Security and patch rollup for FPR13 from ESR60

[classilla]

Through db09f3a62a37

Not relevant:
M1513145 (Windows)
M1525433 (no Skia)
M1525817 (no Skia)
M1525815 (no Skia)

No candidates.

[classilla]

Through 05cf99a95206

Build system patches not shown since we will never take them.

Not relevant:
M1505844 (not in code)
M1512161 (not 10.4 compatible)
M1521884 (our implementation is unaffected)
M1509829 (better covered by our custom UA support)
M1512731 (Windows)
M1523558 (not in our JIT)
M1521214 (not in code)
M1521304 (SCTP mutex issue doesn't seem affected)
M1527717 (Windows)
M1516834 (unaffected)
M1528829 (unaffected)
M1527007 (Windows)
M1531655 (unaffected)
M1523362 (IPC)
M1506665 (no WebGL)
M1532851 (PPC, but we're unaffected)
M1529203 (no module support)
M1527148 (unaffected)

Not taking:
M1522202 (don't care)
M1525357 (don't care)
M1529312 (don't care)
M1530712 (don't care)
M1522182 (don't care)

Deferred:
M1514682 (JS) seems to be a CacheIR irregularity, not regular Baseline. https://hg.mozilla.org/releases/mozilla-esr60/rev/22d30ce1468e
M1530958 (JS) (we are vulnerable but need to wait for bustage to settle)
M1532599 (JS) (ditto)

Candidates:
M1503393 https://hg.mozilla.org/releases/mozilla-esr60/rev/2b5ce588bfca https://hg.mozilla.org/releases/mozilla-esr60/rev/bfb67f6a37d4 (minus test)
M1524214 https://hg.mozilla.org/releases/mozilla-esr60/rev/17c3615c2585 (to nsPresShell.cpp)
M1524755 https://hg.mozilla.org/releases/mozilla-esr60/rev/eb3fb35e30ca
M1525145 https://hg.mozilla.org/releases/mozilla-esr60/rev/79b62b373f67
M1516754 https://hg.mozilla.org/releases/mozilla-esr60/rev/1d656b3a3e0b
M1518001 (JS) https://hg.mozilla.org/releases/mozilla-esr60/rev/9828aafd5210 (Nursery.cpp only)
M1518774 https://hg.mozilla.org/releases/mozilla-esr60/rev/33a5feae238c
M1524264 https://hg.mozilla.org/releases/mozilla-esr60/rev/c4b065b6c7c9 (moving noproxy, not noproxy2)
M1530103 https://hg.mozilla.org/releases/mozilla-esr60/rev/bbf08a8ccbeb (can't hurt)
M1531277 https://hg.mozilla.org/releases/mozilla-esr60/rev/b29af68a0c5a

[classilla]

Bump to c9335db16ad0 (more build system changes, no new candidates)

[classilla]

Evaluated M1514682, determined not vulnerable. The current patch for M1532599 just converts to a release assert and is not a definitive fix, so deferring until more information.

[classilla]

Through 87f3db8be205

M1532708: not relevant (APZ)
M1533894: not relevant (Windows)
M1532674: not taking (don't care)
M1515183: not relevant (no Core Animation with 10.4 SDK)
M1528498: not relevant (unaffected)