIT_OPERATION(operationNewBoundFunction, JSBoundFunction*, (JSGlobalObject* globalObject, JSFunction* function, unsigned boundArgsLength, EncodedJSValue boundThisValue, EncodedJSValue arg0Value, EncodedJSValue arg1Value, EncodedJSValue arg2Value))
-+JSC_DEFINE_JIT_OPERATION(operationNewBoundFunction, JSBoundFunction*, (JSGlobalObject* globalObject, JSFunction* function, EncodedJSValue boundThisValue, EncodedJSValue arg0Value, EncodedJSValue arg1Value, EncodedJSValue arg2Value))
- {
-     VM& vm = globalObject->vm();
-     CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
-@@ -2880,6 +2885,10 @@ JSC_DEFINE_JIT_OPERATION(operationNewBoundFunction, JSBoundFunction*, (JSGlobalO
-     JSValue arg0 = JSValue::decode(arg0Value);
-     JSValue arg1 = JSValue::decode(arg1Value);
-     JSValue arg2 = JSValue::decode(arg2Value);
-+    unsigned boundArgsLength = 0;
-+    boundArgsLength += !!(arg0);
-+    boundArgsLength += !!(arg1);
-+    boundArgsLength += !!(arg2);
-     return JSBoundFunction::createRaw(vm, globalObject, function, boundArgsLength, boundThis, arg0, arg1, arg2);
- }
- 
-diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
-index 9602feb3d66a..7e6080a3ec4e 100644
---- a/Source/JavaScriptCore/dfg/DFGOperations.h
-+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
-@@ -274,8 +274,8 @@ JSC_DECLARE_JIT_OPERATION(operationInt32ToStringWithValidRadix, char*, (JSGlobal
- JSC_DECLARE_JIT_OPERATION(operationInt52ToStringWithValidRadix, char*, (JSGlobalObject*, int64_t, int32_t));
- JSC_DECLARE_JIT_OPERATION(operationDoubleToStringWithValidRadix, char*, (JSGlobalObject*, double, int32_t));
- JSC_DECLARE_JIT_OPERATION(operationFunctionToString, JSString*, (JSGlobalObject*, JSFunction*));
--JSC_DECLARE_JIT_OPERATION(operationFunctionBind, JSBoundFunction*, (JSGlobalObject*, JSObject*, unsigned, EncodedJSValue, EncodedJSValue, EncodedJSValue, EncodedJSValue));
--JSC_DECLARE_JIT_OPERATION(operationNewBoundFunction, JSBoundFunction*, (JSGlobalObject*, JSFunction*, unsigned, EncodedJSValue, EncodedJSValue, EncodedJSValue, EncodedJSValue));
-+JSC_DECLARE_JIT_OPERATION(operationFunctionBind, JSBoundFunction*, (JSGlobalObject*, JSObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, EncodedJSValue));
-+JSC_DECLARE_JIT_OPERATION(operationNewBoundFunction, JSBoundFunction*, (JSGlobalObject*, JSFunction*, EncodedJSValue, EncodedJSValue, EncodedJSValue, EncodedJSValue));
- 
- JSC_DECLARE_JIT_OPERATION(operationNormalizeMapKeyHeapBigInt, EncodedJSValue, (VM*, JSBigInt*));
- JSC_DECLARE_JIT_OPERATION(operationMapHash, UCPUStrictInt32, (JSGlobalObject*, EncodedJSValue input));
-diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
-index 167e61a8d1d0..67f5def0dceb 100644
---- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
-+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
-@@ -6574,12 +6574,10 @@ void SpeculativeJIT::compileFunctionBind(Node* node)
- 
-     speculateObject(m_graph.child(node, 0), targetGPR);
- 
--    unsigned boundArgsLength = node->numberOfBoundArguments();
--
-     GPRFlushedCallResult result(this);
-     GPRReg resultGPR = result.gpr();
-     flushRegisters();
--    callOperation(operationFunctionBind, resultGPR, LinkableConstant::globalObject(*this, node), targetGPR, TrustedImm32(boundArgsLength), boundThisRegs, arg0Regs, arg1Regs, arg2Regs);
-+    callOperation(operationFunctionBind, resultGPR, LinkableConstant::globalObject(*this, node), targetGPR, boundThisRegs, arg0Regs, arg1Regs, arg2Regs);
-     exceptionCheck();
-     cellResult(resultGPR, node);
- }
-@@ -6629,7 +6627,7 @@ void SpeculativeJIT::compileNewBoundFunction(Node* node)
-     store8(TrustedImm32(static_cast<uint8_t>(TriState::Indeterminate)), Address(resultGPR, JSBoundFunction::offsetOfCanConstruct()));
-     mutatorFence(vm());
- 
--    addSlowPathGenerator(slowPathCall(slowPath, this, operationNewBoundFunction, resultGPR, LinkableConstant::globalObject(*this, node), targetGPR, TrustedImm32(node->numberOfBoundArguments()), boundThisRegs, arg0Regs, arg1Regs, arg2Regs));
-+    addSlowPathGenerator(slowPathCall(slowPath, this, operationNewBoundFunction, resultGPR, LinkableConstant::globalObject(*this, node), targetGPR, boundThisRegs, arg0Regs, arg1Regs, arg2Regs));
-     cellResult(resultGPR, node);
- }
- 
-diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
-index 2dda50507633..704d0dd68d8c 100644
---- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
-+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
-@@ -7339,7 +7339,7 @@ IGNORE_CLANG_WARNINGS_END
-         LValue callResult = lazySlowPath(
-             [=, &vm] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
-                 return createLazyCallGenerator(vm, operationNewBoundFunction, locations[0].directGPR(),
--                    CCallHelpers::TrustedImmPtr(globalObject), locations[1].directGPR(), CCallHelpers::TrustedImm32(numberOfBoundArguments),
-+                    CCallHelpers::TrustedImmPtr(globalObject), locations[1].directGPR(),
-                     locations[2].directGPR(), locations[3].directGPR(), locations[4].directGPR(), locations[5].directGPR());
-             },
-             target, thisValue, arg0, arg1, arg2);
-@@ -9014,8 +9014,7 @@ IGNORE_CLANG_WARNINGS_END
-     void compileFunctionBind()
-     {
-         JSGlobalObject* globalObject = m_graph.globalObjectFor(m_origin.semantic);
--        unsigned boundArgsLength = m_node->numberOfBoundArguments();
--        setJSValue(vmCall(pointerType(), operationFunctionBind, weakPointer(globalObject), lowObject(m_graph.child(m_node, 0)), m_out.constInt32(boundArgsLength), lowJSValue(m_graph.child(m_node, 1)), lowJSValue(m_graph.child(m_node, 2)), lowJSValue(m_graph.child(m_node, 3)), lowJSValue(m_graph.child(m_node, 4))));
-+        setJSValue(vmCall(pointerType(), operationFunctionBind, weakPointer(globalObject), lowObject(m_graph.child(m_node, 0)), lowJSValue(m_graph.child(m_node, 1)), lowJSValue(m_graph.child(m_node, 2)), lowJSValue(m_graph.child(m_node, 3)), lowJSValue(m_graph.child(m_node, 4))));
-     }
- 
-     void compileToPrimitive()

rpminspect.yaml

@@ -1,5 +0,0 @@
----
-inspections:
-    abidiff: off
-    changedfiles: off
-    filesize: off

sources

@@ -1,2 +1 @@
-SHA512 (webkitgtk-2.41.1.tar.xz) = a64e112855b53329d99b3f06239e2a7e593a4b22c4c91d87ae67cc37441fdd57458cfcd69151c43a614e10406b25d5f77c43f6865bb5883e32c25c993a506c37
-SHA512 (webkitgtk-2.41.1.tar.xz.asc) = a622232ba91291e3a19cb3693b415e2cf2005bdb52e92054dbe5ced56663d471a1a8942c1a2f53f46124910a270aaec72272ee03e3a590729e195571eab329fe
+312fd29eb7f5970660c6a64b8bf8420e  webkitgtk-2.4.9.tar.xz

webkit-1.3.10-nspluginwrapper.patch

@@ -0,0 +1,13 @@
+diff -Nur webkit-1.3.10.orig/Source/WebCore/plugins/PluginDatabase.cpp webkit-1.3.10/Source/WebCore/plugins/PluginDatabase.cpp
+--- webkit-1.3.10.orig/Source/WebCore/plugins/PluginDatabase.cpp	2011-01-08 09:50:59.000000000 -0700
++++ webkit-1.3.10/Source/WebCore/plugins/PluginDatabase.cpp	2011-01-10 20:55:42.528231854 -0700
+@@ -393,6 +393,9 @@
+     paths.append("/usr/lib64/mozilla/plugins");
+     paths.append("/usr/lib/nsbrowser/plugins");
+     paths.append("/usr/lib64/nsbrowser/plugins");
++    /* And for nspluginwrapper */
++    paths.append("/usr/lib64/mozilla/plugins-wrapped");
++    paths.append("/usr/lib/mozilla/plugins-wrapped");
+ 
+     String mozHome(getenv("MOZILLA_HOME"));
+     mozHome.append("/plugins");

webkitgtk-2.4.1-cloop_fix.patch

@@ -0,0 +1,199 @@
+diff -up webkitgtk-2.4.4/Source/JavaScriptCore/interpreter/ProtoCallFrame.h.cloop_fix webkitgtk-2.4.4/Source/JavaScriptCore/interpreter/ProtoCallFrame.h
+--- webkitgtk-2.4.4/Source/JavaScriptCore/interpreter/ProtoCallFrame.h.cloop_fix	2014-07-23 14:15:45.497658648 +0200
++++ webkitgtk-2.4.4/Source/JavaScriptCore/interpreter/ProtoCallFrame.h	2014-07-23 14:16:46.997687779 +0200
+@@ -36,7 +36,7 @@ struct ProtoCallFrame {
+     Register calleeValue;
+     Register argCountAndCodeOriginValue;
+     Register thisArg;
+-    size_t paddedArgCount;
++    uint32_t paddedArgCount;
+     JSValue *args;
+ 
+     void init(CodeBlock*, JSScope*, JSObject*, JSValue, int, JSValue* otherArgs = 0);
+@@ -53,7 +53,7 @@ struct ProtoCallFrame {
+     int argumentCountIncludingThis() const { return argCountAndCodeOriginValue.payload(); }
+     int argumentCount() const { return argumentCountIncludingThis() - 1; }
+     void setArgumentCountIncludingThis(int count) { argCountAndCodeOriginValue.payload() = count; }
+-    void setPaddedArgsCount(size_t argCount) { paddedArgCount = argCount; }
++    void setPaddedArgsCount(uint32_t argCount) { paddedArgCount = argCount; }
+ 
+     void clearCurrentVPC() { argCountAndCodeOriginValue.tag() = 0; }
+     
+diff -up webkitgtk-2.4.4/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp.cloop_fix webkitgtk-2.4.4/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+--- webkitgtk-2.4.4/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp.cloop_fix	2014-07-23 14:16:02.057667404 +0200
++++ webkitgtk-2.4.4/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	2014-07-23 14:16:46.997687779 +0200
+@@ -1354,7 +1354,7 @@ LLINT_SLOW_PATH_DECL(slow_path_get_from_
+             CodeBlock* codeBlock = exec->codeBlock();
+             ConcurrentJITLocker locker(codeBlock->m_lock);
+             pc[5].u.structure.set(exec->vm(), codeBlock->ownerExecutable(), scope->structure());
+-            pc[6].u.operand = slot.cachedOffset();
++            pc[6].u.pointer = reinterpret_cast<void*>(slot.cachedOffset());
+         }
+     }
+ 
+@@ -1381,7 +1381,7 @@ LLINT_SLOW_PATH_DECL(slow_path_put_to_sc
+         if (slot.isCacheable() && slot.base() == scope && scope->structure()->propertyAccessesAreCacheable()) {
+             ConcurrentJITLocker locker(codeBlock->m_lock);
+             pc[5].u.structure.set(exec->vm(), codeBlock->ownerExecutable(), scope->structure());
+-            pc[6].u.operand = slot.cachedOffset();
++            pc[6].u.pointer = reinterpret_cast<void*>(slot.cachedOffset());
+         }
+     }
+ 
+diff -up webkitgtk-2.4.4/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix webkitgtk-2.4.4/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+--- webkitgtk-2.4.4/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix	2014-07-23 14:16:13.047672325 +0200
++++ webkitgtk-2.4.4/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	2014-07-23 14:18:27.547721786 +0200
+@@ -282,7 +282,7 @@ macro doCallToJavaScript(makeCall, doRet
+     storep temp3, CodeBlock+4[cfr, temp1, 8]
+     btinz temp1, .copyHeaderLoop
+ 
+-    loadi ProtoCallFrame::argCountAndCodeOriginValue[protoCallFrame], temp2
++    loadi PayloadOffset + ProtoCallFrame::argCountAndCodeOriginValue[protoCallFrame], temp2
+     subi 1, temp2
+     loadi ProtoCallFrame::paddedArgCount[protoCallFrame], temp3
+     subi 1, temp3
+@@ -321,7 +321,7 @@ macro doCallToJavaScript(makeCall, doRet
+ 
+ .calleeFramePopped:
+     loadp Callee[cfr], temp3 # VM.topCallFrame
+-    loadp ScopeChain[cfr], temp4
++    loadp ScopeChain + PayloadOffset[cfr], temp4
+     storep temp4, [temp3]
+ 
+     doReturn(extraStackSpace)
+@@ -598,7 +598,7 @@ end
+ 
+ 
+ macro branchIfException(label)
+-    loadp ScopeChain[cfr], t3
++    loadp ScopeChain + PayloadOffset[cfr], t3
+     andp MarkedBlockMask, t3
+     loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
+     bieq VM::m_exception + TagOffset[t3], EmptyValueTag, .noException
+@@ -2039,7 +2039,7 @@ _llint_op_catch:
+     # the interpreter's throw trampoline (see _llint_throw_trampoline).
+     # The throwing code must have known that we were throwing to the interpreter,
+     # and have set VM::targetInterpreterPCForThrow.
+-    loadp ScopeChain[cfr], t3
++    loadp ScopeChain + PayloadOffset[cfr], t3
+     andp MarkedBlockMask, t3
+     loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
+     loadp VM::callFrameForThrow[t3], cfr
+@@ -2159,7 +2159,7 @@ macro nativeCallTrampoline(executableOff
+         andp MarkedBlockMask, t3
+         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
+     elsif C_LOOP
+-        loadp ScopeChain[cfr], t3
++        loadp ScopeChain + PayloadOffset[cfr], t3
+         andp MarkedBlockMask, t3
+         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
+         storep cfr, VM::topCallFrame[t3]
+@@ -2172,7 +2172,7 @@ macro nativeCallTrampoline(executableOff
+         move t2, cfr
+         cloopCallNative executableOffsetToFunction[t1]
+         restoreReturnAddressBeforeReturn(t3)
+-        loadp ScopeChain[cfr], t3
++        loadp ScopeChain + PayloadOffset[cfr], t3
+         andp MarkedBlockMask, t3
+         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
+     else
+@@ -2212,7 +2212,7 @@ macro resolveScope()
+     addi 1, t2
+ 
+ .resolveScopeAfterActivationCheck:
+-    loadp ScopeChain[cfr], t0
++    loadp ScopeChain + PayloadOffset[cfr], t0
+     btiz t2, .resolveScopeLoopEnd
+ 
+ .resolveScopeLoop:
+@@ -2271,13 +2271,13 @@ _llint_op_resolve_scope:
+ 
+ macro loadWithStructureCheck(operand, slowPath)
+     loadisFromInstruction(operand, t0)
+-    loadp [cfr, t0, 8], t0
++    loadp PayloadOffset[cfr, t0, 8], t0
+     loadpFromInstruction(5, t1)
+     bpneq JSCell::m_structure[t0], t1, slowPath
+ end
+ 
+ macro getProperty()
+-    loadisFromInstruction(6, t3)
++    loadpFromInstruction(6, t3)
+     loadPropertyAtVariableOffset(t3, t0, t1, t2)
+     valueProfile(t1, t2, 28, t0)
+     loadisFromInstruction(1, t0)
+@@ -2297,7 +2297,7 @@ end
+ 
+ macro getClosureVar()
+     loadp JSVariableObject::m_registers[t0], t0
+-    loadisFromInstruction(6, t3)
++    loadpFromInstruction(6, t3)
+     loadp TagOffset[t0, t3, 8], t1
+     loadp PayloadOffset[t0, t3, 8], t2
+     valueProfile(t1, t2, 28, t0)
+@@ -2356,7 +2356,7 @@ _llint_op_get_from_scope:
+ macro putProperty()
+     loadisFromInstruction(3, t1)
+     loadConstantOrVariable(t1, t2, t3)
+-    loadisFromInstruction(6, t1)
++    loadpFromInstruction(6, t1)
+     storePropertyAtVariableOffset(t1, t0, t2, t3)
+ end
+ 
+@@ -2374,7 +2374,7 @@ macro putClosureVar()
+     loadisFromInstruction(3, t1)
+     loadConstantOrVariable(t1, t2, t3)
+     loadp JSVariableObject::m_registers[t0], t0
+-    loadisFromInstruction(6, t1)
++    loadpFromInstruction(6, t1)
+     storei t2, TagOffset[t0, t1, 8]
+     storei t3, PayloadOffset[t0, t1, 8]
+ end
+diff -up webkitgtk-2.4.4/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm.cloop_fix webkitgtk-2.4.4/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+--- webkitgtk-2.4.4/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm.cloop_fix	2014-07-23 14:16:19.147675074 +0200
++++ webkitgtk-2.4.4/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	2014-07-23 14:16:46.997687779 +0200
+@@ -171,7 +171,7 @@ macro doCallToJavaScript(makeCall, doRet
+     storep temp3, CodeBlock[cfr, temp1, 8]
+     btinz temp1, .copyHeaderLoop
+ 
+-    loadi ProtoCallFrame::argCountAndCodeOriginValue[protoCallFrame], temp2
++    loadi PayloadOffset + ProtoCallFrame::argCountAndCodeOriginValue[protoCallFrame], temp2
+     subi 1, temp2
+     loadi ProtoCallFrame::paddedArgCount[protoCallFrame], temp3
+     subi 1, temp3
+@@ -2047,7 +2047,7 @@ macro loadWithStructureCheck(operand, sl
+ end
+ 
+ macro getProperty()
+-    loadisFromInstruction(6, t1)
++    loadpFromInstruction(6, t1)
+     loadPropertyAtVariableOffset(t1, t0, t2)
+     valueProfile(t2, 7, t0)
+     loadisFromInstruction(1, t0)
+@@ -2064,7 +2064,7 @@ end
+ 
+ macro getClosureVar()
+     loadp JSVariableObject::m_registers[t0], t0
+-    loadisFromInstruction(6, t1)
++    loadpFromInstruction(6, t1)
+     loadq [t0, t1, 8], t0
+     valueProfile(t0, 7, t1)
+     loadisFromInstruction(1, t1)
+@@ -2121,7 +2121,7 @@ _llint_op_get_from_scope:
+ macro putProperty()
+     loadisFromInstruction(3, t1)
+     loadConstantOrVariable(t1, t2)
+-    loadisFromInstruction(6, t1)
++    loadpFromInstruction(6, t1)
+     storePropertyAtVariableOffset(t1, t0, t2)
+ end
+ 
+@@ -2138,7 +2138,7 @@ macro putClosureVar()
+     loadisFromInstruction(3, t1)
+     loadConstantOrVariable(t1, t2)
+     loadp JSVariableObject::m_registers[t0], t0
+-    loadisFromInstruction(6, t1)
++    loadpFromInstruction(6, t1)
+     storeq t2, [t0, t1, 8]
+ end
+ 

webkitgtk-2.4.1-ppc64_align.patch

@@ -0,0 +1,45 @@
+diff -up webkitgtk-2.4.2/Source/JavaScriptCore/heap/CopiedBlock.h.ppc64_align webkitgtk-2.4.2/Source/JavaScriptCore/heap/CopiedBlock.h
+--- webkitgtk-2.4.2/Source/JavaScriptCore/heap/CopiedBlock.h.ppc64_align	2014-05-12 08:03:53.000000000 +0200
++++ webkitgtk-2.4.2/Source/JavaScriptCore/heap/CopiedBlock.h	2014-05-14 15:16:36.946318596 +0200
+@@ -81,7 +81,7 @@ public:
+     size_t size();
+     size_t capacity();
+ 
+-    static const size_t blockSize = 32 * KB;
++    static const size_t blockSize = 64 * KB;
+ 
+     bool hasWorkList();
+     CopyWorkList& workList();
+diff -up webkitgtk-2.4.2/Source/JavaScriptCore/interpreter/JSStack.cpp.ppc64_align webkitgtk-2.4.2/Source/JavaScriptCore/interpreter/JSStack.cpp
+--- webkitgtk-2.4.2/Source/JavaScriptCore/interpreter/JSStack.cpp.ppc64_align	2014-05-12 08:03:53.000000000 +0200
++++ webkitgtk-2.4.2/Source/JavaScriptCore/interpreter/JSStack.cpp	2014-05-14 15:17:35.617171141 +0200
+@@ -49,7 +49,8 @@ JSStack::JSStack(VM& vm, size_t capacity
+ {
+     ASSERT(capacity && isPageAligned(capacity));
+ 
+-    m_reservation = PageReservation::reserve(roundUpAllocationSize(capacity * sizeof(Register), commitSize), OSAllocator::JSVMStackPages);
++    size_t commitsize = pageSize();
++    m_reservation = PageReservation::reserve(roundUpAllocationSize(capacity * sizeof(Register), commitsize), OSAllocator::JSVMStackPages);
+     updateStackLimit(highAddress());
+     m_commitEnd = highAddress();
+ 
+@@ -78,7 +79,8 @@ bool JSStack::growSlowCase(Register* new
+     // Compute the chunk size of additional memory to commit, and see if we
+     // have it is still within our budget. If not, we'll fail to grow and
+     // return false.
+-    long delta = roundUpAllocationSize(reinterpret_cast<char*>(m_commitEnd) - reinterpret_cast<char*>(newEnd), commitSize);
++    size_t commitsize = pageSize();
++    long delta = roundUpAllocationSize(reinterpret_cast<char*>(m_commitEnd) - reinterpret_cast<char*>(newEnd), commitsize);
+     if (reinterpret_cast<char*>(m_commitEnd) - delta <= reinterpret_cast<char*>(m_useableEnd))
+         return false;
+ 
+@@ -134,7 +136,8 @@ void JSStack::enableErrorStackReserve()
+ 
+ void JSStack::disableErrorStackReserve()
+ {
+-    char* useableEnd = reinterpret_cast<char*>(reservationEnd()) + commitSize;
++    size_t commitsize = pageSize();
++    char* useableEnd = reinterpret_cast<char*>(reservationEnd()) + commitsize;
+     m_useableEnd = reinterpret_cast_ptr<Register*>(useableEnd);
+ 
+     // By the time we get here, we are guaranteed to be destructing the last

webkitgtk-2.4.5-cloop_fix_32.patch

@@ -0,0 +1,31 @@
+diff -up webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix_32 webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+--- webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix_32	2013-08-28 21:06:29.000000000 +0200
++++ webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	2013-09-12 15:32:34.000000000 +0200
+@@ -1679,7 +1679,7 @@ _llint_op_next_pname:
+     loadi 20[PC], t2
+     loadi PayloadOffset[cfr, t2, 8], t2
+     loadp JSPropertyNameIterator::m_jsStrings[t2], t3
+-    loadi [t3, t0, 8], t3
++    loadi PayloadOffset[t3, t0, 8], t3
+     addi 1, t0
+     storei t0, PayloadOffset[cfr, t1, 8]
+     loadi 4[PC], t1
+diff -up webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter.asm.cloop_fix_32 webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+--- webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter.asm.cloop_fix_32	2013-08-28 21:06:29.000000000 +0200
++++ webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter.asm	2013-09-12 15:32:34.000000000 +0200
+@@ -276,13 +276,13 @@ macro assertNotConstant(index)
+ end
+ 
+ macro functionForCallCodeBlockGetter(targetRegister)
+-    loadp Callee[cfr], targetRegister
++    loadp Callee + PayloadOffset[cfr], targetRegister
+     loadp JSFunction::m_executable[targetRegister], targetRegister
+     loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister
+ end
+ 
+ macro functionForConstructCodeBlockGetter(targetRegister)
+-    loadp Callee[cfr], targetRegister
++    loadp Callee + PayloadOffset[cfr], targetRegister
+     loadp JSFunction::m_executable[targetRegister], targetRegister
+     loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister
+ end

webkitgtk-2.4.9-sql_initialize_string.patch

@@ -0,0 +1,12 @@
+diff -up webkitgtk-2.4.9/Source/WebCore/platform/sql/SQLiteStatement.cpp.sql_initialize_string webkitgtk-2.4.9/Source/WebCore/platform/sql/SQLiteStatement.cpp
+--- webkitgtk-2.4.9/Source/WebCore/platform/sql/SQLiteStatement.cpp.sql_initialize_string	2015-09-14 09:25:43.004200172 +0200
++++ webkitgtk-2.4.9/Source/WebCore/platform/sql/SQLiteStatement.cpp	2015-09-14 09:25:57.852082368 +0200
+@@ -71,7 +71,7 @@ int SQLiteStatement::prepare()
+     // this lets SQLite avoid an extra string copy.
+     size_t lengthIncludingNullCharacter = query.length() + 1;
+ 
+-    const char* tail;
++    const char* tail = nullptr;
+     int error = sqlite3_prepare_v2(m_database.sqlite3Handle(), query.data(), lengthIncludingNullCharacter, &m_statement, &tail);
+ 
+     if (error != SQLITE_OK)

webkitgtk-aarch64.patch

@@ -0,0 +1,39 @@
+diff -up webkitgtk-2.4.9/Source/WTF/wtf/dtoa/utils.h.aarch64 webkitgtk-2.4.9/Source/WTF/wtf/dtoa/utils.h
+--- webkitgtk-2.4.9/Source/WTF/wtf/dtoa/utils.h.aarch64	2015-05-20 11:03:24.000000000 +0200
++++ webkitgtk-2.4.9/Source/WTF/wtf/dtoa/utils.h	2015-05-20 13:45:35.629023925 +0200
+@@ -49,7 +49,7 @@
+ defined(__ARMEL__) || \
+ defined(_MIPS_ARCH_MIPS32R2)
+ #define DOUBLE_CONVERSION_CORRECT_DOUBLE_OPERATIONS 1
+-#elif CPU(MIPS) || CPU(MIPS64) || CPU(PPC) || CPU(PPC64) || CPU(PPC64LE) || OS(WINCE) || CPU(SH4) || CPU(S390) || CPU(S390X) || CPU(IA64) || CPU(ALPHA) || CPU(ARM64) || CPU(HPPA)
++#elif CPU(MIPS) || CPU(MIPS64) || CPU(PPC) || CPU(PPC64) || CPU(PPC64LE) || OS(WINCE) || CPU(SH4) || CPU(S390) || CPU(S390X) || CPU(IA64) || CPU(ALPHA) || CPU(AARCH64) || CPU(HPPA)
+ #define DOUBLE_CONVERSION_CORRECT_DOUBLE_OPERATIONS 1
+ #elif defined(_M_IX86) || defined(__i386__)
+ #if defined(_WIN32)
+diff -up webkitgtk-2.4.9/Source/WTF/wtf/Platform.h.aarch64 webkitgtk-2.4.9/Source/WTF/wtf/Platform.h
+--- webkitgtk-2.4.9/Source/WTF/wtf/Platform.h.aarch64	2015-05-20 11:03:24.000000000 +0200
++++ webkitgtk-2.4.9/Source/WTF/wtf/Platform.h	2015-05-20 13:47:34.439861401 +0200
+@@ -334,6 +334,14 @@
+ #define WTF_CPU_NEEDS_ALIGNED_ACCESS 1
+ #endif
+ 
++/* CPU(AARCH64) - AArch64 */
++#if defined(__aarch64__)
++#define WTF_CPU_AARCH64 1
++#if defined(__AARCH64BE__)
++#define WTF_CPU_BIG_ENDIAN 1
++#endif
++#endif
++
+ /* ==== OS() - underlying operating system; only to be used for mandated low-level services like 
+    virtual memory, not to choose a GUI toolkit ==== */
+ 
+@@ -654,7 +662,7 @@
+ #if (CPU(X86_64) && (OS(UNIX) || OS(WINDOWS))) \
+     || (CPU(IA64) && !CPU(IA64_32)) \
+     || CPU(ALPHA) \
+-    || CPU(ARM64) \
++    || CPU(AARCH64) \
+     || CPU(S390X) \
+     || CPU(MIPS64) \
+     || CPU(PPC64) \