698342 - Configure.in requires only NSPR 4.8.8 but we only have test coverage for NSPR 4.8.9

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect, P1)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #673382 +++

When we upgraded mozilla-central to NSPR 4.8.9, we didn't change configure.in to require NSPR 4.8.9. We have no (automated) testing for Firefox 8 (beta), 9 (aurora), or 10 (mozilla-central) with NSPR 4.8.8, so we need to require NSPR 4.8.9 when using system NSS.

This has a material effect only on Linux, AFAICT.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: Require NSPR 4.8.9 or later when using system NSS

Requesting approval for Firefox 8 (beta) and Firefox 9 (aurora).

Comment 2

[(not currently active) Ted Mielczarek]

This is not how we typically do things. It doesn't matter whether we have test coverage or not, what matters is what API/feature compatibility we need. We shouldn't be forcing Linux distros to use the latest NSPR simply because that's what we happen to be using. If we rely on a feature that only exists in a new NSPR, then we should require that version. Distros are on the hook for testing their own builds, and changing the version of NSPR doesn't change that.

Comment 3

[Alex Keybl [:akeybl]]

Ted - how do you suggest we move forward for FF9 and later?

[Triage Comment]
* Minusing tracking-firefox8 as we've already built what we hope to be our RC, and this does not seem critical enough to re-roll

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Please have QA sign off on this after they have tested Firefox 8 on Linux using system NSPR 4.8.8. As far as I know, we have no test coverage of this configuration, but this is the kind of configuration that Linux users get from their distros including Ubuntu and Red Hat.

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Ted Mielczarek [:ted, :luser] from comment #2)
> This is not how we typically do things. It doesn't matter whether we have
> test coverage or not, what matters is what API/feature compatibility we
> need

Who has verified that NSPR 4.8.8 meets the feature, performance, and bugfix criteria we have for Firefox 8? What, what is that criteria? AFAICT, that criteria is implicitly "whatever is in NSPR 4.8.9".

Comment 6

[(not currently active) Ted Mielczarek]

Nobody. There have never been any such criteria. Testing of third-party builds is up to the parties producing those builds. Bumping the NSPR version requirement isn't going to make any material difference in the quality of those builds.

Comment 7

[(not currently active) Ted Mielczarek]

For a related comparison: should we remove all the configure options to make it impossible to build in a configuration that we don't ship? We don't test those build configurations. Should we make it impossible to build with compiler flags that don't match those of our official builds?

Comment 8

[Alex Keybl [:akeybl]]

Comment on attachment 570616 [details] [diff] [review]
Require NSPR 4.8.9 or later when using system NSS

[Triage Comment]
* Denying for Aurora. Please re-request if this is still deemed necessary after consensus is reached and this lands on m-c.

Comment 9

[Wan-Teh Chang]

On major platforms, NSPR is a finished product and is very stable.
This means if Mozilla requires a new version of NSPR, it is usually
a new macro or new function and will result in a build failure, and
the Mozilla package owners in Linux distributions will submit patches
to update the NSPR version requirement.  So in general we don't need
to update the NSPR version requirement if there is no build failure.

You can find exceptions to this rule.  Recent exceptions include:
- https://bugzilla.mozilla.org/show_bug.cgi?id=614526 in NSPR 4.8.8
- https://bugzilla.mozilla.org/show_bug.cgi?id=676457 in NSPR 4.9

Newer versions of Mozilla may depend on such NSPR bug fixes for
functionality or efficient memory usage, and the lack of these
bug fixes cannot be discovered at build time.

Comment 10

[Alex Keybl [:akeybl]]

[Triage Comment[
This appears to be a build issue, and since we didn't get any noise when we shipped for FF8, minusing for 9 and 10.

Comment 11

[Wan-Teh Chang]

Comment on attachment 570616 [details] [diff] [review]
Require NSPR 4.8.9 or later when using system NSS

r=wtc.

We should make a decision about this bug.  We should either mark it WONTFIX,
or just check in this patch in mozilla-central.  It is not worth the trouble
to merge this patch to the other branches.

Comment 12

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

configure.in now requires NSPR 4.9 and NSS 3.13.2.