Issue #1693 - Update NSS to 3.59.1.1

This updates to MoonchildProductions/NSS@bd49b2b88 in the repo created for our
consumption of the library.

9 files changed, 110 insertions, 25 deletions

diff --git a/security/nss/coreconf/Linux.mk b/security/nss/coreconf/Linux.mk
index 854d3ca96..956f0e4a9 100644
--- a/security/nss/coreconf/Linux.mk
+++ b/security/nss/coreconf/Linux.mk
@@ -21,7 +21,7 @@ ifeq ($(USE_PTHREADS),1)
 endif
 
 DEFAULT_COMPILER = gcc
-DEFINES += -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE
+DEFINES += -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE -DSQL_MEASURE_USE_TEMP_DIR
 
 ifeq ($(OS_TARGET),Android)
 ifndef ANDROID_NDK
diff --git a/security/nss/coreconf/README b/security/nss/coreconf/README
index 4b1e410cb..17810bdec 100644
--- a/security/nss/coreconf/README
+++ b/security/nss/coreconf/README
@@ -291,6 +291,13 @@ OVERVIEW of "rules.mk":
         CATEGORY/rule::         Purpose
         ===================     =======================================
 
+        $(PUBLIC_EXPORT_DIR)::            create directory used to
+                                          house public "C" header files
+
+        $(PRIVATE_EXPORT_DIR)::           create directory used to
+                                          house private "C" header
+                                          files
+
         GENERAL
         -------
         all::                   "default" all-encompassing rule which
@@ -517,13 +524,6 @@ OVERVIEW of "rules.mk":
         CATEGORY/rule::                   Purpose
         ===================               =============================
 
-        $(PUBLIC_EXPORT_DIR)::            create directory used to
-                                          house public "C" header files
-
-        $(PRIVATE_EXPORT_DIR)::           create directory used to
-                                          house private "C" header
-                                          files
-
         $(SOURCE_XP_DIR)/
         release/include::                 create directory used to
                                           house "C" header files
diff --git a/security/nss/coreconf/SunOS5.mk b/security/nss/coreconf/SunOS5.mk
index 08956ca24..844b622b3 100644
--- a/security/nss/coreconf/SunOS5.mk
+++ b/security/nss/coreconf/SunOS5.mk
@@ -35,6 +35,7 @@ DEFAULT_COMPILER = cc
 ifdef NS_USE_GCC
 	CC         = gcc
 	OS_CFLAGS += -Wall -Wno-format -Werror-implicit-function-declaration -Wno-switch
+	OS_CFLAGS += -D__EXTENSIONS__
 	CCC        = g++
 	CCC       += -Wall -Wno-format
 	ASFLAGS	  += -x assembler-with-cpp
@@ -65,7 +66,7 @@ endif
 
 RANLIB      = echo
 CPU_ARCH    = sparc
-OS_DEFINES += -DSVR4 -DSYSV -D__svr4 -D__svr4__ -DSOLARIS -D_REENTRANT -D__EXTENSIONS__
+OS_DEFINES += -DSVR4 -DSYSV -D__svr4 -D__svr4__ -DSOLARIS -D_REENTRANT
 
 ifeq ($(OS_TEST),i86pc)
 ifeq ($(USE_64),1)
diff --git a/security/nss/coreconf/arch.mk b/security/nss/coreconf/arch.mk
index 79e56d510..2012d1879 100644
--- a/security/nss/coreconf/arch.mk
+++ b/security/nss/coreconf/arch.mk
@@ -10,7 +10,7 @@
 # OS_TEST	(from uname -m)
 # OS_RELEASE	(from uname -v and/or -r)
 # OS_TARGET	User defined, or set to OS_ARCH
-# CPU_ARCH  	(from unmame -m or -p, ONLY on WINNT)
+# CPU_ARCH  	(from uname -m or -p, ONLY on WINNT)
 # OS_CONFIG	OS_TARGET + OS_RELEASE
 # OBJDIR_TAG    (uses GCOV_TAG, 64BIT_TAG)
 # OBJDIR_NAME
@@ -116,6 +116,7 @@ ifeq ($(OS_ARCH),Linux)
 	OS_RELEASE := $(word 1,$(OS_RELEASE)).$(word 2,$(OS_RELEASE))
     endif
     KERNEL = Linux
+    include $(CORE_DEPTH)/coreconf/Linux.mk
 endif
 
 # Since all uses of OS_ARCH that follow affect only userland, we can
diff --git a/security/nss/coreconf/config.gypi b/security/nss/coreconf/config.gypi
index adb344e79..cbcdf4c13 100644
--- a/security/nss/coreconf/config.gypi
+++ b/security/nss/coreconf/config.gypi
@@ -12,7 +12,7 @@
         # chromium uses pymod_do_main, but gyp doesn't set a sensible
         # Python sys.path (gyp_chromium does).
         'python%': '<(python)',
-        'host_arch%': '<!(<(python) <(DEPTH)/coreconf/detect_host_arch.py)',
+        'host_arch%': '<!("<(python)" <(DEPTH)/coreconf/detect_host_arch.py)',
       },
       'python%': '<(python)',
       'host_arch%': '<(host_arch)',
@@ -37,7 +37,7 @@
         },{
           'use_system_sqlite%': 0,
         }],
-        ['OS=="mac" or OS=="ios" or OS=="win"', {
+        ['OS=="mac" or OS=="ios" or OS=="solaris" or OS=="win"', {
           'cc_use_gnu_ld%': 0,
         }, {
           'cc_use_gnu_ld%': 1,
@@ -66,12 +66,12 @@
           ],
         }],
         ['"<(GENERATOR)"=="ninja"', {
-          'cc_is_clang%': '<!(<(python) <(DEPTH)/coreconf/check_cc.py clang)',
+          'cc_is_clang%': '<!("<(python)" <(DEPTH)/coreconf/check_cc.py clang)',
         }, {
           'cc_is_clang%': '0',
         }],
         ['"<(GENERATOR)"=="ninja"', {
-          'cc_is_gcc%': '<!(<(python) <(DEPTH)/coreconf/check_cc.py gcc)',
+          'cc_is_gcc%': '<!("<(python)" <(DEPTH)/coreconf/check_cc.py gcc)',
         }, {
           'cc_is_gcc%': '0',
         }],
@@ -97,11 +97,17 @@
     'cc_use_gnu_ld%': '<(cc_use_gnu_ld)',
     # Some defaults
     'disable_arm_hw_aes%': 0,
+    'disable_arm_hw_sha1%': 0,
+    'disable_arm_hw_sha2%': 0,
     'disable_tests%': 0,
     'disable_chachapoly%': 0,
-    'disable_dbm%': 0,
+    'disable_deprecated_seed%': 0,
+    'disable_deprecated_rc2%': 0,
+    'disable_dbm%': 1,
     'disable_libpkix%': 1,
     'disable_werror%': 0,
+    'disable_altivec%': 0,
+    'disable_arm32_neon%': 0,
     'mozilla_client%': 0,
     'comm_client%': 0,
     'moz_fold_libs%': 0,
@@ -124,6 +130,9 @@
     'only_dev_random%': 1,
     'disable_fips%': 1,
     'mozpkix_only%': 0,
+    'coverage%': 0,
+    'softfp_cflags%': '',
+    'enable_draft_hpke%': 0,
   },
   'target_defaults': {
     # Settings specific to targets should go here.
@@ -198,7 +207,7 @@
           },
         },
       }],
-      [ 'target_arch=="arm64" or target_arch=="aarch64" or target_arch=="sparc64" or target_arch=="ppc64" or target_arch=="ppc64le" or target_arch=="s390x" or target_arch=="mips64"', {
+      [ 'target_arch=="arm64" or target_arch=="aarch64" or target_arch=="sparc64" or target_arch=="ppc64" or target_arch=="ppc64le" or target_arch=="s390x" or target_arch=="mips64" or target_arch=="e2k"', {
         'defines': [
           'NSS_USE_64',
         ],
@@ -358,6 +367,7 @@
               '_DEFAULT_SOURCE', # for <endian.h> functions, strdup, realpath, and getentropy
               '_BSD_SOURCE', # for the above in glibc <= 2.19
               '_POSIX_SOURCE', # for <signal.h>
+              'SQL_MEASURE_USE_TEMP_DIR', # use tmpdir for the access calls
             ],
           }],
           [ 'OS=="dragonfly" or OS=="freebsd"', {
@@ -387,6 +397,11 @@
               '_REENTRANT',
             ],
           }],
+          [ 'OS!="mac" and OS!="ios" and OS!="solaris" and OS!="win"', {
+            'ldflags': [
+              '-z', 'noexecstack',
+            ],
+          }],
           [ 'OS!="mac" and OS!="ios" and OS!="win"', {
             'cflags': [
               '-fPIC',
@@ -400,9 +415,6 @@
             'cflags_cc': [
               '-std=c++11',
             ],
-            'ldflags': [
-              '-z', 'noexecstack',
-            ],
             'conditions': [
               [ 'target_arch=="ia32"', {
                 'cflags': ['-m32'],
@@ -432,11 +444,11 @@
           }],
           [ 'disable_werror==0 and OS!="android" and OS!="win"', {
             'cflags': [
-              '<!@(<(python) <(DEPTH)/coreconf/werror.py)',
+              '<!@("<(python)" <(DEPTH)/coreconf/werror.py)',
             ],
             'xcode_settings': {
               'OTHER_CFLAGS': [
-                '<!@(<(python) <(DEPTH)/coreconf/werror.py)',
+                '<!@("<(python)" <(DEPTH)/coreconf/werror.py)',
               ],
             },
           }],
@@ -559,11 +571,26 @@
               'NSS_DISABLE_DBM',
             ],
           }],
+          [ 'enable_draft_hpke==1', {
+            'defines': [
+              'NSS_ENABLE_DRAFT_HPKE',
+            ],
+          }],
           [ 'disable_libpkix==1', {
             'defines': [
               'NSS_DISABLE_LIBPKIX',
             ],
           }],
+          [ 'disable_deprecated_seed==1', {
+            'defines': [
+              'NSS_DISABLE_DEPRECATED_SEED',
+            ],
+          }],
+          [ 'disable_deprecated_rc2==1', {
+            'defines': [
+              'NSS_DISABLE_DEPRECATED_RC2',
+            ],
+          }],
         ],
       },
       # Common settings for debug should go here.
@@ -590,9 +617,11 @@
             'Optimization': '<(debug_optimization_level)',
             'BasicRuntimeChecks': '3',
             'RuntimeLibrary': '2', # /MD
+            'DebugInformationFormat': '3',
           },
           'VCLinkerTool': {
             'LinkIncremental': '1',
+            'GenerateDebugInformation' : 'true',
           },
           'VCResourceCompilerTool': {
             'PreprocessorDefinitions': ['DEBUG'],
@@ -635,7 +664,7 @@
     },
   },
   'conditions': [
-    [ 'cc_use_gnu_ld==1', {
+    [ 'cc_use_gnu_ld==1 or OS=="solaris"', {
       'variables': {
         'process_map_file': ['/bin/sh', '-c', '/usr/bin/env grep -v ";-" >(mapfile) | sed -e "s,;+,," -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,;," > >@(_outputs)'],
       },
diff --git a/security/nss/coreconf/config.mk b/security/nss/coreconf/config.mk
index 60a08411e..f071dab36 100644
--- a/security/nss/coreconf/config.mk
+++ b/security/nss/coreconf/config.mk
@@ -137,6 +137,33 @@ include $(CORE_DEPTH)/coreconf/ruleset.mk
 endif
 
 #######################################################################
+# Master "Core Components" macros for Hardware features               #
+#######################################################################
+ifndef NSS_DISABLE_AVX2
+    ifneq ($(CPU_ARCH),x86_64)
+        # Disable AVX2 entirely on non-Intel platforms
+        NSS_DISABLE_AVX2 = 1
+        $(warning CPU_ARCH is not x86_64, disabling -mavx2)
+    else
+        # Clang reports its version as an older gcc, but it's OK
+        ifndef CC_IS_CLANG
+            ifneq (,$(filter 0 1 2 3,$(word 1,$(GCC_VERSION))))
+                NSS_DISABLE_AVX2 = 1
+            endif
+            ifeq (4,$(word 1,$(GCC_VERSION)))
+                ifeq (,$(filter 8 9,$(word 2,$(GCC_VERSION))))
+                    NSS_DISABLE_AVX2 = 1
+                endif
+            endif
+        endif
+        ifeq (1,$(NSS_DISABLE_AVX2))
+            $(warning Unable to find gcc 4.8 or greater, disabling -mavx2)
+            export NSS_DISABLE_AVX2
+        endif
+    endif
+endif #ndef NSS_DISABLE_AVX2
+
+#######################################################################
 # [15.0] Dependencies.
 #######################################################################
 
@@ -162,14 +189,30 @@ ifdef NSS_DISABLE_DBM
 DEFINES += -DNSS_DISABLE_DBM
 endif
 
+ifdef NSS_DISABLE_AVX2
+DEFINES += -DNSS_DISABLE_AVX2
+endif
+
 ifdef NSS_DISABLE_CHACHAPOLY
 DEFINES += -DNSS_DISABLE_CHACHAPOLY
 endif
 
+ifdef NSS_DISABLE_DEPRECATED_SEED
+DEFINES += -DNSS_DISABLE_DEPRECATED_SEED
+endif
+
+ifdef NSS_DISABLE_DEPRECATED_RC2
+DEFINES += -DNSS_DISABLE_DEPRECATED_RC2
+endif
+
 ifdef NSS_PKIX_NO_LDAP
 DEFINES += -DNSS_PKIX_NO_LDAP
 endif
 
+ifdef NSS_ENABLE_DRAFT_HPKE
+DEFINES += -DNSS_ENABLE_DRAFT_HPKE
+endif
+
 # FIPS support requires startup tests to be executed at load time of shared modules.
 # For performance reasons, these tests are disabled by default.
 # When compiling binaries that must support FIPS mode,
@@ -196,6 +239,16 @@ DEFINES += -DPKIX_OBJECT_LEAK_TEST
 endif
 endif
 
+# Avoid building with Neon acceleration on Arm32
+ifdef NSS_DISABLE_ARM32_NEON
+DEFINES += -DNSS_DISABLE_ARM32_NEON
+endif
+
+# Avoid building with PowerPC's Altivec acceleration
+ifdef NSS_DISABLE_ALTIVEC
+DEFINES += -DNSS_DISABLE_ALTIVEC
+endif
+
 # This allows all library and tools code to use the util function
 # implementations directly from libnssutil3, rather than the wrappers
 # in libnss3 which are present for binary compatibility only
diff --git a/security/nss/coreconf/coreconf.dep b/security/nss/coreconf/coreconf.dep
index 590d1bfae..5182f7555 100644
--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -10,4 +10,3 @@
  */
 
 #error "Do not include this header file."
-
diff --git a/security/nss/coreconf/detect_host_arch.py b/security/nss/coreconf/detect_host_arch.py
index 8b505a6b5..a32b01034 100644
--- a/security/nss/coreconf/detect_host_arch.py
+++ b/security/nss/coreconf/detect_host_arch.py
@@ -15,6 +15,8 @@ def main():
         host_arch = 'x64'
     elif fnmatch.fnmatch(host_arch, 'i?86') or host_arch == 'i86pc':
         host_arch = 'ia32'
+    elif host_arch == 'arm64':
+        pass
     elif host_arch.startswith('arm'):
         host_arch = 'arm'
     elif host_arch.startswith('mips'):
diff --git a/security/nss/coreconf/rules.mk b/security/nss/coreconf/rules.mk
index acf4fcc62..e9a6023b8 100644
--- a/security/nss/coreconf/rules.mk
+++ b/security/nss/coreconf/rules.mk
@@ -810,7 +810,7 @@ ifneq ($(BUILD_OPT),)
 REGDATE = $(subst \ ,, $(shell $(PERL)  $(CORE_DEPTH)/$(MODULE)/scripts/now))
 endif
 
-tests:: $(REGRESSION_SPEC) 
+tests:: $(REGRESSION_SPEC)
 	cd $(PLATFORM); \
 	../$(SOURCE_MD_DIR)/bin/regress$(PROG_SUFFIX) specfile=../$(REGRESSION_SPEC) progress $(EXTRA_REGRESS_OPTIONS); \
 	if test ! -d $(TESTS_DIR); then \
@@ -824,7 +824,7 @@ ifneq ($(BUILD_OPT),)
 	echo "then run 'reporter specfile=$(RESULTS_DIR)/rptspec'"
 endif
 else
-tests:: 
+tests::
 	@echo Error: you didn't specify REGRESSION_SPEC in your manifest.mn file!;
 endif