nss-3.28.1nss-3.28.1

26 files changed, 1023 insertions, 103 deletions

diff --git a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
index 9c99228..2107847 100644
--- a/nss/coreconf/Darwin.mk
+++ b/nss/coreconf/Darwin.mk
@@ -3,15 +3,15 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+CC     ?= gcc
+CCC    ?= g++
+RANLIB ?= ranlib
+
 include $(CORE_DEPTH)/coreconf/UNIX.mk
 include $(CORE_DEPTH)/coreconf/Werror.mk
 
 DEFAULT_COMPILER = gcc
 
-CC		= gcc
-CCC		= g++
-RANLIB		= ranlib
-
 ifndef CPU_ARCH
 # When cross-compiling, CPU_ARCH should already be defined as the target
 # architecture, set to powerpc or i386.
@@ -21,10 +21,12 @@ endif
 ifeq (,$(filter-out i%86,$(CPU_ARCH)))
 ifdef USE_64
 CC              += -arch x86_64
+CCC             += -arch x86_64
 override CPU_ARCH	= x86_64
 else
 OS_REL_CFLAGS	= -Di386
 CC              += -arch i386
+CCC             += -arch i386
 override CPU_ARCH	= x86
 endif
 else
@@ -33,6 +35,7 @@ ifeq (arm,$(CPU_ARCH))
 else
 OS_REL_CFLAGS	= -Dppc
 CC              += -arch ppc
+CCC             += -arch ppc
 endif
 endif
 
@@ -82,7 +85,7 @@ endif
 # definitions so that the linker can catch multiply-defined symbols.
 # Also, common symbols are not allowed with Darwin dynamic libraries.
 
-OS_CFLAGS	= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(WARNING_CFLAGS) -fno-common -pipe -DDARWIN -DHAVE_STRERROR -DHAVE_BSD_FLOCK $(DARWIN_SDK_CFLAGS)
+OS_CFLAGS	= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -fno-common -pipe -DDARWIN -DHAVE_STRERROR -DHAVE_BSD_FLOCK $(DARWIN_SDK_CFLAGS)
 
 ifdef BUILD_OPT
 ifeq (11,$(ALLOW_OPT_CODE_SIZE)$(OPT_CODE_SIZE))
@@ -107,6 +110,12 @@ DARWIN_DYLIB_VERSIONS = -compatibility_version 1 -current_version 1
 # May override this with -bundle to create a loadable module.
 DSO_LDOPTS	= -dynamiclib $(DARWIN_DYLIB_VERSIONS) -install_name @executable_path/$(notdir $@) -headerpad_max_install_names
 
+ifdef USE_GCOV
+   OS_CFLAGS += --coverage
+   LDFLAGS += --coverage
+   DSO_LDOPTS += --coverage
+endif
+
 MKSHLIB		= $(CC) $(DSO_LDOPTS) $(DARWIN_SDK_SHLIBFLAGS)
 DLL_SUFFIX	= dylib
 ifdef MAPFILE
@@ -136,3 +145,6 @@ ifeq (3,$(SYS_SQLITE3_VERSION_MAJOR))
         NSS_USE_SYSTEM_SQLITE = 1
     endif
 endif
+
+include $(CORE_DEPTH)/coreconf/sanitizers.mk
+DARWIN_SDK_SHLIBFLAGS += $(SANITIZER_LDFLAGS)
diff --git a/nss/coreconf/FreeBSD.mk b/nss/coreconf/FreeBSD.mk
index c2e51ef..fcbf23f 100644
--- a/nss/coreconf/FreeBSD.mk
+++ b/nss/coreconf/FreeBSD.mk
@@ -21,7 +21,7 @@ ifeq ($(CPU_ARCH),amd64)
 CPU_ARCH		= x86_64
 endif
 
-OS_CFLAGS		= $(DSO_CFLAGS) -ansi -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
+OS_CFLAGS		= $(DSO_CFLAGS) -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
 
 DSO_CFLAGS		= -fPIC
 DSO_LDOPTS		= -shared -Wl,-soname -Wl,$(notdir $@)
diff --git a/nss/coreconf/Linux.mk b/nss/coreconf/Linux.mk
index 7a24118..438dab4 100644
--- a/nss/coreconf/Linux.mk
+++ b/nss/coreconf/Linux.mk
@@ -3,8 +3,11 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+CC     ?= gcc
+CCC    ?= g++
+RANLIB ?= ranlib
+
 include $(CORE_DEPTH)/coreconf/UNIX.mk
-include $(CORE_DEPTH)/coreconf/Werror.mk
 
 #
 # The default implementation strategy for Linux is now pthreads
@@ -17,10 +20,6 @@ ifeq ($(USE_PTHREADS),1)
 	IMPL_STRATEGY = _PTH
 endif
 
-CC			= gcc
-CCC			= g++
-RANLIB			= ranlib
-
 DEFAULT_COMPILER = gcc
 
 ifeq ($(OS_TARGET),Android)
@@ -140,7 +139,7 @@ ifeq ($(USE_PTHREADS),1)
 OS_PTHREAD = -lpthread 
 endif
 
-OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) $(WARNING_CFLAGS) -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR
 OS_LIBS			= $(OS_PTHREAD) -ldl -lc
 
 ifdef USE_PTHREADS
@@ -154,8 +153,12 @@ DSO_LDOPTS		= -shared $(ARCHFLAG) -Wl,--gc-sections
 # The linker on Red Hat Linux 7.2 and RHEL 2.1 (GNU ld version 2.11.90.0.8)
 # incorrectly reports undefined references in the libraries we link with, so
 # we don't use -z defs there.
+# Also, -z defs conflicts with Address Sanitizer, which emits relocations
+# against the libsanitizer runtime built into the main executable.
 ZDEFS_FLAG		= -Wl,-z,defs
+ifneq ($(USE_ASAN),1)
 DSO_LDOPTS		+= $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG))
+endif
 LDFLAGS			+= $(ARCHFLAG)
 
 # On Maemo, we need to use the -rpath-link flag for even the standard system
@@ -211,3 +214,11 @@ PROCESS_MAP_FILE = grep -v ';-' $< | \
 ifeq ($(OS_RELEASE),2.4)
 DEFINES += -DNO_FORK_CHECK
 endif
+
+ifdef USE_GCOV
+OS_CFLAGS += --coverage
+LDFLAGS += --coverage
+DSO_LDOPTS += --coverage
+endif
+
+include $(CORE_DEPTH)/coreconf/sanitizers.mk
diff --git a/nss/coreconf/NetBSD.mk b/nss/coreconf/NetBSD.mk
index f56006c..654f1ae 100644
--- a/nss/coreconf/NetBSD.mk
+++ b/nss/coreconf/NetBSD.mk
@@ -26,7 +26,7 @@ else
 DLL_SUFFIX		= so.1.0
 endif
 
-OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -ansi -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
 
 OS_LIBS			= -lcompat
 
diff --git a/nss/coreconf/OS2.mk b/nss/coreconf/OS2.mk
index bff216c..f23571c 100644
--- a/nss/coreconf/OS2.mk
+++ b/nss/coreconf/OS2.mk
@@ -20,7 +20,7 @@ PROG_SUFFIX = .exe
 
 
 CCC			= gcc
-LINK			= gcc
+LD  			= gcc
 AR                      = emxomfar r $@
 # Keep AR_FLAGS blank so that we do not have to change rules.mk
 AR_FLAGS                = 
diff --git a/nss/coreconf/OpenBSD.mk b/nss/coreconf/OpenBSD.mk
index b356df8..36a92d0 100644
--- a/nss/coreconf/OpenBSD.mk
+++ b/nss/coreconf/OpenBSD.mk
@@ -26,7 +26,7 @@ endif
 
 DLL_SUFFIX		= so.1.0
 
-OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -ansi -Wall -Wno-switch -pipe -DOPENBSD
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DOPENBSD
 
 OS_LIBS			= 
 
diff --git a/nss/coreconf/UNIX.mk b/nss/coreconf/UNIX.mk
index 84b881f..b448e75 100644
--- a/nss/coreconf/UNIX.mk
+++ b/nss/coreconf/UNIX.mk
@@ -62,3 +62,5 @@ endif
 define MAKE_OBJDIR
 if test ! -d $(@D); then rm -rf $(@D); $(NSINSTALL) -D $(@D); fi
 endef
+
+include $(CORE_DEPTH)/coreconf/Werror.mk
diff --git a/nss/coreconf/WIN32.mk b/nss/coreconf/WIN32.mk
index 10e7b52..be795f0 100644
--- a/nss/coreconf/WIN32.mk
+++ b/nss/coreconf/WIN32.mk
@@ -13,7 +13,7 @@ DEFAULT_COMPILER = cl
 ifdef NS_USE_GCC
 	CC           = gcc
 	CCC          = g++
-	LINK         = ld
+	LD           = ld
 	AR           = ar
 	AR          += cr $@
 	RANLIB       = ranlib
@@ -23,7 +23,7 @@ ifdef NS_USE_GCC
 else
 	CC           = cl
 	CCC          = cl
-	LINK         = link
+	LD           = link
         LDFLAGS += -nologo
 	AR           = lib
 	AR          += -nologo -OUT:$@
@@ -104,7 +104,7 @@ endif
 DLL_SUFFIX   = dll
 
 ifdef NS_USE_GCC
-    OS_CFLAGS += -mwindows -mms-bitfields -Werror
+    OS_CFLAGS += -mwindows -mms-bitfields
     _GEN_IMPORT_LIB=-Wl,--out-implib,$(IMPORT_LIBRARY)
     DLLFLAGS  += -mwindows -o $@ -shared -Wl,--export-all-symbols $(if $(IMPORT_LIBRARY),$(_GEN_IMPORT_LIB))
     ifdef BUILD_OPT
@@ -123,14 +123,14 @@ ifdef NS_USE_GCC
 	DEFINES    += -DDEBUG -UNDEBUG -DDEBUG_$(USERNAME)
     endif
 else # !NS_USE_GCC
-    OS_CFLAGS += -W3 -nologo -D_CRT_SECURE_NO_WARNINGS \
-		 -D_CRT_NONSTDC_NO_WARNINGS
+    WARNING_CFLAGS = -W3 -nologo -D_CRT_SECURE_NO_WARNINGS \
+                      -D_CRT_NONSTDC_NO_WARNINGS
     OS_DLLFLAGS += -nologo -DLL -SUBSYSTEM:WINDOWS
     ifndef NSS_ENABLE_WERROR
         NSS_ENABLE_WERROR = 1
     endif
     ifeq ($(NSS_ENABLE_WERROR),1)
-        OS_CFLAGS += -WX
+        WARNING_CFLAGS += -WX
     endif
     ifeq ($(_MSC_VER),$(_MSC_VER_6))
     ifndef MOZ_DEBUG_SYMBOLS
@@ -219,6 +219,7 @@ ifdef USE_64
 	ifeq ($(_MSC_VER_GE_11),1)
 		LDFLAGS += -SUBSYSTEM:CONSOLE,5.02
 	endif
+	CPU_ARCH = x86_64
 else
 	DEFINES += -D_X86_
 	# VS2012 defaults to -arch:SSE2. Use -arch:IA32 to avoid requiring
@@ -231,6 +232,7 @@ else
 		endif
 		LDFLAGS += -SUBSYSTEM:CONSOLE,5.01
 	endif
+	CPU_ARCH = x386
 endif
 endif
 ifeq ($(CPU_ARCH), ALPHA)
@@ -262,7 +264,7 @@ ifdef USE_64
 	ASFLAGS = -nologo -Cp -Sn -Zi $(INCLUDES)
 else
 	AS	= ml.exe
-	ASFLAGS = -nologo -Cp -Sn -Zi -coff $(INCLUDES)
+	ASFLAGS = -nologo -Cp -Sn -Zi -coff -safeseh $(INCLUDES)
 endif
 endif
 
diff --git a/nss/coreconf/Werror.mk b/nss/coreconf/Werror.mk
index 6e2588c..69155eb 100644
--- a/nss/coreconf/Werror.mk
+++ b/nss/coreconf/Werror.mk
@@ -3,68 +3,103 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# This sets warning flags for unix-like operating systems.
+# This sets WARNING_CFLAGS for gcc-like compilers.
+
+ifndef CC_IS_CLANG
+  CC_IS_CLANG := $(and $(findstring clang, $(shell $(CC) --version 2>&1)), 1)
+  # Export CC_IS_CLANG to save a shell invocation when recursing.
+  export CC_IS_CLANG
+endif
+
+ifdef CC_IS_CLANG
+  # Clang claims GCC 4.2.1 compatibility, see GCC_VERSION
+  CC_IS_GCC = 1
+  # Export CC_IS_GCC to save a shell invocation when recursing.
+  export CC_IS_GCC
+endif
+
+ifndef CC_IS_GCC
+  CC_IS_GCC := $(shell $(CC) -x c -E -Wall -Werror /dev/null >/dev/null 2>&1 && echo 1)
+  # Export CC_IS_GCC to save a shell invocation when recursing.
+  export CC_IS_GCC
+endif
 
 ifndef CC_NAME
-  CC_NAME := $(shell $(CC) -? 2>&1 >/dev/null | sed -e 's/:.*//;1q')
+  ifeq (1,$(CC_IS_GCC))
+    CC_NAME := $(shell $(CC) -? 2>&1 >/dev/null | sed -e 's/:.*//;1q')
+  else
+    CC_NAME := $(notdir $(CC))
+  endif
+  # Export CC_NAME to save a shell invocation when recursing.
   export CC_NAME
 endif
 
+ifndef GCC_VERSION
+  ifeq (1,$(CC_IS_GCC))
+    GCC_VERSION := $(subst ., ,$(shell $(CC) -dumpversion || echo x.x.x))
+    # Export GCC_VERSION to save a shell invocation when recursing.
+    export GCC_VERSION
+  endif
+endif
+
 ifndef WARNING_CFLAGS
-  # This tests to see if enabling the warning is possible before
-  # setting an option to disable it.
-  disable_warning = $(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -Wno-$(1))
+  ifneq (1,$(CC_IS_GCC))
+    WARNING_CFLAGS = $(NULL)
+  else
+    # This tests to see if enabling the warning is possible before
+    # setting an option to disable it.
+    disable_warning = $(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -Wno-$(1))
 
-  WARNING_CFLAGS = -Wall
-  ifeq ($(CC_NAME),clang)
-    # -Qunused-arguments : clang objects to arguments that it doesn't understand
-    #    and fixing this would require rearchitecture
-    WARNING_CFLAGS += -Qunused-arguments
-    # -Wno-parentheses-equality : because clang warns about macro expansions
-    OS_CFLAGS += $(call disable_warning,parentheses-equality)
-    ifdef BUILD_OPT
-      # clang is unable to handle glib's expansion of strcmp and similar for optimized
-      # builds, so ignore the resulting errors.
-      # See https://llvm.org/bugs/show_bug.cgi?id=20144
-      WARNING_CFLAGS += $(call disable_warning,array-bounds)
-      WARNING_CFLAGS += $(call disable_warning,unevaluated-expression)
-    endif
-  endif # if clang
+    WARNING_CFLAGS = -Wall
+    ifdef CC_IS_CLANG
+      # -Qunused-arguments : clang objects to arguments that it doesn't understand
+      #    and fixing this would require rearchitecture
+      WARNING_CFLAGS += -Qunused-arguments
+      # -Wno-parentheses-equality : because clang warns about macro expansions
+      WARNING_CFLAGS += $(call disable_warning,parentheses-equality)
+      ifdef BUILD_OPT
+        # clang is unable to handle glib's expansion of strcmp and similar for optimized
+        # builds, so ignore the resulting errors.
+        # See https://llvm.org/bugs/show_bug.cgi?id=20144
+        WARNING_CFLAGS += $(call disable_warning,array-bounds)
+        WARNING_CFLAGS += $(call disable_warning,unevaluated-expression)
+      endif
+    endif # if clang
 
-  ifndef NSS_ENABLE_WERROR
-    ifeq ($(OS_TARGET),Android)
-      # Android lollipop generates the following warning:
-      # error: call to 'sprintf' declared with attribute warning:
-      #   sprintf is often misused; please use snprintf [-Werror]
-      # So, just suppress -Werror entirely on Android
-      NSS_ENABLE_WERROR = 0
-      $(warning OS_TARGET is Android, disabling -Werror)
-    else
-      ifeq ($(CC_NAME),clang)
-        # Clang reports its version as an older gcc, but it's OK
-        NSS_ENABLE_WERROR = 1
+    ifndef NSS_ENABLE_WERROR
+      ifeq ($(OS_TARGET),Android)
+        # Android lollipop generates the following warning:
+        # error: call to 'sprintf' declared with attribute warning:
+        #   sprintf is often misused; please use snprintf [-Werror]
+        # So, just suppress -Werror entirely on Android
+        NSS_ENABLE_WERROR = 0
+        $(warning OS_TARGET is Android, disabling -Werror)
       else
-        CC_VERSION := $(subst ., ,$(shell $(CC) -dumpversion))
-        ifneq (,$(filter 4.8 4.9,$(word 1,$(CC_VERSION)).$(word 2,$(CC_VERSION))))
-          NSS_ENABLE_WERROR = 1
-        endif
-        ifeq (,$(filter 0 1 2 3 4,$(word 1,$(CC_VERSION))))
+        ifdef CC_IS_CLANG
+          # Clang reports its version as an older gcc, but it's OK
           NSS_ENABLE_WERROR = 1
+        else
+          ifneq (,$(filter 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
+            NSS_ENABLE_WERROR = 1
+          endif
+          ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
+            NSS_ENABLE_WERROR = 1
+          endif
         endif
         ifndef NSS_ENABLE_WERROR
           $(warning Unable to find gcc 4.8 or greater, disabling -Werror)
           NSS_ENABLE_WERROR = 0
         endif
       endif
-    endif
-  endif #ndef NSS_ENABLE_WERROR
+    endif #ndef NSS_ENABLE_WERROR
 
-  ifeq ($(NSS_ENABLE_WERROR),1)
-    WARNING_CFLAGS += -Werror
-  else
-    # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
-    # Use this to disable use of that #pragma and the warnings it suppresses.
-    WARNING_CFLAGS += -DNSS_NO_GCC48
+    ifeq ($(NSS_ENABLE_WERROR),1)
+      WARNING_CFLAGS += -Werror
+    else
+      # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
+      # Use this to disable use of that #pragma and the warnings it suppresses.
+      WARNING_CFLAGS += -DNSS_NO_GCC48
+    endif
   endif
   export WARNING_CFLAGS
 endif # ndef WARNING_CFLAGS
diff --git a/nss/coreconf/arch.mk b/nss/coreconf/arch.mk
index 62ba8d5..06c276f 100644
--- a/nss/coreconf/arch.mk
+++ b/nss/coreconf/arch.mk
@@ -6,14 +6,13 @@
 #######################################################################
 # Master "Core Components" macros for getting the OS architecture     #
 # defines these symbols:
-# 64BIT_TAG
 # OS_ARCH	(from uname -r)
 # OS_TEST	(from uname -m)
 # OS_RELEASE	(from uname -v and/or -r)
 # OS_TARGET	User defined, or set to OS_ARCH
 # CPU_ARCH  	(from unmame -m or -p, ONLY on WINNT)
 # OS_CONFIG	OS_TARGET + OS_RELEASE
-# OBJDIR_TAG
+# OBJDIR_TAG    (uses ASAN_TAG, GCOV_TAG, 64BIT_TAG)
 # OBJDIR_NAME
 #######################################################################
 
@@ -21,12 +20,6 @@
 # Macros for getting the OS architecture
 #
 
-ifeq ($(USE_64), 1)
-	64BIT_TAG=_64
-else
-	64BIT_TAG=
-endif
-
 OS_ARCH := $(subst /,_,$(shell uname -s))
 
 #
@@ -205,11 +198,11 @@ ifeq (CYGWIN_NT,$(findstring CYGWIN_NT,$(OS_ARCH)))
     endif
 endif
 #
-# If uname -s returns "MINGW32_NT-*", we assume that we are using
+# If uname -s returns "MINGW*_NT-*", we assume that we are using
 # the uname.exe in the MSYS toolkit.
 #
-ifeq (MINGW32_NT,$(findstring MINGW32_NT,$(OS_ARCH)))
-    OS_RELEASE := $(patsubst MINGW32_NT-%,%,$(OS_ARCH))
+ifneq (,$(filter MINGW32_NT-% MINGW64_NT-%,$(OS_ARCH)))
+    OS_RELEASE := $(patsubst MINGW64_NT-%,%,$(patsubst MINGW32_NT-%,%,$(OS_ARCH)))
     OS_ARCH = WINNT
     USE_MSYS = 1
     ifndef CPU_ARCH
@@ -217,7 +210,7 @@ ifeq (MINGW32_NT,$(findstring MINGW32_NT,$(OS_ARCH)))
 	#
 	# MSYS's uname -m returns "i686" on a Pentium Pro machine.
 	#
-	ifneq (,$(findstring 86,$(CPU_ARCH)))
+	ifneq (,$(filter i%86,$(CPU_ARCH)))
 	    CPU_ARCH = x386
 	endif
     endif
@@ -261,13 +254,30 @@ OS_CONFIG = $(OS_TARGET)$(OS_RELEASE)
 # to distinguish between debug and release builds.
 #
 
+ifeq ($(USE_ASAN), 1)
+    ASAN_TAG = _ASAN
+else
+    ASAN_TAG =
+endif
+ifeq ($(USE_GCOV), 1)
+    GCOV_TAG = _GCOV
+else
+    GCOV_TAG =
+endif
+ifeq ($(USE_64), 1)
+    64BIT_TAG = _64
+else
+    64BIT_TAG =
+endif
+OBJDIR_TAG_BASE=$(ASAN_TAG)$(GCOV_TAG)$(64BIT_TAG)
+
 ifdef BUILD_OPT
-    OBJDIR_TAG = $(64BIT_TAG)_OPT
+    OBJDIR_TAG = $(OBJDIR_TAG_BASE)_OPT
 else
     ifdef BUILD_IDG
-	OBJDIR_TAG = $(64BIT_TAG)_IDG
+	OBJDIR_TAG = $(OBJDIR_TAG_BASE)_IDG
     else
-	OBJDIR_TAG = $(64BIT_TAG)_DBG
+	OBJDIR_TAG = $(OBJDIR_TAG_BASE)_DBG
     endif
 endif
 
@@ -281,10 +291,12 @@ endif
 #
 
 ifdef CROSS_COMPILE
-OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
+    OBJDIR_NAME_COMPILER =
 else
-OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(COMPILER_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
+    OBJDIR_NAME_COMPILER = $(COMPILER_TAG)
 endif
+OBJDIR_NAME_BASE = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(OBJDIR_NAME_COMPILER)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG)
+OBJDIR_NAME = $(OBJDIR_NAME_BASE).OBJ
 
 
 ifeq (,$(filter-out WIN%,$(OS_TARGET)))
@@ -294,11 +306,7 @@ ifndef BUILD_OPT
 # (RTL) in the debug build
 #
 ifdef USE_DEBUG_RTL
-    ifdef CROSS_COMPILE
-    OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJD
-    else
-    OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(COMPILER_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJD
-    endif
+    OBJDIR_NAME = $(OBJDIR_NAME_BASE).OBJD
 endif
 endif
 endif
diff --git a/nss/coreconf/check_cc_clang.py b/nss/coreconf/check_cc_clang.py
new file mode 100644
index 0000000..145ec0a
--- /dev/null
+++ b/nss/coreconf/check_cc_clang.py
@@ -0,0 +1,20 @@
+#!/usr/bin/env python
+
+import os
+import subprocess
+import sys
+
+def main():
+    if sys.platform == 'win32':
+        print 0
+    else:
+        cc = os.environ.get('CC', 'cc')
+        try:
+            cc_is_clang = 'clang' in subprocess.check_output([cc, '--version'])
+        except OSError:
+            # We probably just don't have CC/cc.
+            cc_is_clang = False
+        print int(cc_is_clang)
+
+if __name__ == '__main__':
+    main()
diff --git a/nss/coreconf/command.mk b/nss/coreconf/command.mk
index ec1fd4d..5e92748 100644
--- a/nss/coreconf/command.mk
+++ b/nss/coreconf/command.mk
@@ -11,9 +11,9 @@
 AS            = $(CC)
 ASFLAGS      += $(CFLAGS)
 CCF           = $(CC) $(CFLAGS)
-LINK_DLL      = $(LINK) $(OS_DLLFLAGS) $(DLLFLAGS) $(XLDFLAGS)
-CFLAGS        = $(OPTIMIZER) $(OS_CFLAGS) $(XP_DEFINE) $(DEFINES) $(INCLUDES) \
-		$(XCFLAGS)
+LINK_DLL      = $(LD) $(OS_DLLFLAGS) $(DLLFLAGS) $(XLDFLAGS)
+CFLAGS        = $(OPTIMIZER) $(OS_CFLAGS) $(WARNING_CFLAGS) $(XP_DEFINE) \
+                $(DEFINES) $(INCLUDES) $(XCFLAGS)
 PERL          = perl
 RANLIB        = echo
 TAR           = /bin/tar
diff --git a/nss/coreconf/config.gypi b/nss/coreconf/config.gypi
new file mode 100644
index 0000000..fe9b553
--- /dev/null
+++ b/nss/coreconf/config.gypi
@@ -0,0 +1,530 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'variables': {
+    'module%': '',
+    'variables': {
+      'variables': {
+        'variables': {
+          'python%': 'python',
+        },
+        # chromium uses pymod_do_main, but gyp doesn't set a sensible
+        # Python sys.path (gyp_chromium does).
+        'python%': '<(python)',
+        'host_arch%': '<!(<(python) <(DEPTH)/coreconf/detect_host_arch.py)',
+      },
+      'python%': '<(python)',
+      'host_arch%': '<(host_arch)',
+      'conditions': [
+        ['OS=="android"', {
+          'target_arch%': 'arm',
+        }, {
+          # Default architecture we're building for is the architecture we're
+          # building on.
+          'target_arch%': '<(host_arch)',
+        }],
+        ['OS=="win"', {
+          'use_system_zlib%': 0,
+          'nspr_libs%': ['nspr4.lib', 'plc4.lib', 'plds4.lib'],
+          'zlib_libs%': [],
+          #TODO
+          'moz_debug_flags%': '',
+          'dll_prefix': '',
+          'dll_suffix': 'dll',
+        }, {
+          'nspr_libs%': ['-lplds4', '-lplc4', '-lnspr4'],
+          'use_system_zlib%': 1,
+        }],
+        ['OS=="linux" or OS=="android"', {
+          'zlib_libs%': ['-lz'],
+          'moz_debug_flags%': '-gdwarf-2',
+          'optimize_flags%': '-O2',
+          'dll_prefix': 'lib',
+          'dll_suffix': 'so',
+        }],
+        ['OS=="linux"', {
+          'freebl_name': 'freeblpriv3',
+        }, {
+          'freebl_name': 'freebl3',
+        }],
+        ['OS=="mac"', {
+          'zlib_libs%': ['-lz'],
+          'use_system_sqlite%': 1,
+          'moz_debug_flags%': '-gdwarf-2 -gfull',
+          'optimize_flags%': '-O2',
+          'dll_prefix': 'lib',
+          'dll_suffix': 'dylib',
+        }, {
+          'use_system_sqlite%': 0,
+        }],
+        ['"<(GENERATOR)"=="ninja"', {
+          'cc_is_clang%': '<!(<(python) <(DEPTH)/coreconf/check_cc_clang.py)',
+        }, {
+          'cc_is_clang%': '0',
+        }],
+      ],
+    },
+    # Copy conditionally-set variables out one scope.
+    'python%': '<(python)',
+    'host_arch%': '<(host_arch)',
+    'target_arch%': '<(target_arch)',
+    'use_system_zlib%': '<(use_system_zlib)',
+    'zlib_libs%': ['<@(zlib_libs)'],
+    'moz_debug_flags%': '<(moz_debug_flags)',
+    'nspr_libs%': ['<@(nspr_libs)'],
+    'nspr_lib_dir%': '<(nspr_lib_dir)',
+    'nspr_include_dir%': '<(nspr_include_dir)',
+    'use_system_sqlite%': '<(use_system_sqlite)',
+    'sqlite_libs%': ['-lsqlite3'],
+    'dll_prefix': '<(dll_prefix)',
+    'dll_suffix': '<(dll_suffix)',
+    'freebl_name': '<(freebl_name)',
+    'cc_is_clang%': '<(cc_is_clang)',
+    # Some defaults
+    'disable_tests%': 0,
+    'disable_chachapoly%': 0,
+    'disable_dbm%': 0,
+    'disable_libpkix%': 1,
+    'disable_werror%': 0,
+    'mozilla_client%': 0,
+    'moz_fold_libs%': 0,
+    'moz_folded_library_name%': '',
+    'ssl_enable_zlib%': 1,
+    'use_asan%': 0,
+    'use_ubsan%': 0,
+    'use_msan%': 0,
+    'use_sancov%': 0,
+    'test_build%': 0,
+    'fuzz%': 0,
+    'sign_libs%': 1,
+    'use_pprof%': 0,
+    'nss_public_dist_dir%': '<(nss_dist_dir)/public',
+    'nss_private_dist_dir%': '<(nss_dist_dir)/private',
+  },
+  'target_defaults': {
+    # Settings specific to targets should go here.
+    # This is mostly for linking to libraries.
+    'variables': {
+      'mapfile%': '',
+      'test_build%': 0,
+    },
+    'standalone_static_library': 0,
+    'include_dirs': [
+      '<(nspr_include_dir)',
+      '<(nss_dist_dir)/private/<(module)',
+    ],
+    'conditions': [
+      [ 'OS=="linux"', {
+        'libraries': [
+          '-lpthread',
+          '-ldl',
+          '-lc',
+        ],
+      }],
+    ],
+    'target_conditions': [
+      # If we want to properly export a static library, and copy it to lib,
+      # we need to mark it as a 'standalone_static_library'. Otherwise,
+      # the relative paths in the thin archive will break linking.
+      [ '_type=="shared_library"', {
+        'product_dir': '<(nss_dist_obj_dir)/lib'
+      }, '_type=="executable"', {
+        'product_dir': '<(nss_dist_obj_dir)/bin'
+      }, '_standalone_static_library==1', {
+        'product_dir': '<(nss_dist_obj_dir)/lib'
+      }],
+      # mapfile handling
+      [ 'test_build==0 and mapfile!=""', {
+        # Work around a gyp bug. Fixed upstream but not in Ubuntu packages:
+        # https://chromium.googlesource.com/external/gyp/+/b85ad3e578da830377dbc1843aa4fbc5af17a192%5E%21/
+        'sources': [
+          '<(DEPTH)/coreconf/empty.c',
+        ],
+        'xcode_settings': {
+          'OTHER_LDFLAGS': [
+            '-exported_symbols_list',
+            '<(INTERMEDIATE_DIR)/out.>(mapfile)',
+          ],
+        },
+        'conditions': [
+          [ 'OS=="linux" or OS=="android"', {
+            'ldflags': [
+              '-Wl,--version-script,<(INTERMEDIATE_DIR)/out.>(mapfile)',
+            ],
+          }],
+          [ 'OS=="win"', {
+            # On Windows, .def files are used directly as sources.
+            'sources': [
+              '>(mapfile)',
+            ],
+          }, {
+            # On other platforms, .def files need processing.
+            'sources': [
+              '<(INTERMEDIATE_DIR)/out.>(mapfile)',
+            ],
+            'actions': [{
+              'action_name': 'generate_mapfile',
+              'inputs': [
+                '>(mapfile)',
+              ],
+              'outputs': [
+                '<(INTERMEDIATE_DIR)/out.>(mapfile)',
+              ],
+              'action': ['<@(process_map_file)'],
+            }],
+          }]
+        ],
+      }, 'test_build==1 and _type=="shared_library"', {
+        # When linking a shared lib against a static one, XCode doesn't
+        # export the latter's symbols by default. -all_load fixes that.
+        'xcode_settings': {
+          'OTHER_LDFLAGS': [
+            '-all_load',
+          ],
+        },
+      }],
+      [ '_type=="shared_library" or _type=="executable"', {
+        'libraries': [
+          '<@(nspr_libs)',
+        ],
+        'library_dirs': [
+          '<(nspr_lib_dir)',
+        ],
+      }],
+      # Shared library specific settings.
+      [ '_type=="shared_library"', {
+        'conditions': [
+          [ 'OS=="linux" or OS=="android"', {
+            'ldflags': [
+              '-Wl,--gc-sections',
+              '-Wl,-z,defs',
+            ],
+          }],
+        ],
+        'xcode_settings': {
+          'DYLIB_INSTALL_NAME_BASE': '@executable_path',
+          'DYLIB_COMPATIBILITY_VERSION': '1',
+          'DYLIB_CURRENT_VERSION': '1',
+          'OTHER_LDFLAGS': [
+            '-headerpad_max_install_names',
+          ],
+        },
+        'msvs_settings': {
+          'VCLinkerTool': {
+            'SubSystem': '2',
+          },
+        },
+      }],
+    ],
+    'default_configuration': 'Debug',
+    'configurations': {
+      # Common settings for Debug+Release should go here.
+      'Common': {
+        'abstract': 1,
+        'defines': [
+          'NSS_NO_INIT_SUPPORT',
+          'USE_UTIL_DIRECTLY',
+          'NO_NSPR_10_SUPPORT',
+          'SSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES',
+        ],
+        'msvs_configuration_attributes': {
+          'OutputDirectory': '$(SolutionDir)$(ConfigurationName)',
+          'IntermediateDirectory': '$(OutDir)\\obj\\$(ProjectName)',
+        },
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'AdditionalIncludeDirectories': ['<(nspr_include_dir)'],
+          },
+        },
+        'xcode_settings': {
+          'CLANG_CXX_LANGUAGE_STANDARD': 'c++0x',
+          'OTHER_CFLAGS': [
+            '-fPIC',
+            '-fno-common',
+            '-pipe',
+          ],
+        },
+        'conditions': [
+          [ 'OS=="linux" or OS=="android"', {
+            'defines': [
+              'LINUX2_1',
+              'LINUX',
+              'linux',
+              'HAVE_STRERROR',
+              'XP_UNIX',
+              '_REENTRANT',
+            ],
+            'cflags': [
+              '-fPIC',
+              '-pipe',
+              '-ffunction-sections',
+              '-fdata-sections',
+            ],
+            'cflags_cc': [
+              '-std=c++0x',
+            ],
+            'conditions': [
+              [ 'target_arch=="ia32"', {
+                'cflags': ['-m32'],
+                'ldflags': ['-m32'],
+              }],
+              [ 'target_arch=="x64"', {
+                'cflags': ['-m64'],
+                'ldflags': ['-m64'],
+              }],
+              [ 'use_pprof==1' , {
+                'ldflags': [ '-lprofiler' ],
+              }],
+            ],
+          }],
+          [ 'disable_werror==0 and (OS=="linux" or OS=="mac")', {
+            'cflags': [
+              '<!@(<(python) <(DEPTH)/coreconf/werror.py)',
+            ],
+          }],
+          [ 'fuzz==1', {
+            'cflags': [
+              '-Wno-unused-function',
+            ]
+          }],
+          [ 'use_asan==1 or use_ubsan==1', {
+            'cflags': ['-O1'],
+            'xcode_settings': {
+              'GCC_OPTIMIZATION_LEVEL': '1', # -O1
+            }
+          }],
+          [ 'use_asan==1', {
+            'variables': {
+              'asan_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py asan)',
+              'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
+            },
+            'cflags': ['<@(asan_flags)'],
+            'ldflags': ['<@(asan_flags)'],
+            'ldflags!': ['<@(no_ldflags)'],
+            'xcode_settings': {
+              'OTHER_CFLAGS': ['<@(asan_flags)'],
+              'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
+              # We want to pass -fsanitize=... to our final link call,
+              # but not to libtool. OTHER_LDFLAGS is passed to both.
+              # To trick GYP into doing what we want, we'll piggyback on
+              # LIBRARY_SEARCH_PATHS, producing "-L/usr/lib -fsanitize=...".
+              # The -L/usr/lib is redundant but innocuous: it's a default path.
+              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(asan_flags)'],
+            },
+          }],
+          [ 'use_ubsan==1', {
+            'variables': {
+              'ubsan_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ubsan)',
+              'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
+            },
+            'cflags': ['<@(ubsan_flags)'],
+            'ldflags': ['<@(ubsan_flags)'],
+            'ldflags!': ['<@(no_ldflags)'],
+            'xcode_settings': {
+              'OTHER_CFLAGS': ['<@(ubsan_flags)'],
+              'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
+              # See comment above.
+              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(ubsan_flags)'],
+            },
+          }],
+          [ 'use_msan==1', {
+            'variables': {
+              'msan_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py msan)',
+              'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
+            },
+            'cflags': ['<@(msan_flags)'],
+            'ldflags': ['<@(msan_flags)'],
+            'ldflags!': ['<@(no_ldflags)'],
+            'xcode_settings': {
+              'OTHER_CFLAGS': ['<@(msan_flags)'],
+              'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
+              # See comment above.
+              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(msan_flags)'],
+            },
+          }],
+          [ 'use_sancov!=0', {
+            'variables': {
+              'sancov_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py sancov <(use_sancov))',
+              'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
+            },
+            'cflags': ['<@(sancov_flags)'],
+            'ldflags': ['<@(sancov_flags)'],
+            'ldflags!': ['<@(no_ldflags)'],
+            'xcode_settings': {
+              'OTHER_CFLAGS': ['<@(sancov_flags)'],
+              'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
+              # See comment above.
+              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(sancov_flags)'],
+            },
+          }],
+          [ 'OS=="android" and mozilla_client==0', {
+            'defines': [
+              'NO_SYSINFO',
+              'NO_FORK_CHECK',
+              'ANDROID',
+            ],
+          }],
+          [ 'OS=="mac"', {
+            'defines': [
+              'DARWIN',
+              'HAVE_STRERROR',
+              'HAVE_BSD_FLOCK',
+              'XP_UNIX',
+            ],
+            'conditions': [
+              [ 'target_arch=="ia32"', {
+                'xcode_settings': {
+                  'ARCHS': ['i386'],
+                },
+              }],
+              [ 'target_arch=="x64"', {
+                'xcode_settings': {
+                  'ARCHS': ['x86_64'],
+                },
+              }],
+            ],
+          }],
+          [ 'OS=="win"', {
+            'defines': [
+              '_WINDOWS',
+              'WIN95',
+              '_CRT_SECURE_NO_WARNINGS',
+              '_CRT_NONSTDC_NO_WARNINGS',
+            ],
+            'cflags': [
+              '-W3',
+              '-w44267', # Disable C4267: conversion from 'size_t' to 'type', possible loss of data
+              '-w44244', # Disable C4244: conversion from 'type1' to 'type2', possible loss of data
+              '-w44018', # Disable C4018: 'expression' : signed/unsigned mismatch
+              '-w44312', # Disable C4312: 'type cast': conversion from 'type1' to 'type2' of greater size
+            ],
+            'conditions': [
+              [ 'disable_werror==0', {
+                'cflags': ['-WX']
+              }],
+              [ 'target_arch=="ia32"', {
+                'msvs_configuration_platform': 'Win32',
+                'msvs_settings': {
+                  'VCLinkerTool': {
+                    'MinimumRequiredVersion': '5.01',  # XP.
+                    'TargetMachine': '1',
+                    'ImageHasSafeExceptionHandlers': 'false',
+                  },
+                  'VCCLCompilerTool': {
+                    'PreprocessorDefinitions': [
+                      'WIN32',
+                    ],
+                  },
+                },
+
+              }],
+              [ 'target_arch=="x64"', {
+                'msvs_configuration_platform': 'x64',
+                'msvs_settings': {
+                  'VCLinkerTool': {
+                    'TargetMachine': '17', # x86-64
+                  },
+                  'VCCLCompilerTool': {
+                    'PreprocessorDefinitions': [
+                      'WIN64',
+                      '_AMD64_',
+                    ],
+                  },
+                },
+              }],
+            ],
+          }],
+          [ 'disable_dbm==1', {
+            'defines': [
+              'NSS_DISABLE_DBM',
+            ],
+          }],
+          [ 'disable_libpkix==1', {
+            'defines': [
+              'NSS_DISABLE_LIBPKIX',
+            ],
+          }],
+        ],
+      },
+      # Common settings for debug should go here.
+      'Debug': {
+        'inherit_from': ['Common'],
+        'conditions': [
+          [ 'OS=="linux" or OS=="android"', {
+            'cflags': [
+              '-g',
+              '<(moz_debug_flags)',
+            ],
+          }]
+        ],
+        #TODO: DEBUG_$USER
+        'defines': ['DEBUG'],
+        'xcode_settings': {
+          'COPY_PHASE_STRIP': 'NO',
+          'GCC_OPTIMIZATION_LEVEL': '0',
+          'GCC_GENERATE_DEBUGGING_SYMBOLS': 'YES',
+        },
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'Optimization': '0',
+            'BasicRuntimeChecks': '3',
+            'RuntimeLibrary': '2', # /MD
+          },
+          'VCLinkerTool': {
+            'LinkIncremental': '1',
+          },
+          'VCResourceCompilerTool': {
+            'PreprocessorDefinitions': ['DEBUG'],
+          },
+        },
+      },
+      # Common settings for release should go here.
+      'Release': {
+        'inherit_from': ['Common'],
+        'defines': [
+          'NDEBUG',
+        ],
+        'xcode_settings': {
+          'DEAD_CODE_STRIPPING': 'YES',  # -Wl,-dead_strip
+          'GCC_OPTIMIZATION_LEVEL': '2', # -O2
+        },
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'Optimization': '2', # /Os
+            'RuntimeLibrary': '2', # /MD
+          },
+          'VCLinkerTool': {
+            'LinkIncremental': '1',
+          },
+        },
+      },
+      'conditions': [
+        [ 'OS=="win"', {
+          # The gyp ninja backend requires these.
+          # TODO: either we should support building both 32/64-bit as
+          # configurations from the same gyp build, or we should fix
+          # upstream gyp to not require these.
+          'Debug_x64': {
+            'inherit_from': ['Debug'],
+          },
+          'Release_x64': {
+            'inherit_from': ['Release'],
+          },
+        }],
+      ],
+    },
+  },
+  'conditions': [
+    [ 'OS=="linux" or OS=="android"', {
+      'variables': {
+        'process_map_file': ['/bin/sh', '-c', '/bin/grep -v ";-" >(mapfile) | sed -e "s,;+,," -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,;," > >@(_outputs)'],
+      },
+    }],
+    [ 'OS=="mac"', {
+      'variables': {
+        'process_map_file': ['/bin/sh', '-c', '/usr/bin/grep -v ";+" >(mapfile) | grep -v ";-" | sed -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,," -e "s,^,_," > >@(_outputs)'],
+      },
+    }],
+  ],
+}
diff --git a/nss/coreconf/config.mk b/nss/coreconf/config.mk
index 99c6ce6..09b733d 100644
--- a/nss/coreconf/config.mk
+++ b/nss/coreconf/config.mk
@@ -149,10 +149,6 @@ endif
 ifdef NSS_DISABLE_ECC
 DEFINES += -DNSS_DISABLE_ECC
 endif
- 
-ifdef NSS_ECC_MORE_THAN_SUITE_B
-DEFINES += -DNSS_ECC_MORE_THAN_SUITE_B
-endif
 
 ifdef NSS_ALLOW_UNSUPPORTED_CRITICAL
 DEFINES += -DNSS_ALLOW_UNSUPPORTED_CRITICAL
@@ -162,14 +158,33 @@ ifdef BUILD_LIBPKIX_TESTS
 DEFINES += -DBUILD_LIBPKIX_TESTS
 endif
 
+ifdef NSS_DISABLE_LIBPKIX
+DEFINES += -DNSS_DISABLE_LIBPKIX
+endif
+
 ifdef NSS_DISABLE_DBM
 DEFINES += -DNSS_DISABLE_DBM
 endif
 
+ifdef NSS_DISABLE_CHACHAPOLY
+DEFINES += -DNSS_DISABLE_CHACHAPOLY
+endif
+
 ifdef NSS_PKIX_NO_LDAP
 DEFINES += -DNSS_PKIX_NO_LDAP
 endif
 
+# FIPS support requires startup tests to be executed at load time of shared modules.
+# For performance reasons, these tests are disabled by default.
+# When compiling binaries that must support FIPS mode, 
+# you should define NSS_FORCE_FIPS
+#
+# NSS_NO_INIT_SUPPORT is always defined on platforms that don't support
+# executing the startup tests at library load time.
+ifndef NSS_FORCE_FIPS
+DEFINES += -DNSS_NO_INIT_SUPPORT
+endif
+
 # Avoid building object leak test code for optimized library
 ifndef BUILD_OPT
 ifdef PKIX_OBJECT_LEAK_TEST
@@ -188,3 +203,8 @@ DEFINES += -DNO_NSPR_10_SUPPORT
 
 # Hide old, deprecated, TLS cipher suite names when building NSS
 DEFINES += -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES
+
+# Mozilla's mozilla/modules/zlib/src/zconf.h adds the MOZ_Z_ prefix to zlib
+# exported symbols, which causes problem when NSS is built as part of Mozilla.
+# So we add a NSS_SSL_ENABLE_ZLIB variable to allow Mozilla to turn this off.
+NSS_SSL_ENABLE_ZLIB = 1
diff --git a/nss/coreconf/detect_host_arch.py b/nss/coreconf/detect_host_arch.py
new file mode 100644
index 0000000..f161d3c
--- /dev/null
+++ b/nss/coreconf/detect_host_arch.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import print_function
+
+import fnmatch
+import platform
+
+def main():
+    host_arch = platform.machine().lower()
+    if host_arch in ('amd64', 'x86_64'):
+        host_arch = 'x64'
+    elif fnmatch.fnmatch(host_arch, 'i?86') or host_arch == 'i86pc':
+        host_arch = 'x64'
+    elif host_arch.startswith('arm'):
+        host_arch = 'arm'
+    elif host_arch.startswith('mips'):
+        host_arch = 'mips'
+    print(host_arch)
+
+if __name__ == '__main__':
+    main()
diff --git a/nss/coreconf/empty.c b/nss/coreconf/empty.c
new file mode 100644
index 0000000..a8cf976
--- /dev/null
+++ b/nss/coreconf/empty.c
@@ -0,0 +1 @@
+/* This file is intentionally empty */
diff --git a/nss/coreconf/mkdepend/parse.c b/nss/coreconf/mkdepend/parse.c
index 763ea00..5229d66 100644
--- a/nss/coreconf/mkdepend/parse.c
+++ b/nss/coreconf/mkdepend/parse.c
@@ -429,9 +429,16 @@ struct symtab **
 slookup(char *symbol, struct inclist *file)
 {
 	register int first = 0;
-	register int last = file->i_ndefs - 1;
+	register int last;
 
-	if (file) while (last >= first)
+	if (!file)
+	{
+	    return NULL;
+	}
+
+	last = file->i_ndefs - 1;
+
+	while (last >= first)
 	{
 	    /* Fast inline binary search */
 	    register char *s1;
@@ -461,7 +468,7 @@ slookup(char *symbol, struct inclist *file)
 	        last = middle - 1;
 	    }
 	}
-	return(NULL);
+	return NULL;
 }
 
 static int 
diff --git a/nss/coreconf/nsinstall/nsinstall.gyp b/nss/coreconf/nsinstall/nsinstall.gyp
new file mode 100644
index 0000000..efff6bc
--- /dev/null
+++ b/nss/coreconf/nsinstall/nsinstall.gyp
@@ -0,0 +1,21 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nsinstall',
+      'type': 'executable',
+      'sources': [
+        'nsinstall.c',
+        'pathsub.c'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'coreconf'
+  }
+}
\ No newline at end of file
diff --git a/nss/coreconf/nsinstall/pathsub.c b/nss/coreconf/nsinstall/pathsub.c
index 315cda9..a42a9f3 100644
--- a/nss/coreconf/nsinstall/pathsub.c
+++ b/nss/coreconf/nsinstall/pathsub.c
@@ -5,7 +5,6 @@
 /*
 ** Pathname subroutines.
 */
-#include <assert.h>
 #if defined(FREEBSD) || defined(BSDI) || defined(DARWIN)
 #include <sys/types.h>
 #endif /* FREEBSD */
@@ -158,7 +157,6 @@ relatepaths(char *from, char *to, char *outpath)
     int len;
     char buf[NAME_MAX];
 
-    assert(*from == '/' && *to == '/');
     if (!from || *from != '/')
 	fail("relatepaths: from path does not start with /");
     if (!to || *to != '/')
diff --git a/nss/coreconf/nspr.sh b/nss/coreconf/nspr.sh
new file mode 100644
index 0000000..ff5e383
--- /dev/null
+++ b/nss/coreconf/nspr.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+# This script builds NSPR for NSS.
+#
+# This build system is still under development.  It does not yet support all
+# the features or platforms that the regular NSPR build supports.
+
+# variables
+nspr_opt=()
+nspr_cflags=
+nspr_cxxflags=
+nspr_ldflags=
+
+nspr_sanitizer()
+{
+    nspr_cflags="$nspr_cflags $(python $cwd/coreconf/sanitizers.py $1 $2)"
+    nspr_cxxflags="$nspr_cxxflags $(python $cwd/coreconf/sanitizers.py $1 $2)"
+    nspr_ldflags="$nspr_ldflags $(python $cwd/coreconf/sanitizers.py $1 $2)"
+}
+
+verbose()
+{
+    CFLAGS=$nspr_cflags CXXFLAGS=$nspr_cxxflags LDFLAGS=$nspr_ldflags \
+      CC=$CC CXX=$CCC ../configure "${nspr_opt[@]}" --prefix="$obj_dir"
+    make -C "$cwd/../nspr/$target"
+    make -C "$cwd/../nspr/$target" install
+}
+
+silent()
+{
+    echo "[1/3] configure NSPR ..."
+    CFLAGS=$nspr_cflags CXXFLAGS=$nspr_cxxflags LDFLAGS=$nspr_ldflags \
+      CC=$CC CXX=$CCC ../configure "${nspr_opt[@]}" --prefix="$obj_dir" 1> /dev/null
+    echo "[2/3] make NSPR ..."
+    make -C "$cwd/../nspr/$target" 1> /dev/null
+    echo "[3/3] install NSPR ..."
+    make -C "$cwd/../nspr/$target" install 1> /dev/null
+}
+
+build_nspr()
+{
+    mkdir -p "$cwd/../nspr/$target"
+    cd "$cwd/../nspr/$target"
+    if [ "$1" == 1 ]; then
+        verbose
+    else
+        silent
+    fi
+}
diff --git a/nss/coreconf/rules.mk b/nss/coreconf/rules.mk
index 34b742a..3a80135 100644
--- a/nss/coreconf/rules.mk
+++ b/nss/coreconf/rules.mk
@@ -364,7 +364,11 @@ else
 # Windows
 ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
 NEED_ABSOLUTE_PATH := 1
-ifdef .PYMAKE
+# CURDIR is always an absolute path. If it doesn't start with a /, it's a
+# Windows path meaning we're running under MINGW make (as opposed to MSYS
+# make), or pymake. In both cases, it's preferable to use a Windows path,
+# so use $(CURDIR) as is.
+ifeq (,$(filter /%,$(CURDIR)))
 PWD := $(CURDIR)
 else
 PWD := $(shell pwd)
@@ -382,7 +386,7 @@ endif
 endif
 
 # The quotes allow absolute paths to contain spaces.
-core_abspath = "$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(1)),$(1),$(PWD)/$(1)))"
+core_abspath = '$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(1)),$(1),$(PWD)/$(1)))'
 
 $(OBJDIR)/$(PROG_PREFIX)%$(OBJ_SUFFIX): %.c
 	@$(MAKE_OBJDIR)
diff --git a/nss/coreconf/sanitizers.mk b/nss/coreconf/sanitizers.mk
new file mode 100644
index 0000000..6fd728c
--- /dev/null
+++ b/nss/coreconf/sanitizers.mk
@@ -0,0 +1,35 @@
+# Address Sanitizer support; include this in OS-specific .mk files
+# *after* defining the variables that are appended to here.
+
+ifeq ($(USE_ASAN), 1)
+SANITIZER_FLAGS_COMMON = -fsanitize=address
+
+ifeq ($(USE_UBSAN), 1)
+SANITIZER_FLAGS_COMMON += -fsanitize=undefined -fno-sanitize-recover=undefined
+endif
+
+ifeq ($(FUZZ), 1)
+SANITIZER_FLAGS_COMMON += -fsanitize-coverage=edge
+endif
+
+SANITIZER_FLAGS_COMMON += $(EXTRA_SANITIZER_FLAGS)
+SANITIZER_CFLAGS = $(SANITIZER_FLAGS_COMMON)
+SANITIZER_LDFLAGS = $(SANITIZER_FLAGS_COMMON)
+OS_CFLAGS += $(SANITIZER_CFLAGS)
+LDFLAGS += $(SANITIZER_LDFLAGS)
+
+# ASan needs frame pointers to save stack traces for allocation/free sites.
+# (Warning: some platforms, like ARM Linux in Thumb mode, don't have useful
+# frame pointers even with this option.)
+SANITIZER_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
+
+ifdef BUILD_OPT
+# You probably want to be able to get debug info for failures, even with an
+# optimized build.
+OPTIMIZER += -g
+else
+# Try maintaining reasonable performance, ASan and UBSan slow things down.
+OPTIMIZER += -O1
+endif
+
+endif
diff --git a/nss/coreconf/sanitizers.py b/nss/coreconf/sanitizers.py
new file mode 100644
index 0000000..2f62d00
--- /dev/null
+++ b/nss/coreconf/sanitizers.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python2
+
+from __future__ import print_function
+import sys
+
+def main():
+    if len(sys.argv) < 2:
+        raise Exception('Specify either "ld", asan", "msan", "sancov" or "ubsan" as argument.')
+
+    sanitizer = sys.argv[1]
+    if sanitizer == "ubsan":
+        print('-fsanitize=undefined -fno-sanitize-recover=undefined ', end='')
+        return
+    if sanitizer == "asan":
+        print('-fsanitize=address ', end='')
+        print('-fno-omit-frame-pointer -fno-optimize-sibling-calls ', end='')
+        return
+    if sanitizer == "msan":
+        print('-fsanitize=memory -fsanitize-memory-track-origins ', end='')
+        print('-fno-omit-frame-pointer -fno-optimize-sibling-calls ', end='')
+        return
+    if sanitizer == "sancov":
+        if len(sys.argv) < 3:
+            raise Exception('sancov requires another argument (edge|bb|func).')
+        print('-fsanitize-coverage='+sys.argv[2]+' ', end='')
+        return
+
+    # We have to remove this from the ld flags when building asan.
+    if sanitizer == "ld":
+        print('-Wl,-z,defs ', end='')
+        return
+
+    raise Exception('Specify either "ld", asan", "msan", "sancov" or "ubsan" as argument.')
+
+if __name__ == '__main__':
+    main()
diff --git a/nss/coreconf/shlibsign.py b/nss/coreconf/shlibsign.py
new file mode 100644
index 0000000..dc40a8c
--- /dev/null
+++ b/nss/coreconf/shlibsign.py
@@ -0,0 +1,30 @@
+#!/usr/bin/env python2
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import os
+import subprocess
+import sys
+
+def main():
+    for lib_file in sys.argv[1:]:
+        if os.path.isfile(lib_file):
+            sign(lib_file)
+
+def sign(lib_file):
+    ld_lib_path = os.path.realpath(os.path.join(lib_file, '..'))
+    bin_path = os.path.realpath(os.path.join(ld_lib_path, '../bin'))
+
+    env = os.environ.copy()
+    if sys.platform == 'win32':
+        env['PATH'] = os.pathsep.join((env['PATH'], ld_lib_path))
+    else:
+        env['LD_LIBRARY_PATH'] = env['DYLD_LIBRARY_PATH'] = ld_lib_path
+
+    dev_null = open(os.devnull, 'wb')
+    subprocess.check_call([os.path.join(bin_path, 'shlibsign'), '-v', '-i', lib_file], env=env, stdout=dev_null, stderr=dev_null)
+
+if __name__ == '__main__':
+    main()
diff --git a/nss/coreconf/werror.py b/nss/coreconf/werror.py
new file mode 100644
index 0000000..a37fad9
--- /dev/null
+++ b/nss/coreconf/werror.py
@@ -0,0 +1,58 @@
+#!/usr/bin/env python
+
+import os
+import subprocess
+
+def main():
+    cc = os.environ.get('CC', 'cc')
+    sink = open(os.devnull, 'wb')
+    try:
+        cc_is_clang = 'clang' in subprocess.check_output([cc, '--version'], stderr=sink)
+    except OSError:
+        # We probably just don't have CC/cc.
+        return
+
+    def warning_supported(warning):
+        return subprocess.call([cc, '-x', 'c', '-E', '-Werror',
+                                '-W%s' % warning, os.devnull], stdout=sink, stderr=sink) == 0
+    def can_enable():
+        # This would be a problem
+        if not warning_supported('all'):
+            return False
+
+        # If we aren't clang, make sure we have gcc 4.8 at least
+        if not cc_is_clang:
+            try:
+                v = subprocess.check_output([cc, '-dumpversion'], stderr=sink)
+                v = v.strip(' \r\n').split('.')
+                if v[0] < 4 or (v[0] == 4 and v[1] < 8):
+                    # gcc 4.8 minimum
+                    return False
+            except OSError:
+                return False
+        return True
+
+    if not can_enable():
+        print('-DNSS_NO_GCC48')
+        return
+
+    print('-Werror')
+    print('-Wall')
+
+    def set_warning(warning, contra=''):
+        if warning_supported(warning):
+            print('-W%s%s' % (contra, warning))
+
+    if cc_is_clang:
+        # clang is unable to handle glib's expansion of strcmp and similar for
+        # optimized builds, so disable the resulting errors.
+        # See https://llvm.org/bugs/show_bug.cgi?id=20144
+        for w in ['array-bounds', 'unevaluated-expression',
+                  'parentheses-equality']:
+            set_warning(w, 'no-')
+        print('-Qunused-arguments')
+
+    # set_warning('shadow') # Bug 1309068
+
+if __name__ == '__main__':
+    main()
diff --git a/nss/coreconf/zlib.mk b/nss/coreconf/zlib.mk
new file mode 100644
index 0000000..a8504b7
--- /dev/null
+++ b/nss/coreconf/zlib.mk
@@ -0,0 +1,17 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# Configuration information for linking against zlib.
+
+# If a platform has a system zlib, set USE_SYSTEM_ZLIB to 1 and
+# ZLIB_LIBS to the linker command-line arguments for the system zlib
+# (for example, -lz) in the platform's config file in coreconf.
+ifdef USE_SYSTEM_ZLIB
+OS_LIBS += $(ZLIB_LIBS)
+else
+ZLIB_LIBS = $(DIST)/lib/$(LIB_PREFIX)zlib.$(LIB_SUFFIX)
+EXTRA_LIBS += $(ZLIB_LIBS)
+endif
+