[Backport] CVE-2019-18197 - Multiple vulnerabilities in XMLv5.12.8

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/1998984
and https://chromium-review.googlesource.com/c/chromium/src/+/1906950

Roll libxml2 and libxslt

M-80 merge

The new libxml git hash is a7fe7ee45938c53a8dd028dd40baa461191a2fd2
The new libxslt git hash is 3653123f992db24cec417d12600f4c67388025e3

Unfortunately we don't have the old hashes.

Some xslt template's were updated because the new version of libxslt
requires a MATCH or TEST attribute for a template tag. This is per spec.

(cherry picked from commit 6718c0cd782a6360f819133a945b898fe9e4859f)

Bug: 1020745
Change-Id: I6c43aa29ec4e1bca92c2891b2f310476e703e328
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

39 files changed, 580 insertions, 353 deletions

diff --git a/chromium/third_party/libxml/README.chromium b/chromium/third_party/libxml/README.chromium
index ac875c0488c..de203fe01dc 100644
--- a/chromium/third_party/libxml/README.chromium
+++ b/chromium/third_party/libxml/README.chromium
@@ -1,6 +1,6 @@
 Name: libxml
 URL: http://xmlsoft.org
-Version: 6a6fb8560e75c3b9c15744ef20df9fce9fcd8c6e
+Version: a7fe7ee45938c53a8dd028dd40baa461191a2fd2
 License: MIT
 License File: src/Copyright
 Security Critical: yes
diff --git a/chromium/third_party/libxml/src/libxml2.spec b/chromium/third_party/libxml/src/libxml2.spec
index 52cbeb835c3..e43a371f22a 100644
--- a/chromium/third_party/libxml/src/libxml2.spec
+++ b/chromium/third_party/libxml/src/libxml2.spec
@@ -203,6 +203,6 @@ rm -fr %{buildroot}
 %endif # with_python3
 
 %changelog
-* Tue Feb 19 2019 Daniel Veillard <veillard@redhat.com>
+* Fri Nov  8 2019 Daniel Veillard <veillard@redhat.com>
 - upstream release 2.9.9 see http://xmlsoft.org/news.html
 
diff --git a/chromium/third_party/libxml/src/parser.c b/chromium/third_party/libxml/src/parser.c
index 4e767091683..3a8a0d79e96 100644
--- a/chromium/third_party/libxml/src/parser.c
+++ b/chromium/third_party/libxml/src/parser.c
@@ -2081,8 +2081,8 @@ static void xmlSHRINK (xmlParserCtxtPtr ctxt) {
 	xmlGROW (ctxt);
 
 static void xmlGROW (xmlParserCtxtPtr ctxt) {
-    ptrdiff_t curEnd = ctxt->input->end - ctxt->input->cur;
-    ptrdiff_t curBase = ctxt->input->cur - ctxt->input->base;
+    unsigned long curEnd = ctxt->input->end - ctxt->input->cur;
+    unsigned long curBase = ctxt->input->cur - ctxt->input->base;
 
     if (((curEnd > (unsigned long) XML_MAX_LOOKUP_LIMIT) ||
          (curBase > (unsigned long) XML_MAX_LOOKUP_LIMIT)) &&
@@ -8857,18 +8857,6 @@ xmlParseQNameAndCompare(xmlParserCtxtPtr ctxt, xmlChar const *name,
  *     caller if it was copied, this can be detected by val[*len] == 0.
  */
 
-#define GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end) \
-    const xmlChar *oldbase = ctxt->input->base;\
-    GROW;\
-    if (ctxt->instate == XML_PARSER_EOF)\
-        return(NULL);\
-    if (oldbase != ctxt->input->base) {\
-        ptrdiff_t delta = ctxt->input->base - oldbase;\
-        start = start + delta;\
-        in = in + delta;\
-    }\
-    end = ctxt->input->end;
-
 static xmlChar *
 xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
                          int normalize)
@@ -8898,7 +8886,14 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
     end = ctxt->input->end;
     start = in;
     if (in >= end) {
-        GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end)
+        const xmlChar *oldbase = ctxt->input->base;
+	GROW;
+	if (oldbase != ctxt->input->base) {
+	    long delta = ctxt->input->base - oldbase;
+	    start = start + delta;
+	    in = in + delta;
+	}
+	end = ctxt->input->end;
     }
     if (normalize) {
         /*
@@ -8915,7 +8910,16 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
 	    in++;
 	    start = in;
 	    if (in >= end) {
-                GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end)
+		const xmlChar *oldbase = ctxt->input->base;
+		GROW;
+                if (ctxt->instate == XML_PARSER_EOF)
+                    return(NULL);
+		if (oldbase != ctxt->input->base) {
+		    long delta = ctxt->input->base - oldbase;
+		    start = start + delta;
+		    in = in + delta;
+		}
+		end = ctxt->input->end;
                 if (((in - start) > XML_MAX_TEXT_LENGTH) &&
                     ((ctxt->options & XML_PARSE_HUGE) == 0)) {
                     xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
@@ -8929,7 +8933,16 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
 	    col++;
 	    if ((*in++ == 0x20) && (*in == 0x20)) break;
 	    if (in >= end) {
-                GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end)
+		const xmlChar *oldbase = ctxt->input->base;
+		GROW;
+                if (ctxt->instate == XML_PARSER_EOF)
+                    return(NULL);
+		if (oldbase != ctxt->input->base) {
+		    long delta = ctxt->input->base - oldbase;
+		    start = start + delta;
+		    in = in + delta;
+		}
+		end = ctxt->input->end;
                 if (((in - start) > XML_MAX_TEXT_LENGTH) &&
                     ((ctxt->options & XML_PARSE_HUGE) == 0)) {
                     xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
@@ -8958,7 +8971,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
                 if (ctxt->instate == XML_PARSER_EOF)
                     return(NULL);
 		if (oldbase != ctxt->input->base) {
-		    ptrdiff_t delta = ctxt->input->base - oldbase;
+		    long delta = ctxt->input->base - oldbase;
 		    start = start + delta;
 		    in = in + delta;
 		    last = last + delta;
@@ -8985,7 +8998,16 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
 	    in++;
 	    col++;
 	    if (in >= end) {
-                GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end)
+		const xmlChar *oldbase = ctxt->input->base;
+		GROW;
+                if (ctxt->instate == XML_PARSER_EOF)
+                    return(NULL);
+		if (oldbase != ctxt->input->base) {
+		    long delta = ctxt->input->base - oldbase;
+		    start = start + delta;
+		    in = in + delta;
+		}
+		end = ctxt->input->end;
                 if (((in - start) > XML_MAX_TEXT_LENGTH) &&
                     ((ctxt->options & XML_PARSE_HUGE) == 0)) {
                     xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
diff --git a/chromium/third_party/libxml/src/xmlreader.c b/chromium/third_party/libxml/src/xmlreader.c
index 1f6d8f6a06e..ad9ce0101c6 100644
--- a/chromium/third_party/libxml/src/xmlreader.c
+++ b/chromium/third_party/libxml/src/xmlreader.c
@@ -32,7 +32,6 @@
 #include <libxml/xmlIO.h>
 #include <libxml/xmlreader.h>
 #include <libxml/parserInternals.h>
-
 #ifdef LIBXML_SCHEMAS_ENABLED
 #include <libxml/relaxng.h>
 #include <libxml/xmlschemas.h>
@@ -2267,16 +2266,16 @@ xmlFreeTextReader(xmlTextReaderPtr reader) {
     if (reader->ctxt != NULL) {
         if (reader->dict == reader->ctxt->dict)
 	    reader->dict = NULL;
-#ifdef LIBXML_REGEXP_ENABLED
 	if ((reader->ctxt->vctxt.vstateTab != NULL) &&
 	    (reader->ctxt->vctxt.vstateMax > 0)){
+#ifdef LIBXML_REGEXP_ENABLED
             while (reader->ctxt->vctxt.vstateNr > 0)
                 xmlValidatePopElement(&reader->ctxt->vctxt, NULL, NULL, NULL);
+#endif
 	    xmlFree(reader->ctxt->vctxt.vstateTab);
 	    reader->ctxt->vctxt.vstateTab = NULL;
 	    reader->ctxt->vctxt.vstateMax = 0;
 	}
-#endif
 	if (reader->ctxt->myDoc != NULL) {
 	    if (reader->preserve == 0)
 		xmlTextReaderFreeDoc(reader, reader->ctxt->myDoc);
diff --git a/chromium/third_party/libxslt/README.chromium b/chromium/third_party/libxslt/README.chromium
index 4a5ebe33073..90711e538e3 100644
--- a/chromium/third_party/libxslt/README.chromium
+++ b/chromium/third_party/libxslt/README.chromium
@@ -1,6 +1,6 @@
 Name: libxslt
 URL: http://xmlsoft.org/XSLT
-Version: d1a26a3ff708f3f477bc3f6ef35691fb96be7520
+Version: 3653123f992db24cec417d12600f4c67388025e3
 Security Critical: yes
 License: MIT
 License File: src/Copyright
diff --git a/chromium/third_party/libxslt/linux/config.h b/chromium/third_party/libxslt/linux/config.h
index bdd8fef8477..1e002f2928c 100644
--- a/chromium/third_party/libxslt/linux/config.h
+++ b/chromium/third_party/libxslt/linux/config.h
@@ -143,7 +143,7 @@
 #define HAVE_VSPRINTF 1
 
 /* Define to 1 if you have the <xlocale.h> header file. */
-#define HAVE_XLOCALE_H 1
+/* #undef HAVE_XLOCALE_H */
 
 /* Define to 1 if you have the `_stat' function. */
 /* #undef HAVE__STAT */
@@ -161,7 +161,7 @@
 #define PACKAGE_NAME "libxslt"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "libxslt 1.1.33"
+#define PACKAGE_STRING "libxslt 1.1.34"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "libxslt"
@@ -170,7 +170,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.1.33"
+#define PACKAGE_VERSION "1.1.34"
 
 /* Define to 1 if you have the ANSI C header files. */
 #define STDC_HEADERS 1
@@ -198,11 +198,14 @@
 
 
 /* Version number of package */
-#define VERSION "1.1.33"
+#define VERSION "1.1.34"
 
 /* Define if debugging support is enabled */
 /* #undef WITH_DEBUGGER */
 
+/* Define if profiling support is enabled */
+#define WITH_PROFILER /**/
+
 /* Define to 1 if on MINIX. */
 /* #undef _MINIX */
 
diff --git a/chromium/third_party/libxslt/linux/libexslt/exsltconfig.h b/chromium/third_party/libxslt/linux/libexslt/exsltconfig.h
index 443ee0943dc..112bd6f0be0 100644
--- a/chromium/third_party/libxslt/linux/libexslt/exsltconfig.h
+++ b/chromium/third_party/libxslt/linux/libexslt/exsltconfig.h
@@ -18,7 +18,7 @@ extern "C" {
  *
  * the version string like "1.2.3"
  */
-#define LIBEXSLT_DOTTED_VERSION "1.1.33"
+#define LIBEXSLT_DOTTED_VERSION "1.1.34"
 
 /**
  * LIBEXSLT_VERSION:
diff --git a/chromium/third_party/libxslt/linux/libxslt/xsltwin32config.h b/chromium/third_party/libxslt/linux/libxslt/xsltwin32config.h
index ceccadc7b29..8085bc2fa82 100644
--- a/chromium/third_party/libxslt/linux/libxslt/xsltwin32config.h
+++ b/chromium/third_party/libxslt/linux/libxslt/xsltwin32config.h
@@ -23,21 +23,21 @@ extern "C" {
  *
  * the version string like "1.2.3"
  */
-#define LIBXSLT_DOTTED_VERSION "1.1.33"
+#define LIBXSLT_DOTTED_VERSION "1.1.34"
 
 /**
  * LIBXSLT_VERSION:
  *
  * the version number: 1.2.3 value is 1002003
  */
-#define LIBXSLT_VERSION 10133
+#define LIBXSLT_VERSION 10134
 
 /**
  * LIBXSLT_VERSION_STRING:
  *
  * the version number string, 1.2.3 value is "1002003"
  */
-#define LIBXSLT_VERSION_STRING "10133"
+#define LIBXSLT_VERSION_STRING "10134"
 
 /**
  * LIBXSLT_VERSION_EXTRA:
diff --git a/chromium/third_party/libxslt/mac/config.h b/chromium/third_party/libxslt/mac/config.h
index 04d8185a8ed..aa19ee779d7 100644
--- a/chromium/third_party/libxslt/mac/config.h
+++ b/chromium/third_party/libxslt/mac/config.h
@@ -161,7 +161,7 @@
 #define PACKAGE_NAME "libxslt"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "libxslt 1.1.33"
+#define PACKAGE_STRING "libxslt 1.1.34"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "libxslt"
@@ -170,7 +170,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.1.33"
+#define PACKAGE_VERSION "1.1.34"
 
 /* Define to 1 if you have the ANSI C header files. */
 #define STDC_HEADERS 1
@@ -198,11 +198,14 @@
 
 
 /* Version number of package */
-#define VERSION "1.1.33"
+#define VERSION "1.1.34"
 
 /* Define if debugging support is enabled */
 /* #undef WITH_DEBUGGER */
 
+/* Define if profiling support is enabled */
+#define WITH_PROFILER /**/
+
 /* Define to 1 if on MINIX. */
 /* #undef _MINIX */
 
diff --git a/chromium/third_party/libxslt/src/Makefile.am b/chromium/third_party/libxslt/src/Makefile.am
index ff10f574e99..2c417d0be23 100644
--- a/chromium/third_party/libxslt/src/Makefile.am
+++ b/chromium/third_party/libxslt/src/Makefile.am
@@ -38,6 +38,7 @@ xsltConf.sh: xsltConf.sh.in Makefile
 	    -e 's?\@XSLT_INCLUDEDIR\@?$(XSLT_INCLUDEDIR)?g' \
 	    -e 's?\@VERSION\@?$(VERSION)?g' \
 	    -e 's?\@XSLT_LIBS\@?$(XSLT_LIBS) $(EXTRA_LIBS)?g' \
+	    -e 's?\@XSLT_PRIVATE_LIBS\@?$(XSLT_PRIVATE_LIBS)?g' \
 	       < $(srcdir)/xsltConf.sh.in > xsltConf.tmp \
 	&& mv xsltConf.tmp xsltConf.sh
 
diff --git a/chromium/third_party/libxslt/src/config.h.in b/chromium/third_party/libxslt/src/config.h.in
index 62d5ce6345a..7b77e13a435 100644
--- a/chromium/third_party/libxslt/src/config.h.in
+++ b/chromium/third_party/libxslt/src/config.h.in
@@ -202,6 +202,9 @@
 /* Define if debugging support is enabled */
 #undef WITH_DEBUGGER
 
+/* Define if profiling support is enabled */
+#undef WITH_PROFILER
+
 /* Define to 1 if on MINIX. */
 #undef _MINIX
 
diff --git a/chromium/third_party/libxslt/src/configure.ac b/chromium/third_party/libxslt/src/configure.ac
index 60c3ba063b0..786e8a258b4 100644
--- a/chromium/third_party/libxslt/src/configure.ac
+++ b/chromium/third_party/libxslt/src/configure.ac
@@ -3,7 +3,7 @@ AC_PREREQ(2.63)
 
 m4_define([MAJOR_VERSION], [1])
 m4_define([MINOR_VERSION], [1])
-m4_define([MICRO_VERSION], [33])
+m4_define([MICRO_VERSION], [34])
 
 AC_INIT([libxslt], [MAJOR_VERSION.MINOR_VERSION.MICRO_VERSION])
 AC_CONFIG_SRCDIR([libxslt/xslt.c])
@@ -403,6 +403,20 @@ fi
 AC_SUBST(WITH_DEBUGGER)
 
 dnl
+dnl Is profiler support requested
+dnl
+AC_ARG_WITH(profiler, [  --with-profiler        Add the profiling support (on)])
+if test "$with_profiler" = "no" ; then
+    echo Disabling profiler
+    WITH_PROFILER=0
+else
+    echo Enabling profiler
+    WITH_PROFILER=1
+    AC_DEFINE([WITH_PROFILER],[], [Define if profiling support is enabled])
+fi
+AC_SUBST(WITH_PROFILER)
+
+dnl
 dnl The following new parameters were added to offer
 dnl the ability to specify the location of the libxml
 dnl library during linking and compilation.
@@ -460,7 +474,7 @@ if test "${GCC}" != "yes" ; then
                ;;
     esac
 else
-    CFLAGS="${CFLAGS} -Wall -Wformat=2 -Wmissing-format-attribute"
+    CFLAGS="${CFLAGS} -Wall -Wextra -Wformat=2 -Wmissing-format-attribute"
     case "${host}" in
           alpha*-*-linux* )
 	       CFLAGS="${CFLAGS} -mieee"
@@ -472,34 +486,59 @@ else
 fi
 
 dnl
+dnl Check which type of library to build. Default to building shared and static.
+dnl
+
+build_shared_libs="yes"
+build_static_libs="yes"
+
+if test "$enable_shared" = "no"; then
+    build_shared_libs="no"
+fi
+
+if test "$enable_static" = "no"; then
+    build_static_libs="no"
+fi
+
+if test "$build_shared_libs" = "no" -a "$build_static_libs" = "no"; then
+    build_static_libs="yes"
+fi
+
+dnl
 dnl Override other variables if LIBXML_SRC is set
 dnl
 
-if test "x$LIBXML_SRC" != "x"
-then
-	CWD=`pwd`
-	if cd $LIBXML_SRC
-	then
-		LIBXML_SRC=`pwd`
-		XML_CONFIG="${LIBXML_SRC}/xml2-config"
-		LIBXML_CFLAGS="-I${LIBXML_SRC}/include"
-		LIBXML_LIBS="-L${LIBXML_SRC} `$XML_CONFIG --libs`"
-                WITH_MODULES="`$XML_CONFIG --modules`"
-		cd $CWD
-	else
-		AC_MSG_ERROR([libxml source dir not found (${LIBXML_SRC}), typo?])
-	fi
+if test "x$LIBXML_SRC" != "x"; then
+    CWD=`pwd`
+    if cd $LIBXML_SRC; then
+        LIBXML_SRC=`pwd`
+        XML_CONFIG="${LIBXML_SRC}/xml2-config"
+        LIBXML_CFLAGS="-I${LIBXML_SRC}/include"
+        if test "$build_static_libs" = "no"; then
+            LIBXML_LIBS="-L${LIBXML_SRC} `$XML_CONFIG --libs --dynamic`"
+        else
+            LIBXML_LIBS="-L${LIBXML_SRC} `$XML_CONFIG --libs`"
+        fi
+        WITH_MODULES="`$XML_CONFIG --modules`"
+        cd $CWD
+    else
+        AC_MSG_ERROR([libxml source dir not found (${LIBXML_SRC}), typo?])
+    fi
 fi
 
 dnl
 dnl Try pkg-config first if nothing is set
 dnl
 
-if test "x$LIBXML_CONFIG_PREFIX" = "x" -a "x$LIBXML_LIBS" = "x"
-then
-	PKG_CHECK_MODULES([LIBXML], [libxml-2.0 >= $LIBXML_REQUIRED_VERSION], [
-		WITH_MODULES="`$PKG_CONFIG --variable=modules libxml-2.0`"
-	], [ ])
+if test "x$LIBXML_CONFIG_PREFIX" = "x" -a "x$LIBXML_LIBS" = "x"; then
+    if test "$build_static_libs" = "no"; then
+        PKG_CHECK_MODULES([LIBXML], [libxml-2.0 >= $LIBXML_REQUIRED_VERSION], [
+            WITH_MODULES="`$PKG_CONFIG --variable=modules libxml-2.0`"
+        ], [ ])
+    else
+        PKG_CHECK_MODULES_STATIC([LIBXML], [libxml-2.0 >= $LIBXML_REQUIRED_VERSION],
+        [ ], [ ])
+    fi
 fi
 
 dnl
@@ -509,15 +548,19 @@ dnl
 
 if test "x$LIBXML_LIBS" = "x" && ${XML_CONFIG} --libs print > /dev/null 2>&1
 then
-        AC_MSG_CHECKING(for libxml libraries >= $LIBXML_REQUIRED_VERSION)
-	XMLVERS=`$XML_CONFIG --version`
-	if test VERSION_TO_NUMBER(echo $XMLVERS) -ge VERSION_TO_NUMBER(echo $LIBXML_REQUIRED_VERSION)
-	then
-		AC_MSG_RESULT($XMLVERS found)
-	else
-		AC_MSG_ERROR(Version $XMLVERS found. You need at least libxml2 $LIBXML_REQUIRED_VERSION for this version of libxslt)
-	fi
-	LIBXML_LIBS="`$XML_CONFIG --libs`"
+    AC_MSG_CHECKING(for libxml libraries >= $LIBXML_REQUIRED_VERSION)
+    XMLVERS=`$XML_CONFIG --version`
+    if test VERSION_TO_NUMBER(echo $XMLVERS) -ge VERSION_TO_NUMBER(echo $LIBXML_REQUIRED_VERSION); then
+        AC_MSG_RESULT($XMLVERS found)
+    else
+        AC_MSG_ERROR(Version $XMLVERS found. You need at least libxml2 $LIBXML_REQUIRED_VERSION for this version of libxslt)
+    fi
+
+    if test "$build_static_libs" = "no"; then
+        LIBXML_LIBS="`$XML_CONFIG --libs --dynamic`"
+    else
+        LIBXML_LIBS="`$XML_CONFIG --libs`"
+    fi
 	LIBXML_CFLAGS="`$XML_CONFIG --cflags`"
         WITH_MODULES="`$XML_CONFIG --modules`"
 fi
@@ -540,7 +583,7 @@ then
 fi
 
 AC_MSG_CHECKING([whether shared libraries will be built (required for plugins)])
-if test "$enable_shared" = "no" -a "$with_plugins" = "yes"; then
+if test "$build_shared_libs" = "no" -a "$with_plugins" = "yes"; then
 	 AC_MSG_RESULT(no)
 	 AC_MSG_WARN([Disabling plugin support.])
 	 AC_MSG_WARN([Plugins require that shared libraries be built.])
@@ -598,17 +641,21 @@ AC_SUBST(PYTHON_SITE_PACKAGES)
 
 XSLT_LIBDIR='-L${libdir}'
 XSLT_INCLUDEDIR='-I${includedir}'
-XSLT_LIBS="-lxslt $LIBXML_LIBS $M_LIBS"
+XSLT_LIBS="-lxslt $LIBXML_LIBS"
+XSLT_PRIVATE_LIBS="$M_LIBS"
 AC_SUBST(XSLT_LIBDIR)
 AC_SUBST(XSLT_INCLUDEDIR)
 AC_SUBST(XSLT_LIBS)
+AC_SUBST(XSLT_PRIVATE_LIBS)
 
 EXSLT_LIBDIR='-L${libdir}'
 EXSLT_INCLUDEDIR='-I${includedir}'
-EXSLT_LIBS="-lexslt $XSLT_LIBS $LIBGCRYPT_LIBS"
+EXSLT_LIBS="-lexslt $XSLT_LIBS"
+EXSLT_PRIVATE_LIBS="$XSLT_PRIVATE_LIBS $LIBGCRYPT_LIBS"
 AC_SUBST(EXSLT_LIBDIR)
 AC_SUBST(EXSLT_INCLUDEDIR)
 AC_SUBST(EXSLT_LIBS)
+AC_SUBST(EXSLT_PRIVATE_LIBS)
 
 AC_SUBST(EXTRA_LIBS)
 
@@ -660,9 +707,12 @@ tests/exslt/strings/Makefile
 tests/exslt/date/Makefile
 tests/exslt/dynamic/Makefile
 tests/plugins/Makefile
+tests/fuzz/Makefile
 doc/Makefile
 xslt-config
 libxslt.spec
 ])
+AC_CONFIG_LINKS([tests/fuzz/xpath.xml:tests/fuzz/xpath.xml])
+AC_CONFIG_LINKS([tests/fuzz/xslt.xml:tests/fuzz/xslt.xml])
 
 AC_OUTPUT
diff --git a/chromium/third_party/libxslt/src/libexslt.pc.in b/chromium/third_party/libxslt/src/libexslt.pc.in
index 16676ff6578..c0e954f0f4a 100644
--- a/chromium/third_party/libxslt/src/libexslt.pc.in
+++ b/chromium/third_party/libxslt/src/libexslt.pc.in
@@ -8,5 +8,6 @@ Name: libexslt
 Version: @LIBEXSLT_VERSION@
 Description: EXSLT Extension library
 Requires: libxml-2.0
-Libs: @EXSLT_LIBDIR@ @EXSLT_LIBS@
 Cflags: @EXSLT_INCLUDEDIR@
+Libs: @EXSLT_LIBDIR@ @EXSLT_LIBS@
+Libs.private: @EXSLT_PRIVATE_LIBS@
diff --git a/chromium/third_party/libxslt/src/libexslt/crypto.c b/chromium/third_party/libxslt/src/libexslt/crypto.c
index ac390387c2b..621fd904eb4 100644
--- a/chromium/third_party/libxslt/src/libexslt/crypto.c
+++ b/chromium/third_party/libxslt/src/libexslt/crypto.c
@@ -755,7 +755,14 @@ exsltCryptoRc4DecryptFunction (xmlXPathParserContextPtr ctxt, int nargs) {
     PLATFORM_RC4_DECRYPT (ctxt, padkey, bin, ret_len, ret, ret_len);
     ret[ret_len] = 0;
 
-    xmlXPathReturnString (ctxt, ret);
+    if (xmlCheckUTF8(ret) == 0) {
+	xsltTransformError(tctxt, NULL, tctxt->inst,
+	    "exsltCryptoRc4DecryptFunction: Invalid UTF-8\n");
+        xmlFree(ret);
+	xmlXPathReturnEmptyString(ctxt);
+    } else {
+        xmlXPathReturnString(ctxt, ret);
+    }
 
 done:
     if (key != NULL)
diff --git a/chromium/third_party/libxslt/src/libexslt/date.c b/chromium/third_party/libxslt/src/libexslt/date.c
index 6a3eb584592..1ef2a0acc09 100644
--- a/chromium/third_party/libxslt/src/libexslt/date.c
+++ b/chromium/third_party/libxslt/src/libexslt/date.c
@@ -141,9 +141,9 @@ struct _exsltDateDurVal {
 #define IS_LEAP(y)						\
 	(((y & 3) == 0) && ((y % 25 != 0) || ((y & 15) == 0)))
 
-static const unsigned long daysInMonth[12] =
+static const long daysInMonth[12] =
 	{ 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
-static const unsigned long daysInMonthLeap[12] =
+static const long daysInMonthLeap[12] =
 	{ 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
 
 #define MAX_DAYINMONTH(yr,mon)                                  \
@@ -177,9 +177,9 @@ static const unsigned long daysInMonthLeap[12] =
 #define DAYS_PER_EPOCH          (400 * 365 + 100 - 4 + 1)
 #define YEARS_PER_EPOCH         400
 
-static const unsigned long dayInYearByMonth[12] =
+static const long dayInYearByMonth[12] =
 	{ 0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334 };
-static const unsigned long dayInLeapYearByMonth[12] =
+static const long dayInLeapYearByMonth[12] =
 	{ 0, 31, 60, 91, 121, 152, 182, 213, 244, 274, 305, 335 };
 
 #define DAY_IN_YEAR(day, month, year)				\
@@ -187,6 +187,9 @@ static const unsigned long dayInLeapYearByMonth[12] =
                 dayInLeapYearByMonth[month - 1] :		\
                 dayInYearByMonth[month - 1]) + day)
 
+#define YEAR_MAX LONG_MAX
+#define YEAR_MIN (-LONG_MAX + 1)
+
 /**
  * _exsltDateParseGYear:
  * @dt:  pointer to a date structure
@@ -221,7 +224,7 @@ _exsltDateParseGYear (exsltDateValPtr dt, const xmlChar **str)
     firstChar = cur;
 
     while ((*cur >= '0') && (*cur <= '9')) {
-        if (dt->year >= LONG_MAX / 10)
+        if (dt->year >= YEAR_MAX / 10) /* Not really exact */
             return -1;
 	dt->year = dt->year * 10 + (*cur - '0');
 	cur++;
@@ -1474,11 +1477,12 @@ _exsltDateDayInWeek(long yday, long yr)
     long ret;
 
     if (yr <= 0) {
-        ret = ((yr-2 + ((yr/4)-(yr/100)+(yr/400)) + yday) % 7);
+        /* Compute modulus twice to avoid integer overflow */
+        ret = ((yr%7-2 + ((yr/4)-(yr/100)+(yr/400)) + yday) % 7);
         if (ret < 0)
             ret += 7;
     } else
-        ret = (((yr-1) + (((yr-1)/4)-((yr-1)/100)+((yr-1)/400)) + yday) % 7);
+        ret = (((yr%7-1) + (((yr-1)/4)-((yr-1)/100)+((yr-1)/400)) + yday) % 7);
 
     return ret;
 }
@@ -1532,8 +1536,8 @@ _exsltDateAdd (exsltDateValPtr dt, exsltDateDurValPtr dur)
      * pathological cases.
      */
     carry += (dur->day / DAYS_PER_EPOCH) * YEARS_PER_EPOCH;
-    if ((carry > 0 && dt->year > LONG_MAX - carry) ||
-        (carry < 0 && dt->year < LONG_MIN - carry)) {
+    if ((carry > 0 && dt->year > YEAR_MAX - carry) ||
+        (carry < 0 && dt->year < YEAR_MIN - carry)) {
         /* Overflow */
         exsltDateFreeDate(ret);
         return NULL;
@@ -1583,7 +1587,7 @@ _exsltDateAdd (exsltDateValPtr dt, exsltDateDurValPtr dur)
                 ret->mon -= 1;
             }
             else {
-                if (ret->year == LONG_MIN) {
+                if (ret->year == YEAR_MIN) {
                     exsltDateFreeDate(ret);
                     return NULL;
                 }
@@ -1597,7 +1601,7 @@ _exsltDateAdd (exsltDateValPtr dt, exsltDateDurValPtr dur)
                 ret->mon += 1;
             }
             else {
-                if (ret->year == LONG_MAX) {
+                if (ret->year == YEAR_MAX) {
                     exsltDateFreeDate(ret);
                     return NULL;
                 }
diff --git a/chromium/third_party/libxslt/src/libexslt/dynamic.c b/chromium/third_party/libxslt/src/libexslt/dynamic.c
index dd0804bc6bc..9e116283584 100644
--- a/chromium/third_party/libxslt/src/libexslt/dynamic.c
+++ b/chromium/third_party/libxslt/src/libexslt/dynamic.c
@@ -127,7 +127,15 @@ exsltDynMapFunction(xmlXPathParserContextPtr ctxt, int nargs)
         goto cleanup;
     }
 
-    if (str == NULL || !xmlStrlen(str) || !(comp = xmlXPathCompile(str)))
+    tctxt = xsltXPathGetTransformContext(ctxt);
+    if (tctxt == NULL) {
+	xsltTransformError(xsltXPathGetTransformContext(ctxt), NULL, NULL,
+	      "dyn:map : internal error tctxt == NULL\n");
+	goto cleanup;
+    }
+
+    if (str == NULL || !xmlStrlen(str) ||
+        !(comp = xmlXPathCtxtCompile(tctxt->xpathCtxt, str)))
         goto cleanup;
 
     oldDoc = ctxt->context->doc;
@@ -139,12 +147,6 @@ exsltDynMapFunction(xmlXPathParserContextPtr ctxt, int nargs)
 	 * since we really don't know we're going to be adding node(s)
 	 * down the road we create the RVT regardless
 	 */
-    tctxt = xsltXPathGetTransformContext(ctxt);
-    if (tctxt == NULL) {
-	xsltTransformError(xsltXPathGetTransformContext(ctxt), NULL, NULL,
-	      "dyn:map : internal error tctxt == NULL\n");
-	goto cleanup;
-    }
     container = xsltCreateRVT(tctxt);
     if (container == NULL) {
 	xsltTransformError(tctxt, NULL, NULL,
diff --git a/chromium/third_party/libxslt/src/libexslt/functions.c b/chromium/third_party/libxslt/src/libexslt/functions.c
index 41d37493683..2f744311c0d 100644
--- a/chromium/third_party/libxslt/src/libexslt/functions.c
+++ b/chromium/third_party/libxslt/src/libexslt/functions.c
@@ -674,7 +674,7 @@ exsltFuncResultComp (xsltStylesheetPtr style, xmlNodePtr inst,
      */
     sel = xmlGetNsProp(inst, (const xmlChar *) "select", NULL);
     if (sel != NULL) {
-	ret->select = xmlXPathCompile (sel);
+	ret->select = xsltXPathCompileFlags(style, sel, 0);
 	xmlFree(sel);
     }
     /*
diff --git a/chromium/third_party/libxslt/src/libexslt/saxon.c b/chromium/third_party/libxslt/src/libexslt/saxon.c
index 00b74a482a7..e8b64406a3c 100644
--- a/chromium/third_party/libxslt/src/libexslt/saxon.c
+++ b/chromium/third_party/libxslt/src/libexslt/saxon.c
@@ -105,7 +105,7 @@ exsltSaxonExpressionFunction (xmlXPathParserContextPtr ctxt, int nargs) {
     ret = xmlHashLookup(hash, arg);
 
     if (ret == NULL) {
-	 ret = xmlXPathCompile(arg);
+	 ret = xmlXPathCtxtCompile(tctxt->xpathCtxt, arg);
 	 if (ret == NULL) {
 	      xmlFree(arg);
               xmlXPathSetError(ctxt, XPATH_EXPR_ERROR);
diff --git a/chromium/third_party/libxslt/src/libxslt.pc.in b/chromium/third_party/libxslt/src/libxslt.pc.in
index 082d64cdcf4..81f8be1257a 100644
--- a/chromium/third_party/libxslt/src/libxslt.pc.in
+++ b/chromium/third_party/libxslt/src/libxslt.pc.in
@@ -8,5 +8,6 @@ Name: libxslt
 Version: @VERSION@
 Description: XSLT library version 2.
 Requires: libxml-2.0
-Libs: @XSLT_LIBDIR@ @XSLT_LIBS@ @EXTRA_LIBS@
 Cflags: @XSLT_INCLUDEDIR@
+Libs: @XSLT_LIBDIR@ @XSLT_LIBS@ @EXTRA_LIBS@
+Libs.private: @XSLT_PRIVATE_LIBS@
diff --git a/chromium/third_party/libxslt/src/libxslt.spec b/chromium/third_party/libxslt/src/libxslt.spec
index f2d797b205c..80b320fb869 100644
--- a/chromium/third_party/libxslt/src/libxslt.spec
+++ b/chromium/third_party/libxslt/src/libxslt.spec
@@ -1,6 +1,6 @@
 Summary: Library providing the GNOME XSLT engine
 Name: libxslt
-Version: 1.1.33
+Version: 1.1.34
 Release: 1%{?dist}%{?extra_release}
 License: MIT
 Group: Development/Libraries
@@ -70,7 +70,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
 rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/%{name}{,-python}-%{version}
 
 %check
-make check
+make tests
 
 %clean
 rm -fr %{buildroot}
@@ -122,12 +122,11 @@ rm -fr %{buildroot}
 %doc AUTHORS ChangeLog.gz NEWS README Copyright FEATURES
 %{_libdir}/python*/site-packages/libxslt.py*
 %{_libdir}/python*/site-packages/libxsltmod*
-%doc python/TODO
 %doc python/libxsltclass.txt
 %doc python/tests/*.py
 %doc python/tests/*.xml
 %doc python/tests/*.xsl
 
 %changelog
-* Wed Feb 20 2019 Daniel Veillard <veillard@redhat.com>
-- upstream release 1.1.33 see http://xmlsoft.org/XSLT/news.html
+* Fri Nov  8 2019 Daniel Veillard <veillard@redhat.com>
+- upstream release 1.1.34 see http://xmlsoft.org/XSLT/news.html
diff --git a/chromium/third_party/libxslt/src/libxslt.spec.in b/chromium/third_party/libxslt/src/libxslt.spec.in
index 96c0ca65213..f4af4d4b018 100644
--- a/chromium/third_party/libxslt/src/libxslt.spec.in
+++ b/chromium/third_party/libxslt/src/libxslt.spec.in
@@ -70,7 +70,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
 rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/%{name}{,-python}-%{version}
 
 %check
-make check
+make tests
 
 %clean
 rm -fr %{buildroot}
@@ -122,7 +122,6 @@ rm -fr %{buildroot}
 %doc AUTHORS ChangeLog.gz NEWS README Copyright FEATURES
 %{_libdir}/python*/site-packages/libxslt.py*
 %{_libdir}/python*/site-packages/libxsltmod*
-%doc python/TODO
 %doc python/libxsltclass.txt
 %doc python/tests/*.py
 %doc python/tests/*.xml
diff --git a/chromium/third_party/libxslt/src/libxslt/attrvt.c b/chromium/third_party/libxslt/src/libxslt/attrvt.c
index 125159cedf3..a885526e7ed 100644
--- a/chromium/third_party/libxslt/src/libxslt/attrvt.c
+++ b/chromium/third_party/libxslt/src/libxslt/attrvt.c
@@ -48,7 +48,12 @@ struct _xsltAttrVT {
     /*
      * the content is an alternate of string and xmlXPathCompExprPtr
      */
-    void *segments[MAX_AVT_SEG];
+#if __STDC_VERSION__ >= 199901L
+    /* Using a C99 flexible array member avoids false positives under UBSan */
+    void *segments[];
+#else
+    void *segments[1];
+#endif
 };
 
 /**
@@ -62,15 +67,16 @@ struct _xsltAttrVT {
 static xsltAttrVTPtr
 xsltNewAttrVT(xsltStylesheetPtr style) {
     xsltAttrVTPtr cur;
+    size_t size = sizeof(xsltAttrVT) + MAX_AVT_SEG * sizeof(void*);
 
-    cur = (xsltAttrVTPtr) xmlMalloc(sizeof(xsltAttrVT));
+    cur = (xsltAttrVTPtr) xmlMalloc(size);
     if (cur == NULL) {
 	xsltTransformError(NULL, style, NULL,
 		"xsltNewAttrVTPtr : malloc failed\n");
 	if (style != NULL) style->errors++;
 	return(NULL);
     }
-    memset(cur, 0, sizeof(xsltAttrVT));
+    memset(cur, 0, size);
 
     cur->nb_seg = 0;
     cur->max_seg = MAX_AVT_SEG;
@@ -146,11 +152,14 @@ xsltFreeAVTList(void *avt) {
 static xsltAttrVTPtr
 xsltSetAttrVTsegment(xsltAttrVTPtr avt, void *val) {
     if (avt->nb_seg >= avt->max_seg) {
-	avt = (xsltAttrVTPtr) xmlRealloc(avt, sizeof(xsltAttrVT) +
-			avt->max_seg * sizeof(void *));
-	if (avt == NULL) {
+        size_t size = sizeof(xsltAttrVT) +
+                      (avt->max_seg + MAX_AVT_SEG) * sizeof(void *);
+	xsltAttrVTPtr tmp = (xsltAttrVTPtr) xmlRealloc(avt, size);
+	if (tmp == NULL) {
+            xsltFreeAttrVT(avt);
 	    return NULL;
 	}
+        avt = tmp;
 	memset(&avt->segments[avt->nb_seg], 0, MAX_AVT_SEG*sizeof(void *));
 	avt->max_seg += MAX_AVT_SEG;
     }
@@ -164,7 +173,7 @@ xsltSetAttrVTsegment(xsltAttrVTPtr avt, void *val) {
  * @attr: the attribute coming from the stylesheet.
  *
  * Precompile an attribute in a stylesheet, basically it checks if it is
- * an attrubute value template, and if yes establish some structures needed
+ * an attribute value template, and if yes, establish some structures needed
  * to process it at transformation time.
  */
 void
diff --git a/chromium/third_party/libxslt/src/libxslt/functions.c b/chromium/third_party/libxslt/src/libxslt/functions.c
index a21eedc1089..b350545a11b 100644
--- a/chromium/third_party/libxslt/src/libxslt/functions.c
+++ b/chromium/third_party/libxslt/src/libxslt/functions.c
@@ -55,7 +55,7 @@
 
 /**
  * xsltXPathFunctionLookup:
- * @ctxt:  a void * but the XSLT transformation context actually
+ * @vctxt:  a void * but the XSLT transformation context actually
  * @name:  the function name
  * @ns_uri:  the function namespace URI
  *
diff --git a/chromium/third_party/libxslt/src/libxslt/keys.c b/chromium/third_party/libxslt/src/libxslt/keys.c
index 2881056e5db..ecef5382638 100644
--- a/chromium/third_party/libxslt/src/libxslt/keys.c
+++ b/chromium/third_party/libxslt/src/libxslt/keys.c
@@ -241,6 +241,8 @@ skipString(const xmlChar *cur, int end) {
  */
 static int
 skipPredicate(const xmlChar *cur, int end) {
+    int level = 0;
+
     if ((cur == NULL) || (end < 0)) return(-1);
     if (cur[end] != '[') return(end);
     end++;
@@ -251,12 +253,12 @@ skipPredicate(const xmlChar *cur, int end) {
 	        return(-1);
 	    continue;
 	} else if (cur[end] == '[') {
-	    end = skipPredicate(cur, end);
-	    if (end <= 0)
-	        return(-1);
-	    continue;
-	} else if (cur[end] == ']')
-	    return(end + 1);
+            level += 1;
+	} else if (cur[end] == ']') {
+            if (level == 0)
+	        return(end + 1);
+            level -= 1;
+        }
 	end++;
     }
     return(-1);
@@ -629,6 +631,7 @@ xsltInitCtxtKey(xsltTransformContextPtr ctxt, xsltDocumentPtr idoc,
     xmlNodePtr oldContextNode;
     xsltDocumentPtr oldDocInfo;
     int	oldXPPos, oldXPSize;
+    xmlNodePtr oldXPNode;
     xmlDocPtr oldXPDoc;
     int oldXPNsNr;
     xmlNsPtr *oldXPNamespaces;
@@ -667,6 +670,7 @@ fprintf(stderr, "xsltInitCtxtKey %s : %d\n", keyDef->name, ctxt->keyInitLevel);
     oldDocInfo = ctxt->document;
     oldContextNode = ctxt->node;
 
+    oldXPNode = xpctxt->node;
     oldXPDoc = xpctxt->doc;
     oldXPPos = xpctxt->proximityPosition;
     oldXPSize = xpctxt->contextSize;
@@ -865,6 +869,7 @@ error:
     /*
     * Restore context state.
     */
+    xpctxt->node = oldXPNode;
     xpctxt->doc = oldXPDoc;
     xpctxt->nsNr = oldXPNsNr;
     xpctxt->namespaces = oldXPNamespaces;
diff --git a/chromium/third_party/libxslt/src/libxslt/libxslt.syms b/chromium/third_party/libxslt/src/libxslt/libxslt.syms
index 684cd1bd3c2..94b1d8aa4bc 100644
--- a/chromium/third_party/libxslt/src/libxslt/libxslt.syms
+++ b/chromium/third_party/libxslt/src/libxslt/libxslt.syms
@@ -499,3 +499,13 @@ LIBXML2_1.1.30 {
   xsltDecimalFormatGetByQName;
 } LIBXML2_1.1.27;
 
+LIBXML2_1.1.34 {
+    global:
+
+# xsltInternals
+  xsltParseStylesheetUser;
+
+# pattern
+  xsltCompMatchClearCache;
+} LIBXML2_1.1.30;
+
diff --git a/chromium/third_party/libxslt/src/libxslt/numbers.c b/chromium/third_party/libxslt/src/libxslt/numbers.c
index 89e1f668b2b..92023f8a509 100644
--- a/chromium/third_party/libxslt/src/libxslt/numbers.c
+++ b/chromium/third_party/libxslt/src/libxslt/numbers.c
@@ -36,7 +36,7 @@
 
 #define SYMBOL_QUOTE		((xmlChar)'\'')
 
-#define DEFAULT_TOKEN		(xmlChar)'0'
+#define DEFAULT_TOKEN		'0'
 #define DEFAULT_SEPARATOR	"."
 
 #define MAX_TOKENS		1024
@@ -45,7 +45,7 @@ typedef struct _xsltFormatToken xsltFormatToken;
 typedef xsltFormatToken *xsltFormatTokenPtr;
 struct _xsltFormatToken {
     xmlChar	*separator;
-    xmlChar	 token;
+    int		 token;
     int		 width;
 };
 
@@ -107,20 +107,22 @@ xsltUTF8Charcmp(xmlChar *utf1, xmlChar *utf2) {
      (xsltUTF8Charcmp((letter), (self)->patternSeparator) == 0))
 
 #define IS_DIGIT_ZERO(x) xsltIsDigitZero(x)
-#define IS_DIGIT_ONE(x) xsltIsDigitZero((xmlChar)(x)-1)
+#define IS_DIGIT_ONE(x) xsltIsDigitZero((x)-1)
 
 static int
 xsltIsDigitZero(unsigned int ch)
 {
     /*
      * Reference: ftp://ftp.unicode.org/Public/UNIDATA/UnicodeData.txt
+     *
+     * There a many more digit ranges in newer Unicode versions. These
+     * are only the zeros that match Digit in XML 1.0 (IS_DIGIT macro).
      */
     switch (ch) {
     case 0x0030: case 0x0660: case 0x06F0: case 0x0966:
     case 0x09E6: case 0x0A66: case 0x0AE6: case 0x0B66:
     case 0x0C66: case 0x0CE6: case 0x0D66: case 0x0E50:
-    case 0x0E60: case 0x0F20: case 0x1040: case 0x17E0:
-    case 0x1810: case 0xFF10:
+    case 0x0ED0: case 0x0F20:
 	return TRUE;
     default:
 	return FALSE;
@@ -382,11 +384,14 @@ xsltNumberFormatTokenize(const xmlChar *format,
 		tokens->tokens[tokens->nTokens].token = val - 1;
 		ix += len;
 		val = xmlStringCurrentChar(NULL, format+ix, &len);
-	    }
-	} else if ( (val == (xmlChar)'A') ||
-		    (val == (xmlChar)'a') ||
-		    (val == (xmlChar)'I') ||
-		    (val == (xmlChar)'i') ) {
+	    } else {
+                tokens->tokens[tokens->nTokens].token = '0';
+                tokens->tokens[tokens->nTokens].width = 1;
+            }
+	} else if ( (val == 'A') ||
+		    (val == 'a') ||
+		    (val == 'I') ||
+		    (val == 'i') ) {
 	    tokens->tokens[tokens->nTokens].token = val;
 	    ix += len;
 	    val = xmlStringCurrentChar(NULL, format+ix, &len);
@@ -397,7 +402,7 @@ xsltNumberFormatTokenize(const xmlChar *format,
 	     *  not support a numbering sequence that starts with that
 	     *  token, it must use a format token of 1."
 	     */
-	    tokens->tokens[tokens->nTokens].token = (xmlChar)'0';
+	    tokens->tokens[tokens->nTokens].token = '0';
 	    tokens->tokens[tokens->nTokens].width = 1;
 	}
 	/*
@@ -824,6 +829,16 @@ xsltNumberFormat(xsltTransformContextPtr ctxt,
 					      output);
 	    }
 	}
+
+        /*
+         * Unlike `match` patterns, `count` and `from` patterns can contain
+         * variable references, so we have to clear the pattern match
+         * cache if the "direct" matching algorithm was used.
+         */
+        if (data->countPat != NULL)
+            xsltCompMatchClearCache(ctxt, data->countPat);
+        if (data->fromPat != NULL)
+            xsltCompMatchClearCache(ctxt, data->fromPat);
     }
     /* Insert number as text node */
     xsltCopyTextString(ctxt, ctxt->insert, xmlBufferContent(output), 0);
@@ -844,7 +859,8 @@ XSLT_NUMBER_FORMAT_END:
 static int
 xsltFormatNumberPreSuffix(xsltDecimalFormatPtr self, xmlChar **format, xsltFormatNumberInfoPtr info)
 {
-    int	count=0;	/* will hold total length of prefix/suffix */
+    /* will hold total length of prefix/suffix without quote characters */
+    int	count=0;
     int len;
 
     while (1) {
@@ -942,7 +958,6 @@ xsltFormatNumberConversion(xsltDecimalFormatPtr self,
     xmlBufferPtr buffer;
     xmlChar *the_format, *prefix = NULL, *suffix = NULL;
     xmlChar *nprefix, *nsuffix = NULL;
-    xmlChar pchar;
     int	    prefix_length, suffix_length = 0, nprefix_length, nsuffix_length;
     double  scale;
     int	    j, len;
@@ -970,7 +985,7 @@ xsltFormatNumberConversion(xsltDecimalFormatPtr self,
 		*result = xmlStrdup(BAD_CAST "-");
 	    else
 		*result = xmlStrdup(self->minusSign);
-	    /* no-break on purpose */
+	    /* Intentional fall-through */
 	case 1:
 	    if ((self == NULL) || (self->infinity == NULL))
 		*result = xmlStrcat(*result, BAD_CAST "Infinity");
@@ -1267,14 +1282,13 @@ OUTPUT_NUMBER:
 	xmlBufferAdd(buffer, self->minusSign, xmlUTF8Strsize(self->minusSign, 1));
 
     /* Put the prefix into the buffer */
-    for (j = 0; j < prefix_length; j++) {
-	if ((pchar = *prefix++) == SYMBOL_QUOTE) {
-	    len = xmlUTF8Strsize(prefix, 1);
-	    xmlBufferAdd(buffer, prefix, len);
-	    prefix += len;
-	    j += len - 1;	/* length of symbol less length of quote */
-	} else
-	    xmlBufferAdd(buffer, &pchar, 1);
+    for (j = 0; j < prefix_length; ) {
+	if (*prefix == SYMBOL_QUOTE)
+            prefix++;
+        len = xmlUTF8Strsize(prefix, 1);
+        xmlBufferAdd(buffer, prefix, len);
+        prefix += len;
+        j += len;
     }
 
     /* Next do the integer part of the number */
@@ -1283,13 +1297,14 @@ OUTPUT_NUMBER:
     number = floor((scale * number + 0.5)) / scale;
     if ((self->grouping != NULL) &&
         (self->grouping[0] != 0)) {
+        int gchar;
 
 	len = xmlStrlen(self->grouping);
-	pchar = xsltGetUTF8Char(self->grouping, &len);
+	gchar = xsltGetUTF8Char(self->grouping, &len);
 	xsltNumberFormatDecimal(buffer, floor(number), self->zeroDigit[0],
 				format_info.integer_digits,
 				format_info.group,
-				pchar, len);
+				gchar, len);
     } else
 	xsltNumberFormatDecimal(buffer, floor(number), self->zeroDigit[0],
 				format_info.integer_digits,
@@ -1332,14 +1347,13 @@ OUTPUT_NUMBER:
 	}
     }
     /* Put the suffix into the buffer */
-    for (j = 0; j < suffix_length; j++) {
-	if ((pchar = *suffix++) == SYMBOL_QUOTE) {
-            len = xmlUTF8Strsize(suffix, 1);
-	    xmlBufferAdd(buffer, suffix, len);
-	    suffix += len;
-	    j += len - 1;	/* length of symbol less length of escape */
-	} else
-	    xmlBufferAdd(buffer, &pchar, 1);
+    for (j = 0; j < suffix_length; ) {
+	if (*suffix == SYMBOL_QUOTE)
+            suffix++;
+        len = xmlUTF8Strsize(suffix, 1);
+        xmlBufferAdd(buffer, suffix, len);
+        suffix += len;
+        j += len;
     }
 
     *result = xmlStrdup(xmlBufferContent(buffer));
diff --git a/chromium/third_party/libxslt/src/libxslt/pattern.c b/chromium/third_party/libxslt/src/libxslt/pattern.c
index 7d660192ac8..c6496732a6b 100644
--- a/chromium/third_party/libxslt/src/libxslt/pattern.c
+++ b/chromium/third_party/libxslt/src/libxslt/pattern.c
@@ -113,7 +113,6 @@ struct _xsltCompMatch {
     xmlNsPtr *nsList;		/* the namespaces in scope */
     int nsNr;			/* the number of namespaces in scope */
     xsltStepOpPtr steps;        /* ops for computation */
-    int novar;                  /* doesn't contain variables */
 };
 
 typedef struct _xsltParserContext xsltParserContext;
@@ -342,20 +341,14 @@ xsltCompMatchAdd(xsltParserContextPtr ctxt, xsltCompMatchPtr comp,
 	    xsltAllocateExtra(ctxt->style);
     }
     if (op == XSLT_OP_PREDICATE) {
-	xmlXPathContextPtr xctxt;
+        int flags = 0;
 
-	if (ctxt->style != NULL)
-	    xctxt = xmlXPathNewContext(ctxt->style->doc);
-	else
-	    xctxt = xmlXPathNewContext(NULL);
 #ifdef XML_XPATH_NOVAR
 	if (novar != 0)
-	    xctxt->flags = XML_XPATH_NOVAR;
+	    flags = XML_XPATH_NOVAR;
 #endif
-	if (ctxt->style != NULL)
-	    xctxt->dict = ctxt->style->dict;
-	comp->steps[comp->nbStep].comp = xmlXPathCtxtCompile(xctxt, value);
-	xmlXPathFreeContext(xctxt);
+	comp->steps[comp->nbStep].comp = xsltXPathCompileFlags(ctxt->style,
+                value, flags);
 	if (comp->steps[comp->nbStep].comp == NULL) {
 	    xsltTransformError(NULL, ctxt->style, ctxt->elem,
 		    "Failed to compile predicate\n");
@@ -595,8 +588,7 @@ xsltTestCompMatchDirect(xsltTransformContextPtr ctxt, xsltCompMatchPtr comp,
 	}
 	ix = 0;
 
-	if ((parent == NULL) || (node->doc == NULL) || isRVT ||
-            (comp->novar == 0))
+	if ((parent == NULL) || (node->doc == NULL) || isRVT)
 	    nocache = 1;
 
 	if (nocache == 0) {
@@ -1251,6 +1243,34 @@ xsltTestCompMatchList(xsltTransformContextPtr ctxt, xmlNodePtr node,
     return(0);
 }
 
+/**
+ * xsltCompMatchClearCache:
+ * @ctxt:  a XSLT process context
+ * @comp: the precompiled pattern list
+ *
+ * Clear pattern match cache.
+ */
+void
+xsltCompMatchClearCache(xsltTransformContextPtr ctxt, xsltCompMatchPtr comp) {
+    xsltStepOpPtr sel;
+    xmlXPathObjectPtr list;
+
+    if ((ctxt == NULL) || (comp == NULL))
+        return;
+
+    sel = &comp->steps[0];
+    list = (xmlXPathObjectPtr) XSLT_RUNTIME_EXTRA_LST(ctxt, sel->lenExtra);
+
+    if (list != NULL) {
+        xmlXPathFreeObject(list);
+
+        XSLT_RUNTIME_EXTRA_LST(ctxt, sel->lenExtra) = NULL;
+        XSLT_RUNTIME_EXTRA(ctxt, sel->previousExtra, ptr) = NULL;
+        XSLT_RUNTIME_EXTRA(ctxt, sel->indexExtra, ival) = 0;
+        XSLT_RUNTIME_EXTRA_FREE(ctxt, sel->lenExtra) = NULL;
+    }
+}
+
 /************************************************************************
  *									*
  *			Dedicated parser for templates			*
@@ -1795,9 +1815,7 @@ xsltCompileRelativePathPattern(xsltParserContextPtr ctxt, xmlChar *token, int no
 	    PUSH(XSLT_OP_PARENT, NULL, NULL, novar);
 	    NEXT;
 	    SKIP_BLANKS;
-	    if ((CUR != 0) && (CUR != '|')) {
-		xsltCompileRelativePathPattern(ctxt, NULL, novar);
-	    }
+	    xsltCompileStepPattern(ctxt, NULL, novar);
 	} else {
 	    ctxt->error = 1;
 	}
@@ -1862,6 +1880,8 @@ xsltCompileLocationPathPattern(xsltParserContextPtr ctxt, int novar) {
 	    xsltCompileIdKeyPattern(ctxt, name, 1, novar, 0);
 	    xmlFree(name);
 	    name = NULL;
+            if (ctxt->error)
+                return;
 	    if ((CUR == '/') && (NXT(1) == '/')) {
 		PUSH(XSLT_OP_ANCESTOR, NULL, NULL, novar);
 		NEXT;
@@ -1972,7 +1992,6 @@ xsltCompilePatternInternal(const xmlChar *pattern, xmlDocPtr doc,
 		j++;
 	}
 	element->nsNr = j;
-        element->novar = novar;
 
 
 #ifdef WITH_XSLT_DEBUG_PATTERN
@@ -2137,8 +2156,15 @@ xsltAddTemplate(xsltStylesheetPtr style, xsltTemplatePtr cur,
         xmlHashAddEntry2(style->namedTemplates, cur->name, cur->nameURI, cur);
     }
 
-    if (cur->match == NULL)
+    if (cur->match == NULL) {
+            if (cur->name == NULL) {
+                xsltTransformError(NULL, style, cur->elem,
+                    "xsl:template: need to specify match or name attribute\n");
+                style->errors++;
+                return(-1);
+            }
 	return(0);
+    }
 
     priority = cur->priority;
     pat = xsltCompilePatternInternal(cur->match, style->doc, cur->elem,
@@ -2364,6 +2390,7 @@ xsltGetTemplate(xsltTransformContextPtr ctxt, xmlNodePtr node,
 		case XML_ELEMENT_NODE:
 		    if (node->name[0] == ' ')
 			break;
+                    /* Intentional fall-through */
 		case XML_ATTRIBUTE_NODE:
 		case XML_PI_NODE:
 		    name = node->name;
@@ -2401,7 +2428,7 @@ xsltGetTemplate(xsltTransformContextPtr ctxt, xmlNodePtr node,
 	    list = NULL;
 	while (list != NULL) {
 	    if (xsltTestCompMatch(ctxt, list, node,
-			          ctxt->mode, ctxt->modeURI)) {
+			          ctxt->mode, ctxt->modeURI) == 1) {
 		ret = list->template;
 		priority = list->priority;
 		break;
@@ -2470,7 +2497,7 @@ xsltGetTemplate(xsltTransformContextPtr ctxt, xmlNodePtr node,
 	while ((list != NULL) &&
 	       ((ret == NULL)  || (list->priority > priority))) {
 	    if (xsltTestCompMatch(ctxt, list, node,
-			          ctxt->mode, ctxt->modeURI)) {
+			          ctxt->mode, ctxt->modeURI) == 1) {
 		ret = list->template;
 		priority = list->priority;
 		break;
@@ -2487,7 +2514,7 @@ xsltGetTemplate(xsltTransformContextPtr ctxt, xmlNodePtr node,
 	    while ((list != NULL) &&
 		   ((ret == NULL)  || (list->priority > priority))) {
 		if (xsltTestCompMatch(ctxt, list, node,
-				      ctxt->mode, ctxt->modeURI)) {
+				      ctxt->mode, ctxt->modeURI) == 1) {
 		    ret = list->template;
 		    priority = list->priority;
 		    break;
@@ -2500,7 +2527,7 @@ xsltGetTemplate(xsltTransformContextPtr ctxt, xmlNodePtr node,
 	    while ((list != NULL) &&
 		   ((ret == NULL)  || (list->priority > priority))) {
 		if (xsltTestCompMatch(ctxt, list, node,
-				      ctxt->mode, ctxt->modeURI)) {
+				      ctxt->mode, ctxt->modeURI) == 1) {
 		    ret = list->template;
 		    priority = list->priority;
 		    break;
@@ -2515,7 +2542,7 @@ keyed_match:
 	    while ((list != NULL) &&
 		   ((ret == NULL)  || (list->priority > priority))) {
 		if (xsltTestCompMatch(ctxt, list, node,
-				      ctxt->mode, ctxt->modeURI)) {
+				      ctxt->mode, ctxt->modeURI) == 1) {
 		    ret = list->template;
 		    priority = list->priority;
 		    break;
diff --git a/chromium/third_party/libxslt/src/libxslt/pattern.h b/chromium/third_party/libxslt/src/libxslt/pattern.h
index eb21be32937..a0991c0ce83 100644
--- a/chromium/third_party/libxslt/src/libxslt/pattern.h
+++ b/chromium/third_party/libxslt/src/libxslt/pattern.h
@@ -45,6 +45,9 @@ XSLTPUBFUN int XSLTCALL
 					 xmlNodePtr node,
 					 xsltCompMatchPtr comp);
 XSLTPUBFUN void XSLTCALL
+		xsltCompMatchClearCache	(xsltTransformContextPtr ctxt,
+					 xsltCompMatchPtr comp);
+XSLTPUBFUN void XSLTCALL
 		xsltNormalizeCompSteps	(void *payload,
 					 void *data,
 					 const xmlChar *name);
diff --git a/chromium/third_party/libxslt/src/libxslt/templates.c b/chromium/third_party/libxslt/src/libxslt/templates.c
index 88547ed87de..48b73a53c42 100644
--- a/chromium/third_party/libxslt/src/libxslt/templates.c
+++ b/chromium/third_party/libxslt/src/libxslt/templates.c
@@ -332,7 +332,7 @@ xsltAttrTemplateValueProcessNode(xsltTransformContextPtr ctxt,
 			nsNr = i;
 		    }
 		}
-		comp = xmlXPathCompile(expr);
+		comp = xmlXPathCtxtCompile(ctxt->xpathCtxt, expr);
                 val = xsltEvalXPathStringNs(ctxt, comp, nsNr, nsList);
 		xmlXPathFreeCompExpr(comp);
 		xmlFree(expr);
diff --git a/chromium/third_party/libxslt/src/libxslt/transform.c b/chromium/third_party/libxslt/src/libxslt/transform.c
index 13793914f5d..fd02369cb00 100644
--- a/chromium/third_party/libxslt/src/libxslt/transform.c
+++ b/chromium/third_party/libxslt/src/libxslt/transform.c
@@ -232,6 +232,8 @@ xsltTemplateParamsCleanup(xsltTransformContextPtr ctxt)
         ctxt->vars = NULL;
 }
 
+#ifdef WITH_PROFILER
+
 /**
  * profPush:
  * @ctxt: the transformation context
@@ -340,6 +342,8 @@ profCallgraphAdd(xsltTemplatePtr templ, xsltTemplatePtr parent)
     }
 }
 
+#endif /* WITH_PROFILER */
+
 /**
  * xsltPreCompEval:
  * @ctxt: transform context
@@ -1090,6 +1094,8 @@ xsltCopyText(xsltTransformContextPtr ctxt, xmlNodePtr target,
 	    if ((copy->content = xmlStrdup(cur->content)) == NULL)
 		return NULL;
 	}
+
+	ctxt->lasttext = NULL;
     } else {
         /*
 	 * normal processing. keep counters to extend the text node
@@ -2205,6 +2211,7 @@ xsltProcessOneNode(xsltTransformContextPtr ctxt, xmlNodePtr contextNode,
     }
 }
 
+#ifdef WITH_DEBUGGER
 static xmlNodePtr
 xsltDebuggerStartSequenceConstructor(xsltTransformContextPtr ctxt,
 				     xmlNodePtr contextNode,
@@ -2240,6 +2247,7 @@ xsltDebuggerStartSequenceConstructor(xsltTransformContextPtr ctxt,
     }
     return(debugedNode);
 }
+#endif /* WITH_DEBUGGER */
 
 /**
  * xsltLocalVariablePush:
@@ -2411,6 +2419,17 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
     */
     cur = list;
     while (cur != NULL) {
+        if (ctxt->opLimit != 0) {
+            if (ctxt->opCount >= ctxt->opLimit) {
+		xsltTransformError(ctxt, NULL, cur,
+		    "xsltApplySequenceConstructor: "
+                    "Operation limit exceeded\n");
+	        ctxt->state = XSLT_STATE_STOPPED;
+                goto error;
+            }
+            ctxt->opCount += 1;
+        }
+
         ctxt->inst = cur;
 
 #ifdef WITH_DEBUGGER
@@ -2867,6 +2886,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
                 /*
                  * Search if there are fallbacks
                  */
+                ctxt->insert = insert;
                 child = cur->children;
                 while (child != NULL) {
                     if ((IS_XSLT_ELEM(child)) &&
@@ -2878,6 +2898,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
                     }
                     child = child->next;
                 }
+                ctxt->insert = oldInsert;
 
                 if (!found) {
                     xsltTransformError(ctxt, NULL, cur,
@@ -3086,10 +3107,12 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
 		      xsltStackElemPtr withParams)
 {
     int oldVarsBase = 0;
-    long start = 0;
     xmlNodePtr cur;
     xsltStackElemPtr tmpParam = NULL;
     xmlDocPtr oldUserFragmentTop;
+#ifdef WITH_PROFILER
+    long start = 0;
+#endif
 
 #ifdef XSLT_REFACTORED
     xsltStyleItemParamPtr iparam;
@@ -3144,12 +3167,16 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
     ctxt->varsBase = ctxt->varsNr;
 
     ctxt->node = contextNode;
+
+#ifdef WITH_PROFILER
     if (ctxt->profile) {
 	templ->nbCalls++;
 	start = xsltTimestamp();
 	profPush(ctxt, 0);
 	profCallgraphAdd(templ, ctxt->templ);
     }
+#endif
+
     /*
     * Push the xsl:template declaration onto the stack.
     */
@@ -3257,6 +3284,8 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
     * Pop the xsl:template declaration from the stack.
     */
     templPop(ctxt);
+
+#ifdef WITH_PROFILER
     if (ctxt->profile) {
 	long spent, child, total, end;
 
@@ -3277,6 +3306,7 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
 	if (ctxt->profNr > 0)
 	    ctxt->profTab[ctxt->profNr - 1] += total;
     }
+#endif
 
 #ifdef WITH_DEBUGGER
     if ((ctxt->debugStatus != XSLT_DEBUG_NONE) && (addCallResult)) {
@@ -3434,7 +3464,7 @@ xsltDocumentElem(xsltTransformContextPtr ctxt, xmlNodePtr node,
 		 * XPath expression.
 		 * (see http://xml.apache.org/xalan-j/extensionslib.html#redirect)
 		 */
-		cmp = xmlXPathCompile(URL);
+		cmp = xmlXPathCtxtCompile(ctxt->xpathCtxt, URL);
                 val = xsltEvalXPathString(ctxt, cmp);
 		xmlXPathFreeCompExpr(cmp);
 		xmlFree(URL);
@@ -4997,7 +5027,7 @@ xsltApplyTemplates(xsltTransformContextPtr ctxt, xmlNodePtr node,
 			    break;
 			}
 		    }
-		    /* no break on purpose */
+		    /* Intentional fall-through */
 		case XML_ELEMENT_NODE:
 		case XML_DOCUMENT_NODE:
 		case XML_HTML_DOCUMENT_NODE:
@@ -5897,8 +5927,16 @@ xsltApplyStylesheetInternal(xsltStylesheetPtr style, xmlDocPtr doc,
     ctxt->initialContextDoc = doc;
     ctxt->initialContextNode = (xmlNodePtr) doc;
 
-    if (profile != NULL)
+    if (profile != NULL) {
+#ifdef WITH_PROFILER
         ctxt->profile = 1;
+#else
+        xsltTransformError(ctxt, NULL, (xmlNodePtr) doc,
+                "xsltApplyStylesheetInternal: "
+                "libxslt compiled without profiler\n");
+        goto error;
+#endif
+    }
 
     if (output != NULL)
         ctxt->outputFile = output;
@@ -6173,9 +6211,12 @@ xsltApplyStylesheetInternal(xsltStylesheetPtr style, xmlDocPtr doc,
         }
     }
     xmlXPathFreeNodeSet(ctxt->nodeList);
+
+#ifdef WITH_PROFILER
     if (profile != NULL) {
         xsltSaveProfiling(ctxt, profile);
     }
+#endif
 
     /*
      * Be pedantic.
diff --git a/chromium/third_party/libxslt/src/libxslt/variables.c b/chromium/third_party/libxslt/src/libxslt/variables.c
index 8f88e573d78..4c972a4136b 100644
--- a/chromium/third_party/libxslt/src/libxslt/variables.c
+++ b/chromium/third_party/libxslt/src/libxslt/variables.c
@@ -205,7 +205,8 @@ xsltRegisterLocalRVT(xsltTransformContextPtr ctxt,
  * This function is unsupported in newer releases of libxslt.
  */
 int
-xsltExtensionInstructionResultFinalize(xsltTransformContextPtr ctxt)
+xsltExtensionInstructionResultFinalize(
+        xsltTransformContextPtr ctxt ATTRIBUTE_UNUSED)
 {
     xmlGenericError(xmlGenericErrorContext,
             "xsltExtensionInstructionResultFinalize is unsupported "
@@ -230,8 +231,9 @@ xsltExtensionInstructionResultFinalize(xsltTransformContextPtr ctxt)
  * libxslt.
  */
 int
-xsltExtensionInstructionResultRegister(xsltTransformContextPtr ctxt,
-				       xmlXPathObjectPtr obj)
+xsltExtensionInstructionResultRegister(
+        xsltTransformContextPtr ctxt ATTRIBUTE_UNUSED,
+	xmlXPathObjectPtr obj ATTRIBUTE_UNUSED)
 {
     return(0);
 }
@@ -858,7 +860,7 @@ xsltEvalVariable(xsltTransformContextPtr ctxt, xsltStackElemPtr variable,
 	if ((comp != NULL) && (comp->comp != NULL)) {
 	    xpExpr = comp->comp;
 	} else {
-	    xpExpr = xmlXPathCompile(variable->select);
+	    xpExpr = xmlXPathCtxtCompile(ctxt->xpathCtxt, variable->select);
 	}
 	if (xpExpr == NULL)
 	    return(NULL);
@@ -1099,7 +1101,7 @@ xsltEvalGlobalVariable(xsltStackElemPtr elem, xsltTransformContextPtr ctxt)
 	if ((comp != NULL) && (comp->comp != NULL)) {
 	    xpExpr = comp->comp;
 	} else {
-	    xpExpr = xmlXPathCompile(elem->select);
+	    xpExpr = xmlXPathCtxtCompile(ctxt->xpathCtxt, elem->select);
 	}
 	if (xpExpr == NULL)
 	    goto error;
@@ -1550,7 +1552,7 @@ xsltProcessUserParamInternal(xsltTransformContextPtr ctxt,
 
     result = NULL;
     if (eval != 0) {
-        xpExpr = xmlXPathCompile(value);
+        xpExpr = xmlXPathCtxtCompile(ctxt->xpathCtxt, value);
 	if (xpExpr != NULL) {
 	    xmlDocPtr oldXPDoc;
 	    xmlNodePtr oldXPContextNode;
@@ -1967,7 +1969,7 @@ xsltVariableLookup(xsltTransformContextPtr ctxt, const xmlChar *name,
  * @inst:  the xsl:with-param instruction element
  *
  * Processes an xsl:with-param instruction at transformation time.
- * The value is compute, but not recorded.
+ * The value is computed, but not recorded.
  * NOTE that this is also called with an *xsl:param* element
  * from exsltFuncFunctionFunction().
  *
diff --git a/chromium/third_party/libxslt/src/libxslt/xslt.c b/chromium/third_party/libxslt/src/libxslt/xslt.c
index 780a5ad75ea..4164ad1d1cb 100644
--- a/chromium/third_party/libxslt/src/libxslt/xslt.c
+++ b/chromium/third_party/libxslt/src/libxslt/xslt.c
@@ -592,10 +592,6 @@ xsltCompilationCtxtFree(xsltCompilerCtxtPtr cctxt)
     }
     if (cctxt->tmpList != NULL)
 	xsltPointerListFree(cctxt->tmpList);
-#ifdef XSLT_REFACTORED_XPATHCOMP
-    if (cctxt->xpathCtxt != NULL)
-	xmlXPathFreeContext(cctxt->xpathCtxt);
-#endif
     if (cctxt->nsAliases != NULL)
 	xsltFreeNsAliasList(cctxt->nsAliases);
 
@@ -631,15 +627,6 @@ xsltCompilationCtxtCreate(xsltStylesheetPtr style) {
     if (ret->tmpList == NULL) {
 	goto internal_err;
     }
-#ifdef XSLT_REFACTORED_XPATHCOMP
-    /*
-    * Create the XPath compilation context in order
-    * to speed up precompilation of XPath expressions.
-    */
-    ret->xpathCtxt = xmlXPathNewContext(NULL);
-    if (ret->xpathCtxt == NULL)
-	goto internal_err;
-#endif
 
     return(ret);
 
@@ -761,14 +748,15 @@ internal_err:
 #endif
 
 /**
- * xsltNewStylesheet:
+ * xsltNewStylesheetInternal:
+ * @parent:  the parent stylesheet or NULL
  *
  * Create a new XSLT Stylesheet
  *
  * Returns the newly allocated xsltStylesheetPtr or NULL in case of error
  */
-xsltStylesheetPtr
-xsltNewStylesheet(void) {
+static xsltStylesheetPtr
+xsltNewStylesheetInternal(xsltStylesheetPtr parent) {
     xsltStylesheetPtr ret = NULL;
 
     ret = (xsltStylesheetPtr) xmlMalloc(sizeof(xsltStylesheet));
@@ -779,6 +767,7 @@ xsltNewStylesheet(void) {
     }
     memset(ret, 0, sizeof(xsltStylesheet));
 
+    ret->parent = parent;
     ret->omitXmlDeclaration = -1;
     ret->standalone = -1;
     ret->decimalFormat = xsltNewDecimalFormat(NULL, NULL);
@@ -799,6 +788,21 @@ xsltNewStylesheet(void) {
 	"creating dictionary for stylesheet\n");
 #endif
 
+    if (parent == NULL) {
+        ret->principal = ret;
+
+        ret->xpathCtxt = xmlXPathNewContext(NULL);
+        if (ret->xpathCtxt == NULL) {
+            xsltTransformError(NULL, NULL, NULL,
+                    "xsltNewStylesheet: xmlXPathNewContext failed\n");
+            goto internal_err;
+        }
+        if (xmlXPathContextSetCache(ret->xpathCtxt, 1, -1, 0) == -1)
+            goto internal_err;
+    } else {
+        ret->principal = parent->principal;
+    }
+
     xsltInit();
 
     return(ret);
@@ -810,6 +814,18 @@ internal_err:
 }
 
 /**
+ * xsltNewStylesheet:
+ *
+ * Create a new XSLT Stylesheet
+ *
+ * Returns the newly allocated xsltStylesheetPtr or NULL in case of error
+ */
+xsltStylesheetPtr
+xsltNewStylesheet(void) {
+    return xsltNewStylesheetInternal(NULL);
+}
+
+/**
  * xsltAllocateExtra:
  * @style:  an XSLT stylesheet
  *
@@ -1065,6 +1081,9 @@ xsltFreeStylesheet(xsltStylesheetPtr style)
 #endif
     xmlDictFree(style->dict);
 
+    if (style->xpathCtxt != NULL)
+	xmlXPathFreeContext(style->xpathCtxt);
+
     memset(style, -1, sizeof(xsltStylesheet));
     xmlFree(style);
 }
@@ -1349,8 +1368,8 @@ xsltParseStylesheetOutput(xsltStylesheetPtr style, xmlNodePtr cur)
 			*  via the stylesheet's error handling.
 			*/
 			xsltTransformError(NULL, style, cur,
-			    "Attribute 'cdata-section-elements': The value "
-			    "'%s' is not a valid QName.\n", element);
+			    "Attribute 'cdata-section-elements': "
+			    "Not a valid QName.\n");
 			style->errors++;
 		    } else {
 			xmlNsPtr ns;
@@ -5479,7 +5498,7 @@ error:
 
 /**
  * xsltIncludeComp:
- * @cctxt: the compilation contenxt
+ * @cctxt: the compilation context
  * @node:  the xsl:include node
  *
  * Process the xslt include node on the source node
@@ -6532,54 +6551,67 @@ xsltParseStylesheetImportedDoc(xmlDocPtr doc,
     if (doc == NULL)
 	return(NULL);
 
-    retStyle = xsltNewStylesheet();
+    retStyle = xsltNewStylesheetInternal(parentStyle);
     if (retStyle == NULL)
 	return(NULL);
-    /*
-    * Set the importing stylesheet module; also used to detect recursion.
-    */
-    retStyle->parent = parentStyle;
+
+    if (xsltParseStylesheetUser(retStyle, doc) != 0) {
+        xsltFreeStylesheet(retStyle);
+        return(NULL);
+    }
+
+    return(retStyle);
+}
+
+/**
+ * xsltParseStylesheetUser:
+ * @style: pointer to the stylesheet
+ * @doc:  an xmlDoc parsed XML
+ *
+ * Parse an XSLT stylesheet with a user-provided stylesheet struct.
+ *
+ * Returns 0 if successful, -1 in case of error.
+ */
+int
+xsltParseStylesheetUser(xsltStylesheetPtr style, xmlDocPtr doc) {
+    if ((style == NULL) || (doc == NULL))
+	return(-1);
+
     /*
     * Adjust the string dict.
     */
     if (doc->dict != NULL) {
-        xmlDictFree(retStyle->dict);
-	retStyle->dict = doc->dict;
+        xmlDictFree(style->dict);
+	style->dict = doc->dict;
 #ifdef WITH_XSLT_DEBUG
         xsltGenericDebug(xsltGenericDebugContext,
 	    "reusing dictionary from %s for stylesheet\n",
 	    doc->URL);
 #endif
-	xmlDictReference(retStyle->dict);
+	xmlDictReference(style->dict);
     }
 
     /*
     * TODO: Eliminate xsltGatherNamespaces(); we must not restrict
     *  the stylesheet to containt distinct namespace prefixes.
     */
-    xsltGatherNamespaces(retStyle);
+    xsltGatherNamespaces(style);
 
 #ifdef XSLT_REFACTORED
     {
 	xsltCompilerCtxtPtr cctxt;
 	xsltStylesheetPtr oldCurSheet;
 
-	if (parentStyle == NULL) {
+	if (style->parent == NULL) {
 	    xsltPrincipalStylesheetDataPtr principalData;
 	    /*
-	    * Principal stylesheet
-	    * --------------------
-	    */
-	    retStyle->principal = retStyle;
-	    /*
 	    * Create extra data for the principal stylesheet.
 	    */
 	    principalData = xsltNewPrincipalStylesheetData();
 	    if (principalData == NULL) {
-		xsltFreeStylesheet(retStyle);
-		return(NULL);
+		return(-1);
 	    }
-	    retStyle->principalData = principalData;
+	    style->principalData = principalData;
 	    /*
 	    * Create the compilation context
 	    * ------------------------------
@@ -6587,14 +6619,13 @@ xsltParseStylesheetImportedDoc(xmlDocPtr doc,
 	    * This is currently the only function where the
 	    * compilation context is created.
 	    */
-	    cctxt = xsltCompilationCtxtCreate(retStyle);
+	    cctxt = xsltCompilationCtxtCreate(style);
 	    if (cctxt == NULL) {
-		xsltFreeStylesheet(retStyle);
-		return(NULL);
+		return(-1);
 	    }
-	    retStyle->compCtxt = (void *) cctxt;
-	    cctxt->style = retStyle;
-	    cctxt->dict = retStyle->dict;
+	    style->compCtxt = (void *) cctxt;
+	    cctxt->style = style;
+	    cctxt->dict = style->dict;
 	    cctxt->psData = principalData;
 	    /*
 	    * Push initial dummy node info.
@@ -6605,22 +6636,21 @@ xsltParseStylesheetImportedDoc(xmlDocPtr doc,
 	    /*
 	    * Imported stylesheet.
 	    */
-	    retStyle->principal = parentStyle->principal;
-	    cctxt = parentStyle->compCtxt;
-	    retStyle->compCtxt = cctxt;
+	    cctxt = style->parent->compCtxt;
+	    style->compCtxt = cctxt;
 	}
 	/*
 	* Save the old and set the current stylesheet structure in the
 	* compilation context.
 	*/
 	oldCurSheet = cctxt->style;
-	cctxt->style = retStyle;
+	cctxt->style = style;
 
-	retStyle->doc = doc;
-	xsltParseStylesheetProcess(retStyle, doc);
+	style->doc = doc;
+	xsltParseStylesheetProcess(style, doc);
 
 	cctxt->style = oldCurSheet;
-	if (parentStyle == NULL) {
+	if (style->parent == NULL) {
 	    /*
 	    * Pop the initial dummy node info.
 	    */
@@ -6631,65 +6661,54 @@ xsltParseStylesheetImportedDoc(xmlDocPtr doc,
 	    * stylesheets.
 	    * TODO: really?
 	    */
-	    /* retStyle->compCtxt = NULL; */
+	    /* style->compCtxt = NULL; */
 	}
-	/*
-	* Free the stylesheet if there were errors.
-	*/
-	if (retStyle != NULL) {
-	    if (retStyle->errors != 0) {
+
 #ifdef XSLT_REFACTORED_XSLT_NSCOMP
-		/*
-		* Restore all changes made to namespace URIs of ns-decls.
-		*/
-		if (cctxt->psData->nsMap)
-		    xsltRestoreDocumentNamespaces(cctxt->psData->nsMap, doc);
+        if (style->errors != 0) {
+            /*
+            * Restore all changes made to namespace URIs of ns-decls.
+            */
+            if (cctxt->psData->nsMap)
+                xsltRestoreDocumentNamespaces(cctxt->psData->nsMap, doc);
+        }
 #endif
-		/*
-		* Detach the doc from the stylesheet; otherwise the doc
-		* will be freed in xsltFreeStylesheet().
-		*/
-		retStyle->doc = NULL;
-		/*
-		* Cleanup the doc if its the main stylesheet.
-		*/
-		if (parentStyle == NULL) {
-		    xsltCleanupStylesheetTree(doc, xmlDocGetRootElement(doc));
-		    if (retStyle->compCtxt != NULL) {
-			xsltCompilationCtxtFree(retStyle->compCtxt);
-			retStyle->compCtxt = NULL;
-		    }
-		}
 
-		xsltFreeStylesheet(retStyle);
-		retStyle = NULL;
-	    }
-	}
+        if (style->parent == NULL) {
+            xsltCompilationCtxtFree(style->compCtxt);
+            style->compCtxt = NULL;
+        }
     }
 
 #else /* XSLT_REFACTORED */
     /*
     * Old behaviour.
     */
-    retStyle->doc = doc;
-    if (xsltParseStylesheetProcess(retStyle, doc) == NULL) {
-		retStyle->doc = NULL;
-		xsltFreeStylesheet(retStyle);
-		retStyle = NULL;
-    }
-    if (retStyle != NULL) {
-	if (retStyle->errors != 0) {
-	    retStyle->doc = NULL;
-	    if (parentStyle == NULL)
-		xsltCleanupStylesheetTree(doc,
-		    xmlDocGetRootElement(doc));
-	    xsltFreeStylesheet(retStyle);
-	    retStyle = NULL;
-	}
+    style->doc = doc;
+    if (xsltParseStylesheetProcess(style, doc) == NULL) {
+        style->doc = NULL;
+        return(-1);
     }
 #endif /* else of XSLT_REFACTORED */
 
-    return(retStyle);
+    if (style->errors != 0) {
+        /*
+        * Detach the doc from the stylesheet; otherwise the doc
+        * will be freed in xsltFreeStylesheet().
+        */
+        style->doc = NULL;
+        /*
+        * Cleanup the doc if its the main stylesheet.
+        */
+        if (style->parent == NULL)
+            xsltCleanupStylesheetTree(doc, xmlDocGetRootElement(doc));
+        return(-1);
+    }
+
+    if (style->parent == NULL)
+        xsltResolveStylesheetAttributeSet(style);
+
+    return(0);
 }
 
 /**
@@ -6707,27 +6726,9 @@ xsltParseStylesheetImportedDoc(xmlDocPtr doc,
 
 xsltStylesheetPtr
 xsltParseStylesheetDoc(xmlDocPtr doc) {
-    xsltStylesheetPtr ret;
-
     xsltInitGlobals();
 
-    ret = xsltParseStylesheetImportedDoc(doc, NULL);
-    if (ret == NULL)
-	return(NULL);
-
-    xsltResolveStylesheetAttributeSet(ret);
-#ifdef XSLT_REFACTORED
-    /*
-    * Free the compilation context.
-    * TODO: Check if it's better to move this cleanup to
-    *   xsltParseStylesheetImportedDoc().
-    */
-    if (ret->compCtxt != NULL) {
-	xsltCompilationCtxtFree(XSLT_CCTXT(ret));
-	ret->compCtxt = NULL;
-    }
-#endif
-    return(ret);
+    return(xsltParseStylesheetImportedDoc(doc, NULL));
 }
 
 /**
diff --git a/chromium/third_party/libxslt/src/libxslt/xsltInternals.h b/chromium/third_party/libxslt/src/libxslt/xsltInternals.h
index f9066adc93d..14a971aaa30 100644
--- a/chromium/third_party/libxslt/src/libxslt/xsltInternals.h
+++ b/chromium/third_party/libxslt/src/libxslt/xsltInternals.h
@@ -105,14 +105,6 @@ extern const xmlChar *xsltXSLTAttrMarker;
  */
 /* #define XSLT_REFACTORED_XSLT_NSCOMP */
 
-/**
- * XSLT_REFACTORED_XPATHCOMP:
- *
- * Internal define to enable the optimization of the
- * compilation of XPath expressions.
- */
-#define XSLT_REFACTORED_XPATHCOMP
-
 #ifdef XSLT_REFACTORED_XSLT_NSCOMP
 
 extern const xmlChar *xsltConstNamespaceNameXSLT;
@@ -478,7 +470,7 @@ typedef void (*xsltElemPreCompDeallocator) (xsltElemPreCompPtr comp);
  */
 struct _xsltElemPreComp {
     xsltElemPreCompPtr next;		/* next item in the global chained
-					   list hold by xsltStylesheet. */
+					   list held by xsltStylesheet. */
     xsltStyleType type;		/* type of the element */
     xsltTransformFunction func;	/* handling function */
     xmlNodePtr inst;			/* the node in the stylesheet's tree
@@ -590,7 +582,7 @@ struct _xsltNsListContainer {
  */
 struct _xsltStylePreComp {
     xsltElemPreCompPtr next;    /* next item in the global chained
-				   list hold by xsltStylesheet */
+				   list held by xsltStylesheet */
     xsltStyleType type;         /* type of the item */
     xsltTransformFunction func; /* handling function */
     xmlNodePtr inst;		/* the node in the stylesheet's tree
@@ -1346,9 +1338,6 @@ struct _xsltCompilerCtxt {
     */
     int strict;
     xsltPrincipalStylesheetDataPtr psData;
-#ifdef XSLT_REFACTORED_XPATHCOMP
-    xmlXPathContextPtr xpathCtxt;
-#endif
     xsltStyleItemUknownPtr unknownItem;
     int hasNsAliases; /* Indicator if there was an xsl:namespace-alias. */
     xsltNsAliasPtr nsAliases;
@@ -1642,6 +1631,8 @@ struct _xsltStylesheet {
     int forwards_compatible;
 
     xmlHashTablePtr namedTemplates; /* hash table of named templates */
+
+    xmlXPathContextPtr xpathCtxt;
 };
 
 typedef struct _xsltTransformCache xsltTransformCache;
@@ -1789,6 +1780,8 @@ struct _xsltTransformContext {
     int depth;          /* Needed to catch recursions */
     int maxTemplateDepth;
     int maxTemplateVars;
+    unsigned long opLimit;
+    unsigned long opCount;
 };
 
 /**
@@ -1871,6 +1864,9 @@ XSLTPUBFUN xsltStylesheetPtr XSLTCALL
 XSLTPUBFUN xsltStylesheetPtr XSLTCALL
 			xsltParseStylesheetImportedDoc(xmlDocPtr doc,
 						xsltStylesheetPtr style);
+XSLTPUBFUN int XSLTCALL
+			xsltParseStylesheetUser(xsltStylesheetPtr style,
+						xmlDocPtr doc);
 XSLTPUBFUN xsltStylesheetPtr XSLTCALL
 			xsltLoadStylesheetPI	(xmlDocPtr doc);
 XSLTPUBFUN void XSLTCALL
diff --git a/chromium/third_party/libxslt/src/libxslt/xsltconfig.h b/chromium/third_party/libxslt/src/libxslt/xsltconfig.h
index 42a99dcdd68..7f5c184da49 100644
--- a/chromium/third_party/libxslt/src/libxslt/xsltconfig.h
+++ b/chromium/third_party/libxslt/src/libxslt/xsltconfig.h
@@ -20,21 +20,21 @@ extern "C" {
  *
  * the version string like "1.2.3"
  */
-#define LIBXSLT_DOTTED_VERSION "1.1.33"
+#define LIBXSLT_DOTTED_VERSION "1.1.34"
 
 /**
  * LIBXSLT_VERSION:
  *
  * the version number: 1.2.3 value is 10203
  */
-#define LIBXSLT_VERSION 10133
+#define LIBXSLT_VERSION 10134
 
 /**
  * LIBXSLT_VERSION_STRING:
  *
  * the version number string, 1.2.3 value is "10203"
  */
-#define LIBXSLT_VERSION_STRING "10133"
+#define LIBXSLT_VERSION_STRING "10134"
 
 /**
  * LIBXSLT_VERSION_EXTRA:
@@ -111,6 +111,19 @@ extern "C" {
 #endif
 
 /**
+ * WITH_PROFILER:
+ *
+ * Activate the compilation of the profiler. Speed penalty
+ * is insignifiant.
+ * On by default unless --without-profiler is passed to configure
+ */
+#if 1
+#ifndef WITH_PROFILER
+#define WITH_PROFILER
+#endif
+#endif
+
+/**
  * WITH_MODULES:
  *
  * Whether module support is configured into libxslt
@@ -120,7 +133,7 @@ extern "C" {
 #ifndef WITH_MODULES
 #define WITH_MODULES
 #endif
-#define LIBXSLT_DEFAULT_PLUGINS_PATH() "NULL"
+#define LIBXSLT_DEFAULT_PLUGINS_PATH() "/usr/local/lib/libxslt-plugins"
 #endif
 
 /**
diff --git a/chromium/third_party/libxslt/src/libxslt/xsltconfig.h.in b/chromium/third_party/libxslt/src/libxslt/xsltconfig.h.in
index 1dda1766c25..ec4844afefb 100644
--- a/chromium/third_party/libxslt/src/libxslt/xsltconfig.h.in
+++ b/chromium/third_party/libxslt/src/libxslt/xsltconfig.h.in
@@ -111,6 +111,19 @@ extern "C" {
 #endif
 
 /**
+ * WITH_PROFILER:
+ *
+ * Activate the compilation of the profiler. Speed penalty
+ * is insignifiant.
+ * On by default unless --without-profiler is passed to configure
+ */
+#if @WITH_PROFILER@
+#ifndef WITH_PROFILER
+#define WITH_PROFILER
+#endif
+#endif
+
+/**
  * WITH_MODULES:
  *
  * Whether module support is configured into libxslt
diff --git a/chromium/third_party/libxslt/src/libxslt/xsltutils.c b/chromium/third_party/libxslt/src/libxslt/xsltutils.c
index adefde988f9..94097b9d209 100644
--- a/chromium/third_party/libxslt/src/libxslt/xsltutils.c
+++ b/chromium/third_party/libxslt/src/libxslt/xsltutils.c
@@ -1578,7 +1578,15 @@ xsltSaveResultTo(xmlOutputBufferPtr buf, xmlDocPtr result,
 	    xmlOutputBufferWriteString(buf, "?>\n");
 	}
 	if (result->children != NULL) {
-	    xmlNodePtr child = result->children;
+            xmlNodePtr children = result->children;
+	    xmlNodePtr child = children;
+
+            /*
+             * Hack to avoid quadratic behavior when scanning
+             * result->children in xmlGetIntSubset called by
+             * xmlNodeDumpOutput.
+             */
+            result->children = NULL;
 
 	    while (child != NULL) {
 		xmlNodeDumpOutput(buf, result, child, 0, (indent == 1),
@@ -1591,6 +1599,8 @@ xsltSaveResultTo(xmlOutputBufferPtr buf, xmlDocPtr result,
 	    }
 	    if (indent)
 			xmlOutputBufferWriteString(buf, "\n");
+
+            result->children = children;
 	}
 	xmlOutputBufferFlush(buf);
     }
@@ -1788,6 +1798,8 @@ xsltSaveResultToString(xmlChar **doc_txt_ptr, int * doc_txt_len,
     return 0;
 }
 
+#ifdef WITH_PROFILER
+
 /************************************************************************
  *									*
  *		Generating profiling information			*
@@ -2265,6 +2277,8 @@ xsltGetProfileInformation(xsltTransformContextPtr ctxt)
     return ret;
 }
 
+#endif /* WITH_PROFILER */
+
 /************************************************************************
  *									*
  *		Hooks for libxml2 XPath					*
@@ -2288,25 +2302,7 @@ xsltXPathCompileFlags(xsltStylesheetPtr style, const xmlChar *str, int flags) {
     xmlXPathCompExprPtr ret;
 
     if (style != NULL) {
-#ifdef XSLT_REFACTORED_XPATHCOMP
-	if (XSLT_CCTXT(style)) {
-	    /*
-	    * Proposed by Jerome Pesenti
-	    * --------------------------
-	    * For better efficiency we'll reuse the compilation
-	    * context's XPath context. For the common stylesheet using
-	    * XPath expressions this will reduce compilation time to
-	    * about 50%.
-	    *
-	    * See http://mail.gnome.org/archives/xslt/2006-April/msg00037.html
-	    */
-	    xpathCtxt = XSLT_CCTXT(style)->xpathCtxt;
-	    xpathCtxt->doc = style->doc;
-	} else
-	    xpathCtxt = xmlXPathNewContext(style->doc);
-#else
-	xpathCtxt = xmlXPathNewContext(style->doc);
-#endif
+        xpathCtxt = style->principal->xpathCtxt;
 	if (xpathCtxt == NULL)
 	    return NULL;
 	xpathCtxt->dict = style->dict;
@@ -2322,13 +2318,9 @@ xsltXPathCompileFlags(xsltStylesheetPtr style, const xmlChar *str, int flags) {
     */
     ret = xmlXPathCtxtCompile(xpathCtxt, str);
 
-#ifdef XSLT_REFACTORED_XPATHCOMP
-    if ((style == NULL) || (! XSLT_CCTXT(style))) {
+    if (style == NULL) {
 	xmlXPathFreeContext(xpathCtxt);
     }
-#else
-    xmlXPathFreeContext(xpathCtxt);
-#endif
     /*
      * TODO: there is a lot of optimizations which should be possible
      *       like variable slot precomputations, function precomputations, etc.
@@ -2358,6 +2350,23 @@ xsltXPathCompile(xsltStylesheetPtr style, const xmlChar *str) {
  *									*
  ************************************************************************/
 
+int xslDebugStatus;
+
+/**
+ * xsltGetDebuggerStatus:
+ *
+ * Get xslDebugStatus.
+ *
+ * Returns the value of xslDebugStatus.
+ */
+int
+xsltGetDebuggerStatus(void)
+{
+    return(xslDebugStatus);
+}
+
+#ifdef WITH_DEBUGGER
+
 /*
  * There is currently only 3 debugging callback defined
  * Debugger callbacks are disabled by default
@@ -2378,8 +2387,6 @@ static xsltDebuggerCallbacks xsltDebuggerCurrentCallbacks = {
     NULL  /* drop */
 };
 
-int xslDebugStatus;
-
 /**
  * xsltSetDebuggerStatus:
  * @value : the value to be set
@@ -2393,19 +2400,6 @@ xsltSetDebuggerStatus(int value)
 }
 
 /**
- * xsltGetDebuggerStatus:
- *
- * Get xslDebugStatus.
- *
- * Returns the value of xslDebugStatus.
- */
-int
-xsltGetDebuggerStatus(void)
-{
-    return(xslDebugStatus);
-}
-
-/**
  * xsltSetDebuggerCallbacks:
  * @no : number of callbacks
  * @block : the block of callbacks
@@ -2479,3 +2473,5 @@ xslDropCall(void)
 	xsltDebuggerCurrentCallbacks.drop();
 }
 
+#endif /* WITH_DEBUGGER */
+
diff --git a/chromium/third_party/libxslt/src/libxslt/xsltutils.h b/chromium/third_party/libxslt/src/libxslt/xsltutils.h
index 789865a63dc..ea6c3740540 100644
--- a/chromium/third_party/libxslt/src/libxslt/xsltutils.h
+++ b/chromium/third_party/libxslt/src/libxslt/xsltutils.h
@@ -80,7 +80,7 @@ extern "C" {
       ((n)->type == XML_PI_NODE)))
 
 /*
- * Our own version of namespaced atributes lookup.
+ * Our own version of namespaced attributes lookup.
  */
 XSLTPUBFUN xmlChar * XSLTCALL
 		xsltGetNsProp	(xmlNodePtr node,
diff --git a/chromium/third_party/libxslt/src/win32/libxslt.def.src b/chromium/third_party/libxslt/src/win32/libxslt.def.src
index fe7e767c014..b4846a6bc14 100644
--- a/chromium/third_party/libxslt/src/win32/libxslt.def.src
+++ b/chromium/third_party/libxslt/src/win32/libxslt.def.src
@@ -44,6 +44,7 @@ xsltChoose
 xsltCleanupGlobals
 xsltCleanupTemplates
 xsltComment
+xsltCompMatchClearCache
 xsltCompileAttr
 xsltCompilePattern
 xsltComputeSortResult
@@ -176,6 +177,7 @@ xsltParseStylesheetInclude
 xsltParseStylesheetOutput
 xsltParseStylesheetParam
 xsltParseStylesheetProcess
+xsltParseStylesheetUser
 xsltParseStylesheetVariable
 xsltParseTemplateContent
 xsltPointerListAddSize
diff --git a/chromium/third_party/libxslt/src/xsltConf.sh.in b/chromium/third_party/libxslt/src/xsltConf.sh.in
index 666774b66a6..f7e8fa1550a 100644
--- a/chromium/third_party/libxslt/src/xsltConf.sh.in
+++ b/chromium/third_party/libxslt/src/xsltConf.sh.in
@@ -3,5 +3,6 @@
 #
 XSLT_LIBDIR="@XSLT_LIBDIR@"
 XSLT_LIBS="@XSLT_LIBS@"
+XSLT_PRIVATE_LIBS="@XSLT_PRIVATE_LIBS@"
 XSLT_INCLUDEDIR="@XSLT_INCLUDEDIR@"
 MODULE_VERSION="xslt-@VERSION@"