--- a/ChangeLog	Mon Oct 28 15:24:42 2019 +0000
+++ b/ChangeLog	Fri Nov 08 18:32:17 2019 +0000
@@ -1,3 +1,31 @@
+2019-11-08  Andrew John Hughes  <gnu_andrew@member.fsf.org>
+
+	Bump to icedtea-3.14.0.
+	* patches/rh1022017.patch:
+	Removed as included upstream as 8228825 / CVE-2019-2894.
+	* Makefile.am:
+	(CORBA_CHANGESET): Update to icedtea-3.14.0 tag.
+	(JAXP_CHANGESET): Likewise.
+	(JAXWS_CHANGESET): Likewise.
+	(JDK_CHANGESET): Likewise.
+	(LANGTOOLS_CHANGESET): Likewise.
+	(OPENJDK_CHANGESET): Likewise.
+	(NASHORN_CHANGESET): Likewise.
+	(CORBA_SHA256SUM): Likewise.
+	(JAXP_SHA256SUM): Likewise.
+	(JAXWS_SHA256SUM): Likewise.
+	(JDK_SHA256SUM): Likewise.
+	(LANGTOOLS_SHA256SUM): Likewise.
+	(OPENJDK_SHA256SUM): Likewise.
+	(NASHORN_SHA256SUM): Likewise.
+	(ICEDTEA_PATCHES): Drop RH1022017 patch.
+	* NEWS: Updated.
+	* acinclude.m4:
+	(IT_DETERMINE_VERSION): Set BUILD_VERSION to b09
+	and MILESTONE to fcs for final release.
+	* configure.ac: Bump to 3.14.0.
+	* hotspot.map.in: Update to icedtea-3.14.0 tag.
+
 2019-10-23  Andrew John Hughes  <gnu_andrew@member.fsf.org>
 
 	Bump shenandoah to aarch64-shenandoah-jdk8u232-b09.

--- a/Makefile.am	Mon Oct 28 15:24:42 2019 +0000
+++ b/Makefile.am	Fri Nov 08 18:32:17 2019 +0000
@@ -1,20 +1,20 @@
 # Dependencies
 
-CORBA_CHANGESET = 8603ad099188
-JAXP_CHANGESET = a8bf97e97149
-JAXWS_CHANGESET = fb9f067e1218
-JDK_CHANGESET = 740c6726f6fe
-LANGTOOLS_CHANGESET = 69b271efa4fa
-OPENJDK_CHANGESET = d1cf93b54a47
-NASHORN_CHANGESET = 349bdbf4733b
-
-CORBA_SHA256SUM = ddef233773eaf72da4060a79823073a2c6abde0a690e7ca98e06d87b84bb71b0
-JAXP_SHA256SUM = 4e930262fbfd2c252fa313c3c18a067b348c9f27396d111ff35f083453ce114b
-JAXWS_SHA256SUM = 79d548c0d75e71620ba2d5993b55ea68aa7215fcbeba0d4f986f5e41415d9d07
-JDK_SHA256SUM = 162ae0236badbd88a3691cfef4c38c915269dcade6e803b3f1876d2154f724ef
-LANGTOOLS_SHA256SUM = fdb16dd3d4c71fa423c4df1c402dc7a05211134b08c9a42d3ec5bc4852db9e1c
-OPENJDK_SHA256SUM = ff378e71822d246ba733670d519c4a40fffd6db804545795bc578605f6a77f95
-NASHORN_SHA256SUM = e913da6150f116dc2524585c5f77bcef9a93edbcebf7ba8af64c8ccfec970da6
+CORBA_CHANGESET = a37140ba122d
+JAXP_CHANGESET = 9f2145980ba0
+JAXWS_CHANGESET = af5760dceec0
+JDK_CHANGESET = ce6c8c2cad27
+LANGTOOLS_CHANGESET = ccec65feaaac
+OPENJDK_CHANGESET = 454c6cbb8073
+NASHORN_CHANGESET = 13722b4babad
+
+CORBA_SHA256SUM = 8b8ea2835242ef20dd407388d2213c6e5ed7cfd92b3647d2293b720ecd5dd49e
+JAXP_SHA256SUM = 2dca397ea00c7a08954c6176e6659e142b147051cae80c7bd8dcd580e4078261
+JAXWS_SHA256SUM = 608b714fc961cb4d26259b7ae1b6815975b6aa982daadd1689aafbd1d95723ae
+JDK_SHA256SUM = 07d5c002dde5ca54aedf9f8095c075124b20a1e843f33bf7e029d4eeeef3904d
+LANGTOOLS_SHA256SUM = 5f63153cbdf5156cc41d3a82d90452a009ccf8ac024309d427ed4c9c8d376f12
+OPENJDK_SHA256SUM = 79030ebfb38fe2072a45e56146cde8595021ee3e2f91c7d156a6d12198e20546
+NASHORN_SHA256SUM = cd83a7caf61e1f7fef1220364acf34cc966a0bf60463fe504308d3235b192e53
 
 HS_TYPE = "`$(AWK) 'version==$$1 {print $$2}' version=$(HSBUILD) $(abs_top_builddir)/hotspot.map`"
 HS_URL = "`$(AWK) 'version==$$1 {print $$3}' version=$(HSBUILD) $(abs_top_builddir)/hotspot.map`"
@@ -419,10 +419,6 @@
 	patches/jamvm/pr2775-cache_api.patch
 endif
 
-if !USE_NON_NSS_CURVES
-ICEDTEA_PATCHES += patches/rh1022017.patch
-endif
-
 if ENABLE_NSS
 ICEDTEA_PATCHES += patches/pkcs11-nss-config.patch
 else

--- a/NEWS	Mon Oct 28 15:24:42 2019 +0000
+++ b/NEWS	Fri Nov 08 18:32:17 2019 +0000
@@ -12,6 +12,32 @@
 
 New in release 3.14.0 (2019-10-XX):
 
+* Security fixes
+  - S8167646: Better invalid FilePermission
+  - S8213429, CVE-2019-2933: Windows file handling redux
+  - S8218573, CVE-2019-2945: Better socket support
+  - S8218877: Help transform transformers
+  - S8220186: Improve use of font temporary files
+  - S8220302, CVE-2019-2949: Better Kerberos ccache handling
+  - S8221497: Optional Panes in Swing
+  - S8221858, CVE-2019-2958: Build Better Processes
+  - S8222684, CVE-2019-2964: Better support for patterns
+  - S8222690, CVE-2019-2962: Better Glyph Images
+  - S8223163: Better pattern recognition
+  - S8223505, CVE-2019-2973: Better pattern compilation
+  - S8223518, CVE-2019-2975: Unexpected exception in jjs
+  - S8223892, CVE-2019-2978: Improved handling of jar files
+  - S8224025: Fix for JDK-8220302 is not complete
+  - S8224532, CVE-2019-2981: Better Path supports
+  - S8224915, CVE-2019-2983: Better serial attributes
+  - S8225286, CVE-2019-2987: Better rendering of native glyphs
+  - S8225292, CVE-2019-2988: Better Graphics2D drawing
+  - S8225298, CVE-2019-2989: Improve TLS connection support
+  - S8225597, CVE-2019-2992: Enhance font glyph mapping
+  - S8226765, CVE-2019-2999: Commentary on Javadoc comments
+  - S8227129: Better ligature for subtables
+  - S8227601: Better collection of references
+  - S8228825, CVE-2019-2894: Enhance ECDSA operations
 * Import of OpenJDK 8 u232 build 01
   - S6913047: Long term memory leak when using PKCS11 and JCE exceeds 32 bit process address space
   - S6946830: javax.crypto.Cipher.doFinal behavior differs depending on platform
@@ -43,6 +69,62 @@
   - S8226928: [TESTBUG] test/java/net/NetworkInterface/IPv4Only.java fails intermittently on AIX
   - S8227018: CompletableFuture should not call Runtime.availableProcessors on fast path
   - S8228405: Incorrect format strings in PhaseIdealLoop::rc_predicate
+* Import of OpenJDK 8 u232 build 02
+  - S8075546: Add tiered testing definitions to the langtools repo
+  - S8202252: (aio) Closed AsynchronousSocketChannel keeps completion handler alive
+  - S8216597: SIGBUS in Java_sun_security_pkcs11_wrapper_PKCS11_getNativeKeyInfo after JDK-6913047
+  - S8220513: Wrapper Key may get deleted when closing sessions in SunPKCS11 crypto provider
+  - S8222737: [TESTBUG] Allow for tier 1 like testing in OpenJDK 8u
+  - S8224580: Matcher can cause oop field/array element to be reloaded
+  - S8226543: Reduce GC pressure during message digest calculations in password-based encryption
+* Import of OpenJDK 8 u232 build 03
+  - S8213561: ZipFile/MultiThreadedReadTest.java timed out in tier1
+  - S8217785: Padding ParallelTaskTerminator::_offered_termination variable
+* Import of OpenJDK 8 u232 build 04
+  - S8188868: PPC64: Support AES intrinsics on Big Endian
+* Import of OpenJDK 8 u232 build 05
+  - S8080157: assert(allocates2(pc)) failed: not in CodeBuffer memory
+  - S8087128: C2: Disallow definition split on MachCopySpill nodes
+  - S8139965: Hang seen when using com.sun.jndi.ldap.search.replyQueueSize
+  - S8147502: Digest is incorrectly truncated for ECDSA signatures when the bit length of n is less than the field size
+  - S8147611: G1 - Missing memory barrier in start_cset_region_for_worker
+  - S8151066: assert(0 <= i && i < length()) failed: index out of bounds
+  - S8155951: VM crash in nsk/jvmti/RedefineClasses/StressRedefine: assert failed: Corrupted constant pool
+  - S8202948: C2: assert(init_offset >= 0) failed: positive offset from object start
+  - S8203324: Use out of scope in getMacOSXLocale of java_props_macosx.c:120
+  - S8206879: Currency decimal marker incorrect for Peru
+  - S8211232: GraphKit::make_runtime_call() sometimes attaches wrong memory state to call
+  - S8214687: Optimize Collections.nCopies().hashCode() and equals()
+  - S8214702: Wrong text position for whitespaced string in printing Swing text
+  - S8215130: Fix errors in LittleCMS 2.9 reported by GCC 8
+  - S8215265: C2: range check elimination may allow illegal out of bound access
+  - S8217359: C2 compiler triggers SIGSEGV after transformation in ConvI2LNode::Ideal
+  - S8217731: Font rendering and glyph spacing changed from jdk-8 to jdk-11
+  - S8217896: Make better use of LCPUs when building on AIX
+  - S8218201: Failures when vmIntrinsics::_getClass is not inlined
+  - S8218280: LineNumberReader throws "Mark invalid" exception if CRLF straddles buffer.
+  - S8218780: Update MUSCLE PCSC-Lite header files
+  - S8219517: assert(false) failed: infinite loop in PhaseIterGVN::optimize
+  - S8220072: GCC 8.3 reports errors in java.base
+  - S8222980: Upgrade IANA Language Subtag Registry to Version 2019-04-03
+  - S8223177: Data race on JvmtiEnvBase::_tag_map in double-checked locking
+  - S8223227: Rename acquire_tag_map() to tag_map_acquire() in jvmtiEnvBase
+  - S8225423: GTK L&F: JSplitPane: There is no divider shown
+  - S8226798: JVM crash in klassItable::initialize_itable_for_interface(int, InstanceKlass*, bool, Thread*)
+  - S8226964: [Yaru] GTK L&F: There is no difference between menu selected and de-selected
+  - S8228440: TestAESCiphers tests fail with "access denied" trying to access ArrayUtil
+* Import of OpenJDK 8 u232 build 06
+  - S8178870: instrumentation.retransformClasses cause coredump
+  - S8216965: crash in freetypeScaler.c CopyBW2Grey8
+  - S8217676: Upgrade libpng to 1.6.37
+  - S8222108: Reduce minRefreshTime for updating remote printer list on Windows
+* Import of OpenJDK 8 u232 build 08
+  - S8225425: java.lang.UnsatisfiedLinkError: net.dll: Can't find dependent libraries
+  - S8226607: Inconsistent info between pcsclite.md and MUSCLE headers
+  - S8228469: (tz) Upgrade time-zone data to tzdata2019b
+  - S8230085: (fs) FileStore::isReadOnly is always true on macOS Catalina
+  - S8231098: (tz) Upgrade time-zone data to tzdata2019c
+  - S8231463: Fix runtime/RedefineTests/RedefineDoubleDelete.java test in 8u
 * Shenandoah
   - [backport] 8230425: Shenandoah forces +UseNUMAInterleaving even after explicitly disabled
   - Missing include precompiled.hpp in shenandoahSynchronizerIterator.cpp
@@ -51,56 +133,32 @@
   - Revert parts of x86_64.ad to 8u upstream state
   - Revert Shenandoah/JDK8-only changes relating to MonitorInUseLists
   - Revert Shenandoah-specific assert after JDK-8211926 landed
-  - S8038392: Generating prelink cache breaks JAVA 'jinfo' utility normal behaviour
-  - S8080157: assert(allocates2(pc)) failed: not in CodeBuffer memory
-  - S8087128: C2: Disallow definition split on MachCopySpill nodes
-  - S8141570: Fix Zero interpreter build for --disable-precompiled-headers
-  - S8143072: [JVMCI] Port JVMCI to AArch64
-  - S8147611: G1 - Missing memory barrier in start_cset_region_for_worker
-  - S8151066: assert(0 <= i && i < length()) failed: index out of bounds
-  - S8155951: VM crash in nsk/jvmti/RedefineClasses/StressRedefine: assert failed: Corrupted constant pool
-  - S8178870: instrumentation.retransformClasses cause coredump
-  - S8179954: AArch64: C1 and C2 volatile accesses are not sequentially consistent
-  - S8188868: PPC64: Support AES intrinsics on Big Endian
-  - S8202948: C2: assert(init_offset >= 0) failed: positive offset from object start
-  - S8205421: AARCH64: StubCodeMark should be placed after alignment
-  - S8206163: AArch64: incorrect code generation for StoreCM
-  - S8209420: Track membars for volatile accesses so they can be properly optimized
-  - S8211232: GraphKit::make_runtime_call() sometimes attaches wrong memory state to call
-  - S8211233: MemBarNode::trailing_membar() and MemBarNode::leading_membar() need to handle dying subgraphs better
-  - S8213134: AArch64: vector shift failed with MaxVectorSize=8
-  - S8214857: "bad trailing membar" assert failure at memnode.cpp:3220
-  - S8215265: C2: range check elimination may allow illegal out of bound access
-  - S8216350: AArch64: monitor unlock fast path not called
-  - S8217359: C2 compiler triggers SIGSEGV after transformation in ConvI2LNode::Ideal
-  - S8217676: Upgrade libpng to 1.6.37
-  - S8217785: Padding ParallelTaskTerminator::_offered_termination variable
-  - S8218201: Failures when vmIntrinsics::_getClass is not inlined
-  - S8219011: Implement MacroAssembler::warn method on AArch64
-  - S8219517: assert(false) failed: infinite loop in PhaseIterGVN::optimize
-  - S8222737: [TESTBUG] Allow for tier 1 like testing in OpenJDK 8u
-  - S8223177: Data race on JvmtiEnvBase::_tag_map in double-checked locking
-  - S8223227: Rename acquire_tag_map() to tag_map_acquire() in jvmtiEnvBase
-  - S8224580: Matcher can cause oop field/array element to be reloaded
-  - S8226607: Inconsistent info between pcsclite.md and MUSCLE headers
-  - S8226798: JVM crash in klassItable::initialize_itable_for_interface(int, InstanceKlass*, bool, Thread*)
-  - S8228400: Remove built-in AArch64 simulator
-  - S8228406: Superfluous change in chaitin.hpp
-  - S8228593: Revert explicit JDK 7 support additions
-  - S8228716: Revert InstanceKlass::print_on debug additions
-  - S8228718: Revert incorrect backport of JDK-8129757 to 8-aarch64
-  - S8228725: AArch64: Purge method call format support
   - S8228746: Revert incorrect StubRoutines::contains change
-  - S8228747: Revert "unused" attribute from test_arraycopy_func
-  - S8228767: Revert ResourceMark additions
-  - S8228770: Revert development hsdis changes
-  - S8229123: Revert build fixes for aarch64/zero
-  - S8229124: Revert disassembler.cpp changes
-  - S8229145: Revert TemplateTable::bytecode() visibility change
   - S8231366: Shenandoah: Shenandoah String Dedup thread is not properly initialized
-  - S8231463: Fix runtime/RedefineTests/RedefineDoubleDelete.java test in 8u
 * AArch64 port
   - S8151775, PR3750: aarch64: add support for 8.1 LSE atomic operations
+  - S8179954, PR3762: AArch64: C1 and C2 volatile accesses are not sequentially consistent
+  - S8205421, PR3762: AARCH64: StubCodeMark should be placed after alignment
+  - S8206163, PR3762: AArch64: incorrect code generation for StoreCM
+  - S8209420, PR3762: Track membars for volatile accesses so they can be properly optimized
+  - S8211233, PR3762: MemBarNode::trailing_membar() and MemBarNode::leading_membar() need to handle dying subgraphs better
+  - S8213134, PR3762: AArch64: vector shift failed with MaxVectorSize=8
+  - S8214857, PR3762: "bad trailing membar" assert failure at memnode.cpp:3220
+  - S8216350, PR3762: AArch64: monitor unlock fast path not called
+  - S8219011, PR3762: Implement MacroAssembler::warn method on AArch64
+  - S8228400, PR3762: Remove built-in AArch64 simulator
+  - S8228406, PR3762: Superfluous change in chaitin.hpp
+  - S8228593, PR3762: Revert explicit JDK 7 support additions
+  - S8228716, PR3762: Revert InstanceKlass::print_on debug additions
+  - S8228718, PR3762: Revert incorrect backport of JDK-8129757 to 8-aarch64
+  - S8228725, PR3762: AArch64: Purge method call format support
+  - S8228747, PR3762: Revert "unused" attribute from test_arraycopy_func
+  - S8228767, PR3762: Revert ResourceMark additions
+  - S8228770, PR3762: Revert development hsdis changes
+  - S8229123, PR3762: Revert build fixes for aarch64/zero
+  - S8229124, PR3762: Revert disassembler.cpp changes
+  - S8229145, PR3762: Revert TemplateTable::bytecode() visibility change
+  - PR3762: profile_has_unique_klass gives wrong result
 
 New in release 3.13.0 (2019-07-18):
 
@@ -3073,7 +3131,7 @@
   - S8000650, PR2462: unpack200.exe should check gzip crc
   - S8031668, PR2842: TOOLCHAIN_FIND_COMPILER unexpectedly resolves symbolic links
   - S8035341: Allow using a system installed libpng
-  - S8038392: Generating prelink cache breaks JAVA 'jinfo' utility normal behavior
+  - S8038392, RH1064383: Generating prelink cache breaks JAVA 'jinfo' utility normal behavior
   - S8042159: Allow using a system-installed lcms2
   - S8042806: Splashscreen uses libjpeg-internal macros
   - S8043805: Allow using a system-installed libjpeg
@@ -4612,7 +4670,7 @@
   - S8036837: Increment hsx 24.55 build to b03 for 7u55-b12
   - S8037012: (tz) Support tzdata2014a
   - S8038306: (tz) Support tzdata2014b
-  - S8038392: Generating prelink cache breaks JAVA 'jinfo' utility normal behavior
+  - S8038392, RH1064383: Generating prelink cache breaks JAVA 'jinfo' utility normal behavior
   - S8042264: 7u65 l10n resource file translation update 1
   - S8042582: Test java/awt/KeyboardFocusmanager/ChangeKFMTest/ChangeKFMTest.html fails on Windows x64
   - S8042590: Running form URL throws NPE

--- a/acinclude.m4	Mon Oct 28 15:24:42 2019 +0000
+++ b/acinclude.m4	Fri Nov 08 18:32:17 2019 +0000
@@ -2090,8 +2090,8 @@
   JAVA_VER=1.8.0
   JAVA_VENDOR=openjdk
   JDK_UPDATE_VERSION=232
-  BUILD_VERSION=b01
-  MILESTONE=ea
+  BUILD_VERSION=b09
+  MILESTONE=fcs
   if test "x${MILESTONE}" = "xfcs"; then
     COMBINED_VERSION=${JDK_UPDATE_VERSION}-${BUILD_VERSION}
   else

--- a/configure.ac	Mon Oct 28 15:24:42 2019 +0000
+++ b/configure.ac	Fri Nov 08 18:32:17 2019 +0000
@@ -1,4 +1,4 @@
-AC_INIT([icedtea], [3.14.0pre01], [distro-pkg-dev@openjdk.java.net])
+AC_INIT([icedtea], [3.14.0], [distro-pkg-dev@openjdk.java.net])
 AC_CANONICAL_HOST
 AC_CANONICAL_TARGET
 AM_INIT_AUTOMAKE([1.9 tar-pax foreign])

--- a/hotspot.map.in	Mon Oct 28 15:24:42 2019 +0000
+++ b/hotspot.map.in	Fri Nov 08 18:32:17 2019 +0000
@@ -1,4 +1,4 @@
 # version type(drop/hg) url changeset sha256sum
-default drop http://icedtea.classpath.org/download/drops/icedtea8/@ICEDTEA_RELEASE@ a8b62a7ca950 fa6cebbdcb0f781fa4a5469bd72e7094b7bec00ffbb90c26dc0c2ddc7b6754da
+default drop http://icedtea.classpath.org/download/drops/icedtea8/@ICEDTEA_RELEASE@ 4ccc1ae03940 adc660a9ad3853325d3bec8fb0d9e533a37058d051a069c4421620e75f23b908
 shenandoah drop https://icedtea.classpath.org/download/drops/icedtea8/@ICEDTEA_RELEASE@ 9e52f8d3b511 90f4871a86424df7ce47c1f603df8102207be0ae452b98c6b53c17ded45afcd6
 aarch32 drop https://icedtea.classpath.org/download/drops/icedtea8/@ICEDTEA_RELEASE@ 26d64a5c4b9a 68816570a5953d9b04f9b8b15f53f47f2ef4ea76bc16f9935bd94cebc07679c8

--- a/patches/rh1022017.patch	Mon Oct 28 15:24:42 2019 +0000
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,28 +0,0 @@
-diff --git a/src/share/classes/sun/security/ssl/EllipticCurvesExtension.java b/src/share/classes/sun/security/ssl/EllipticCurvesExtension.java
---- openjdk/jdk/src/share/classes/sun/security/ssl/EllipticCurvesExtension.java
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/EllipticCurvesExtension.java
-@@ -168,20 +168,10 @@
-                     "contains no supported elliptic curves");
-             }
-         } else {        // default curves
--            int[] ids;
--            if (requireFips) {
--                ids = new int[] {
--                    // only NIST curves in FIPS mode
--                    23, 24, 25, 9, 10, 11, 12, 13, 14,
--                };
--            } else {
--                ids = new int[] {
--                    // NIST curves first
--                    23, 24, 25, 9, 10, 11, 12, 13, 14,
--                    // non-NIST curves
--                    22,
--                };
--            }
-+            int[] ids = new int[] { 
-+		// NSS currently only supports these three NIST curves
-+		23, 24, 25
-+	    };
- 
-             idList = new ArrayList<>(ids.length);
-             for (int curveId : ids) {