--- a/modules/freetype2/README.moz-patches
+++ b/modules/freetype2/README.moz-patches
@@ -1,12 +1,16 @@
 This directory contains FreeType v2.9 downloaded from
 https://download.savannah.gnu.org/releases/freetype/
 
 The following post-2.9 commits have been cherry-picked from
-the upstream FreeType repository (see bug 1434697, bug 1438522, bug 1453653):
+the upstream FreeType repository (see bug 1434697, bug 1438522, bug 1453653, bug 1454359):
 
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=994eb2b34934bc5face9f83b2d3b12cf7a9262ab
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=cc2f3cdecff5a351e7e8961b9f2e389ab740231a
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=4a03f17449ae45f0dacf4de4694ccd6e5e1b24d1
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=68dddcdcbe18a08d778026efc01b1369e35cbf6a
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=29c759284e305ec428703c9a5831d0b1fc3497ef
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=bd9400bd464f6cd7c74f52ece1c1065fe2a87aab
+http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=827ca3bcf25b9e4dc2edf31381c0774e1d227285
+http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=235b1e2fe6ca325f449c5a73c75432d62d73f524
+http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=70ac167c47f5ca966fb578b1f215430f46915a49
+http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=2a1597826a84275660e7410368200b37f85ffdaf

--- a/modules/freetype2/src/truetype/ttinterp.c
+++ b/modules/freetype2/src/truetype/ttinterp.c
@@ -2949,17 +2949,17 @@
   /*                                                                       */
   /* CEILING[]:    CEILING                                                 */
   /* Opcode range: 0x67                                                    */
   /* Stack:        f26.6 --> f26.6                                         */
   /*                                                                       */
   static void
   Ins_CEILING( FT_Long*  args )
   {
-    args[0] = FT_PIX_CEIL( args[0] );
+    args[0] = FT_PIX_CEIL_LONG( args[0] );
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /* RS[]:         Read Store                                              */
   /* Opcode range: 0x43                                                    */
   /* Stack:        uint32 --> uint32                                       */
@@ -3284,17 +3284,20 @@
   /*                                                                       */
   static void
   Ins_SLOOP( TT_ExecContext  exc,
              FT_Long*        args )
   {
     if ( args[0] < 0 )
       exc->error = FT_THROW( Bad_Argument );
     else
-      exc->GS.loop = args[0];
+    {
+      /* we heuristically limit the number of loops to 16 bits */
+      exc->GS.loop = args[0] > 0xFFFFL ? 0xFFFFL : args[0];
+    }
   }
 
 
   static FT_Bool
   SkipCode( TT_ExecContext  exc )
   {
     exc->IP += exc->length;
 
@@ -5869,26 +5872,28 @@
 
     if ( ( exc->opcode & 1 ) != 0 )
     {
       cur_dist = FAST_PROJECT( &exc->zp0.cur[point] );
 #ifdef TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY
       if ( SUBPIXEL_HINTING_INFINALITY &&
            exc->ignore_x_mode          &&
            exc->GS.freeVector.x != 0   )
-        distance = Round_None(
-                     exc,
-                     cur_dist,
-                     exc->tt_metrics.compensations[0] ) - cur_dist;
+        distance = SUB_LONG(
+                     Round_None( exc,
+                                 cur_dist,
+                                 exc->tt_metrics.compensations[0] ),
+                     cur_dist );
       else
 #endif
-        distance = exc->func_round(
-                     exc,
-                     cur_dist,
-                     exc->tt_metrics.compensations[0] ) - cur_dist;
+        distance = SUB_LONG(
+                     exc->func_round( exc,
+                                      cur_dist,
+                                      exc->tt_metrics.compensations[0] ),
+                     cur_dist );
     }
     else
       distance = 0;
 
     exc->func_move( exc, &exc->zp0, point, distance );
 
     exc->GS.rp0 = point;
     exc->GS.rp1 = point;
@@ -6183,17 +6188,17 @@
     FT_Int      B2           = 0;
     FT_Bool     reverse_move = FALSE;
 #endif /* TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY */
 
 
     minimum_distance    = exc->GS.minimum_distance;
     control_value_cutin = exc->GS.control_value_cutin;
     point               = (FT_UShort)args[0];
-    cvtEntry            = (FT_ULong)( args[1] + 1 );
+    cvtEntry            = (FT_ULong)( ADD_LONG( args[1], 1 ) );
 
 #ifdef TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY
     if ( SUBPIXEL_HINTING_INFINALITY                        &&
          exc->ignore_x_mode                                 &&
          exc->GS.freeVector.x != 0                          &&
          !( exc->sph_tweak_flags & SPH_TWEAK_NORMAL_ROUND ) )
       control_value_cutin = minimum_distance = 0;
 #endif /* TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY */