1513913 - Firefox 60 core dumps during start on Solaris when using profile from version 52

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Petr Sumbera]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0

Steps to reproduce:

00007fecfa131590 libc.so.1`__lwp_sigqueue+0xa()
00007fecfa1315b0 libc.so.1`raise+0x19()
00007fecfa1315f0 libxul.so`nsProfileLock::FatalSignalHandler+0xe2()
00007fecfa131690 libxul.so`WasmFaultHandler+0xe60()
00007fecfa1316a0 libc.so.1`__sighndlr+6()
00007fecfa131740 libc.so.1`call_user_handler+0x2f1()
00007fecfa131770 libc.so.1`sigacthandler+0xde(b, 7fecfa132580, 7fecfa131790)
00007fecfa132740 libnssdbm3.so`__get_page+0x139()
00007fecfa1327a0 libnssdbm3.so`__get_buf+0x171()
00007fecfa1327e0 libnssdbm3.so`hash_seq+0xb0()
00007fecfa132900 libnssdbm3.so`legacy_ReadSecmodDB+0x93()
00007fecfa132940 libsoftokn3.so`sftkdbCall_ReadSecmodDB+0x4b()
00007fecfa1329c0 libsoftokn3.so`NSC_ModuleDBFunc+0x136()
00007fecfa1329d0 libnss3.so`SECMOD_GetModuleSpecList+0x23()
00007fecfa132a40 libnss3.so`SECMOD_LoadModule+0x170()
00007fecfa132ae0 libnss3.so`nss_Init+0xba9()
00007fecfa132b60 libnss3.so`NSS_Initialize+0x72()
00007fecfa132c00 libxul.so`mozilla::psm::InitializeNSS+0xdb()
00007fecfa132da0 libxul.so`nsNSSComponent::InitializeNSS+0x768()
00007fecfa132dc0 libxul.so`nsNSSComponent::Init+0x81()
00007fecfa132df0 libxul.so`+0x59()
00007fecfa132e00 libxul.so`mozilla::GenericFactory::CreateInstance+0x13()
00007fecfa132e40 libxul.so`nsComponentManagerImpl::CreateInstanceByContractID+0xce()
00007fecfa132f00 libxul.so`nsComponentManagerImpl::GetServiceByContractID+0x360()
00007fecfa132f10 libxul.so`CallGetService+0x26()
00007fecfa132f30 libxul.so`nsGetServiceByContractIDWithError::operatorconst+0x15()
00007fecfa132f60 libxul.so`nsCOMPtr_base::assign_from_gs_contractid_with_error+0x1d()
00007fecfa132fb0 libxul.so`net_EnsurePSMInit+0x37()
00007fecfa133040 libxul.so`mozilla::net::nsHttpHandler::NewProxiedChannel2+0x2e2()
00007fecfa133190 libxul.so`mozilla::net::nsIOService::NewChannelFromURIWithProxyFlagsInternal+0x1b5()
00007fecfa133200 libxul.so`mozilla::net::nsIOService::NewChannelFromURIWithProxyFlagsInternal+0x1df()
00007fecfa133240 libxul.so`mozilla::net::nsIOService::NewChannelFromURIWithClientAndController+0x2b()
00007fecfa1332f0 libxul.so`NS_NewChannelInternal+0xb0()
00007fecfa133370 libxul.so`NS_NewChannel+0x53()
00007fecfa133440 libxul.so`mozilla::dom::XMLHttpRequestMainThread::CreateChannel+0x40d()
00007fecfa133660 libxul.so`mozilla::dom::XMLHttpRequestMainThread::Open+0x46f()
00007fecfa133710 libxul.so`mozilla::dom::XMLHttpRequestMainThread::Open+0x84()
00007fecfa133960 libxul.so`mozilla::dom::XMLHttpRequestBinding::open+0x21a()
00007fecfa133a30 libxul.so`mozilla::dom::GenericBindingMethod+0x111()
00007fecfa133a90 libxul.so`js::CallJSNative+0x74()
00007fecfa133b30 libxul.so`js::InternalCallOrConstruct+0x40f()
00007fecfa133b70 libxul.so`InternalCall+0x4d()
00007fecfa134b70 libxul.so`Interpret+0x707d()
00007fecfa134c70 libxul.so`js::RunScript+0x141()
00007fecfa134d10 libxul.so`js::InternalCallOrConstruct+0x3c5()
00007fecfa134d50 libxul.so`InternalCall+0x4d()
00007fecfa134d80 libxul.so`js::Call+0x32()
00007fecfa134eb0 libxul.so`JS_CallFunctionValue+0x115()
00007fecfa1353c0 libxul.so`nsXPCWrappedJSClass::CallMethod+0x560()
00007fecfa1353f0 libxul.so`nsXPCWrappedJS::CallMethod+0x45()
00007fecfa135500 libxul.so`PrepareAndDispatch+0x382()
00007fecfa135580 libxul.so`SharedStub+0x5b()
00007fecfa1355a0 libxul.so`mozilla::net::CaptivePortalService::Prepare+0x4a()
00007fecfa1355c0 0x7fe372b84d4a()
00007fecfa135780 libxul.so`XPCWrappedNative::CallMethod+0x74f()
00007fecfa1358f0 libxul.so`XPC_WN_CallMethod+0x2f8()
00007fecfa135950 libxul.so`js::CallJSNative+0x74()
00007fecfa1359f0 libxul.so`js::InternalCallOrConstruct+0x40f()
00007fecfa135a30 libxul.so`InternalCall+0x4d()
00007fecfa136a30 libxul.so`Interpret+0x707d()
00007fecfa136b30 libxul.so`js::RunScript+0x141()
00007fecfa136bd0 libxul.so`js::InternalCallOrConstruct+0x3c5()
00007fecfa136c10 libxul.so`InternalCall+0x4d()
00007fecfa136c40 libxul.so`js::Call+0x32()
00007fecfa136d70 libxul.so`JS_CallFunctionValue+0x115()
00007fecfa137280 libxul.so`nsXPCWrappedJSClass::CallMethod+0x560()
00007fecfa1372b0 libxul.so`nsXPCWrappedJS::CallMethod+0x45()
00007fecfa1373c0 libxul.so`PrepareAndDispatch+0x382()
00007fecfa137440 libxul.so`SharedStub+0x5b()
00007fecfa137490 libxul.so`mozilla::net::CaptivePortalService::PerformCheck+0xb5()
00007fecfa1374b0 libxul.so`mozilla::net::CaptivePortalService::RecheckCaptivePortal+0x6d()
00007fecfa1374d0 0x7fe372b84d4a()
00007fecfa137690 libxul.so`XPCWrappedNative::CallMethod+0x74f()
00007fecfa137800 libxul.so`XPC_WN_CallMethod+0x2f8()
00007fecfa137860 libxul.so`js::CallJSNative+0x74()
00007fecfa137900 libxul.so`js::InternalCallOrConstruct+0x40f()
00007fecfa137940 libxul.so`InternalCall+0x4d()
00007fecfa138940 libxul.so`Interpret+0x707d()
00007fecfa138a40 libxul.so`js::RunScript+0x141()
00007fecfa138ae0 libxul.so`js::InternalCallOrConstruct+0x3c5()
00007fecfa138b20 libxul.so`InternalCall+0x4d()
00007fecfa138b50 libxul.so`js::Call+0x32()
00007fecfa138c80 libxul.so`JS_CallFunctionValue+0x115()
00007fecfa139190 libxul.so`nsXPCWrappedJSClass::CallMethod+0x560()
00007fecfa1391c0 libxul.so`nsXPCWrappedJS::CallMethod+0x45()
00007fecfa1392d0 libxul.so`PrepareAndDispatch+0x382()
00007fecfa139350 libxul.so`SharedStub+0x5b()
00007fecfa1393a0 libxul.so`nsObserverList::NotifyObservers+0x60()
00007fecfa1393f0 libxul.so`nsObserverService::NotifyObservers+0xa4()
00007fecfa139430 0x7fe372b84d4a()
00007fecfa1395f0 libxul.so`XPCWrappedNative::CallMethod+0x74f()
00007fecfa139760 libxul.so`XPC_WN_CallMethod+0x2f8()
00007fecfa1397c0 libxul.so`js::CallJSNative+0x74()
00007fecfa139860 libxul.so`js::InternalCallOrConstruct+0x40f()
00007fecfa1398a0 libxul.so`InternalCall+0x4d()
00007fecfa13a8a0 libxul.so`Interpret+0x707d()
00007fecfa13a9a0 libxul.so`js::RunScript+0x141()
00007fecfa13aa40 libxul.so`js::InternalCallOrConstruct+0x3c5()
00007fecfa13aa80 libxul.so`InternalCall+0x4d()
00007fecfa13aa90 libxul.so`js::CallFromStack+9()
00007fecfa13aef0 libxul.so`js::jit::DoCallFallback+0x2e9()
00007fecfa13af68 0x1ca3e69a0456()
00007fecfa13afe8 0x7fe358e43b18()
00007fecfa13b050 0x1ca3e6988add()
00007fecfa13b590 libxul.so`EnterJit+0x5d7()
00007fecfa13b5c0 libxul.so`js::jit::MaybeEnterJit+0xba()
00007fecfa13b6c0 libxul.so`js::RunScript+0x11a()
00007fecfa13b760 libxul.so`js::InternalCallOrConstruct+0x3c5()
00007fecfa13b7a0 libxul.so`InternalCall+0x4d()
00007fecfa13b7d0 libxul.so`js::Call+0x32()
00007fecfa13b8d0 libxul.so`JS::Call+0x135()
00007fecfa13baa0 libxul.so`mozilla::dom::EventListener::HandleEvent+0x2c8()
00007fecfa13bc90 libxul.so`void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>+0x16c()
00007fecfa13bd10 libxul.so`mozilla::EventListenerManager::HandleEventSubType+0xa2()
00007fecfa13bef0 libxul.so`mozilla::EventListenerManager::HandleEventInternal+0x392()
00007fecfa13bf20 libxul.so`mozilla::EventTargetChainItem::HandleEvent+0x244()
00007fecfa13bfc0 libxul.so`mozilla::EventTargetChainItem::HandleEventTargetChain+0x24f()
00007fecfa13c100 libxul.so`mozilla::EventDispatcher::Dispatch+0xf54()
00007fecfa13c170 libxul.so`mozilla::EventDispatcher::DispatchDOMEvent+0x7e()
00007fecfa13c1d0 libxul.so`nsPresContext::FireDOMPaintEvent+0x14f()
00007fecfa13c2e0 libxul.so`nsView::DidCompositeWindow+0xa8()
00007fecfa13c320 libxul.so`mozilla::layers::ClientLayerManager::DidComposite+0x124()
00007fecfa13c390 libxul.so`mozilla::layers::CompositorBridgeChild::RecvDidComposite+0x111()
00007fecfa13c500 libxul.so`mozilla::layers::PCompositorBridgeChild::OnMessageReceived+0x495()
00007fecfa13c540 libxul.so`mozilla::layers::PCompositorManagerChild::OnMessageReceived+0x4a()
00007fecfa13c5a0 libxul.so`mozilla::ipc::MessageChannel::DispatchAsyncMessage+0x144()
00007fecfa13c650 libxul.so`mozilla::ipc::MessageChannel::DispatchMessage+0x47d()
00007fecfa13c6c0 libxul.so`mozilla::ipc::MessageChannel::RunMessage+0xd2()
00007fecfa13c6e0 libxul.so`mozilla::ipc::MessageChannel::MessageTask::Run+0xd6()
00007fecfa13c7f0 libxul.so`nsThread::ProcessNextEvent+0x367()
00007fecfa13c820 libxul.so`NS_ProcessNextEvent+0x1d()
00007fecfa13c870 libxul.so`mozilla::ipc::MessagePump::Run+0x22f()
00007fecfa13c8b0 libxul.so`MessageLoop::RunInternal+0x54()
00007fecfa13c8f0 libxul.so`MessageLoop::Run+0x25()
00007fecfa13c910 libxul.so`nsBaseAppShell::Run+0x29()
00007fecfa13c930 libxul.so`nsAppStartup::Run+0x77()
00007fecfa13cc90 libxul.so`XREMain::XRE_mainRun+0x1e04()
00007fecfa13cd50 libxul.so`XREMain::XRE_main+0xa3b()
00007fecfa13cf10 libxul.so`XRE_main+0x121()
00007fecfa13cf20 libxul.so`mozilla::BootstrapImpl::XRE_main+0x11()
00007fecfa13d360 do_main+0x1b9()
00007fecfa13d390 main+0x8a()
00007fecfa13d3a0 _start+0x43()

Comment 1

[Petr Sumbera]

Starting Firefox in gdb and setting breakpoint in __get_page() I see following:

Thread 2 hit Breakpoint 1, __get_page (hashp=hashp@entry=0x7fd5cd72bc00, p=0x7fd5cd780000 '\377' <repeats 200 times>..., bucket=bucket@entry=0, 
    is_bucket=is_bucket@entry=1, is_disk=is_disk@entry=1, is_bitmap=is_bitmap@entry=0)
    at /builds/psumbera/userland-ff-60.4.0esr/components/desktop/firefox/firefox-60.4.0/security/nss/lib/dbm/src/h_page.c:696
696     /builds/psumbera/userland-ff-60.4.0esr/components/desktop/firefox/firefox-60.4.0/security/nss/lib/dbm/src/h_page.c: No such file or directory.
(gdb) cont
Continuing.
..
Thread 2 hit Breakpoint 1, __get_page (hashp=hashp@entry=0x7fd5cd72bc00, p=0x7fd5cd782000 '\377' <repeats 200 times>..., bucket=bucket@entry=1, 
    is_bucket=is_bucket@entry=1, is_disk=is_disk@entry=1, is_bitmap=is_bitmap@entry=0)
    at /builds/psumbera/userland-ff-60.4.0esr/components/desktop/firefox/firefox-60.4.0/security/nss/lib/dbm/src/h_page.c:696
696     in /builds/psumbera/userland-ff-60.4.0esr/components/desktop/firefox/firefox-60.4.0/security/nss/lib/dbm/src/h_page.c
(gdb) step
..
(gdb) step
710     in /builds/psumbera/userland-ff-60.4.0esr/components/desktop/firefox/firefox-60.4.0/security/nss/lib/dbm/src/h_page.c
(gdb) print hashp
$2 = (HTAB *) 0x7fd5cd72bc00
(gdb) print hashp->hdr.hdrpages
$3 = 1
(gdb) print bucket
$4 = 1
(gdb) print hashp->hdr.spares
$5 = {0, 2, 2, 0 <repeats 29 times>}
(gdb) break __log2
Breakpoint 4 at 0x7fd5cd017d23: __log2. (2 locations)
(gdb) step

Thread 2 hit Breakpoint 4, 0x00007fd5ee457ec4 in log2 () from /lib/64/libm.so.2
(gdb) up
#1  0x00007fd5cd018365 in __get_page (hashp=hashp@entry=0x7fd5cd72bc00, p=0x7fd5cd782000 '\377' <repeats 200 times>..., bucket=bucket@entry=1, 
    is_bucket=is_bucket@entry=1, is_disk=is_disk@entry=1, is_bitmap=is_bitmap@entry=0)
    at /builds/psumbera/userland-ff-60.4.0esr/components/desktop/firefox/firefox-60.4.0/security/nss/lib/dbm/src/h_page.c:710
710     in /builds/psumbera/userland-ff-60.4.0esr/components/desktop/firefox/firefox-60.4.0/security/nss/lib/dbm/src/h_page.c
(gdb) step
Single stepping until exit from function log2,
which has no line number information.

Thread 2 received signal SIGSEGV, Segmentation fault.
0x00007fd5cd018368 in __get_page (hashp=hashp@entry=0x7fd5cd72bc00, p=0x7fd5cd782000 '\377' <repeats 200 times>..., bucket=bucket@entry=1, 
    is_bucket=is_bucket@entry=1, is_disk=is_disk@entry=1, is_bitmap=is_bitmap@entry=0)
    at /builds/psumbera/userland-ff-60.4.0esr/components/desktop/firefox/firefox-60.4.0/security/nss/lib/dbm/src/h_page.c:710
710     in /builds/psumbera/userland-ff-60.4.0esr/components/desktop/firefox/firefox-60.4.0/security/nss/lib/dbm/src/h_page.c

Comment 2

[Petr Sumbera]

From above I see that it call Solaris log2. Where there is also __log2 implantation in security/nss/lib/dbm/src/h_log2.c. When forcing to use it the problem seem to go away.

Comment 3

[Petr Sumbera]

Above fix to use __log2 doesn't help for all cases (it might have helped just for one simple profile). In another case it crashes when calling OADDR_TO_PAGE(bucket).

Thread 2 received signal SIGSEGV, Segmentation fault.
0x00007fe9c0e18438 in __get_page (hashp=hashp@entry=0x7fe9c1d07c00, p=0x7fe9c1fe1000 '\377' <repeats 200 times>..., bucket=bucket@entry=2050, 
    is_bucket=is_bucket@entry=0, is_disk=is_disk@entry=2, is_bitmap=is_bitmap@entry=0)

Comment 4

[Petr Sumbera]

The issue really seems to be with __log2. On Solaris __log2 is in libm:

$ nm /usr/lib/libm.so | grep __log2
[2153]  |    224832|        12|FUNC |GLOB |0    |20     |__log2
[1549]  |    243120|        12|FUNC |GLOB |0    |20     |__log2f
[1555]  |    274176|        12|FUNC |GLOB |0    |20     |__log2l

$ ggrep -r __log2 /usr/include/
/usr/include/iso/math_c99.h:extern float __log2f(float);
/usr/include/iso/math_c99.h:extern double __log2(double);
/usr/include/iso/math_c99.h:extern long double __log2l(long double);
/usr/include/iso/math_c99.h:    inline float log2(float __X) { return __log2f(__X); }
/usr/include/iso/math_c99.h:    inline long double log2(long double __X) { return __log2l(__X); }
/usr/include/iso/math_c99.h:        log2(_Tp __X) { return __log2(__X); }

With 32bit Firefox 52 it somehow still worked. And __log2() from h_log2.c got called.

But now with 64bit Firefox 60 it calls libm version of __log2() which returns different results (and Firefox cores dump).

Comment 5

[Petr Sumbera]

Attachment: Bug1513913.patch

Comment 6

[Martin Thomson [:mt:]]

Thanks for the patch Petr.  It looks good, except that I think we want to avoid creating more functions with double-underscore names.  Those are for the compiler, and we don't need to create conflicts; we could instead use dbm_log2 as the function name.  The same applies to all of the other __ functions.

We've moved to sqlite, so we're not spending a lot of effort maintaining this code, but renaming all the functions would be ideal.

Comment 7

[Petr Sumbera]

Attachment: Bug1513913.patch

Perhaps we can push it like it's now? Or will you change all functions starting with two underscores?

Comment 8

[Martin Thomson [:mt:]]

Attachment: Bug 1513913 - Rename all __ functions in dbm, r?jcj

We're having some fun here with collisions, so I thought I'd pre-empt any future
problems.

Comment 9

[Martin Thomson [:mt:]]

https://hg.mozilla.org/projects/nss/rev/b10754b2cb747dbc970d71e393868e96b1f5c1e9

Petr, I hope that this addresses your concerns with what we have on trunk.  So that means 3.42.  The code is very stable, so we can do backports very easily.  We won't cut new releases on old branches for this sort of problem, but we could ensure that fix would be included in any point release we make.

Comment 10

[Martin Thomson [:mt:]]

Comment on attachment 9032942 [details] [diff] [review]
Bug1513913.patch

Review of attachment 9032942 [details] [diff] [review]:
-----------------------------------------------------------------

Clearing review flag.