diff -r 3cc9f17ca9bb -r b61e849fe451 mozilla-skia-overflow.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/mozilla-skia-overflow.patch	Wed Jan 18 22:06:23 2017 +0100
@@ -0,0 +1,32 @@
+# HG changeset patch
+# User Lee Salzman <lsalzman@mozilla.com>
+# Date 1474489725 14400
+#      Wed Sep 21 16:28:45 2016 -0400
+# Node ID 38a427a913b57080374b9966466b8f436ec39eb8
+# Parent  4dfd3f00543d1d7adc3f0f852e6f32fbca6f3420
+fix invalid Sk4f store to SkColor in SkPixmap::erase
+
+MozReview-Commit-ID: 840x1nXgYns
+
+diff --git a/gfx/skia/skia/src/core/SkPixmap.cpp b/gfx/skia/skia/src/core/SkPixmap.cpp
+--- a/gfx/skia/skia/src/core/SkPixmap.cpp
++++ b/gfx/skia/skia/src/core/SkPixmap.cpp
+@@ -221,17 +221,17 @@ bool SkPixmap::erase(const SkColor4f& or
+         pm = *this;
+     }
+ 
+     const SkColor4f color = origColor.pin();
+ 
+     if (kRGBA_F16_SkColorType != pm.colorType()) {
+         Sk4f c4 = Sk4f::Load(color.vec());
+         SkColor c;
+-        (c4 * Sk4f(255) + Sk4f(0.5f)).store(&c);
++        SkNx_cast<uint8_t>(c4 * Sk4f(255) + Sk4f(0.5f)).store(&c);
+         return pm.erase(c);
+     }
+ 
+     const uint64_t half4 = color.premul().toF16();
+     for (int y = 0; y < pm.height(); ++y) {
+         sk_memset64(pm.writable_addr64(0, y), half4, pm.width());
+     }
+     return true;