diff -r 000000000000 -r 6474c204b198 gfx/cairo/cairo-clamp-boundary.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/gfx/cairo/cairo-clamp-boundary.patch	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,71 @@
+# HG changeset patch
+# User Milan Sreckovic <msreckovic@mozilla.com>
+# Date 1362078121 18000
+# Node ID e9e6d97b153d8ec17ee03bb1deef1dec24c7a17c
+# Parent  c65d59d33aa86b7e75bc420ea3beda6201e0aceb
+Bug 825721: clamp negative box starts and disallow negative sizes. r=jmuizelaar
+
+diff --git a/gfx/cairo/cairo/src/cairo-image-surface.c b/gfx/cairo/cairo/src/cairo-image-surface.c
+--- a/gfx/cairo/cairo/src/cairo-image-surface.c
++++ b/gfx/cairo/cairo/src/cairo-image-surface.c
+@@ -1846,16 +1846,20 @@ static cairo_status_t
+     if (likely (status == CAIRO_STATUS_SUCCESS)) {
+ 	for (chunk = &clear.chunks; chunk != NULL; chunk = chunk->next) {
+ 	    for (i = 0; i < chunk->count; i++) {
+ 		int x1 = _cairo_fixed_integer_part (chunk->base[i].p1.x);
+ 		int y1 = _cairo_fixed_integer_part (chunk->base[i].p1.y);
+ 		int x2 = _cairo_fixed_integer_part (chunk->base[i].p2.x);
+ 		int y2 = _cairo_fixed_integer_part (chunk->base[i].p2.y);
+ 
++		x1 = (x1 < 0 ? 0 : x1);
++		y1 = (y1 < 0 ? 0 : y1);
++		if (x2 <= x1 || y2 <= y1)
++		    continue;
+ 		pixman_fill ((uint32_t *) dst->data, dst->stride / sizeof (uint32_t),
+ 			     PIXMAN_FORMAT_BPP (dst->pixman_format),
+ 			     x1, y1, x2 - x1, y2 - y1,
+ 			     0);
+ 	    }
+ 	}
+     }
+ 
+@@ -2669,16 +2673,18 @@ static cairo_status_t
+ 	const cairo_box_t *box = chunk->base;
+ 
+ 	for (i = 0; i < chunk->count; i++) {
+ 	    int x1 = _cairo_fixed_integer_ceil (box[i].p1.x);
+ 	    int y1 = _cairo_fixed_integer_ceil (box[i].p1.y);
+ 	    int x2 = _cairo_fixed_integer_floor (box[i].p2.x);
+ 	    int y2 = _cairo_fixed_integer_floor (box[i].p2.y);
+ 
++	    x1 = (x1 < 0 ? 0 : x1);
++	    y1 = (y1 < 0 ? 0 : y1);
+ 	    if (x2 > x1 && y2 > y1) {
+ 		cairo_box_t b;
+ 
+ 		pixman_fill ((uint32_t *) dst->data,
+ 			     dst->stride / sizeof (uint32_t),
+ 			     PIXMAN_FORMAT_BPP (dst->pixman_format),
+ 			     x1, y1, x2 - x1, y2 - y1,
+ 			     pixel);
+@@ -2929,17 +2935,19 @@ static cairo_status_t
+ 	    cairo_box_t *box = chunk->base;
+ 
+ 	    for (i = 0; i < chunk->count; i++) {
+ 		int x1 = _cairo_fixed_integer_round_down (box[i].p1.x);
+ 		int y1 = _cairo_fixed_integer_round_down (box[i].p1.y);
+ 		int x2 = _cairo_fixed_integer_round_down (box[i].p2.x);
+ 		int y2 = _cairo_fixed_integer_round_down (box[i].p2.y);
+ 
+-		if (x2 == x1 || y2 == y1)
++		x1 = (x1 < 0 ? 0 : x1);
++		y1 = (y1 < 0 ? 0 : y1);
++		if (x2 <= x1 || y2 <= y1)
+ 		    continue;
+ 
+ 		pixman_fill ((uint32_t *) dst->data, dst->stride / sizeof (uint32_t),
+ 			     PIXMAN_FORMAT_BPP (dst->pixman_format),
+ 			     x1, y1, x2 - x1, y2 - y1,
+ 			     pixel);
+ 	    }
+ 	}