Bump nss to 3.22.1 and nspr to 4.12

It seems like nss has activated -Werror, even though the code is not
warning free: [1].  This applies also to the additional patches that
would need to be patched to be a warning free patch, endless recursion.

To avoid messing around with something like that: [2], we disable
-Werror option for now. Also note, that [2] doesn't fix all warnings,
but only part of them so that we let with unsolved non-trivially to
fix warnings on different supported compilers if we would choose the
warning-free-compilation-path.

[1] https://groups.google.com/d/topic/mozilla.dev.tech.crypto/TgnF3tIMxJ0/discussion
[2] https://git.fedorahosted.org/cgit/nss-pem.git/commit/?id=ec2b9a90623b1ec5adb6ebe8d6651b35854786ec

Reviewed-on: https://gerrit.libreoffice.org/22650
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: David Ostrovsky <david@ostrovsky.org>
(cherry picked from commit 486c91147c587febdacf3fa95d56633dbd703d5f)

Change-Id: I762c03acede6c4eac715d3b0589061eeabbcc7c2
Reviewed-on: https://gerrit.libreoffice.org/23097
Reviewed-by: David Ostrovsky <david@ostrovsky.org>
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

7 files changed, 64 insertions, 36 deletions

diff --git a/download.lst b/download.lst
index d621dc2dcde0..c17a0971c818 100755
--- a/download.lst
+++ b/download.lst
@@ -103,7 +103,7 @@ export MWAW_TARBALL := libmwaw-0.3.$(MWAW_VERSION_MICRO).tar.bz2
 export MYSQLCPPCONN_TARBALL := 7239a4430efd4d0189c4f24df67f08e5-mysql-connector-c++-1.1.4.tar.gz
 export MYTHES_TARBALL := a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz
 export NEON_TARBALL := 231adebe5c2f78fded3e3df6e958878e-neon-0.30.1.tar.gz
-export NSS_TARBALL := 478e0e90ebc4a90159549e77021021fd-nss-3.19.4-with-nspr-4.10.10.tar.gz
+export NSS_TARBALL := d45f17e742acd490d1df7256cb4356b6-nss-3.22.1-with-nspr-4.12.tar.gz
 export ODFGEN_MD5SUM := 32572ea48d9021bbd6fa317ddb697abc
 export ODFGEN_VERSION_MICRO := 6
 export ODFGEN_TARBALL := libodfgen-0.1.$(ODFGEN_VERSION_MICRO).tar.bz2
diff --git a/external/nss/ExternalProject_nss.mk b/external/nss/ExternalProject_nss.mk
index 17ea6f1d36a2..bd649716a6c1 100644
--- a/external/nss/ExternalProject_nss.mk
+++ b/external/nss/ExternalProject_nss.mk
@@ -22,6 +22,7 @@ $(call gb_ExternalProject_get_state_target,nss,configure):
 		nspr/configure --includedir=$(call gb_UnpackedTarball_get_dir,nss)/mozilla/dist/out/include \
 			$(if $(CROSS_COMPILING),--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM)) \
 			$(if $(filter MSC-X86_64,$(COM)-$(CPUNAME)),--enable-64bit) \
+			$(if $(filter MSC-INTEL,$(COM)-$(CPUNAME)),--host=i686-pc-cygwin) \
 	,,nss_configure.log)
 
 ifeq ($(OS),WNT)
diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk
index 4afd2751fdc3..bf3ef9afe6c1 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -27,6 +27,8 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
         external/nss/nss-chromium-nss-static.patch \
         external/nss/nss-more-static.patch \
         external/nss/nss-ios.patch) \
+	$(if $(filter MSC-INTEL,$(COM)-$(CPUNAME)), \
+		external/nss/nss.cygwin64.in32bit.patch) \
 ))
 
 # nss-pem is only needed for internal curl to read the NSS CA database
diff --git a/external/nss/nss.cygwin64.in32bit.patch b/external/nss/nss.cygwin64.in32bit.patch
new file mode 100755
index 000000000000..b00761a0e85b
--- /dev/null
+++ b/external/nss/nss.cygwin64.in32bit.patch
@@ -0,0 +1,14 @@
+This fixes architecture mismatch, when building
+on Cygwin 64bit and in 32bit mode
+diff -ru nss.orig/nss/Makefile nss/nss/Makefile
+--- a/nss.orig/nss/Makefile       2016-02-26 01:00:52.146713100 +0100
++++ b/nss/nss/Makefile    2016-02-26 01:02:05.303560100 +0100
+@@ -59,6 +59,8 @@
+ # Translate coreconf build options to NSPR configure options.
+ #
+
++NSPR_CONFIGURE_OPTS += --host=i686-pc-cygwin
++
+ ifeq ($(OS_TARGET),Android)
+ NSPR_CONFIGURE_OPTS += --with-android-ndk=$(ANDROID_NDK) \
+                        --target=$(ANDROID_PREFIX) \
diff --git a/external/nss/nss.patch b/external/nss/nss.patch
index d02a65b7160e..548363578789 100644
--- a/external/nss/nss.patch
+++ b/external/nss/nss.patch
@@ -51,24 +51,34 @@ diff -ru a/nss/cmd/platlibs.mk b/nss/cmd/platlibs.mk
  endif
  endif
  
-diff -ru a/nss/coreconf/arch.mk b/nss/coreconf/arch.mk
---- a/a/nss/coreconf/arch.mk	2014-09-29 16:46:38.175421471 +0100
-+++ b/b/nss/coreconf/arch.mk	2014-09-29 16:47:42.986012244 +0100
-@@ -280,10 +280,15 @@
+diff -ru nss.orig/nss/coreconf/arch.mk nss/nss/coreconf/arch.mk
+--- a/nss.orig/nss/coreconf/arch.mk	2016-02-12 15:36:18.000000000 +0100
++++ b/nss/nss/coreconf/arch.mk	2016-02-23 20:48:31.595941079 +0100
+@@ -280,15 +280,21 @@
  # IMPL_STRATEGY may be defined too.
  #
  
+-ifdef CROSS_COMPILE
+-OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
+-else
 -OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(COMPILER_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
+-endif
 +# OBJDIR_NAME is used to build the directory containing the built objects, for 
 +# example mozilla/dist/Linux2.6_x86_glibc_PTH_DBG.OBJ
 +# We need to deliver the contents of that folder into instdir. To make that 
 +# easier in the makefile we rename this directory to "out". 
++#ifdef CROSS_COMPILE
++#OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
++#else
 +#OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(COMPILER_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
++#endif
 +OBJDIR_NAME = out
  
+ 
  ifeq (,$(filter-out WIN%,$(OS_TARGET)))
 -ifndef BUILD_OPT
 +ifdef THIS_HAS_BEEN_DISABLED_TO_GET_out
++
  #
  # Define USE_DEBUG_RTL if you want to use the debug runtime library
  # (RTL) in the debug build
@@ -162,3 +172,16 @@ diff -ru a/nss/Makefile b/nss/Makefile
  #! gmake
  #
  # This Source Code Form is subject to the terms of the Mozilla Public
+diff -ru nss.orig/nss/coreconf/Werror.mk nss/nss/coreconf/Werror.mk
+--- a/nss.orig/nss/coreconf/Werror.mk	2016-02-12 15:36:18.000000000 +0100
++++ b/nss/nss/coreconf/Werror.mk	2016-02-23 23:58:15.119584046 +0100
+@@ -60,7 +60,8 @@
+   endif #ndef NSS_ENABLE_WERROR
+ 
+   ifeq ($(NSS_ENABLE_WERROR),1)
+-    WARNING_CFLAGS += -Werror
++# We do not treat warnings as errors.
++#    WARNING_CFLAGS += -Werror
+   else
+     # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
+     # Use this to disable use of that #pragma and the warnings it suppresses.
diff --git a/external/nss/nss.vs2015.patch b/external/nss/nss.vs2015.patch
index 42a325df9e56..de4f8762fd5b 100755
--- a/external/nss/nss.vs2015.patch
+++ b/external/nss/nss.vs2015.patch
@@ -1,12 +1,12 @@
-diff -ru nss.orig/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
---- foo/nss.orig/nss/coreconf/WIN32.mk	2015-06-17 20:26:43.000000000 +0200
-+++ foo/nss/nss/coreconf/WIN32.mk	2015-08-31 20:40:40.146490300 +0200
-@@ -192,7 +192,7 @@
- ifneq ($(_MSC_VER),$(_MSC_VER_6))
-     # Convert certain deadly warnings to errors (see list at end of file)
-     OS_CFLAGS += -we4002 -we4003 -we4004 -we4006 -we4009 -we4013 \
--     -we4015 -we4028 -we4033 -we4035 -we4045 -we4047 -we4053 -we4054 -we4063 \
-+     -we4015 -we4028 -we4033 -we4035 -we4045 -we4047 -we4053 -we4063 \
-      -we4064 -we4078 -we4087 -we4090 -we4098 -we4390 -we4551 -we4553 -we4715
- 
+diff -ru nss.org/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
+--- a/nss.org/nss/coreconf/WIN32.mk	2016-02-12 15:36:18.000000000 +0100
++++ b/nss/nss/coreconf/WIN32.mk	2016-02-26 00:42:43.170809600 +0100
+@@ -199,7 +199,7 @@
+     # Disable C4244: conversion from 'type1' to 'type2', possible loss of data
+     # Disable C4018: 'expression' : signed/unsigned mismatch
+     # Disable C4312: 'type cast': conversion from 'type1' to 'type2' of greater size
+-    OS_CFLAGS += -w44267 -w44244 -w44018 -w44312
++    OS_CFLAGS += -w44267 -w44244 -w44018 -w44312 -wd4996 -wd4554
      ifeq ($(_MSC_VER_GE_12),1)
+ 	OS_CFLAGS += -FS
+     endif
diff --git a/external/nss/ubsan.patch.0 b/external/nss/ubsan.patch.0
index 956e07b3a37f..ccf04b92b023 100644
--- a/external/nss/ubsan.patch.0
+++ b/external/nss/ubsan.patch.0
@@ -1,24 +1,12 @@
---- nss/lib/certdb/crl.c
-+++ nss/lib/certdb/crl.c
-@@ -2150,7 +2150,7 @@
+diff -ru nss.orig/nss/lib/certdb/crl.c nss/nss/lib/certdb/crl.c
+--- nss/lib/certdb/crl.c	2016-02-12 15:36:18.000000000 +0100
++++ nss/lib/certdb/crl.c	2016-02-23 20:57:17.067924598 +0100
+@@ -1982,7 +1982,7 @@
          return SECSuccess;
      }
      /* all CRLs are good, sort them by thisUpdate */
--    qsort(cache->crls, cache->ncrls, sizeof(CachedCrl*),
-+    if (cache->ncrls != 0) qsort(cache->crls, cache->ncrls, sizeof(CachedCrl*),
-           SortCRLsByThisUpdate);
- 
-     if (cache->ncrls)
---- nss/lib/libpkix/pkix/util/pkix_tools.h
-+++ nss/lib/libpkix/pkix/util/pkix_tools.h
-@@ -1458,8 +1458,8 @@
- 
- extern PRLogModuleInfo *pkixLog;
- 
--#define PKIX_MAGIC_HEADER           LL_INIT(0xFEEDC0FF, 0xEEFACADE)
--#define PKIX_MAGIC_HEADER_DESTROYED LL_INIT(0xBAADF00D, 0xDEADBEEF)
-+#define PKIX_MAGIC_HEADER           LL_INIT(0xFEEDC0FFU, 0xEEFACADEU)
-+#define PKIX_MAGIC_HEADER_DESTROYED LL_INIT(0xBAADF00DU, 0xDEADBEEFU)
- 
- /* see source file for function documentation */
+-    qsort(cache->crls, cache->ncrls, sizeof(CachedCrl*), SortCRLsByThisUpdate);
++    if (cache->ncrls != 0) qsort(cache->crls, cache->ncrls, sizeof(CachedCrl*), SortCRLsByThisUpdate);
  
+     if (cache->ncrls) {
+         /* pick the newest CRL */