611451 - Mac OS X shared libraries export all symbols

Status: RESOLVED FIXED

(NSS :: Build, defect, P2)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The Sync J-PAKE prototype uses JS-ctypes to access the MPI library embedded in the FreeBL shared library. The prototype was developed on Mac OS X and apparently worked fine on that platform. When the Sync J-PAKE prototype was tested on Windows, it failed. The hypothesis is that the Mac OS X builds are exporting the MPI symbols from the FreeBL shared library whereas the other platforms are not. Presumably, the Mac OS X behavior is wrong and the shared libraries need to be built with MPI and other internal symbols hidden.

Comment 1

[Wan-Teh Chang]

I noticed this bug today. Looking at the build log closely, I saw a warning
message from the nmedit command:

grep -v ';+' nssutil.def | grep -v ';-' | sed -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,,' -e 's,^,_,' > Darwin12.2.0_64_DBG.OBJ/nssutil.def
rm -f Darwin12.2.0_64_DBG.OBJ/libnssutil3.dylib
gcc -arch x86_64 -dynamiclib -compatibility_version 1 -current_version 1 -install_name @executable_path/libnssutil3.dylib -headerpad_max_install_names  -o Darwin12.2.0_64_DBG.OBJ/libnssutil3.dylib Darwin12.2.0_64_DBG.OBJ/quickder.o Darwin12.2.0_64_DBG.OBJ/secdig.o Darwin12.2.0_64_DBG.OBJ/derdec.o Darwin12.2.0_64_DBG.OBJ/derenc.o Darwin12.2.0_64_DBG.OBJ/dersubr.o Darwin12.2.0_64_DBG.OBJ/dertime.o Darwin12.2.0_64_DBG.OBJ/errstrs.o Darwin12.2.0_64_DBG.OBJ/nssb64d.o Darwin12.2.0_64_DBG.OBJ/nssb64e.o Darwin12.2.0_64_DBG.OBJ/nssrwlk.o Darwin12.2.0_64_DBG.OBJ/nssilock.o Darwin12.2.0_64_DBG.OBJ/oidstring.o Darwin12.2.0_64_DBG.OBJ/portreg.o Darwin12.2.0_64_DBG.OBJ/secalgid.o Darwin12.2.0_64_DBG.OBJ/secasn1d.o Darwin12.2.0_64_DBG.OBJ/secasn1e.o Darwin12.2.0_64_DBG.OBJ/secasn1u.o Darwin12.2.0_64_DBG.OBJ/secitem.o Darwin12.2.0_64_DBG.OBJ/secload.o Darwin12.2.0_64_DBG.OBJ/secoid.o Darwin12.2.0_64_DBG.OBJ/sectime.o Darwin12.2.0_64_DBG.OBJ/secport.o Darwin12.2.0_64_DBG.OBJ/templates.o Darwin12.2.0_64_DBG.OBJ/utf8.o Darwin12.2.0_64_DBG.OBJ/utilmod.o Darwin12.2.0_64_DBG.OBJ/utilpars.o    -L../../../../dist/Darwin12.2.0_64_DBG.OBJ/lib -L../../../../dist/Darwin12.2.0_64_DBG.OBJ/lib -lplc4 -lplds4 -lnspr4  
chmod +x Darwin12.2.0_64_DBG.OBJ/libnssutil3.dylib
nmedit -s Darwin12.2.0_64_DBG.OBJ/nssutil.def Darwin12.2.0_64_DBG.OBJ/libnssutil3.dylib
nmedit: removing global symbols from a final linked no longer supported.  Use -exported_symbols_list at link time when building: /Users/wtc/nss-tip.2/mozilla/security/nss/lib/util/Darwin12.2.0_64_DBG.OBJ/libnssutil3.dylib

I will attach a patch.

Comment 2

[Wan-Teh Chang]

Attachment: Use the -exported_symbols_list linker option instead of the nmedit command

This patch implements the suggestion in the nmedit warning message.
I verified it works on Mac OS X 10.8.2 with Xcode 4.5.1.

I am worried that the -exported_symbols_list linker option won't
work on the NSS Mac/ppc tinderbox. Kai, could you test it?

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 689571 [details] [diff] [review]
Use the -exported_symbols_list linker option instead of the nmedit command

This is very similar to what we do in Gecko. r+ me though I'm not the best reviewer for Mac-specific stuff.

Comment 4

[Wan-Teh Chang]

Comment on attachment 689571 [details] [diff] [review]
Use the -exported_symbols_list linker option instead of the nmedit command

(In reply to Wan-Teh Chang from comment #2)
>
> I am worried that the -exported_symbols_list linker option won't
> work on the NSS Mac/ppc tinderbox. Kai, could you test it?

Kai, I found the answer to my question in bug 403250 comment 1.
The -exported_symbols_list linker option is supported by the ld
in all the Xcode versions we use today. So please don't test
this patch on the NSS Mac/ppc tinderbox.

For future reference: Mozilla's use of nmedit and transition to
-exported_symbols_list was done in three bugs:
Bug 187732 - limit exported symbols for components
Bug 195186 - Use -exported_symbols_list instead of nmedit when
             possible
Bug 403250 - [10.5] 1.8 build configured with --enable-strip fails:
             strip: symbols referenced by relocation entries that
             can't be stripped in: .../xpinstall/src/libxpinstall.dylib

Comment 5

[Wan-Teh Chang]

Comment on attachment 689571 [details] [diff] [review]
Use the -exported_symbols_list linker option instead of the nmedit command

Mark, could you review this patch? This is the NSS equivalent of
your patch in bug 403250. Thanks.

Comment 6

[Robert Relyea]

Comment on attachment 689571 [details] [diff] [review]
Use the -exported_symbols_list linker option instead of the nmedit command

r+ rrelyea as well

Comment 7

[Wan-Teh Chang]

Patch checked in on the NSS trunk (NSS 3.14.1).

Checking in Darwin.mk;
/cvsroot/mozilla/security/coreconf/Darwin.mk,v  <--  Darwin.mk
new revision: 1.32; previous revision: 1.31
done
Checking in rules.mk;
/cvsroot/mozilla/security/coreconf/rules.mk,v  <--  rules.mk
new revision: 1.88; previous revision: 1.87
done

Comment 8

[Wan-Teh Chang]

Patch pushed to mozilla-inbound as part of NSS_3_14_1_BETA3:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0956fb40dbe2

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0956fb40dbe2