Bug 22067

Summary: [GTK] Sun Java plugin segfaults at PluginPackage::createPackage()
Product: WebKit Reporter: Michael Monreal <michael.monreal+bugs>
Component: Plug-insAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: alp
Priority: P2 Keywords: Gtk
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Linux   
Attachments:
Description Flags
GDB output
none
config.log
none
Fix Java plugin segfaults zwarich: review+

Description Michael Monreal 2008-11-04 13:46:21 PST
I regularly do WebKit/GTK builds. For some time now I see segfaults while loading most webpages. See the attached gdb log (example visiting osnews.com).
Comment 1 Michael Monreal 2008-11-04 13:48:34 PST
Created attachment 24893 [details]
GDB output
Comment 2 Alp Toker 2008-11-05 08:27:22 PST
(In reply to comment #0)
> I regularly do WebKit/GTK builds. For some time now I see segfaults while
> loading most webpages. See the attached gdb log (example visiting osnews.com).
> 

Hi!

Can you try one of the patches in bug #22033 (attachment 24884 [details] or 24885) and report back success/failure?
Comment 3 Alp Toker 2008-11-05 08:28:07 PST
The output of your config.log and your actual CPU architecture will help too.
Comment 4 Michael Monreal 2008-11-05 10:30:48 PST
Created attachment 24911 [details]
config.log

Here's my config.log

I'll try the patches now, but the bug says they are meant to fix crashes on google... which actually seems to be one of the few pages that fully load without crashing for me.
Comment 5 Michael Monreal 2008-11-05 11:02:32 PST
Neither of the patches fixes the problem.
Comment 6 Alp Toker 2008-11-05 11:35:38 PST
(In reply to comment #5)
> Neither of the patches fixes the problem.
> 

Thanks for checking. Which SVN revision are you testing with and do you have a known-good revision number where the problem didn't show up?

The backtrace suggests this crash may be related to the plugin code. Can you get a list of the plugins you have installed (both in ~/.mozilla and the system)? Especially if it's trying to load Java or the gjs Java plugin or swfdec which I think might already have proposed fixes..

If you have time to narrow down the plugin causing the issue by moving them out of the way and moving them back one by one, that could help too. I'm going to try pinging some people who might have more ideas on this.
Comment 7 Michael Monreal 2008-11-05 13:04:40 PST
(In reply to comment #6)
> The backtrace suggests this crash may be related to the plugin code

You are totally right! The segfault is caused by the new java plugin (libnpjp2.so). After removing this one, everything seems to work quite stable. Actually, I have yet to see any crash... great!

Even better if this is already known and has proposed patches. Feel free to close or mark as dupe.
Comment 8 Alp Toker 2008-11-05 15:23:55 PST
Let's keep this open until we either blacklist the plugin or fix the crash.
Comment 9 Alp Toker 2008-11-05 18:51:35 PST
(In reply to comment #7)
> (In reply to comment #6)
> > The backtrace suggests this crash may be related to the plugin code
> 
> You are totally right! The segfault is caused by the new java plugin
> (libnpjp2.so). After removing this one, everything seems to work quite stable.
> Actually, I have yet to see any crash... great!

Found the cause of the crash. It's due to the lack of null checking following g_module_symbol() calls.

I've been trying to get the plugin working but I don't know what to make of it. libnpjp2.so is unusual in that it:

 1) Doesn't provide the expected NP_GetValue function symbol
 2) Doesn't explicitly link to libnspr.so which it seems to use (working around this with LD_PRELOAD=/usr/lib/libnspr4.so for testing)

I'm beginning to suspect the new Java plugin is tied more closely to Mozilla internals than its predecessors and other plugins in which case the best I'll be able to do is fix the crash. On the plus side, the crash fixes I'm cooking up will make the plugin code more robust in general.
Comment 10 Michael Monreal 2008-11-06 00:30:16 PST
Well this plugin is not the default ATM I think. I was told to give it a try because the old one crashed on tribaltrouble2.com.
Comment 11 Alp Toker 2008-11-06 04:15:25 PST
Created attachment 24939 [details]
Fix Java plugin segfaults
Comment 12 Cameron Zwarich (cpst) 2008-11-06 10:15:08 PST
Comment on attachment 24939 [details]
Fix Java plugin segfaults

r=me
Comment 13 Alp Toker 2008-11-06 13:18:22 PST
Landed in r38184.