61018 - Random crash in gklayout.so due to rand()

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P3)

Description

[cls]

I'm not sure how to reproduce this crash.  I closed the 'view source' window as
I have time and time before and I received this error:

./mozilla-bin: error in loading shared libraries:
/usr/cls/src/obj-opt-O/dist/bin/components/libgklayout.so: undefined symbol:
rand, version y__9nsJSUtilsP11nsISupportsP9JSContextP8JSObjectlPl

I received a similar error in liblocalmail.so a couple of days ago and mscott
thought that it may have been due to the use of memcpy() instead of
nsCRT::memcpy() (bug 60830).  Are we calling rand() someplace instead of the
proper xpcom or nspr equivalent?

Comment 1

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Please triage.

Comment 2

[harishd]

Eric, would you mind taking a look into this bug?  I see some rand() calls in 
nsFormFrame.cpp.

http://lxr.mozilla.org/seamonkey/source/layout/html/forms/src/nsFormFrame.cpp#13
03

Comment 3

[Kevin McCluskey (gone)]

Marking mozilla0.9.1

Comment 4

[Eric Pollmann]

The only generic equivalent I could find is XP_RANDOM(), which should expand to
rand() on Linux systems anyway.  Before replacing all rand() calls everywhere
with XP_RANDOM(), Chris, can you verify that the patch I'm about to attach fixes
your crash?

To give an idea of how widespread rand() and srand() are, check this out:
Calls to XP_RANDOM():

modules/libimg/src/color.cpp, line 186 -- fs->err1[i] = (XP_RANDOM() % 1024 -
512)/4;

Calls to rand() or srand() (lxr search for "rand("):

(I placed things in a directory matching *test* at the bottom to reduce noise)

/include/xp_str.h, line 135 -- #define XP_SRANDOM(seed) srand((seed))
/include/xp_mcom.h, line 167 -- #define XP_SRANDOM(seed) srand((seed))
/modules/libimg/src/scale.cpp, line 409 -- tmprand =
1+(int)(200.0*rand()/(RAND_MAX+1.0));
/modules/libimg/src/scale.cpp, line 430 -- tmprand =
1+(int)(200.0*rand()/(RAND_MAX+1.0));
/profile/src/nsProfile.cpp, line 1138 -- srand((uint)(fpTime * 1e-6 + 0.5)); //
use 1e-6, granularity of PR_Now() on the mac is seconds
/profile/src/nsProfile.cpp, line 1143 -- saltStr.Append(table[rand()%TABLE_SIZE]);
/xpcom/typelib/xpidl/glib/glib-1.2.1/gthread/testgthread.c, line 171 -- guint
random_value = rand() % 10000;
/xpinstall/wizard/mac/src/Parser.c, line 899 -- srand(time(NULL));
/xpinstall/wizard/mac/src/Parser.c, line 900 -- arbitrary = rand();
/xpinstall/wizard/windows/setup/extra.c, line 3284 -- srand((unsigned)time(NULL));
/xpinstall/wizard/windows/setup/extra.c, line 3285 -- lArbitrary = rand() % 100;
/htmlparser/src/nsDTDDebug.cpp, line 514 -- srand((unsigned)time(NULL));
/htmlparser/src/nsDTDDebug.cpp, line 525 -- ltime += (time_t)rand();
/layout/html/forms/src/nsFormFrame.cpp, line 1304 -- rand(), rand(), rand());
/mailnews/compose/src/nsMsgCompUtils.cpp, line 742 -- srand( (unsigned)aTime );
/mailnews/compose/src/nsMsgCompUtils.cpp, line 747 -- buf[i] = rand() % 10;
/mailnews/mapi/mapi32/mapiutl.cpp, line 143 -- srand( (unsigned)time( NULL ) );
/mailnews/mapi/mapi32/mapiutl.cpp, line 144 -- id = rand();
/uriloader/exthandler/nsExternalHelperAppService.cpp, line 746 --
srand((uint)(fpTime * 1e-6 + 0.5));
/uriloader/exthandler/nsExternalHelperAppService.cpp, line 750 --
saltedTempLeafName.Append(table[(rand()%TABLE_SIZE)]);


            -------- rand() in tests --------

/dbm/tests/lots.c, line 327 -- n = rand();
/dbm/tests/lots.c, line 587 -- if(1 == rand() % 3)
/dbm/tests/lots.c, line 592 -- if(1 == rand() % 3)
/modules/libjar/test/TestJarCache.cpp, line 127 -- int k = rand()%ZIP_COUNT;
/modules/libjar/test/TestJarCache.cpp, line 138 -- PR_Sleep(rand()%10);
/nsprpub/pr/tests/cltsrv.c, line 268 -- descriptor->size = PR_htonl(descbytes =
rand() % clipping);
/nsprpub/pr/tests/cltsrv.c, line 367 -- rv = PR_WaitCondVar(client->stateChange,
rand() % clipping);
/nsprpub/pr/tests/dbmalloc.c, line 209 -- int which = rand() % n;
/nsprpub/pr/tests/dbmalloc.c, line 238 -- srand(time(0));
/nsprpub/pr/tests/many_cv.c, line 35 -- PRInt32 ran = rand() >> 16;
/nsprpub/pr/tests/provider.c, line 269 -- descriptor->size = PR_htonl(descbytes
= rand() % clipping);
/nsprpub/pr/tests/provider.c, line 368 -- rv =
PR_WaitCondVar(client->stateChange, rand() % clipping);
/nsprpub/pr/tests/tmoacc.c, line 60 -- PRUint32 random = (rand() % RANDOM_RANGE)
* half / RANDOM_RANGE;
/nsprpub/pr/tests/tmocon.c, line 91 -- PRUint32 random = rand() % quarter; /*
something in[0..timeout / 4) */
/nsprpub/pr/tests/randseed.c, line 60 -- static void PrintRand( void *buf,
PRIntn size )
/nsprpub/pr/tests/randseed.c, line 93 -- } /* end PrintRand() */
/nsprpub/pr/tests/randseed.c, line 136 -- if (debug) PrintRand( buf, rSize );
/nsprpub/lib/tests/arena.c, line 114 -- PRIntn sz = (rand() % (max -min)) + min
+ sizeof(double);
/nsprpub/lib/tests/arena.c, line 285 -- srand( (unsigned)time( NULL ) ); /* seed
random number generator */
/xpcom/tests/TestPipes.cpp, line 226 -- len = len * rand() / RAND_MAX;
/xpcom/tests/TestPipes.cpp, line 478 -- len = len * rand() / RAND_MAX;
/xpcom/tests/windows/nsStringTest.h, line 1518 -- srand( (unsigned)time( NULL ) );
/xpcom/tests/windows/nsStringTest.h, line 1530 -- int r=rand();
/xpcom/tests/TestVoidBTree.cpp, line 196 -- PRInt32 slot = i ? rand() % i : 0;
/xpcom/tests/TestVoidBTree.cpp, line 243 -- PRInt32 slot = i ? rand() % i : 0;
/xpcom/tests/TestVoidBTree.cpp, line 271 -- PRInt32 slot = i ? rand() % i : 0;
/gfx/tests/btest/BitTest.cpp, line 430 -- cpos.x = (100*::rand())/32000;
/gfx/tests/btest/BitTest.cpp, line 431 -- cpos.y = (100*::rand())/32000;
/layout/html/tests/block/dom/testlogic.js, line 171 -- function Rand() {
/layout/html/tests/block/dom/testlogic.js, line 197 -- var rr = Rand() >> 3;
/widget/tests/scribble/Scribble.cpp, line 351 -- srand(aEvent->time);
/widget/tests/scribble/Scribble.cpp, line 372 -- drawCtx->SetColor((nscolor)rand());
/widget/tests/scribble/Scribble.cpp, line 374 -- rect.MoveTo(x+(rand() %
width),y+( rand() % height));
/widget/tests/scribble/Scribble.cpp, line 375 -- rect.SizeTo(rand() % (width -
rect.x),
/widget/tests/scribble/Scribble.cpp, line 376 -- rand() % (height - rect.y));
/widget/tests/scribble/Scribble.cpp, line 382 -- drawCtx->SetColor((nscolor)rand());
/widget/tests/scribble/Scribble.cpp, line 384 -- rect.MoveTo(x+(rand() %
width+1),y+( rand() % height+1));
/widget/tests/scribble/Scribble.cpp, line 385 -- rect.SizeTo(rand() % (width -
rect.x)+1,
/widget/tests/scribble/Scribble.cpp, line 386 -- rand() % (height - rect.y)+1);

Comment 5

[Eric Pollmann]

Attachment: patch to test XP_RANDOM() for crashy fixiness

Comment 6

[cls]

I have not seen that particular crash since I reported the bug. (I've seen
others along the same vein though.) I applied the patch though and I did see the
undefined symbol change from rand@@GLIBC_2.0 to random@@GLIBC_2.0 . I'm not sure
if that's going to help this particular problem.  I tried explicitly linking -lc
against the component to see if that changed the nm output any and it didn't.

I think using XP_RANDOM may be the proper way to go but I'd open a separate bug
on it to pursue it.  If you want to close this bug out as WFM or invalid, that's
fine.  If I can find a concrete way to reproduce it, I'll reopen.

Comment 7

[Eric Pollmann]

Thanks for looking into this again Christopher!  Marking WFM per your suggestion
- that seems like the right thing to do for now, and if this can be reproduced
in the future, please reopen, thanks!

Comment 8

[Chris Petersen]

Marking verified per last comments.