4 files changed, 492 insertions, 1 deletions

diff --git a/www/waterfox/Makefile b/www/waterfox/Makefile
index 6e74971a9cad..01fbddf5b23d 100644
--- a/www/waterfox/Makefile
+++ b/www/waterfox/Makefile
@@ -2,7 +2,7 @@
 
 PORTNAME=	waterfox
 DISTVERSION=	56.1.0
-PORTREVISION=	17
+PORTREVISION=	18
 CATEGORIES=	www ipv6
 
 MAINTAINER=	jbeich@FreeBSD.org
diff --git a/www/waterfox/files/patch-bug1426129 b/www/waterfox/files/patch-bug1426129
new file mode 100644
index 000000000000..9809f02d1c98
--- /dev/null
+++ b/www/waterfox/files/patch-bug1426129
@@ -0,0 +1,168 @@
+commit 2ad185b12fe3
+Author: Paul Adenot <paul@paul.cx>
+Date:   Mon Mar 5 20:24:16 2018 +0200
+
+    Bug 1426129 - Take a reference to `this` when calling methods asynchronously in CameraChild.cpp. r=pehrsons a=lizzard
+    
+    --HG--
+    extra : amend_source : bb0df026ffa8198485415c8c44fdb7df372f07ee
+---
+ dom/media/systemservices/CamerasChild.cpp | 33 ++++++++++++++++++-------------
+ dom/media/systemservices/CamerasChild.h   |  9 +++++++++
+ 2 files changed, 28 insertions(+), 14 deletions(-)
+
+diff --git dom/media/systemservices/CamerasChild.cpp dom/media/systemservices/CamerasChild.cpp
+index 594b90f808e4..79224b73cefa 100644
+--- dom/media/systemservices/CamerasChild.cpp
++++ dom/media/systemservices/CamerasChild.cpp
+@@ -34,7 +34,9 @@ CamerasSingleton::CamerasSingleton()
+   : mCamerasMutex("CamerasSingleton::mCamerasMutex"),
+     mCameras(nullptr),
+     mCamerasChildThread(nullptr),
+-    mFakeDeviceChangeEventThread(nullptr) {
++    mFakeDeviceChangeEventThread(nullptr),
++    mInShutdown(false)
++{
+   LOG(("CamerasSingleton: %p", this));
+ }
+ 
+@@ -291,7 +293,7 @@ CamerasChild::NumberOfCapabilities(CaptureEngine aCapEngine,
+   LOG(("NumberOfCapabilities for %s", deviceUniqueIdUTF8));
+   nsCString unique_id(deviceUniqueIdUTF8);
+   nsCOMPtr<nsIRunnable> runnable =
+-    mozilla::NewNonOwningRunnableMethod<CaptureEngine, nsCString>(
++    mozilla::NewRunnableMethod<CaptureEngine, nsCString>(
+       "camera::PCamerasChild::SendNumberOfCapabilities",
+       this,
+       &CamerasChild::SendNumberOfCapabilities,
+@@ -307,7 +309,7 @@ CamerasChild::NumberOfCaptureDevices(CaptureEngine aCapEngine)
+ {
+   LOG((__PRETTY_FUNCTION__));
+   nsCOMPtr<nsIRunnable> runnable =
+-    mozilla::NewNonOwningRunnableMethod<CaptureEngine>(
++    mozilla::NewRunnableMethod<CaptureEngine>(
+       "camera::PCamerasChild::SendNumberOfCaptureDevices",
+       this,
+       &CamerasChild::SendNumberOfCaptureDevices,
+@@ -334,7 +336,7 @@ CamerasChild::EnsureInitialized(CaptureEngine aCapEngine)
+ {
+   LOG((__PRETTY_FUNCTION__));
+   nsCOMPtr<nsIRunnable> runnable =
+-    mozilla::NewNonOwningRunnableMethod<CaptureEngine>(
++    mozilla::NewRunnableMethod<CaptureEngine>(
+       "camera::PCamerasChild::SendEnsureInitialized",
+       this,
+       &CamerasChild::SendEnsureInitialized,
+@@ -353,7 +355,7 @@ CamerasChild::GetCaptureCapability(CaptureEngine aCapEngine,
+   LOG(("GetCaptureCapability: %s %d", unique_idUTF8, capability_number));
+   nsCString unique_id(unique_idUTF8);
+   nsCOMPtr<nsIRunnable> runnable =
+-    mozilla::NewNonOwningRunnableMethod<CaptureEngine, nsCString, unsigned int>(
++    mozilla::NewRunnableMethod<CaptureEngine, nsCString, unsigned int>(
+       "camera::PCamerasChild::SendGetCaptureCapability",
+       this,
+       &CamerasChild::SendGetCaptureCapability,
+@@ -395,7 +397,7 @@ CamerasChild::GetCaptureDevice(CaptureEngine aCapEngine,
+ {
+   LOG((__PRETTY_FUNCTION__));
+   nsCOMPtr<nsIRunnable> runnable =
+-    mozilla::NewNonOwningRunnableMethod<CaptureEngine, unsigned int>(
++    mozilla::NewRunnableMethod<CaptureEngine, unsigned int>(
+       "camera::PCamerasChild::SendGetCaptureDevice",
+       this,
+       &CamerasChild::SendGetCaptureDevice,
+@@ -439,9 +441,9 @@ CamerasChild::AllocateCaptureDevice(CaptureEngine aCapEngine,
+   LOG((__PRETTY_FUNCTION__));
+   nsCString unique_id(unique_idUTF8);
+   nsCOMPtr<nsIRunnable> runnable =
+-    mozilla::NewNonOwningRunnableMethod<CaptureEngine,
+-                                        nsCString,
+-                                        const mozilla::ipc::PrincipalInfo&>(
++    mozilla::NewRunnableMethod<CaptureEngine,
++                               nsCString,
++                               const mozilla::ipc::PrincipalInfo&>(
+       "camera::PCamerasChild::SendAllocateCaptureDevice",
+       this,
+       &CamerasChild::SendAllocateCaptureDevice,
+@@ -475,7 +477,7 @@ CamerasChild::ReleaseCaptureDevice(CaptureEngine aCapEngine,
+ {
+   LOG((__PRETTY_FUNCTION__));
+   nsCOMPtr<nsIRunnable> runnable =
+-    mozilla::NewNonOwningRunnableMethod<CaptureEngine, int>(
++    mozilla::NewRunnableMethod<CaptureEngine, int>(
+       "camera::PCamerasChild::SendReleaseCaptureDevice",
+       this,
+       &CamerasChild::SendReleaseCaptureDevice,
+@@ -526,7 +528,7 @@ CamerasChild::StartCapture(CaptureEngine aCapEngine,
+                            webrtcCaps.codecType,
+                            webrtcCaps.interlaced);
+   nsCOMPtr<nsIRunnable> runnable = mozilla::
+-    NewNonOwningRunnableMethod<CaptureEngine, int, VideoCaptureCapability>(
++    NewRunnableMethod<CaptureEngine, int, VideoCaptureCapability>(
+       "camera::PCamerasChild::SendStartCapture",
+       this,
+       &CamerasChild::SendStartCapture,
+@@ -542,7 +544,7 @@ CamerasChild::StopCapture(CaptureEngine aCapEngine, const int capture_id)
+ {
+   LOG((__PRETTY_FUNCTION__));
+   nsCOMPtr<nsIRunnable> runnable =
+-    mozilla::NewNonOwningRunnableMethod<CaptureEngine, int>(
++    mozilla::NewRunnableMethod<CaptureEngine, int>(
+       "camera::PCamerasChild::SendStopCapture",
+       this,
+       &CamerasChild::SendStopCapture,
+@@ -559,6 +561,9 @@ void
+ Shutdown(void)
+ {
+   OffTheBooksMutexAutoLock lock(CamerasSingleton::Mutex());
++
++  CamerasSingleton::StartShutdown();
++
+   CamerasChild* child = CamerasSingleton::Child();
+   if (!child) {
+     // We don't want to cause everything to get fired up if we're
+@@ -610,7 +615,7 @@ CamerasChild::ShutdownParent()
+     // Delete the parent actor.
+     // CamerasChild (this) will remain alive and is only deleted by the
+     // IPC layer when SendAllDone returns.
+-    nsCOMPtr<nsIRunnable> deleteRunnable = mozilla::NewNonOwningRunnableMethod(
++    nsCOMPtr<nsIRunnable> deleteRunnable = mozilla::NewRunnableMethod(
+       "camera::PCamerasChild::SendAllDone", this, &CamerasChild::SendAllDone);
+     CamerasSingleton::Thread()->Dispatch(deleteRunnable, NS_DISPATCH_NORMAL);
+   } else {
+@@ -733,7 +738,7 @@ CamerasChild::~CamerasChild()
+ {
+   LOG(("~CamerasChild: %p", this));
+ 
+-  {
++  if (!CamerasSingleton::InShutdown()) {
+     OffTheBooksMutexAutoLock lock(CamerasSingleton::Mutex());
+     // In normal circumstances we've already shut down and the
+     // following does nothing. But on fatal IPC errors we will
+diff --git dom/media/systemservices/CamerasChild.h dom/media/systemservices/CamerasChild.h
+index b2029dbd6b9d..620c409b656f 100644
+--- dom/media/systemservices/CamerasChild.h
++++ dom/media/systemservices/CamerasChild.h
+@@ -93,6 +93,14 @@ public:
+     return gTheInstance.get()->mFakeDeviceChangeEventThread;
+   }
+ 
++  static bool InShutdown() {
++    return gTheInstance.get()->mInShutdown;
++  }
++
++  static void StartShutdown() {
++    gTheInstance.get()->mInShutdown = true;
++  }
++
+ private:
+   static Singleton<CamerasSingleton> gTheInstance;
+ 
+@@ -110,6 +118,7 @@ private:
+   CamerasChild* mCameras;
+   nsCOMPtr<nsIThread> mCamerasChildThread;
+   nsCOMPtr<nsIThread> mFakeDeviceChangeEventThread;
++  Atomic<bool> mInShutdown;
+ };
+ 
+ // Get a pointer to a CamerasChild object we can use to do IPC with.
diff --git a/www/waterfox/files/patch-bug1452619 b/www/waterfox/files/patch-bug1452619
new file mode 100644
index 000000000000..f86ea111b1f3
--- /dev/null
+++ b/www/waterfox/files/patch-bug1452619
@@ -0,0 +1,234 @@
+commit d2a37cf6d599
+Author: Jeff Walden <jwalden@mit.edu>
+Date:   Mon Apr 9 12:02:43 2018 -0700
+
+    Bug 1452619 - Implement mozilla::IsAsciiAlpha. r=froydnj, a=lizzard
+---
+ js/src/jsstr.h               |   3 +-
+ mfbt/TextUtils.h             |  58 +++++++++++++++++++++++
+ mfbt/moz.build               |   1 +
+ mfbt/tests/TestTextUtils.cpp | 106 +++++++++++++++++++++++++++++++++++++++++++
+ mfbt/tests/moz.build         |   1 +
+ 5 files changed, 168 insertions(+), 1 deletion(-)
+
+diff --git js/src/jsstr.h js/src/jsstr.h
+index 3b92aa21b344..7e9621d4a265 100644
+--- js/src/jsstr.h
++++ js/src/jsstr.h
+@@ -9,6 +9,7 @@
+ 
+ #include "mozilla/HashFunctions.h"
+ #include "mozilla/PodOperations.h"
++#include "mozilla/TextUtils.h"
+ 
+ #include <stdio.h>
+ 
+@@ -95,7 +96,7 @@ struct JSSubString {
+ #define JS7_UNOCT(c)    (JS7_UNDEC(c))
+ #define JS7_ISHEX(c)    ((c) < 128 && isxdigit(c))
+ #define JS7_UNHEX(c)    (unsigned)(JS7_ISDEC(c) ? (c) - '0' : 10 + tolower(c) - 'a')
+-#define JS7_ISLET(c)    ((c) < 128 && isalpha(c))
++#define JS7_ISLET(c)    (mozilla::IsAsciiAlpha(c))
+ 
+ extern size_t
+ js_strlen(const char16_t* s);
+diff --git mfbt/TextUtils.h mfbt/TextUtils.h
+new file mode 100644
+index 000000000000..9494296ce1fc
+--- /dev/null
++++ mfbt/TextUtils.h
+@@ -0,0 +1,58 @@
++/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* vim: set ts=8 sts=2 et sw=2 tw=80: */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++/* Character/text operations. */
++
++#ifndef mozilla_TextUtils_h
++#define mozilla_TextUtils_h
++
++#include "mozilla/TypeTraits.h"
++
++namespace mozilla {
++
++namespace detail {
++
++template<typename Char>
++class MakeUnsignedChar
++  : public MakeUnsigned<Char>
++{};
++
++template<>
++class MakeUnsignedChar<char16_t>
++{
++public:
++  using Type = char16_t;
++};
++
++template<>
++class MakeUnsignedChar<char32_t>
++{
++public:
++  using Type = char32_t;
++};
++
++} // namespace detail
++
++/**
++ * Returns true iff |aChar| matches [a-zA-Z].
++ *
++ * This function is basically what you thought isalpha was, except its behavior
++ * doesn't depend on the user's current locale.
++ */
++template<typename Char>
++constexpr bool
++IsAsciiAlpha(Char aChar)
++{
++  using UnsignedChar = typename detail::MakeUnsignedChar<Char>::Type;
++  return ('a' <= static_cast<UnsignedChar>(aChar) &&
++          static_cast<UnsignedChar>(aChar) <= 'z') ||
++         ('A' <= static_cast<UnsignedChar>(aChar) &&
++          static_cast<UnsignedChar>(aChar) <= 'Z');
++}
++
++} // namespace mozilla
++
++#endif /* mozilla_TextUtils_h */
+diff --git mfbt/moz.build mfbt/moz.build
+index f23a3b6f5d86..897a686f48dd 100644
+--- mfbt/moz.build
++++ mfbt/moz.build
+@@ -87,6 +87,7 @@ EXPORTS.mozilla = [
+     'StaticAnalysisFunctions.h',
+     'TaggedAnonymousMemory.h',
+     'TemplateLib.h',
++    'TextUtils.h',
+     'ThreadLocal.h',
+     'ToString.h',
+     'Tuple.h',
+diff --git mfbt/tests/TestTextUtils.cpp mfbt/tests/TestTextUtils.cpp
+new file mode 100644
+index 000000000000..db481c1389a1
+--- /dev/null
++++ mfbt/tests/TestTextUtils.cpp
+@@ -0,0 +1,106 @@
++/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* vim: set ts=8 sts=2 et sw=2 tw=80: */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
++ * You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++#include "mozilla/Assertions.h"
++#include "mozilla/TextUtils.h"
++
++using mozilla::IsAsciiAlpha;
++
++// char
++
++static_assert(!IsAsciiAlpha('@'), "'@' isn't ASCII alpha");
++static_assert('@' == 0x40, "'@' has value 0x40");
++
++static_assert('A' == 0x41, "'A' has value 0x41");
++static_assert(IsAsciiAlpha('A'), "'A' is ASCII alpha");
++static_assert(IsAsciiAlpha('B'), "'B' is ASCII alpha");
++static_assert(IsAsciiAlpha('M'), "'M' is ASCII alpha");
++static_assert(IsAsciiAlpha('Y'), "'Y' is ASCII alpha");
++static_assert(IsAsciiAlpha('Z'), "'Z' is ASCII alpha");
++
++static_assert('Z' == 0x5A, "'Z' has value 0x5A");
++static_assert('[' == 0x5B, "'[' has value 0x5B");
++static_assert(!IsAsciiAlpha('['), "'[' isn't ASCII alpha");
++
++static_assert(!IsAsciiAlpha('`'), "'`' isn't ASCII alpha");
++static_assert('`' == 0x60, "'`' has value 0x60");
++
++static_assert('a' == 0x61, "'a' has value 0x61");
++static_assert(IsAsciiAlpha('a'), "'a' is ASCII alpha");
++static_assert(IsAsciiAlpha('b'), "'b' is ASCII alpha");
++static_assert(IsAsciiAlpha('m'), "'m' is ASCII alpha");
++static_assert(IsAsciiAlpha('y'), "'y' is ASCII alpha");
++static_assert(IsAsciiAlpha('z'), "'z' is ASCII alpha");
++
++static_assert('z' == 0x7A, "'z' has value 0x7A");
++static_assert('{' == 0x7B, "'{' has value 0x7B");
++static_assert(!IsAsciiAlpha('{'), "'{' isn't ASCII alpha");
++
++// char16_t
++
++static_assert(!IsAsciiAlpha(u'@'), "u'@' isn't ASCII alpha");
++static_assert(u'@' == 0x40, "u'@' has value 0x40");
++
++static_assert(u'A' == 0x41, "u'A' has value 0x41");
++static_assert(IsAsciiAlpha(u'A'), "u'A' is ASCII alpha");
++static_assert(IsAsciiAlpha(u'B'), "u'B' is ASCII alpha");
++static_assert(IsAsciiAlpha(u'M'), "u'M' is ASCII alpha");
++static_assert(IsAsciiAlpha(u'Y'), "u'Y' is ASCII alpha");
++static_assert(IsAsciiAlpha(u'Z'), "u'Z' is ASCII alpha");
++
++static_assert(u'Z' == 0x5A, "u'Z' has value 0x5A");
++static_assert(u'[' == 0x5B, "u'[' has value 0x5B");
++static_assert(!IsAsciiAlpha(u'['), "u'[' isn't ASCII alpha");
++
++static_assert(!IsAsciiAlpha(u'`'), "u'`' isn't ASCII alpha");
++static_assert(u'`' == 0x60, "u'`' has value 0x60");
++
++static_assert(u'a' == 0x61, "u'a' has value 0x61");
++static_assert(IsAsciiAlpha(u'a'), "u'a' is ASCII alpha");
++static_assert(IsAsciiAlpha(u'b'), "u'b' is ASCII alpha");
++static_assert(IsAsciiAlpha(u'm'), "u'm' is ASCII alpha");
++static_assert(IsAsciiAlpha(u'y'), "u'y' is ASCII alpha");
++static_assert(IsAsciiAlpha(u'z'), "u'z' is ASCII alpha");
++
++static_assert(u'z' == 0x7A, "u'z' has value 0x7A");
++static_assert(u'{' == 0x7B, "u'{' has value 0x7B");
++static_assert(!IsAsciiAlpha(u'{'), "u'{' isn't ASCII alpha");
++
++// char32_t
++
++static_assert(!IsAsciiAlpha(U'@'), "U'@' isn't ASCII alpha");
++static_assert(U'@' == 0x40, "U'@' has value 0x40");
++
++static_assert(U'A' == 0x41, "U'A' has value 0x41");
++static_assert(IsAsciiAlpha(U'A'), "U'A' is ASCII alpha");
++static_assert(IsAsciiAlpha(U'B'), "U'B' is ASCII alpha");
++static_assert(IsAsciiAlpha(U'M'), "U'M' is ASCII alpha");
++static_assert(IsAsciiAlpha(U'Y'), "U'Y' is ASCII alpha");
++static_assert(IsAsciiAlpha(U'Z'), "U'Z' is ASCII alpha");
++
++static_assert(U'Z' == 0x5A, "U'Z' has value 0x5A");
++static_assert(U'[' == 0x5B, "U'[' has value 0x5B");
++static_assert(!IsAsciiAlpha(U'['), "U'[' isn't ASCII alpha");
++
++static_assert(!IsAsciiAlpha(U'`'), "U'`' isn't ASCII alpha");
++static_assert(U'`' == 0x60, "U'`' has value 0x60");
++
++static_assert(U'a' == 0x61, "U'a' has value 0x61");
++static_assert(IsAsciiAlpha(U'a'), "U'a' is ASCII alpha");
++static_assert(IsAsciiAlpha(U'b'), "U'b' is ASCII alpha");
++static_assert(IsAsciiAlpha(U'm'), "U'm' is ASCII alpha");
++static_assert(IsAsciiAlpha(U'y'), "U'y' is ASCII alpha");
++static_assert(IsAsciiAlpha(U'z'), "U'z' is ASCII alpha");
++
++static_assert(U'z' == 0x7A, "U'z' has value 0x7A");
++static_assert(U'{' == 0x7B, "U'{' has value 0x7B");
++static_assert(!IsAsciiAlpha(U'{'), "U'{' isn't ASCII alpha");
++
++int
++main()
++{
++  return 0;
++}
+diff --git mfbt/tests/moz.build mfbt/tests/moz.build
+index f96117e038d9..bd25ab1d0b0d 100644
+--- mfbt/tests/moz.build
++++ mfbt/tests/moz.build
+@@ -42,6 +42,7 @@ CppUnitTests([
+     'TestSHA1',
+     'TestSplayTree',
+     'TestTemplateLib',
++    'TestTextUtils',
+     'TestTuple',
+     'TestTypedEnum',
+     'TestTypeTraits',
diff --git a/www/waterfox/files/patch-bug1454692 b/www/waterfox/files/patch-bug1454692
new file mode 100644
index 000000000000..b25232580059
--- /dev/null
+++ b/www/waterfox/files/patch-bug1454692
@@ -0,0 +1,89 @@
+commit 0ce659a05fd3
+Author: Lee Salzman <lsalzman@mozilla.com>
+Date:   Sun Apr 29 20:10:51 2018 -0400
+
+    Bug 1454692 - Backport some upstream Skia fixes to ESR52. r=rhunt, a=abillings
+    
+    --HG--
+    extra : histedit_source : 0fcd64cabe6f54a2286083d6518e4e6451183a19%2C37f5e7f9dbbfc01102631c33b23329d2af5aa71b
+---
+ gfx/skia/skia/src/core/SkMask.cpp                          | 7 ++++++-
+ gfx/skia/skia/src/gpu/GrBufferAllocPool.cpp                | 5 +++--
+ gfx/skia/skia/src/gpu/batches/GrAAHairLinePathRenderer.cpp | 9 ++++++++-
+ 3 files changed, 17 insertions(+), 4 deletions(-)
+
+diff --git gfx/skia/skia/src/core/SkMask.cpp gfx/skia/skia/src/core/SkMask.cpp
+index 167d30d166b1..2a74cf4b2463 100644
+--- gfx/skia/skia/src/core/SkMask.cpp
++++ gfx/skia/skia/src/core/SkMask.cpp
+@@ -45,7 +45,12 @@ uint8_t* SkMask::AllocImage(size_t size) {
+ #ifdef TRACK_SKMASK_LIFETIME
+     SkDebugf("SkMask::AllocImage %d\n", gCounter++);
+ #endif
+-    return (uint8_t*)sk_malloc_throw(SkAlign4(size));
++    size_t aligned_size = std::numeric_limits<size_t>::max();
++    size_t adjustment = 3;
++    if (size + adjustment > size) {
++        aligned_size = (size + adjustment) & ~adjustment;
++    }
++    return static_cast<uint8_t*>(sk_malloc_throw(aligned_size));
+ }
+ 
+ /** We explicitly use this allocator for SkBimap pixels, so that we can
+diff --git gfx/skia/skia/src/gpu/GrBufferAllocPool.cpp gfx/skia/skia/src/gpu/GrBufferAllocPool.cpp
+index 38bde0dc9a38..1556d2e27971 100644
+--- gfx/skia/skia/src/gpu/GrBufferAllocPool.cpp
++++ gfx/skia/skia/src/gpu/GrBufferAllocPool.cpp
+@@ -14,6 +14,7 @@
+ #include "GrResourceProvider.h"
+ #include "GrTypes.h"
+ 
++#include "SkSafeMath.h"
+ #include "SkTraceEvent.h"
+ 
+ #ifdef SK_DEBUG
+@@ -335,7 +336,7 @@ void* GrVertexBufferAllocPool::makeSpace(size_t vertexSize,
+     SkASSERT(startVertex);
+ 
+     size_t offset SK_INIT_TO_AVOID_WARNING;
+-    void* ptr = INHERITED::makeSpace(vertexSize * vertexCount,
++    void* ptr = INHERITED::makeSpace(SkSafeMath::Mul(vertexSize, vertexCount),
+                                      vertexSize,
+                                      buffer,
+                                      &offset);
+@@ -360,7 +361,7 @@ void* GrIndexBufferAllocPool::makeSpace(int indexCount,
+     SkASSERT(startIndex);
+ 
+     size_t offset SK_INIT_TO_AVOID_WARNING;
+-    void* ptr = INHERITED::makeSpace(indexCount * sizeof(uint16_t),
++    void* ptr = INHERITED::makeSpace(SkSafeMath::Mul(indexCount, sizeof(uint16_t)),
+                                      sizeof(uint16_t),
+                                      buffer,
+                                      &offset);
+diff --git gfx/skia/skia/src/gpu/ops/GrAAHairLinePathRenderer.cpp gfx/skia/skia/src/gpu/ops/GrAAHairLinePathRenderer.cpp
+index 274e30846571..3879fe3fcbba 100644
+--- gfx/skia/skia/src/gpu/ops/GrAAHairLinePathRenderer.cpp
++++ gfx/skia/skia/src/gpu/ops/GrAAHairLinePathRenderer.cpp
+@@ -823,6 +823,13 @@ void AAHairlineOp::onPrepareDraws(Target* target) const {
+ 
+     int lineCount = lines.count() / 2;
+     int conicCount = conics.count() / 3;
++    int quadAndConicCount = conicCount + quadCount;
++
++    static constexpr int kMaxLines = SK_MaxS32 / kLineSegNumVertices;
++    static constexpr int kMaxQuadsAndConics = SK_MaxS32 / kQuadNumVertices;
++    if (lineCount > kMaxLines || quadAndConicCount > kMaxQuadsAndConics) {
++        return;
++    }
+ 
+     // do lines first
+     if (lineCount) {
+@@ -893,7 +900,7 @@ void AAHairlineOp::onPrepareDraws(Target* target) const {
+             ref_quads_index_buffer(target->resourceProvider()));
+ 
+         size_t vertexStride = sizeof(BezierVertex);
+-        int vertexCount = kQuadNumVertices * quadCount + kQuadNumVertices * conicCount;
++        int vertexCount = kQuadNumVertices * quadAndConicCount;
+         void *vertices = target->makeVertexSpace(vertexStride, vertexCount,
+                                                  &vertexBuffer, &firstVertex);
+