Debian Bug report logs - #483949
unaligned word access in xulrunner

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Martin Guy" <martinwguy@yahoo.it>

To: submit@bugs.debian.org

Subject: unaligned word access in xulrunner

Date: Sun, 1 Jun 2008 13:41:13 +0100

[Message part 1 (text/plain, inline)]

Package: xulrunner
Version: 1.9~rc1
Severity: normal
User: martinwguy@yahoo.it
Usertags: patch

There is an unaligned word access bug in
toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp line 2024
where a char pointer is cast to an int pointer and accessed. On arm
and armel by default this silently gives junk values. On other
architectures it will cause a bus faults.

Fortunately the fix is trivial and local, though there are probably
more mozilla- o C++-like ways to reimplement this before sending it
upstream.

[xulrunner-1.9~rc1-unaligned-access.diff (text/plain, attachment)]

Message #10 received at 483949@bugs.debian.org (full text, mbox, reply):

From: "Martin Guy" <martinwguy@yahoo.it>

To: 483949@bugs.debian.org

Date: Mon, 2 Jun 2008 12:00:09 +0100

[Message part 1 (text/plain, inline)]

Oops. There's another occurrence of the same thing a few dozen lines later.
This new patch fixes both of them (in the same grotty manner :)
Firefox now seems crash-free as far as unaligned word accesses are concerned.

    M

[xulrunner-1.9~rc1-unaligned-access.diff (text/plain, attachment)]

Message #15 received at 483949@bugs.debian.org (full text, mbox, reply):

From: Riku Voipio <riku.voipio@iki.fi>

To: 483949@bugs.debian.org, 482415@bugs.debian.org, jwatzman@andrew.cmu.edu, martinwguy@yahoo.it

Subject: xulrunner crash

Date: Sat, 7 Jun 2008 14:58:52 +0300

Martin Guy's xulrunner built with his patch at 483949 seems to work
fine. Thanks for tracking this down!

Josh, you might want to try applying the patch and building
xulrunner on powerpc to see if it fixes the crash there too.


-- 
"rm -rf" only sounds scary if you don't have backups

Message #20 received at 483949@bugs.debian.org (full text, mbox, reply):

From: Mike Hommey <mh@glandium.org>

To: Riku Voipio <riku.voipio@iki.fi>, 483949@bugs.debian.org

Cc: 482415@bugs.debian.org, jwatzman@andrew.cmu.edu, martinwguy@yahoo.it

Subject: Re: Bug#483949: xulrunner crash

Date: Sat, 7 Jun 2008 14:27:01 +0200

On Sat, Jun 07, 2008 at 02:58:52PM +0300, Riku Voipio wrote:
> Martin Guy's xulrunner built with his patch at 483949 seems to work
> fine. Thanks for tracking this down!
> 
> Josh, you might want to try applying the patch and building
> xulrunner on powerpc to see if it fixes the crash there too.

The strange thing is that #482415 was originally reported on amd64,
where such alignment problems shouldn't have any effect.

Mike

Message #25 received at 483949@bugs.debian.org (full text, mbox, reply):

From: "Martin Guy" <martinwguy@yahoo.it>

To: "Mike Hommey" <mh@glandium.org>

Cc: 483949@bugs.debian.org

Subject: Re: Bug#483949: xulrunner crash

Date: Sat, 7 Jun 2008 14:10:05 +0100

On 6/7/08, Mike Hommey <mh@glandium.org> wrote:
>  The strange thing is that #482415 was originally reported on amd64,
>  where such alignment problems shouldn't have any effect.

482415 is something different, giving immediate failure on startup
with a message. It was filed against iceweasel-3.0~b5-1, and is
reported to be fixed in 3.0~rc1-1.

The two unaligned 32-bit accesses in xulrunner occur long after
startup when visiting previously unvisited URLs and give SIGBUS in
nsUrlClassifierDBServiceWorker::GetShaEntries() at
toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp line 2024

Message #30 received at 483949@bugs.debian.org (full text, mbox, reply):

From: Mike Hommey <mh@glandium.org>

To: Martin Guy <martinwguy@yahoo.it>, 483949@bugs.debian.org

Subject: Re: Bug#483949: unaligned word access in xulrunner

Date: Sat, 7 Jun 2008 19:50:48 +0200

On Sun, Jun 01, 2008 at 01:41:13PM +0100, Martin Guy wrote:
> Package: xulrunner
> Version: 1.9~rc1
> Severity: normal
> User: martinwguy@yahoo.it
> Usertags: patch
> 
> There is an unaligned word access bug in
> toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp line 2024
> where a char pointer is cast to an int pointer and accessed. On arm
> and armel by default this silently gives junk values. On other
> architectures it will cause a bus faults.
> 
> Fortunately the fix is trivial and local, though there are probably
> more mozilla- o C++-like ways to reimplement this before sending it
> upstream.

It's not more mozilla-o C++-like, but it is less verbose and should work
as fine:

diff --git a/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp b/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp
index f454145..eb4513d 100644
--- a/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp
+++ b/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp
@@ -2020,8 +2020,9 @@ nsUrlClassifierDBServiceWorker::GetShaEntries(PRUint32 tableId,
           return NS_ERROR_FAILURE;
         }
         const nsCSubstring& str = Substring(chunk, start, 4);
-        const PRUint32 *p = reinterpret_cast<const PRUint32*>(str.BeginReading());
-        entry->mAddChunkId = PR_ntohl(*p);
+        PRUint32 p;
+        memcpy(&p, reinterpret_cast<const PRUint32*>(str.BeginReading()), 4);
+        entry->mAddChunkId = PR_ntohl(p);
         if (entry->mAddChunkId == 0) {
           NS_WARNING("Received invalid chunk number.");
           return NS_ERROR_FAILURE;
@@ -2049,8 +2050,9 @@ nsUrlClassifierDBServiceWorker::GetShaEntries(PRUint32 tableId,
 
         if (chunkType == CHUNK_SUB) {
           const nsCSubstring& str = Substring(chunk, start, 4);
-          const PRUint32 *p = reinterpret_cast<const PRUint32*>(str.BeginReading());
-          entry->mAddChunkId = PR_ntohl(*p);
+          PRUint32 p;
+          memcpy(&p, reinterpret_cast<const PRUint32*>(str.BeginReading()), 4);
+          entry->mAddChunkId = PR_ntohl(p);
           if (entry->mAddChunkId == 0) {
             NS_WARNING("Received invalid chunk number.");
             return NS_ERROR_FAILURE;

Mike

Message #45 received at 483949@bugs.debian.org (full text, mbox, reply):

From: Josh Watzman <jwatzman@andrew.cmu.edu>

To: Riku Voipio <riku.voipio@iki.fi>

Cc: 483949@bugs.debian.org, 482415@bugs.debian.org, martinwguy@yahoo.it

Subject: Re: xulrunner crash

Date: Sun, 08 Jun 2008 09:31:30 -0400

[Message part 1 (text/plain, inline)]

Riku Voipio wrote:
> Martin Guy's xulrunner built with his patch at 483949 seems to work
> fine. Thanks for tracking this down!
> 
> Josh, you might want to try applying the patch and building
> xulrunner on powerpc to see if it fixes the crash there too.

I patched with the recent one Mike Hommey posted in 483949 which did
*not* fix the crash on startup when attempting to run mybrowser and
xulmine, the suggested test apps. Thanks for the tip, but it looks like
the bugs are different :(

My debugging skills are lacking here, so I'm not even 100% sure my crash
is exactly the same crash as in 482415 (though it looks very similar);
if someone would give me instructions on how to generate useful info to
compare and debug them, I'm willing to give whatever data is needed.

Josh Watzman

-- 

I cryptographically sign nearly all my emails with PGP/gpg. If it isn't
signed, it's probably not from me! If you have the capability, please
encrypt responses.

[signature.asc (application/pgp-signature, attachment)]

Message #50 received at 483949-close@bugs.debian.org (full text, mbox, reply):

From: Mike Hommey <glandium@debian.org>

To: 483949-close@bugs.debian.org

Subject: Bug#483949: fixed in xulrunner 1.9~rc2-1

Date: Sun, 08 Jun 2008 19:33:07 +0000

Source: xulrunner
Source-Version: 1.9~rc2-1

We believe that the bug you reported is fixed in the latest version of
xulrunner, which is due to be installed in the Debian FTP archive:

libmozillainterfaces-java_1.9~rc2-1_all.deb
  to pool/main/x/xulrunner/libmozillainterfaces-java_1.9~rc2-1_all.deb
libmozjs-dev_1.9~rc2-1_amd64.deb
  to pool/main/x/xulrunner/libmozjs-dev_1.9~rc2-1_amd64.deb
libmozjs1d-dbg_1.9~rc2-1_amd64.deb
  to pool/main/x/xulrunner/libmozjs1d-dbg_1.9~rc2-1_amd64.deb
libmozjs1d_1.9~rc2-1_amd64.deb
  to pool/main/x/xulrunner/libmozjs1d_1.9~rc2-1_amd64.deb
python-xpcom_1.9~rc2-1_amd64.deb
  to pool/main/x/xulrunner/python-xpcom_1.9~rc2-1_amd64.deb
spidermonkey-bin_1.9~rc2-1_amd64.deb
  to pool/main/x/xulrunner/spidermonkey-bin_1.9~rc2-1_amd64.deb
xulrunner-1.9-dbg_1.9~rc2-1_amd64.deb
  to pool/main/x/xulrunner/xulrunner-1.9-dbg_1.9~rc2-1_amd64.deb
xulrunner-1.9-gnome-support_1.9~rc2-1_amd64.deb
  to pool/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9~rc2-1_amd64.deb
xulrunner-1.9_1.9~rc2-1_amd64.deb
  to pool/main/x/xulrunner/xulrunner-1.9_1.9~rc2-1_amd64.deb
xulrunner-dev_1.9~rc2-1_amd64.deb
  to pool/main/x/xulrunner/xulrunner-dev_1.9~rc2-1_amd64.deb
xulrunner_1.9~rc2-1.diff.gz
  to pool/main/x/xulrunner/xulrunner_1.9~rc2-1.diff.gz
xulrunner_1.9~rc2-1.dsc
  to pool/main/x/xulrunner/xulrunner_1.9~rc2-1.dsc
xulrunner_1.9~rc2.orig.tar.gz
  to pool/main/x/xulrunner/xulrunner_1.9~rc2.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 483949@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mike Hommey <glandium@debian.org> (supplier of updated xulrunner package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 08 Jun 2008 10:41:19 +0200
Source: xulrunner
Binary: xulrunner-1.9 xulrunner-1.9-gnome-support libmozjs1d libmozjs-dev libmozjs1d-dbg spidermonkey-bin xulrunner-dev xulrunner-1.9-dbg libmozillainterfaces-java python-xpcom
Architecture: source all amd64
Version: 1.9~rc2-1
Distribution: unstable
Urgency: low
Maintainer: Mike Hommey <glandium@debian.org>
Changed-By: Mike Hommey <glandium@debian.org>
Description: 
 libmozillainterfaces-java - XPCOM bindings for Java
 libmozjs-dev - Development files for the Mozilla SpiderMonkey JavaScript library
 libmozjs1d - The Mozilla SpiderMonkey JavaScript library
 libmozjs1d-dbg - Development files for the Mozilla SpiderMonkey JavaScript library
 python-xpcom - XPCOM bindings for Python
 spidermonkey-bin - standalone JavaScript/ECMAScript (ECMA-262) interpreter
 xulrunner-1.9 - XUL + XPCOM application runner
 xulrunner-1.9-dbg - Development files for the Gecko engine library
 xulrunner-1.9-gnome-support - Support for GNOME in xulrunner applications
 xulrunner-dev - Development files for the Gecko engine library
Closes: 483949
Changes: 
 xulrunner (1.9~rc2-1) unstable; urgency=low
 .
   * modules/libjar/nsJAR.cpp: Apply patch from Alexander Sack to avoid
     deadlocks.
   * debian/xulrunner-1.9.links: Don't create links for nspr libraries,
     since nspr now has them.
   * debian/control: Since we don't ship neither nspr nor nss so links, force
     dependencies onto versions of nspr and nss that ship them, to avoid
     partial upgrade surprises to our testing or unstable users.
   * toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:
     Fix unaligned word access. Thanks Martin Guy to have tracked this down.
     Closes: #483949.
   * debian/control: Remove xulrunner-dev-bin and xulrunner-1.9-common
     packages, adapt xulrunner-dev and xulrunner-1.9 for transition.
   * debian/xulrunner-1.9-common.*, debian/xulrunner-dev-bin.*: Removed.
   * debian/xulrunner-1.9.*, debian/xulrunner-dev.*: Install files that
     previously were in xulrunner-1.9-common and xulrunner-dev-bin.
   * debian/rules:
     + Don't filter-out mozilla-config and xpcom-config files when
       installing arch-indep files.
     + Don't install the buildconfig.html override, it is not needed anymore.
   * toolkit/content/jar.mn: Do include content/global/buildconfig.html in
     toolkit.jar.
Checksums-Sha1: 
 4d73756e82b875f0f4ae731f4ab8139e6c7f8144 1750 xulrunner_1.9~rc2-1.dsc
 4063ff5408b5133df7ce63a5bd539cbdc2333e37 40066791 xulrunner_1.9~rc2.orig.tar.gz
 dacc881a8dfa1daf25f84664a733a488dca8d14d 99479 xulrunner_1.9~rc2-1.diff.gz
 bde60f8ddf45d9e4a27f277fa15f607ff26b56b6 1452000 libmozillainterfaces-java_1.9~rc2-1_all.deb
 34f7a4033b465e6d1abb1d8b8273e00d7db2b5c3 7703228 xulrunner-1.9_1.9~rc2-1_amd64.deb
 a451bcb47a6a538af44a6b54fd738c1b0fa60e77 97566 xulrunner-1.9-gnome-support_1.9~rc2-1_amd64.deb
 009cb9e7eb1280aa95d0d9f7d36c11611d9af366 369228 libmozjs1d_1.9~rc2-1_amd64.deb
 5065200ab4608a231a1c872198ea9e8f56c89319 219208 libmozjs-dev_1.9~rc2-1_amd64.deb
 5c518486c5e80271463df469cd3911fcd1fcc4f0 885834 libmozjs1d-dbg_1.9~rc2-1_amd64.deb
 c4ac95329fb998e81fcb745eb5ef73cd0328666a 65774 spidermonkey-bin_1.9~rc2-1_amd64.deb
 e81ca6f9bd105de42704b74a5330c63204107755 4997464 xulrunner-dev_1.9~rc2-1_amd64.deb
 7649a04cac880a7d08fb0b4271068bc83b2b4bef 49897032 xulrunner-1.9-dbg_1.9~rc2-1_amd64.deb
 73a58ed9ce8542e13eda3e5e712de79756105f69 146970 python-xpcom_1.9~rc2-1_amd64.deb
Checksums-Sha256: 
 da073ef941780b2243d8eac47d2f5cbdf72363554a2fae2b75e00488abdfebaa 1750 xulrunner_1.9~rc2-1.dsc
 c778200aa784a4a171c3d23a272589359e09565e5f12ad99592c9639f9d223f0 40066791 xulrunner_1.9~rc2.orig.tar.gz
 9f83d7f4d7d38d3212578b616c4bd4b1ac719099ee3c62b72b7249f4af056166 99479 xulrunner_1.9~rc2-1.diff.gz
 00a61326761b9db3926fb4cb158e86f5024fb564d80181bbbc8c849e079ba799 1452000 libmozillainterfaces-java_1.9~rc2-1_all.deb
 f8b32e65e1bbc311c498dac1e70ca94c89de708ca76b6c41a1f743d29113469b 7703228 xulrunner-1.9_1.9~rc2-1_amd64.deb
 625e4e055e3f1d5c67caa4f6fbd24eb09823f818efa6c92e246b4526927d9bec 97566 xulrunner-1.9-gnome-support_1.9~rc2-1_amd64.deb
 94b50417d5521340386e170c75a8d121de47748e4108de2e79a15bf2a1f9251f 369228 libmozjs1d_1.9~rc2-1_amd64.deb
 2e33f4ef6f87381ee5a20c81d9945136b77708eb5b63537b0f8e289b514c5048 219208 libmozjs-dev_1.9~rc2-1_amd64.deb
 59ffa58f8486330aca6c0db9b5ef8f65ad4d6d065ceeaf8eff21d56feea70930 885834 libmozjs1d-dbg_1.9~rc2-1_amd64.deb
 62ef8ec05fd649ff3dd7114cb8e078b3da20a8798e44981d49403c68735183d7 65774 spidermonkey-bin_1.9~rc2-1_amd64.deb
 2a538e2f8fa953569074a2a03a64b7f0a2011a2ad72fd460a0993d90f638257b 4997464 xulrunner-dev_1.9~rc2-1_amd64.deb
 2ec8c05114fc188eee206932aaa45c4f75d4a4d86c0b72f4b397cb8bf940b058 49897032 xulrunner-1.9-dbg_1.9~rc2-1_amd64.deb
 c2d731fa5d1367c008597066c10d76e3e8397be9d5f7e57a6b583db8ad9f4565 146970 python-xpcom_1.9~rc2-1_amd64.deb
Files: 
 d8c2fac0fc6f1450d2d300f820d154aa 1750 devel optional xulrunner_1.9~rc2-1.dsc
 71b9830afd7094113f070632d6034ad1 40066791 devel optional xulrunner_1.9~rc2.orig.tar.gz
 dc0a4c67c09faee28cdaf8fcfd991b8a 99479 devel optional xulrunner_1.9~rc2-1.diff.gz
 078403c4b54859729b3c0a7c0a90312c 1452000 libdevel extra libmozillainterfaces-java_1.9~rc2-1_all.deb
 6efb9b8d552d1b0099ce0d85cf1d8482 7703228 devel optional xulrunner-1.9_1.9~rc2-1_amd64.deb
 32a0c583ee1cba6e3ab9b70187733c98 97566 devel optional xulrunner-1.9-gnome-support_1.9~rc2-1_amd64.deb
 8831353b50a24ab53bd11b8da1d8ed68 369228 libs optional libmozjs1d_1.9~rc2-1_amd64.deb
 5ba5846f88d2987d9a90086fcfc4210e 219208 libdevel optional libmozjs-dev_1.9~rc2-1_amd64.deb
 73be840f494b0b4aadee136558daff63 885834 libdevel extra libmozjs1d-dbg_1.9~rc2-1_amd64.deb
 815e59e4ea5a594a01347eb98860a8ae 65774 interpreters optional spidermonkey-bin_1.9~rc2-1_amd64.deb
 ace10836dfa5abb3695dd99d0805eb00 4997464 libdevel optional xulrunner-dev_1.9~rc2-1_amd64.deb
 f4c02a98d221cf68dc507ee2f7e9809a 49897032 libdevel extra xulrunner-1.9-dbg_1.9~rc2-1_amd64.deb
 fb93d6ce4fe84764775da36947afec0c 146970 python extra python-xpcom_1.9~rc2-1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIS6A13kvaLFT9KlgRAsAaAJ9XrgvNacFWmkMPeSFSHnvCq2Cm7wCfWee4
EzkXGsVSTBmhtkccA9zLst8=
=5hOU
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.