Bug#624732: xulrunner dies with sigseg on startup on powerpc

[Jörg Sommer]

Jörg Sommer hat am Sun 01. May, 02:36 (+0200) geschrieben:
> Package: xulrunner-2.0
> Version: 2.0.1-1
> Severity: normal
> 
> Hi,
> 
> simply running xulrunner-2.0 yields a segmentation fault.
> 
> There's something broken in the dynamic linking process, hence this can
> also be a bug in libc6, but I've read Firefox does fancy stuff to speedup
> start‐up so this can be a bug in Firefox.

I've checked some older versions found at <http://snapshot.debian.org/>.
Version 2.0~rc1-1 works and version 2.0-1 yields a SIGSEG.

% xulrunner-2.0 --version
Mozilla XULRunner 2.0 - 20110310110453

I've looked at the code and found this:

2.0-1

10001f4c:       94 21 ff f0     stwu    r1,-16(r1)
10001f50:       7c 69 1b 78     mr      r9,r3
10001f54:       7c 08 02 a6     mflr    r0
10001f58:       42 9f 00 05     bcl-    20,4*cr7+so,10001f5c <_malloc_prefork-0x8a64>
10001f5c:       90 01 00 14     stw     r0,20(r1)
10001f60:       bf c1 00 08     stmw    r30,8(r1)
10001f64:       7f c8 02 a6     mflr    r30
10001f68:       3f de 00 03     addis   r30,r30,3
10001f6c:       3b de c1 30     addi    r30,r30,-16080
10001f70:       88 03 00 00     lbz     r0,0(r3)
10001f74:       38 60 00 00     li      r3,0
10001f78:       2f 80 00 2d     cmpwi   cr7,r0,45
10001f7c:       40 9e 00 28     bne-    cr7,10001fa4 <_malloc_prefork-0x8a1c>
10001f80:       88 69 00 01     lbz     r3,1(r9)
10001f84:       38 09 00 01     addi    r0,r9,1
10001f88:       68 69 00 2d     xori    r9,r3,45
10001f8c:       21 29 00 00     subfic  r9,r9,0
10001f90:       7d 20 01 94     addze   r9,r0
10001f94:       7d 23 4b 78     mr      r3,r9
10001f98:       48 01 19 69     bl      10013900 <jemalloc_stats+0x540>
10001f9c:       7c 63 00 34     cntlzw  r3,r3
10001fa0:       54 63 d9 7e     rlwinm  r3,r3,27,5,31
10001fa4:       39 61 00 10     addi    r11,r1,16
10001fa8:       48 01 1c 08     b       10013bb0 <jemalloc_stats+0x7f0>

2.0rc1-1

10001dac:       94 21 ff f0     stwu    r1,-16(r1)
10001db0:       7c 69 1b 78     mr      r9,r3
10001db4:       7c 08 02 a6     mflr    r0
10001db8:       42 9f 00 05     bcl-    20,4*cr7+so,10001dbc <_malloc_postfork-0x97b4>
10001dbc:       38 60 00 00     li      r3,0
10001dc0:       93 c1 00 08     stw     r30,8(r1)
10001dc4:       90 01 00 14     stw     r0,20(r1)
10001dc8:       7f c8 02 a6     mflr    r30
10001dcc:       3f de 00 03     addis   r30,r30,3
10001dd0:       3b de d2 d8     addi    r30,r30,-11560
10001dd4:       88 09 00 00     lbz     r0,0(r9)
10001dd8:       2f 80 00 2d     cmpwi   cr7,r0,45
10001ddc:       40 9e 00 28     bne-    cr7,10001e04 <_malloc_postfork-0x976c>
10001de0:       88 69 00 01     lbz     r3,1(r9)
10001de4:       39 29 00 01     addi    r9,r9,1
10001de8:       68 60 00 2d     xori    r0,r3,45
10001dec:       20 00 00 00     subfic  r0,r0,0
10001df0:       7c 09 01 94     addze   r0,r9
10001df4:       7c 03 03 78     mr      r3,r0
10001df8:       48 01 2d 99     bl      10014b90 <valloc+0x1050>
10001dfc:       7c 63 00 34     cntlzw  r3,r3
10001e00:       54 63 d9 7e     rlwinm  r3,r3,27,5,31
10001e04:       80 01 00 14     lwz     r0,20(r1)
10001e08:       83 c1 00 08     lwz     r30,8(r1)
10001e0c:       38 21 00 10     addi    r1,r1,16
10001e10:       7c 08 03 a6     mtlr    r0
10001e14:       4e 80 00 20     blr

While version 2.0rc1-1 ends with an blr, version 2.0-1 jumps to another
function. I've disassembled the code on alioth with binutils multiarch,
hence the symbol names are broken.

% objdump -d /tmp/xulr-2.0-1/usr/lib/xulrunner-2.0/xulrunner-bin

Bye, Jörg.
-- 
Prof: Ist etwas an der Tafel nicht zu lesen? Sie schauen so komisch.
Studentin: Nein, es ist alles in Ordnung.
Prof: Aber ihr Gesicht sieht überhaupt nicht in Ordnung aus.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature http://en.wikipedia.org/wiki/OpenPGP
URL: <http://lists.alioth.debian.org/pipermail/pkg-mozilla-maintainers/attachments/20110501/b7631523/attachment.pgp>