Bump nss to 3.22.1 and nspr to 4.12

It seems like nss has activated -Werror, even though the code is not
warning free: [1].  This applies also to the additional patches that
would need to be patched to be a warning free patch, endless recursion.

To avoid messing around with something like that: [2], we disable
-Werror option for now. Also note, that [2] doesn't fix all warnings,
but only part of them so that we let with unsolved non-trivially to
fix warnings on different supported compilers if we would choose the
warning-free-compilation-path.

[1] https://groups.google.com/d/topic/mozilla.dev.tech.crypto/TgnF3tIMxJ0/discussion
[2] https://git.fedorahosted.org/cgit/nss-pem.git/commit/?id=ec2b9a90623b1ec5adb6ebe8d6651b35854786ec

Change-Id: I762c03acede6c4eac715d3b0589061eeabbcc7c2
Reviewed-on: https://gerrit.libreoffice.org/22650
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: David Ostrovsky <david@ostrovsky.org>

7 files changed, 68 insertions, 40 deletions

diff --git a/external/nss/ExternalProject_nss.mk b/external/nss/ExternalProject_nss.mk
index 17ea6f1d36a2..bd649716a6c1 100644
--- a/external/nss/ExternalProject_nss.mk
+++ b/external/nss/ExternalProject_nss.mk
@@ -22,6 +22,7 @@ $(call gb_ExternalProject_get_state_target,nss,configure):
 		nspr/configure --includedir=$(call gb_UnpackedTarball_get_dir,nss)/mozilla/dist/out/include \
 			$(if $(CROSS_COMPILING),--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM)) \
 			$(if $(filter MSC-X86_64,$(COM)-$(CPUNAME)),--enable-64bit) \
+			$(if $(filter MSC-INTEL,$(COM)-$(CPUNAME)),--host=i686-pc-cygwin) \
 	,,nss_configure.log)
 
 ifeq ($(OS),WNT)
diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk
index 38acfedad04f..2d960b8bb7e5 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -28,6 +28,8 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
         external/nss/nss-chromium-nss-static.patch \
         external/nss/nss-more-static.patch \
         external/nss/nss-ios.patch) \
+	$(if $(filter MSC-INTEL,$(COM)-$(CPUNAME)), \
+		external/nss/nss.cygwin64.in32bit.patch) \
 ))
 
 # nss-pem is only needed for internal curl to read the NSS CA database
diff --git a/external/nss/clang-cl.patch.0 b/external/nss/clang-cl.patch.0
index bc904218f804..48f0ba85b32a 100644
--- a/external/nss/clang-cl.patch.0
+++ b/external/nss/clang-cl.patch.0
@@ -32,17 +32,17 @@
  #include <stdlib.h>
  #pragma intrinsic(_rotl, _rotr)
  #define PR_ROTATE_LEFT32(a, bits) _rotl(a, bits)
---- nss/lib/certdb/certdb.h
-+++ nss/lib/certdb/certdb.h
-@@ -31,7 +31,7 @@
+--- nss/lib/certdb/certdb.h	2016-02-12 15:36:18.000000000 +0100
++++ nss/lib/certdb/certdb.h	2016-02-23 21:08:34.607903348 +0100
+@@ -30,7 +30,7 @@
  #endif
- #define CERTDB_VALID_PEER  ((__CERTDB_VALID_PEER) CERTDB_TERMINAL_RECORD)
+ #define CERTDB_VALID_PEER ((__CERTDB_VALID_PEER)CERTDB_TERMINAL_RECORD)
  #else
 -#ifdef _WIN32
 +#if defined _WIN32 && !defined __clang__
  #pragma deprecated(CERTDB_VALID_PEER)
  #endif
- #define CERTDB_VALID_PEER  CERTDB_TERMINAL_RECORD 
+ #define CERTDB_VALID_PEER CERTDB_TERMINAL_RECORD
 --- nss/lib/util/pkcs11n.h
 +++ nss/lib/util/pkcs11n.h
 @@ -390,7 +390,7 @@
diff --git a/external/nss/nss.cygwin64.in32bit.patch b/external/nss/nss.cygwin64.in32bit.patch
new file mode 100755
index 000000000000..b00761a0e85b
--- /dev/null
+++ b/external/nss/nss.cygwin64.in32bit.patch
@@ -0,0 +1,14 @@
+This fixes architecture mismatch, when building
+on Cygwin 64bit and in 32bit mode
+diff -ru nss.orig/nss/Makefile nss/nss/Makefile
+--- a/nss.orig/nss/Makefile       2016-02-26 01:00:52.146713100 +0100
++++ b/nss/nss/Makefile    2016-02-26 01:02:05.303560100 +0100
+@@ -59,6 +59,8 @@
+ # Translate coreconf build options to NSPR configure options.
+ #
+
++NSPR_CONFIGURE_OPTS += --host=i686-pc-cygwin
++
+ ifeq ($(OS_TARGET),Android)
+ NSPR_CONFIGURE_OPTS += --with-android-ndk=$(ANDROID_NDK) \
+                        --target=$(ANDROID_PREFIX) \
diff --git a/external/nss/nss.patch b/external/nss/nss.patch
index e555d6eb7ab1..2cb23bea2cc1 100644
--- a/external/nss/nss.patch
+++ b/external/nss/nss.patch
@@ -40,24 +40,34 @@ diff -ru a/nss/cmd/platlibs.mk b/nss/cmd/platlibs.mk
  endif
  endif
  
-diff -ru a/nss/coreconf/arch.mk b/nss/coreconf/arch.mk
---- a/a/nss/coreconf/arch.mk	2014-09-29 16:46:38.175421471 +0100
-+++ b/b/nss/coreconf/arch.mk	2014-09-29 16:47:42.986012244 +0100
-@@ -280,10 +280,15 @@
+diff -ru nss.orig/nss/coreconf/arch.mk nss/nss/coreconf/arch.mk
+--- a/nss.orig/nss/coreconf/arch.mk	2016-02-12 15:36:18.000000000 +0100
++++ b/nss/nss/coreconf/arch.mk	2016-02-23 20:48:31.595941079 +0100
+@@ -280,15 +280,21 @@
  # IMPL_STRATEGY may be defined too.
  #
  
+-ifdef CROSS_COMPILE
+-OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
+-else
 -OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(COMPILER_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
+-endif
 +# OBJDIR_NAME is used to build the directory containing the built objects, for 
 +# example mozilla/dist/Linux2.6_x86_glibc_PTH_DBG.OBJ
 +# We need to deliver the contents of that folder into instdir. To make that 
 +# easier in the makefile we rename this directory to "out". 
++#ifdef CROSS_COMPILE
++#OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
++#else
 +#OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(COMPILER_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
++#endif
 +OBJDIR_NAME = out
  
+ 
  ifeq (,$(filter-out WIN%,$(OS_TARGET)))
 -ifndef BUILD_OPT
 +ifdef THIS_HAS_BEEN_DISABLED_TO_GET_out
++
  #
  # Define USE_DEBUG_RTL if you want to use the debug runtime library
  # (RTL) in the debug build
@@ -151,3 +161,16 @@ diff -ru a/nss/Makefile b/nss/Makefile
  #! gmake
  #
  # This Source Code Form is subject to the terms of the Mozilla Public
+diff -ru nss.orig/nss/coreconf/Werror.mk nss/nss/coreconf/Werror.mk
+--- a/nss.orig/nss/coreconf/Werror.mk	2016-02-12 15:36:18.000000000 +0100
++++ b/nss/nss/coreconf/Werror.mk	2016-02-23 23:58:15.119584046 +0100
+@@ -60,7 +60,8 @@
+   endif #ndef NSS_ENABLE_WERROR
+ 
+   ifeq ($(NSS_ENABLE_WERROR),1)
+-    WARNING_CFLAGS += -Werror
++# We do not treat warnings as errors.
++#    WARNING_CFLAGS += -Werror
+   else
+     # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
+     # Use this to disable use of that #pragma and the warnings it suppresses.
diff --git a/external/nss/nss.vs2015.patch b/external/nss/nss.vs2015.patch
index 42a325df9e56..de4f8762fd5b 100644..100755
--- a/external/nss/nss.vs2015.patch
+++ b/external/nss/nss.vs2015.patch
@@ -1,12 +1,12 @@
-diff -ru nss.orig/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
---- foo/nss.orig/nss/coreconf/WIN32.mk	2015-06-17 20:26:43.000000000 +0200
-+++ foo/nss/nss/coreconf/WIN32.mk	2015-08-31 20:40:40.146490300 +0200
-@@ -192,7 +192,7 @@
- ifneq ($(_MSC_VER),$(_MSC_VER_6))
-     # Convert certain deadly warnings to errors (see list at end of file)
-     OS_CFLAGS += -we4002 -we4003 -we4004 -we4006 -we4009 -we4013 \
--     -we4015 -we4028 -we4033 -we4035 -we4045 -we4047 -we4053 -we4054 -we4063 \
-+     -we4015 -we4028 -we4033 -we4035 -we4045 -we4047 -we4053 -we4063 \
-      -we4064 -we4078 -we4087 -we4090 -we4098 -we4390 -we4551 -we4553 -we4715
- 
+diff -ru nss.org/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
+--- a/nss.org/nss/coreconf/WIN32.mk	2016-02-12 15:36:18.000000000 +0100
++++ b/nss/nss/coreconf/WIN32.mk	2016-02-26 00:42:43.170809600 +0100
+@@ -199,7 +199,7 @@
+     # Disable C4244: conversion from 'type1' to 'type2', possible loss of data
+     # Disable C4018: 'expression' : signed/unsigned mismatch
+     # Disable C4312: 'type cast': conversion from 'type1' to 'type2' of greater size
+-    OS_CFLAGS += -w44267 -w44244 -w44018 -w44312
++    OS_CFLAGS += -w44267 -w44244 -w44018 -w44312 -wd4996 -wd4554
      ifeq ($(_MSC_VER_GE_12),1)
+ 	OS_CFLAGS += -FS
+     endif
diff --git a/external/nss/ubsan.patch.0 b/external/nss/ubsan.patch.0
index 956e07b3a37f..ccf04b92b023 100644
--- a/external/nss/ubsan.patch.0
+++ b/external/nss/ubsan.patch.0
@@ -1,24 +1,12 @@
---- nss/lib/certdb/crl.c
-+++ nss/lib/certdb/crl.c
-@@ -2150,7 +2150,7 @@
+diff -ru nss.orig/nss/lib/certdb/crl.c nss/nss/lib/certdb/crl.c
+--- nss/lib/certdb/crl.c	2016-02-12 15:36:18.000000000 +0100
++++ nss/lib/certdb/crl.c	2016-02-23 20:57:17.067924598 +0100
+@@ -1982,7 +1982,7 @@
          return SECSuccess;
      }
      /* all CRLs are good, sort them by thisUpdate */
--    qsort(cache->crls, cache->ncrls, sizeof(CachedCrl*),
-+    if (cache->ncrls != 0) qsort(cache->crls, cache->ncrls, sizeof(CachedCrl*),
-           SortCRLsByThisUpdate);
- 
-     if (cache->ncrls)
---- nss/lib/libpkix/pkix/util/pkix_tools.h
-+++ nss/lib/libpkix/pkix/util/pkix_tools.h
-@@ -1458,8 +1458,8 @@
- 
- extern PRLogModuleInfo *pkixLog;
- 
--#define PKIX_MAGIC_HEADER           LL_INIT(0xFEEDC0FF, 0xEEFACADE)
--#define PKIX_MAGIC_HEADER_DESTROYED LL_INIT(0xBAADF00D, 0xDEADBEEF)
-+#define PKIX_MAGIC_HEADER           LL_INIT(0xFEEDC0FFU, 0xEEFACADEU)
-+#define PKIX_MAGIC_HEADER_DESTROYED LL_INIT(0xBAADF00DU, 0xDEADBEEFU)
- 
- /* see source file for function documentation */
+-    qsort(cache->crls, cache->ncrls, sizeof(CachedCrl*), SortCRLsByThisUpdate);
++    if (cache->ncrls != 0) qsort(cache->crls, cache->ncrls, sizeof(CachedCrl*), SortCRLsByThisUpdate);
  
+     if (cache->ncrls) {
+         /* pick the newest CRL */