From 026acc36a602a243a889285e7b1ebcee0603ed73 Mon Sep 17 00:00:00 2001
From: Peter Van der Beken <peterv@propagandism.org>
Date: Fri, 7 Mar 2025 14:15:29 +0000
Subject: [PATCH] Bug 1950575 - Add vendoring for Expat. r=mccr8

Differential Revision: https://phabricator.services.mozilla.com/D239717
---
 parser/expat/00_xmlchar.patch                 |  46 +++
 parser/expat/01_noslop.patch                  |  14 +
 parser/expat/02_report_mismatched_tag.patch   |  73 +++++
 parser/expat/03_dont_generate_salt.patch      |  37 +++
 parser/expat/04_always_set_eventptrs.patch    |  14 +
 parser/expat/05_getcurrentbyteindex.patch     |  17 ++
 .../expat/06_report_processing_entity.patch   |  17 ++
 parser/expat/07_always_store_rawnames.patch   |  86 ++++++
 .../08_dont_ignore_undeclared_entity.patch    |  33 +++
 parser/expat/09_include_xmlns.patch           | 140 ++++++++++
 parser/expat/10_internalsubset.patch          |  17 ++
 parser/expat/11_nested_entities.patch         |  33 +++
 parser/expat/12_version_limit.patch           |  28 ++
 parser/expat/13_no_debug_report.patch         | 218 +++++++++++++++
 parser/expat/14_unused.patch                  | 262 ++++++++++++++++++
 parser/expat/README_MOZILLA                   |   9 +
 parser/expat/{ => expat}/lib/ascii.h          |   0
 parser/expat/{ => expat}/lib/asciitab.h       |   0
 parser/expat/{ => expat}/lib/expat.h          |   0
 parser/expat/{ => expat}/lib/expat_external.h |   0
 parser/expat/{ => expat}/lib/iasciitab.h      |   0
 parser/expat/{ => expat}/lib/internal.h       |   0
 parser/expat/{ => expat}/lib/latin1tab.h      |   0
 parser/expat/{ => expat}/lib/moz_expat.h      |   0
 parser/expat/{ => expat}/lib/moz_xmlparse.c   |   0
 parser/expat/{ => expat}/lib/moz_xmltok.c     |   6 +
 parser/expat/{ => expat}/lib/nametab.h        |   0
 parser/expat/{ => expat}/lib/siphash.h        |   0
 parser/expat/{ => expat}/lib/utf8tab.h        |   0
 parser/expat/{ => expat}/lib/winconfig.h      |   0
 parser/expat/{ => expat}/lib/xmlparse.c       |   0
 parser/expat/{ => expat}/lib/xmlrole.c        |   0
 parser/expat/{ => expat}/lib/xmlrole.h        |   0
 parser/expat/{ => expat}/lib/xmltok.c         |   0
 parser/expat/{ => expat}/lib/xmltok.h         |   0
 parser/expat/{ => expat}/lib/xmltok_impl.c    |   0
 parser/expat/{ => expat}/lib/xmltok_impl.h    |   0
 parser/expat/{ => expat}/lib/xmltok_ns.c      |   0
 parser/expat/lib/moz.build                    |  23 --
 parser/expat/moz.build                        |  17 +-
 parser/expat/moz.yaml                         |  64 +++++
 parser/expat/{lib => }/sources.mozbuild       |   6 +-
 security/rlbox/moz.build                      |   6 +-
 43 files changed, 1135 insertions(+), 31 deletions(-)
 create mode 100644 parser/expat/00_xmlchar.patch
 create mode 100644 parser/expat/01_noslop.patch
 create mode 100644 parser/expat/02_report_mismatched_tag.patch
 create mode 100644 parser/expat/03_dont_generate_salt.patch
 create mode 100644 parser/expat/04_always_set_eventptrs.patch
 create mode 100644 parser/expat/05_getcurrentbyteindex.patch
 create mode 100644 parser/expat/06_report_processing_entity.patch
 create mode 100644 parser/expat/07_always_store_rawnames.patch
 create mode 100644 parser/expat/08_dont_ignore_undeclared_entity.patch
 create mode 100644 parser/expat/09_include_xmlns.patch
 create mode 100644 parser/expat/10_internalsubset.patch
 create mode 100644 parser/expat/11_nested_entities.patch
 create mode 100644 parser/expat/12_version_limit.patch
 create mode 100644 parser/expat/13_no_debug_report.patch
 create mode 100644 parser/expat/14_unused.patch
 create mode 100644 parser/expat/README_MOZILLA
 rename parser/expat/{ => expat}/lib/ascii.h (100%)
 rename parser/expat/{ => expat}/lib/asciitab.h (100%)
 rename parser/expat/{ => expat}/lib/expat.h (100%)
 rename parser/expat/{ => expat}/lib/expat_external.h (100%)
 rename parser/expat/{ => expat}/lib/iasciitab.h (100%)
 rename parser/expat/{ => expat}/lib/internal.h (100%)
 rename parser/expat/{ => expat}/lib/latin1tab.h (100%)
 rename parser/expat/{ => expat}/lib/moz_expat.h (100%)
 rename parser/expat/{ => expat}/lib/moz_xmlparse.c (100%)
 rename parser/expat/{ => expat}/lib/moz_xmltok.c (97%)
 rename parser/expat/{ => expat}/lib/nametab.h (100%)
 rename parser/expat/{ => expat}/lib/siphash.h (100%)
 rename parser/expat/{ => expat}/lib/utf8tab.h (100%)
 rename parser/expat/{ => expat}/lib/winconfig.h (100%)
 rename parser/expat/{ => expat}/lib/xmlparse.c (100%)
 rename parser/expat/{ => expat}/lib/xmlrole.c (100%)
 rename parser/expat/{ => expat}/lib/xmlrole.h (100%)
 rename parser/expat/{ => expat}/lib/xmltok.c (100%)
 rename parser/expat/{ => expat}/lib/xmltok.h (100%)
 rename parser/expat/{ => expat}/lib/xmltok_impl.c (100%)
 rename parser/expat/{ => expat}/lib/xmltok_impl.h (100%)
 rename parser/expat/{ => expat}/lib/xmltok_ns.c (100%)
 delete mode 100644 parser/expat/lib/moz.build
 create mode 100644 parser/expat/moz.yaml
 rename parser/expat/{lib => }/sources.mozbuild (80%)

diff --git a/parser/expat/00_xmlchar.patch b/parser/expat/00_xmlchar.patch
new file mode 100644
index 000000000000..49e0f9a99a95
--- /dev/null
+++ b/parser/expat/00_xmlchar.patch
@@ -0,0 +1,46 @@
+diff --git a/expat/lib/expat_external.h b/expat/lib/expat_external.h
+--- a/expat/lib/expat_external.h
++++ b/expat/lib/expat_external.h
+@@ -137,6 +137,9 @@ extern "C" {
+ #  endif
+ #endif
+ 
++/* BEGIN MOZILLA CHANGE (typedef XML_Char to char16_t) */
++#if 0
++
+ #ifdef XML_UNICODE /* Information is UTF-16 encoded. */
+ #  ifdef XML_UNICODE_WCHAR_T
+ typedef wchar_t XML_Char;
+@@ -150,6 +153,9 @@ typedef char XML_Char;
+ typedef char XML_LChar;
+ #endif   /* XML_UNICODE */
+ 
++#endif
++/* END MOZILLA CHANGE */
++
+ #ifdef XML_LARGE_SIZE /* Use large integers for file/stream positions. */
+ typedef long long XML_Index;
+ typedef unsigned long long XML_Size;
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -194,6 +194,9 @@ typedef char ICHAR;
+ 
+ #endif
+ 
++/* BEGIN MOZILLA CHANGE (typedef XML_Char to char16_t) */
++#if 0
++
+ #ifdef XML_UNICODE
+ 
+ #  ifdef XML_UNICODE_WCHAR_T
+@@ -211,6 +214,9 @@ typedef char ICHAR;
+ 
+ #endif
+ 
++#endif
++/* END MOZILLA CHANGE */
++
+ /* Round up n to be a multiple of sz, where sz is a power of 2. */
+ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1))
+ 
diff --git a/parser/expat/01_noslop.patch b/parser/expat/01_noslop.patch
new file mode 100644
index 000000000000..22b24f2a44bb
--- /dev/null
+++ b/parser/expat/01_noslop.patch
@@ -0,0 +1,14 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -269,7 +269,9 @@ typedef struct {
+ #define INIT_DATA_BUF_SIZE 1024
+ #define INIT_ATTS_SIZE 16
+ #define INIT_ATTS_VERSION 0xFFFFFFFF
+-#define INIT_BLOCK_SIZE 1024
++/* BEGIN MOZILLA CHANGE (Avoid slop in poolGrow() allocations) */
++#define INIT_BLOCK_SIZE ((int)(1024 - (offsetof(BLOCK, s) / sizeof(XML_Char))))
++/* END MOZILLA CHANGE */
+ #define INIT_BUFFER_SIZE 1024
+ 
+ #define EXPAND_SPARE 24
diff --git a/parser/expat/02_report_mismatched_tag.patch b/parser/expat/02_report_mismatched_tag.patch
new file mode 100644
index 000000000000..aa4bd5c8382e
--- /dev/null
+++ b/parser/expat/02_report_mismatched_tag.patch
@@ -0,0 +1,73 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -764,6 +764,9 @@ struct XML_ParserStruct {
+   ACCOUNTING m_accounting;
+   ENTITY_STATS m_entity_stats;
+ #endif
++/* BEGIN MOZILLA CHANGE (Report opening tag of mismatched closing tag) */
++  const XML_Char* m_mismatch;
++/* END MOZILLA CHANGE */
+ };
+ 
+ #define MALLOC(parser, s) (parser->m_mem.malloc_fcn((s)))
+@@ -1189,6 +1192,10 @@ parserCreate(const XML_Char *encodingNam
+     parser->m_internalEncoding = XmlGetInternalEncoding();
+   }
+ 
++/* BEGIN MOZILLA CHANGE (Report opening tag of mismatched closing tag) */
++  parser->m_mismatch = NULL;
++/* END MOZILLA CHANGE */
++
+   return parser;
+ }
+ 
+@@ -2645,6 +2652,14 @@ XML_SetBillionLaughsAttackProtectionActi
+ }
+ #endif /* XML_GE == 1 */
+ 
++/* BEGIN MOZILLA CHANGE (Report opening tag of mismatched closing tag) */
++const XML_Char * XMLCALL
++MOZ_XML_GetMismatchedTag(XML_Parser parser)
++{
++  return parser->m_mismatch;
++}
++/* END MOZILLA CHANGE */
++
+ XML_Bool XMLCALL
+ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled) {
+   if (parser != NULL && (enabled == XML_TRUE || enabled == XML_FALSE)) {
+@@ -3117,6 +3132,33 @@ doContent(XML_Parser parser, int startTa
+         len = XmlNameLength(enc, rawName);
+         if (len != tag->rawNameLength
+             || memcmp(tag->rawName, rawName, len) != 0) {
++/* BEGIN MOZILLA CHANGE (Report opening tag of mismatched closing tag) */
++          /* This code is copied from the |if (parser->m_endElementHandler)|
++             block below
++          */
++          const XML_Char *localPart;
++          const XML_Char *prefix;
++          XML_Char *uri;
++          localPart = tag->name.localPart;
++          if (parser->m_ns && localPart) {
++            /* localPart and prefix may have been overwritten in
++               tag->name.str, since this points to the binding->uri
++               buffer which gets reused; so we have to add them again
++            */
++            uri = (XML_Char *)tag->name.str + tag->name.uriLen;
++            /* don't need to check for space - already done in storeAtts() */
++            while (*localPart)
++              *uri++ = *localPart++;
++            prefix = tag->name.prefix;
++            if (parser->m_ns_triplets && prefix) {
++              *uri++ = parser->m_namespaceSeparator;
++              while (*prefix)
++                *uri++ = *prefix++;
++            }
++            *uri = XML_T('\0');
++          }
++          parser->m_mismatch = tag->name.str;
++/* END MOZILLA CHANGE */
+           *eventPP = rawName;
+           return XML_ERROR_TAG_MISMATCH;
+         }
diff --git a/parser/expat/03_dont_generate_salt.patch b/parser/expat/03_dont_generate_salt.patch
new file mode 100644
index 000000000000..91cb70eb2418
--- /dev/null
+++ b/parser/expat/03_dont_generate_salt.patch
@@ -0,0 +1,37 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -796,6 +796,8 @@ static const XML_Char implicitContext[]
+        ASCII_s,     ASCII_p,     ASCII_a,      ASCII_c,      ASCII_e,
+        '\0'};
+ 
++/* BEGIN MOZILLA CHANGE (we already set a salt through XML_SetHashSalt) */
++#if 0
+ /* To avoid warnings about unused functions: */
+ #if ! defined(HAVE_ARC4RANDOM_BUF) && ! defined(HAVE_ARC4RANDOM)
+ 
+@@ -957,9 +959,13 @@ ENTROPY_DEBUG(const char *label, unsigne
+   }
+   return entropy;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ static unsigned long
+ generate_hash_secret_salt(XML_Parser parser) {
++/* BEGIN MOZILLA CHANGE (we already set a salt through XML_SetHashSalt) */
++#if 0
+   unsigned long entropy;
+   (void)parser;
+ 
+@@ -999,6 +1005,10 @@ generate_hash_secret_salt(XML_Parser par
+                          entropy * (unsigned long)2305843009213693951ULL);
+   }
+ #endif
++#else
++  abort();
++#endif
++/* END MOZILLA CHANGE */
+ }
+ 
+ static unsigned long
diff --git a/parser/expat/04_always_set_eventptrs.patch b/parser/expat/04_always_set_eventptrs.patch
new file mode 100644
index 000000000000..c097c3856fee
--- /dev/null
+++ b/parser/expat/04_always_set_eventptrs.patch
@@ -0,0 +1,14 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -2328,6 +2328,10 @@ XML_ResumeParser(XML_Parser parser) {
+   XmlUpdatePosition(parser->m_encoding, parser->m_positionPtr,
+                     parser->m_bufferPtr, &parser->m_position);
+   parser->m_positionPtr = parser->m_bufferPtr;
++/* BEGIN MOZILLA CHANGE (always set m_eventPtr/m_eventEndPtr) */
++  parser->m_eventPtr = parser->m_bufferPtr;
++  parser->m_eventEndPtr = parser->m_bufferPtr;
++/* END MOZILLA CHANGE */
+   return result;
+ }
+ 
diff --git a/parser/expat/05_getcurrentbyteindex.patch b/parser/expat/05_getcurrentbyteindex.patch
new file mode 100644
index 000000000000..5ae0d381723e
--- /dev/null
+++ b/parser/expat/05_getcurrentbyteindex.patch
@@ -0,0 +1,17 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -2357,7 +2357,13 @@ XML_GetCurrentByteIndex(XML_Parser parse
+   if (parser->m_eventPtr)
+     return (XML_Index)(parser->m_parseEndByteIndex
+                        - (parser->m_parseEndPtr - parser->m_eventPtr));
++/* BEGIN MOZILLA CHANGE (fix XML_GetCurrentByteIndex) */
++#if 0
+   return -1;
++#else
++  return parser->m_parseEndByteIndex;
++#endif
++/* END MOZILLA CHANGE */
+ }
+ 
+ int XMLCALL
diff --git a/parser/expat/06_report_processing_entity.patch b/parser/expat/06_report_processing_entity.patch
new file mode 100644
index 000000000000..41bc684b575a
--- /dev/null
+++ b/parser/expat/06_report_processing_entity.patch
@@ -0,0 +1,17 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -2680,6 +2680,13 @@ MOZ_XML_GetMismatchedTag(XML_Parser pars
+ }
+ /* END MOZILLA CHANGE */
+ 
++/* BEGIN MOZILLA CHANGE (Report whether the parser is currently expanding an entity) */
++XML_Bool XMLCALL
++MOZ_XML_ProcessingEntityValue(XML_Parser parser) {
++  return parser->m_openInternalEntities != NULL;
++}
++/* END MOZILLA CHANGE */
++
+ XML_Bool XMLCALL
+ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled) {
+   if (parser != NULL && (enabled == XML_TRUE || enabled == XML_FALSE)) {
diff --git a/parser/expat/07_always_store_rawnames.patch b/parser/expat/07_always_store_rawnames.patch
new file mode 100644
index 000000000000..3b71b368eca7
--- /dev/null
+++ b/parser/expat/07_always_store_rawnames.patch
@@ -0,0 +1,86 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -491,6 +491,13 @@ static enum XML_Error doProlog(XML_Parse
+                                enum XML_Account account);
+ static enum XML_Error processInternalEntity(XML_Parser parser, ENTITY *entity,
+                                             XML_Bool betweenDecl);
++/* BEGIN MOZILLA CHANGE (Bug 1746996 - Ensure that storeRawNames is always called) */
++static enum XML_Error doContentInternal(XML_Parser parser, int startTagLevel,
++                                        const ENCODING *enc, const char *start,
++                                        const char *end, const char **endPtr,
++                                        XML_Bool haveMore,
++                                        enum XML_Account account);
++/* END MOZILLA CHANGE */
+ static enum XML_Error doContent(XML_Parser parser, int startTagLevel,
+                                 const ENCODING *enc, const char *start,
+                                 const char *end, const char **endPtr,
+@@ -2756,10 +2763,14 @@ contentProcessor(XML_Parser parser, cons
+   enum XML_Error result = doContent(
+       parser, 0, parser->m_encoding, start, end, endPtr,
+       (XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_ACCOUNT_DIRECT);
++/* BEGIN MOZILLA CHANGE (Bug 1746996 - Ensure that storeRawNames is always called) */
++#if 0
+   if (result == XML_ERROR_NONE) {
+     if (! storeRawNames(parser))
+       return XML_ERROR_NO_MEMORY;
+   }
++#endif
++/* END MOZILLA CHANGE */
+   return result;
+ }
+ 
+@@ -2872,6 +2883,24 @@ externalEntityContentProcessor(XML_Parse
+       = doContent(parser, 1, parser->m_encoding, start, end, endPtr,
+                   (XML_Bool)! parser->m_parsingStatus.finalBuffer,
+                   XML_ACCOUNT_ENTITY_EXPANSION);
++/* BEGIN MOZILLA CHANGE (Bug 1746996 - Ensure that storeRawNames is always called) */
++#if 0
++  if (result == XML_ERROR_NONE) {
++    if (! storeRawNames(parser))
++      return XML_ERROR_NO_MEMORY;
++  }
++#endif
++/* END MOZILLA CHANGE */
++  return result;
++}
++
++static enum XML_Error
++doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
++          const char *s, const char *end, const char **nextPtr,
++          XML_Bool haveMore, enum XML_Account account) {
++/* BEGIN MOZILLA CHANGE (Bug 1746996 - Ensure that storeRawNames is always called) */
++  enum XML_Error result = doContentInternal(parser, startTagLevel, enc, s, end,
++                                            nextPtr, haveMore, account);
+   if (result == XML_ERROR_NONE) {
+     if (! storeRawNames(parser))
+       return XML_ERROR_NO_MEMORY;
+@@ -2880,9 +2909,10 @@ externalEntityContentProcessor(XML_Parse
+ }
+ 
+ static enum XML_Error
+-doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+-          const char *s, const char *end, const char **nextPtr,
+-          XML_Bool haveMore, enum XML_Account account) {
++doContentInternal(XML_Parser parser, int startTagLevel, const ENCODING *enc,
++                  const char *s, const char *end, const char **nextPtr,
++                  XML_Bool haveMore, enum XML_Account account) {
++/* END MOZILLA CHANGE */
+   /* save one level of indirection */
+   DTD *const dtd = parser->m_dtd;
+ 
+@@ -6038,10 +6068,14 @@ internalEntityProcessor(XML_Parser parse
+                        parser->m_encoding, s, end, nextPtr,
+                        (XML_Bool)! parser->m_parsingStatus.finalBuffer,
+                        XML_ACCOUNT_DIRECT);
++/* BEGIN MOZILLA CHANGE (Bug 1746996 - Ensure that storeRawNames is always called) */
++#if 0
+     if (result == XML_ERROR_NONE) {
+       if (! storeRawNames(parser))
+         return XML_ERROR_NO_MEMORY;
+     }
++#endif
++/* END MOZILLA CHANGE */
+     return result;
+   }
+ }
diff --git a/parser/expat/08_dont_ignore_undeclared_entity.patch b/parser/expat/08_dont_ignore_undeclared_entity.patch
new file mode 100644
index 000000000000..8d07e2ae03ea
--- /dev/null
+++ b/parser/expat/08_dont_ignore_undeclared_entity.patch
@@ -0,0 +1,33 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -3028,9 +3028,15 @@ doContentInternal(XML_Parser parser, int
+       } else if (! entity) {
+         if (parser->m_skippedEntityHandler)
+           parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0);
++/* BEGIN MOZILLA CHANGE (Bug 35984 - Undeclared entities are ignored when external DTD not found) */
++#if 0
+         else if (parser->m_defaultHandler)
+           reportDefault(parser, enc, s, next);
+         break;
++#else
++        return XML_ERROR_UNDEFINED_ENTITY;
++#endif
++/* END MOZILLA CHANGE */
+       }
+       if (entity->open)
+         return XML_ERROR_RECURSIVE_ENTITY_REF;
+@@ -6229,7 +6235,13 @@ appendAttributeValue(XML_Parser parser, 
+         if ((pool == &parser->m_tempPool) && parser->m_defaultHandler)
+           reportDefault(parser, enc, ptr, next);
+         */
++/* BEGIN MOZILLA CHANGE (Bug 35984 - Undeclared entities are ignored when external DTD not found) */
++#if 0
+         break;
++#else
++        return XML_ERROR_UNDEFINED_ENTITY;
++#endif
++/* END MOZILLA CHANGE */
+       }
+       if (entity->open) {
+         if (enc == parser->m_encoding) {
diff --git a/parser/expat/09_include_xmlns.patch b/parser/expat/09_include_xmlns.patch
new file mode 100644
index 000000000000..fa5a1e232909
--- /dev/null
+++ b/parser/expat/09_include_xmlns.patch
@@ -0,0 +1,140 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -3458,6 +3458,9 @@ storeAtts(XML_Parser parser, const ENCOD
+   int n;
+   XML_Char *uri;
+   int nPrefixes = 0;
++/* BEGIN MOZILLA CHANGE (Include xmlns attributes in attributes array) */
++  int nXMLNSDeclarations = 0;
++/* END MOZILLA CHANGE */
+   BINDING *binding;
+   const XML_Char *localPart;
+ 
+@@ -3615,7 +3618,15 @@ storeAtts(XML_Parser parser, const ENCOD
+                                            appAtts[attIndex], bindingsPtr);
+         if (result)
+           return result;
++/* BEGIN MOZILLA CHANGE (Include xmlns attributes in attributes array) */
++#if 0
+         --attIndex;
++#else
++        attIndex++;
++        nXMLNSDeclarations++;
++        (attId->name)[-1] = 3;
++#endif
++/* END MOZILLA CHANGE */
+       } else {
+         /* deal with other prefixed names later */
+         attIndex++;
+@@ -3647,6 +3658,12 @@ storeAtts(XML_Parser parser, const ENCOD
+                                              da->value, bindingsPtr);
+           if (result)
+             return result;
++/* BEGIN MOZILLA CHANGE (Include xmlns attributes in attributes array) */
++          (da->id->name)[-1] = 3;
++          nXMLNSDeclarations++;
++          appAtts[attIndex++] = da->id->name;
++          appAtts[attIndex++] = da->value;
++/* END MOZILLA CHANGE */
+         } else {
+           (da->id->name)[-1] = 2;
+           nPrefixes++;
+@@ -3665,7 +3682,13 @@ storeAtts(XML_Parser parser, const ENCOD
+   /* expand prefixed attribute names, check for duplicates,
+      and clear flags that say whether attributes were specified */
+   i = 0;
++/* BEGIN MOZILLA CHANGE (Include xmlns attributes in attributes array) */
++#if 0
+   if (nPrefixes) {
++#else
++  if (nPrefixes || nXMLNSDeclarations) {
++#endif
++/* END MOZILLA CHANGE */
+     int j; /* hash table index */
+     unsigned long version = parser->m_nsAttsVersion;
+ 
+@@ -3675,6 +3698,9 @@ storeAtts(XML_Parser parser, const ENCOD
+     }
+ 
+     unsigned int nsAttsSize = 1u << parser->m_nsAttsPower;
++/* BEGIN MOZILLA CHANGE (Include xmlns attributes in attributes array) */
++    if (nPrefixes) {
++/* END MOZILLA CHANGE */
+     unsigned char oldNsAttsPower = parser->m_nsAttsPower;
+     /* size of hash table must be at least 2 * (# of prefixed attributes) */
+     if ((nPrefixes << 1)
+@@ -3724,6 +3750,9 @@ storeAtts(XML_Parser parser, const ENCOD
+         parser->m_nsAtts[--j].version = version;
+     }
+     parser->m_nsAttsVersion = --version;
++/* BEGIN MOZILLA CHANGE (Include xmlns attributes in attributes array) */
++    }
++/* END MOZILLA CHANGE */
+ 
+     /* expand prefixed names and check for duplicates */
+     for (; i < attIndex; i += 2) {
+@@ -3823,10 +3852,63 @@ storeAtts(XML_Parser parser, const ENCOD
+         parser->m_nsAtts[j].hash = uriHash;
+         parser->m_nsAtts[j].uriName = s;
+ 
++/* BEGIN MOZILLA CHANGE (Include xmlns attributes in attributes array) */
++#if 0
+         if (! --nPrefixes) {
++#else
++        if (! --nPrefixes && ! nXMLNSDeclarations) {
++#endif
++/* END MOZILLA CHANGE */
+           i += 2;
+           break;
+         }
++/* BEGIN MOZILLA CHANGE (Include xmlns attributes in attributes array) */
++      } else if (s[-1] == 3) { /* xmlns attribute */
++        static const XML_Char xmlnsNamespace[] = {
++          ASCII_h, ASCII_t, ASCII_t, ASCII_p, ASCII_COLON, ASCII_SLASH, ASCII_SLASH,
++          ASCII_w, ASCII_w, ASCII_w, ASCII_PERIOD, ASCII_w, ASCII_3, ASCII_PERIOD,
++          ASCII_o, ASCII_r, ASCII_g, ASCII_SLASH, ASCII_2, ASCII_0, ASCII_0, ASCII_0,
++          ASCII_SLASH, ASCII_x, ASCII_m, ASCII_l, ASCII_n, ASCII_s, ASCII_SLASH, '\0'
++        };
++        static const XML_Char xmlnsPrefix[] = {
++          ASCII_x, ASCII_m, ASCII_l, ASCII_n, ASCII_s, '\0'
++        };
++
++        ((XML_Char *)s)[-1] = 0;  /* clear flag */
++        if (! poolAppendString(&parser->m_tempPool, xmlnsNamespace)
++            || ! poolAppendChar(&parser->m_tempPool, parser->m_namespaceSeparator))
++          return XML_ERROR_NO_MEMORY;
++        s += sizeof(xmlnsPrefix) / sizeof(xmlnsPrefix[0]) - 1;
++        if (*s == XML_T(':')) {
++          ++s;
++          do {  /* copies null terminator */
++            if (! poolAppendChar(&parser->m_tempPool, *s))
++              return XML_ERROR_NO_MEMORY;
++          } while (*s++);
++          if (parser->m_ns_triplets) { /* append namespace separator and prefix */
++            parser->m_tempPool.ptr[-1] = parser->m_namespaceSeparator;
++            if (! poolAppendString(&parser->m_tempPool, xmlnsPrefix)
++                || ! poolAppendChar(&parser->m_tempPool, '\0'))
++              return XML_ERROR_NO_MEMORY;
++          }
++        }
++        else {
++          /* xlmns attribute without a prefix. */
++          if (! poolAppendString(&parser->m_tempPool, xmlnsPrefix)
++              || ! poolAppendChar(&parser->m_tempPool, '\0'))
++            return XML_ERROR_NO_MEMORY;
++        }
++
++        /* store expanded name in attribute list */
++        s = poolStart(&parser->m_tempPool);
++        poolFinish(&parser->m_tempPool);
++        appAtts[i] = s;
++
++        if (! --nXMLNSDeclarations && ! nPrefixes) {
++          i += 2;
++          break;
++        }
++/* END MOZILLA CHANGE */
+       } else                     /* not prefixed */
+         ((XML_Char *)s)[-1] = 0; /* clear flag */
+     }
diff --git a/parser/expat/10_internalsubset.patch b/parser/expat/10_internalsubset.patch
new file mode 100644
index 000000000000..27a9fb8025d0
--- /dev/null
+++ b/parser/expat/10_internalsubset.patch
@@ -0,0 +1,17 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5752,7 +5752,13 @@ doProlog(XML_Parser parser, const ENCODI
+           entity->open = XML_TRUE;
+           entityTrackingOnOpen(parser, entity, __LINE__);
+           if (! parser->m_externalEntityRefHandler(
++/* BEGIN MOZILLA CHANGE (Bug 191482 - Add external entity inclusions to internalSubset) */
++#if 0
+                   parser->m_externalEntityRefHandlerArg, 0, entity->base,
++#else
++                  parser->m_externalEntityRefHandlerArg, entity->name, entity->base,
++#endif
++/* END MOZILLA CHANGE */
+                   entity->systemId, entity->publicId)) {
+             entityTrackingOnClose(parser, entity, __LINE__);
+             entity->open = XML_FALSE;
diff --git a/parser/expat/11_nested_entities.patch b/parser/expat/11_nested_entities.patch
new file mode 100644
index 000000000000..290d187f4cff
--- /dev/null
+++ b/parser/expat/11_nested_entities.patch
@@ -0,0 +1,33 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -6085,7 +6085,29 @@ processInternalEntity(XML_Parser parser,
+       entityTrackingOnClose(parser, entity, __LINE__);
+ #endif /* XML_GE == 1 */
+       entity->open = XML_FALSE;
++/* BEGIN MOZILLA CHANGE (Bug 569229 - Deal with parser interruption from nested entities) */
++#if 0
+       parser->m_openInternalEntities = openEntity->next;
++#else
++      if (parser->m_openInternalEntities == openEntity) {
++        parser->m_openInternalEntities = openEntity->next;
++      }
++      else {
++        /* openEntity should be closed, but it contains an inner entity that is
++           still open. Remove openEntity from the m_openInternalEntities linked
++           list by looking for the inner entity in the list that links to
++           openEntity and fixing up its 'next' member
++        */
++        OPEN_INTERNAL_ENTITY *innerOpenEntity = parser->m_openInternalEntities;
++        do {
++          if (innerOpenEntity->next == openEntity) {
++            innerOpenEntity->next = openEntity->next;
++            break;
++          }
++        } while ((innerOpenEntity = innerOpenEntity->next));
++      }
++#endif
++/* END MOZILLA CHANGE */
+       /* put openEntity back in list of free instances */
+       openEntity->next = parser->m_freeInternalEntities;
+       parser->m_freeInternalEntities = openEntity;
diff --git a/parser/expat/12_version_limit.patch b/parser/expat/12_version_limit.patch
new file mode 100644
index 000000000000..a505f726e53e
--- /dev/null
+++ b/parser/expat/12_version_limit.patch
@@ -0,0 +1,28 @@
+diff --git a/expat/lib/xmltok.c b/expat/lib/xmltok.c
+--- a/expat/lib/xmltok.c
++++ b/expat/lib/xmltok.c
+@@ -1148,6 +1148,10 @@ static const char KW_yes[] = {ASCII_y, A
+ 
+ static const char KW_no[] = {ASCII_n, ASCII_o, '\0'};
+ 
++/* BEGIN MOZILLA CHANGE (Bug 62157 - Document content is rendered even though version value is not "1.0") */
++static const char KW_XML_1_0[] = {ASCII_1, ASCII_PERIOD, ASCII_0, '\0'};
++/* END MOZILLA CHANGE */
++
+ static int
+ doParseXmlDecl(const ENCODING *(*encodingFinder)(const ENCODING *, const char *,
+                                                  const char *),
+@@ -1175,6 +1179,13 @@ doParseXmlDecl(const ENCODING *(*encodin
+       *versionPtr = val;
+     if (versionEndPtr)
+       *versionEndPtr = ptr;
++/* BEGIN MOZILLA CHANGE (Bug 62157 - Document content is rendered even though version value is not "1.0") */
++     /* Anything else but a version="1.0" is invalid for us, until we support later versions. */
++     if (!XmlNameMatchesAscii(enc, val, ptr - enc->minBytesPerChar, KW_XML_1_0)) {
++       *badPtr = val;
++       return 0;
++     }
++/* END MOZILLA CHANGE */
+     if (! parsePseudoAttribute(enc, ptr, end, &name, &nameEnd, &val, &ptr)) {
+       *badPtr = ptr;
+       return 0;
diff --git a/parser/expat/13_no_debug_report.patch b/parser/expat/13_no_debug_report.patch
new file mode 100644
index 000000000000..3d1f7d94a59e
--- /dev/null
+++ b/parser/expat/13_no_debug_report.patch
@@ -0,0 +1,218 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -444,16 +444,24 @@ typedef unsigned long long XmlBigCount;
+ typedef struct accounting {
+   XmlBigCount countBytesDirect;
+   XmlBigCount countBytesIndirect;
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+   unsigned long debugLevel;
++#endif
++/* END MOZILLA CHANGE */
+   float maximumAmplificationFactor; // >=1.0
+   unsigned long long activationThresholdBytes;
+ } ACCOUNTING;
+ 
+ typedef struct entity_stats {
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+   unsigned int countEverOpened;
+   unsigned int currentDepth;
+   unsigned int maximumDepthSeen;
+   unsigned long debugLevel;
++#endif
++/* END MOZILLA CHANGE */
+ } ENTITY_STATS;
+ #endif /* XML_GE == 1 */
+ 
+@@ -611,18 +619,26 @@ static void parserInit(XML_Parser parser
+ static float accountingGetCurrentAmplification(XML_Parser rootParser);
+ static void accountingReportStats(XML_Parser originParser, const char *epilog);
+ static void accountingOnAbort(XML_Parser originParser);
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+ static void accountingReportDiff(XML_Parser rootParser,
+                                  unsigned int levelsAwayFromRootParser,
+                                  const char *before, const char *after,
+                                  ptrdiff_t bytesMore, int source_line,
+                                  enum XML_Account account);
++#endif
++/* END MOZILLA CHANGE */
+ static XML_Bool accountingDiffTolerated(XML_Parser originParser, int tok,
+                                         const char *before, const char *after,
+                                         int source_line,
+                                         enum XML_Account account);
+ 
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+ static void entityTrackingReportStats(XML_Parser parser, ENTITY *entity,
+                                       const char *action, int sourceLine);
++#endif
++/* END MOZILLA CHANGE */
+ static void entityTrackingOnOpen(XML_Parser parser, ENTITY *entity,
+                                  int sourceLine);
+ static void entityTrackingOnClose(XML_Parser parser, ENTITY *entity,
+@@ -632,8 +648,12 @@ static XML_Parser getRootParserOf(XML_Pa
+                                   unsigned int *outLevelDiff);
+ #endif /* XML_GE == 1 */
+ 
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+ static unsigned long getDebugLevel(const char *variableName,
+                                    unsigned long defaultDebugLevel);
++#endif
++/* END MOZILLA CHANGE */
+ 
+ #define poolStart(pool) ((pool)->start)
+ #define poolLength(pool) ((pool)->ptr - (pool)->start)
+@@ -1292,15 +1312,23 @@ parserInit(XML_Parser parser, const XML_
+ 
+ #if XML_GE == 1
+   memset(&parser->m_accounting, 0, sizeof(ACCOUNTING));
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+   parser->m_accounting.debugLevel = getDebugLevel("EXPAT_ACCOUNTING_DEBUG", 0u);
++#endif
++/* END MOZILLA CHANGE */
+   parser->m_accounting.maximumAmplificationFactor
+       = EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT;
+   parser->m_accounting.activationThresholdBytes
+       = EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT;
+ 
+   memset(&parser->m_entity_stats, 0, sizeof(ENTITY_STATS));
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+   parser->m_entity_stats.debugLevel = getDebugLevel("EXPAT_ENTITY_DEBUG", 0u);
+ #endif
++/* END MOZILLA CHANGE */
++#endif
+ }
+ 
+ /* moves list of bindings to m_freeBindingList */
+@@ -8069,6 +8097,8 @@ accountingGetCurrentAmplification(XML_Pa
+ 
+ static void
+ accountingReportStats(XML_Parser originParser, const char *epilog) {
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+   const XML_Parser rootParser = getRootParserOf(originParser, NULL);
+   assert(! rootParser->m_parentParser);
+ 
+@@ -8084,6 +8114,8 @@ accountingReportStats(XML_Parser originP
+           (void *)rootParser, rootParser->m_accounting.countBytesDirect,
+           rootParser->m_accounting.countBytesIndirect,
+           (double)amplificationFactor, epilog);
++#endif
++/* END MOZILLA CHANGE */
+ }
+ 
+ static void
+@@ -8091,6 +8123,8 @@ accountingOnAbort(XML_Parser originParse
+   accountingReportStats(originParser, " ABORTING\n");
+ }
+ 
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+ static void
+ accountingReportDiff(XML_Parser rootParser,
+                      unsigned int levelsAwayFromRootParser, const char *before,
+@@ -8127,6 +8161,8 @@ accountingReportDiff(XML_Parser rootPars
+   }
+   fprintf(stderr, "\"\n");
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ static XML_Bool
+ accountingDiffTolerated(XML_Parser originParser, int tok, const char *before,
+@@ -8174,11 +8210,15 @@ accountingDiffTolerated(XML_Parser origi
+         || (amplificationFactor
+             <= rootParser->m_accounting.maximumAmplificationFactor);
+ 
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+   if (rootParser->m_accounting.debugLevel >= 2u) {
+     accountingReportStats(rootParser, "");
+     accountingReportDiff(rootParser, levelsAwayFromRootParser, before, after,
+                          bytesMore, source_line, account);
+   }
++#endif
++/* END MOZILLA CHANGE */
+ 
+   return tolerated;
+ }
+@@ -8197,6 +8237,8 @@ testingAccountingGetCountBytesIndirect(X
+   return parser->m_accounting.countBytesIndirect;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+ static void
+ entityTrackingReportStats(XML_Parser rootParser, ENTITY *entity,
+                           const char *action, int sourceLine) {
+@@ -8220,9 +8262,13 @@ entityTrackingReportStats(XML_Parser roo
+       entity->is_param ? "%" : "&", entityName, action, entity->textLen,
+       sourceLine);
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ static void
+ entityTrackingOnOpen(XML_Parser originParser, ENTITY *entity, int sourceLine) {
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+   const XML_Parser rootParser = getRootParserOf(originParser, NULL);
+   assert(! rootParser->m_parentParser);
+ 
+@@ -8234,15 +8280,21 @@ entityTrackingOnOpen(XML_Parser originPa
+   }
+ 
+   entityTrackingReportStats(rootParser, entity, "OPEN ", sourceLine);
++#endif
++/* END MOZILLA CHANGE */
+ }
+ 
+ static void
+ entityTrackingOnClose(XML_Parser originParser, ENTITY *entity, int sourceLine) {
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+   const XML_Parser rootParser = getRootParserOf(originParser, NULL);
+   assert(! rootParser->m_parentParser);
+ 
+   entityTrackingReportStats(rootParser, entity, "CLOSE", sourceLine);
+   rootParser->m_entity_stats.currentDepth--;
++#endif
++/* END MOZILLA CHANGE */
+ }
+ 
+ static XML_Parser
+@@ -8260,6 +8312,8 @@ getRootParserOf(XML_Parser parser, unsig
+   return rootParser;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+ const char *
+ unsignedCharToPrintable(unsigned char c) {
+   switch (c) {
+@@ -8781,9 +8835,13 @@ unsignedCharToPrintable(unsigned char c)
+   }
+   assert(0); /* never gets here */
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ #endif /* XML_GE == 1 */
+ 
++/* BEGIN MOZILLA CHANGE (don't report debug information) */
++#if 0
+ static unsigned long
+ getDebugLevel(const char *variableName, unsigned long defaultDebugLevel) {
+   const char *const valueOrNull = getenv(variableName);
+@@ -8802,3 +8860,5 @@ getDebugLevel(const char *variableName, 
+ 
+   return debugLevel;
+ }
++#endif
++/* END MOZILLA CHANGE */
diff --git a/parser/expat/14_unused.patch b/parser/expat/14_unused.patch
new file mode 100644
index 000000000000..57a5f02351eb
--- /dev/null
+++ b/parser/expat/14_unused.patch
@@ -0,0 +1,262 @@
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -564,8 +564,12 @@ static XML_Bool setContext(XML_Parser pa
+ static void FASTCALL normalizePublicId(XML_Char *s);
+ 
+ static DTD *dtdCreate(const XML_Memory_Handling_Suite *ms);
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ /* do not call if m_parentParser != NULL */
+ static void dtdReset(DTD *p, const XML_Memory_Handling_Suite *ms);
++#endif
++/* END MOZILLA CHANGE */
+ static void dtdDestroy(DTD *p, XML_Bool isDocEntity,
+                        const XML_Memory_Handling_Suite *ms);
+ static int dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
+@@ -576,7 +580,11 @@ static NAMED *lookup(XML_Parser parser, 
+                      size_t createSize);
+ static void FASTCALL hashTableInit(HASH_TABLE *table,
+                                    const XML_Memory_Handling_Suite *ms);
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ static void FASTCALL hashTableClear(HASH_TABLE *table);
++#endif
++/* END MOZILLA CHANGE */
+ static void FASTCALL hashTableDestroy(HASH_TABLE *table);
+ static void FASTCALL hashTableIterInit(HASH_TABLE_ITER *iter,
+                                        const HASH_TABLE *table);
+@@ -800,6 +808,8 @@ struct XML_ParserStruct {
+ #define REALLOC(parser, p, s) (parser->m_mem.realloc_fcn((p), (s)))
+ #define FREE(parser, p) (parser->m_mem.free_fcn((p)))
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ XML_Parser XMLCALL
+ XML_ParserCreate(const XML_Char *encodingName) {
+   return XML_ParserCreate_MM(encodingName, NULL, NULL);
+@@ -810,6 +820,8 @@ XML_ParserCreateNS(const XML_Char *encod
+   XML_Char tmp[2] = {nsSep, 0};
+   return XML_ParserCreate_MM(encodingName, NULL, tmp);
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ // "xml=http://www.w3.org/XML/1998/namespace"
+ static const XML_Char implicitContext[]
+@@ -1331,6 +1343,8 @@ parserInit(XML_Parser parser, const XML_
+ #endif
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ /* moves list of bindings to m_freeBindingList */
+ static void FASTCALL
+ moveToFreeBindingList(XML_Parser parser, BINDING *bindings) {
+@@ -1409,6 +1423,8 @@ XML_SetEncoding(XML_Parser parser, const
+   }
+   return XML_STATUS_OK;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ XML_Parser XMLCALL
+ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
+@@ -1665,6 +1681,8 @@ XML_UseParserAsHandlerArg(XML_Parser par
+     parser->m_handlerArg = parser;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ enum XML_Error XMLCALL
+ XML_UseForeignDTD(XML_Parser parser, XML_Bool useDTD) {
+   if (parser == NULL)
+@@ -1681,6 +1699,8 @@ XML_UseForeignDTD(XML_Parser parser, XML
+   return XML_ERROR_FEATURE_REQUIRES_XML_DTD;
+ #endif
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ void XMLCALL
+ XML_SetReturnNSTriplet(XML_Parser parser, int do_nst) {
+@@ -1756,6 +1776,8 @@ XML_SetElementHandler(XML_Parser parser,
+   parser->m_endElementHandler = end;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ void XMLCALL
+ XML_SetStartElementHandler(XML_Parser parser, XML_StartElementHandler start) {
+   if (parser != NULL)
+@@ -1767,6 +1789,8 @@ XML_SetEndElementHandler(XML_Parser pars
+   if (parser != NULL)
+     parser->m_endElementHandler = end;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ void XMLCALL
+ XML_SetCharacterDataHandler(XML_Parser parser,
+@@ -1798,6 +1822,8 @@ XML_SetCdataSectionHandler(XML_Parser pa
+   parser->m_endCdataSectionHandler = end;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ void XMLCALL
+ XML_SetStartCdataSectionHandler(XML_Parser parser,
+                                 XML_StartCdataSectionHandler start) {
+@@ -1819,6 +1845,8 @@ XML_SetDefaultHandler(XML_Parser parser,
+   parser->m_defaultHandler = handler;
+   parser->m_defaultExpandInternalEntities = XML_FALSE;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ void XMLCALL
+ XML_SetDefaultHandlerExpand(XML_Parser parser, XML_DefaultHandler handler) {
+@@ -1837,6 +1865,8 @@ XML_SetDoctypeDeclHandler(XML_Parser par
+   parser->m_endDoctypeDeclHandler = end;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ void XMLCALL
+ XML_SetStartDoctypeDeclHandler(XML_Parser parser,
+                                XML_StartDoctypeDeclHandler start) {
+@@ -1849,6 +1879,8 @@ XML_SetEndDoctypeDeclHandler(XML_Parser 
+   if (parser != NULL)
+     parser->m_endDoctypeDeclHandler = end;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ void XMLCALL
+ XML_SetUnparsedEntityDeclHandler(XML_Parser parser,
+@@ -1873,6 +1905,8 @@ XML_SetNamespaceDeclHandler(XML_Parser p
+   parser->m_endNamespaceDeclHandler = end;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ void XMLCALL
+ XML_SetStartNamespaceDeclHandler(XML_Parser parser,
+                                  XML_StartNamespaceDeclHandler start) {
+@@ -1893,6 +1927,8 @@ XML_SetNotStandaloneHandler(XML_Parser p
+   if (parser != NULL)
+     parser->m_notStandaloneHandler = handler;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ void XMLCALL
+ XML_SetExternalEntityRefHandler(XML_Parser parser,
+@@ -1911,6 +1947,8 @@ XML_SetExternalEntityRefHandlerArg(XML_P
+     parser->m_externalEntityRefHandlerArg = parser;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ void XMLCALL
+ XML_SetSkippedEntityHandler(XML_Parser parser,
+                             XML_SkippedEntityHandler handler) {
+@@ -1944,6 +1982,8 @@ XML_SetEntityDeclHandler(XML_Parser pars
+   if (parser != NULL)
+     parser->m_entityDeclHandler = handler;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ void XMLCALL
+ XML_SetXmlDeclHandler(XML_Parser parser, XML_XmlDeclHandler handler) {
+@@ -2401,6 +2441,8 @@ XML_GetCurrentByteIndex(XML_Parser parse
+ /* END MOZILLA CHANGE */
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ int XMLCALL
+ XML_GetCurrentByteCount(XML_Parser parser) {
+   if (parser == NULL)
+@@ -2429,6 +2471,8 @@ XML_GetInputContext(XML_Parser parser, i
+ #endif /* XML_CONTEXT_BYTES > 0 */
+   return (const char *)0;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ XML_Size XMLCALL
+ XML_GetCurrentLineNumber(XML_Parser parser) {
+@@ -2454,6 +2498,8 @@ XML_GetCurrentColumnNumber(XML_Parser pa
+   return parser->m_position.columnNumber;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ void XMLCALL
+ XML_FreeContentModel(XML_Parser parser, XML_Content *model) {
+   if (parser != NULL)
+@@ -2682,6 +2728,8 @@ XML_GetFeatureList(void) {
+ 
+   return features;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ #if XML_GE == 1
+ XML_Bool XMLCALL
+@@ -7146,6 +7194,8 @@ dtdCreate(const XML_Memory_Handling_Suit
+   return p;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ static void
+ dtdReset(DTD *p, const XML_Memory_Handling_Suite *ms) {
+   HASH_TABLE_ITER iter;
+@@ -7186,6 +7236,8 @@ dtdReset(DTD *p, const XML_Memory_Handli
+   p->hasParamEntityRefs = XML_FALSE;
+   p->standalone = XML_FALSE;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ static void
+ dtdDestroy(DTD *p, XML_Bool isDocEntity, const XML_Memory_Handling_Suite *ms) {
+@@ -7540,6 +7592,8 @@ lookup(XML_Parser parser, HASH_TABLE *ta
+   return table->v[i];
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ static void FASTCALL
+ hashTableClear(HASH_TABLE *table) {
+   size_t i;
+@@ -7549,6 +7603,8 @@ hashTableClear(HASH_TABLE *table) {
+   }
+   table->used = 0;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ static void FASTCALL
+ hashTableDestroy(HASH_TABLE *table) {
+@@ -8223,6 +8279,8 @@ accountingDiffTolerated(XML_Parser origi
+   return tolerated;
+ }
+ 
++/* BEGIN MOZILLA CHANGE (unused API) */
++#if 0
+ unsigned long long
+ testingAccountingGetCountBytesDirect(XML_Parser parser) {
+   if (! parser)
+@@ -8236,6 +8294,8 @@ testingAccountingGetCountBytesIndirect(X
+     return 0;
+   return parser->m_accounting.countBytesIndirect;
+ }
++#endif
++/* END MOZILLA CHANGE */
+ 
+ /* BEGIN MOZILLA CHANGE (don't report debug information) */
+ #if 0
diff --git a/parser/expat/README_MOZILLA b/parser/expat/README_MOZILLA
new file mode 100644
index 000000000000..724ca660ee36
--- /dev/null
+++ b/parser/expat/README_MOZILLA
@@ -0,0 +1,9 @@
+The Expat parser is vendored from https://github.com/libexpat/libexpat.
+See moz.yaml for the current in-tree version.
+
+To update run
+
+$ ./mach vendor parser/expat/moz.yaml --patch-mode=none
+$ hg commit -m "Bug X - Update to Expat x.x.x."
+$ ./mach vendor parser/expat/moz.yaml --patch-mode=only
+$ hg commit -m "Bug X - Apply local patches to Expat x.x.x."
diff --git a/parser/expat/lib/ascii.h b/parser/expat/expat/lib/ascii.h
similarity index 100%
rename from parser/expat/lib/ascii.h
rename to parser/expat/expat/lib/ascii.h
diff --git a/parser/expat/lib/asciitab.h b/parser/expat/expat/lib/asciitab.h
similarity index 100%
rename from parser/expat/lib/asciitab.h
rename to parser/expat/expat/lib/asciitab.h
diff --git a/parser/expat/lib/expat.h b/parser/expat/expat/lib/expat.h
similarity index 100%
rename from parser/expat/lib/expat.h
rename to parser/expat/expat/lib/expat.h
diff --git a/parser/expat/lib/expat_external.h b/parser/expat/expat/lib/expat_external.h
similarity index 100%
rename from parser/expat/lib/expat_external.h
rename to parser/expat/expat/lib/expat_external.h
diff --git a/parser/expat/lib/iasciitab.h b/parser/expat/expat/lib/iasciitab.h
similarity index 100%
rename from parser/expat/lib/iasciitab.h
rename to parser/expat/expat/lib/iasciitab.h
diff --git a/parser/expat/lib/internal.h b/parser/expat/expat/lib/internal.h
similarity index 100%
rename from parser/expat/lib/internal.h
rename to parser/expat/expat/lib/internal.h
diff --git a/parser/expat/lib/latin1tab.h b/parser/expat/expat/lib/latin1tab.h
similarity index 100%
rename from parser/expat/lib/latin1tab.h
rename to parser/expat/expat/lib/latin1tab.h
diff --git a/parser/expat/lib/moz_expat.h b/parser/expat/expat/lib/moz_expat.h
similarity index 100%
rename from parser/expat/lib/moz_expat.h
rename to parser/expat/expat/lib/moz_expat.h
diff --git a/parser/expat/lib/moz_xmlparse.c b/parser/expat/expat/lib/moz_xmlparse.c
similarity index 100%
rename from parser/expat/lib/moz_xmlparse.c
rename to parser/expat/expat/lib/moz_xmlparse.c
diff --git a/parser/expat/lib/moz_xmltok.c b/parser/expat/expat/lib/moz_xmltok.c
similarity index 97%
rename from parser/expat/lib/moz_xmltok.c
rename to parser/expat/expat/lib/moz_xmltok.c
index a10ab916d18a..cfad45baf06e 100644
--- a/parser/expat/lib/moz_xmltok.c
+++ b/parser/expat/expat/lib/moz_xmltok.c
@@ -5,6 +5,9 @@
 
 #include "xmltok.c"
 
+#ifdef MOZILLA_CLIENT
+#ifndef MOZ_IN_WASM_SANDBOX
+
 #ifdef IS_LITTLE_ENDIAN
 
 #define PREFIX(ident) little2_ ## ident
@@ -160,3 +163,6 @@ int MOZ_XMLTranslateEntity(const char* ptr, const char* end, const char** next,
 #undef BYTE_TYPE
 #undef IS_NAME_CHAR_MINBPC
 #undef IS_NMSTRT_CHAR_MINBPC
+
+#endif  /* !MOZ_IN_WASM_SANDBOX */
+#endif  /* MOZILLA_CLIENT */
diff --git a/parser/expat/lib/nametab.h b/parser/expat/expat/lib/nametab.h
similarity index 100%
rename from parser/expat/lib/nametab.h
rename to parser/expat/expat/lib/nametab.h
diff --git a/parser/expat/lib/siphash.h b/parser/expat/expat/lib/siphash.h
similarity index 100%
rename from parser/expat/lib/siphash.h
rename to parser/expat/expat/lib/siphash.h
diff --git a/parser/expat/lib/utf8tab.h b/parser/expat/expat/lib/utf8tab.h
similarity index 100%
rename from parser/expat/lib/utf8tab.h
rename to parser/expat/expat/lib/utf8tab.h
diff --git a/parser/expat/lib/winconfig.h b/parser/expat/expat/lib/winconfig.h
similarity index 100%
rename from parser/expat/lib/winconfig.h
rename to parser/expat/expat/lib/winconfig.h
diff --git a/parser/expat/lib/xmlparse.c b/parser/expat/expat/lib/xmlparse.c
similarity index 100%
rename from parser/expat/lib/xmlparse.c
rename to parser/expat/expat/lib/xmlparse.c
diff --git a/parser/expat/lib/xmlrole.c b/parser/expat/expat/lib/xmlrole.c
similarity index 100%
rename from parser/expat/lib/xmlrole.c
rename to parser/expat/expat/lib/xmlrole.c
diff --git a/parser/expat/lib/xmlrole.h b/parser/expat/expat/lib/xmlrole.h
similarity index 100%
rename from parser/expat/lib/xmlrole.h
rename to parser/expat/expat/lib/xmlrole.h
diff --git a/parser/expat/lib/xmltok.c b/parser/expat/expat/lib/xmltok.c
similarity index 100%
rename from parser/expat/lib/xmltok.c
rename to parser/expat/expat/lib/xmltok.c
diff --git a/parser/expat/lib/xmltok.h b/parser/expat/expat/lib/xmltok.h
similarity index 100%
rename from parser/expat/lib/xmltok.h
rename to parser/expat/expat/lib/xmltok.h
diff --git a/parser/expat/lib/xmltok_impl.c b/parser/expat/expat/lib/xmltok_impl.c
similarity index 100%
rename from parser/expat/lib/xmltok_impl.c
rename to parser/expat/expat/lib/xmltok_impl.c
diff --git a/parser/expat/lib/xmltok_impl.h b/parser/expat/expat/lib/xmltok_impl.h
similarity index 100%
rename from parser/expat/lib/xmltok_impl.h
rename to parser/expat/expat/lib/xmltok_impl.h
diff --git a/parser/expat/lib/xmltok_ns.c b/parser/expat/expat/lib/xmltok_ns.c
similarity index 100%
rename from parser/expat/lib/xmltok_ns.c
rename to parser/expat/expat/lib/xmltok_ns.c
diff --git a/parser/expat/lib/moz.build b/parser/expat/lib/moz.build
deleted file mode 100644
index 817674ceeede..000000000000
--- a/parser/expat/lib/moz.build
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include("sources.mozbuild")
-
-EXPORTS += [
-    'expat.h',
-    'expat_external.h',
-    'moz_expat.h',
-]
-
-if CONFIG["MOZ_WASM_SANDBOXING_EXPAT"]:
-    SOURCES += ['moz_xmltok.c']
-else:
-    SOURCES += expat_sources
-
-FINAL_LIBRARY = 'xul'
-
-for k, v in expat_defines:
-    DEFINES[k] = v
diff --git a/parser/expat/moz.build b/parser/expat/moz.build
index f79e8a9083ea..db00d8e0ff66 100644
--- a/parser/expat/moz.build
+++ b/parser/expat/moz.build
@@ -4,12 +4,15 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+include("sources.mozbuild")
+
 with Files('**'):
     BUG_COMPONENT = ('Core', 'XML')
 
-DIRS += ['lib']
-
 EXPORTS += [
+    'expat/lib/expat.h',
+    'expat/lib/expat_external.h',
+    'expat/lib/moz_expat.h',
     'expat_config.h',
     'expat_config_moz.h',
     'expat_config_rlbox.h',
@@ -17,6 +20,16 @@ EXPORTS += [
     'rlbox_expat_types.h',
 ]
 
+if CONFIG["MOZ_WASM_SANDBOXING_EXPAT"]:
+    SOURCES += ['expat/lib/moz_xmltok.c']
+else:
+    SOURCES += expat_sources
+
 LOCAL_INCLUDES += [
     '!/security/rlbox',
 ]
+
+FINAL_LIBRARY = 'xul'
+
+for k, v in expat_defines:
+    DEFINES[k] = v
diff --git a/parser/expat/moz.yaml b/parser/expat/moz.yaml
new file mode 100644
index 000000000000..afef0f8863fa
--- /dev/null
+++ b/parser/expat/moz.yaml
@@ -0,0 +1,64 @@
+schema: 1
+
+bugzilla:
+  product: Core
+  component: "XML"
+
+# Document the source of externally hosted code
+origin:
+  name: libexpat
+  description: Expat is an XML parser.
+  url: https://github.com/libexpat/libexpat
+  release: 2.2.1 (2017-06-17T18:07:00+02:00).
+  revision: 2.2.1
+  license: MIT
+  license-file: COPYING
+
+  notes: >
+    To test the upstream's main branch tip, one can
+    run `./mach vendor --revision tip parser/expat/moz.yaml`
+
+vendoring:
+  url: https://github.com/libexpat/libexpat
+  source-hosting: github
+  tracking: tag
+
+  exclude:
+    - "**"
+    - expat/lib/Makefile.am
+    - expat/lib/libexpat.def.cmake
+
+  include:
+    - AUTHORS
+    - Changes
+    - COPYING
+    - README.md
+    - expat/lib/*
+
+  keep:
+    - expat_config.h
+    - expat_config_moz.h
+    - expat_config_rlbox.h
+    - rlbox_expat.h
+    - rlbox_expat_types.h
+    - sources.mozbuild
+    - expat/lib/moz_expat.h
+    - expat/lib/moz_xmlparse.c
+    - expat/lib/moz_xmltok.c
+
+  patches:
+    - 00_xmlchar.patch
+    - 01_noslop.patch
+    - 02_report_mismatched_tag.patch
+    - 03_dont_generate_salt.patch
+    - 04_always_set_eventptrs.patch
+    - 05_getcurrentbyteindex.patch
+    - 06_report_processing_entity.patch
+    - 07_always_store_rawnames.patch
+    - 08_dont_ignore_undeclared_entity.patch
+    - 09_include_xmlns.patch
+    - 10_internalsubset.patch
+    - 11_nested_entities.patch
+    - 12_version_limit.patch
+    - 13_no_debug_report.patch
+    - 14_unused.patch
diff --git a/parser/expat/lib/sources.mozbuild b/parser/expat/sources.mozbuild
similarity index 80%
rename from parser/expat/lib/sources.mozbuild
rename to parser/expat/sources.mozbuild
index 1a8212a080c2..78bc8b23f2da 100644
--- a/parser/expat/lib/sources.mozbuild
+++ b/parser/expat/sources.mozbuild
@@ -5,9 +5,9 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 expat_sources = [
-    'moz_xmlparse.c',
-    'xmlrole.c',
-    'xmltok.c',
+    'expat/lib/moz_xmlparse.c',
+    'expat/lib/moz_xmltok.c',
+    'expat/lib/xmlrole.c',
 ]
 
 expat_defines = [
diff --git a/security/rlbox/moz.build b/security/rlbox/moz.build
index 7ad8d076f0f1..feb85c63ebe5 100644
--- a/security/rlbox/moz.build
+++ b/security/rlbox/moz.build
@@ -54,11 +54,11 @@ if CONFIG["MOZ_WASM_SANDBOXING_OGG"]:
     LOCAL_INCLUDES += ["/media/libogg"]
 
 if CONFIG["MOZ_WASM_SANDBOXING_EXPAT"]:
-    include("/parser/expat/lib/sources.mozbuild")
-    WASM_SOURCES += ["/parser/expat/lib/" + s for s in expat_sources]
+    include("/parser/expat/sources.mozbuild")
+    WASM_SOURCES += ["/parser/expat/" + s for s in expat_sources]
     for k, v in expat_defines:
         WASM_DEFINES[k] = v
-    LOCAL_INCLUDES += ["/parser/expat/lib/"]
+    LOCAL_INCLUDES += ["/parser/expat/expat/lib/"]
 
 if CONFIG["MOZ_WASM_SANDBOXING_WOFF2"]:
     include("/modules/woff2/sources.mozbuild")