Bug 22067 – [GTK] Sun Java plugin segfaults at PluginPackage::createPackage()

• Component: Plug-ins
• Status: RESOLVED FIXED

[Michael Monreal]

I regularly do WebKit/GTK builds. For some time now I see segfaults while loading most webpages. See the attached gdb log (example visiting osnews.com).

[Michael Monreal]

Created attachment 24893 [details]
GDB output

[Alp Toker]

(In reply to comment #0)
> I regularly do WebKit/GTK builds. For some time now I see segfaults while
> loading most webpages. See the attached gdb log (example visiting osnews.com).
> 

Hi!

Can you try one of the patches in bug #22033 (attachment 24884 [details] or 24885) and report back success/failure?

[Alp Toker]

The output of your config.log and your actual CPU architecture will help too.

[Michael Monreal]

Created attachment 24911 [details]
config.log

Here's my config.log

I'll try the patches now, but the bug says they are meant to fix crashes on google... which actually seems to be one of the few pages that fully load without crashing for me.

[Michael Monreal]

Neither of the patches fixes the problem.

[Alp Toker]

(In reply to comment #5)
> Neither of the patches fixes the problem.
> 

Thanks for checking. Which SVN revision are you testing with and do you have a known-good revision number where the problem didn't show up?

The backtrace suggests this crash may be related to the plugin code. Can you get a list of the plugins you have installed (both in ~/.mozilla and the system)? Especially if it's trying to load Java or the gjs Java plugin or swfdec which I think might already have proposed fixes..

If you have time to narrow down the plugin causing the issue by moving them out of the way and moving them back one by one, that could help too. I'm going to try pinging some people who might have more ideas on this.

[Michael Monreal]

(In reply to comment #6)
> The backtrace suggests this crash may be related to the plugin code

You are totally right! The segfault is caused by the new java plugin (libnpjp2.so). After removing this one, everything seems to work quite stable. Actually, I have yet to see any crash... great!

Even better if this is already known and has proposed patches. Feel free to close or mark as dupe.

[Alp Toker]

Let's keep this open until we either blacklist the plugin or fix the crash.

[Alp Toker]

(In reply to comment #7)
> (In reply to comment #6)
> > The backtrace suggests this crash may be related to the plugin code
> 
> You are totally right! The segfault is caused by the new java plugin
> (libnpjp2.so). After removing this one, everything seems to work quite stable.
> Actually, I have yet to see any crash... great!

Found the cause of the crash. It's due to the lack of null checking following g_module_symbol() calls.

I've been trying to get the plugin working but I don't know what to make of it. libnpjp2.so is unusual in that it:

 1) Doesn't provide the expected NP_GetValue function symbol
 2) Doesn't explicitly link to libnspr.so which it seems to use (working around this with LD_PRELOAD=/usr/lib/libnspr4.so for testing)

I'm beginning to suspect the new Java plugin is tied more closely to Mozilla internals than its predecessors and other plugins in which case the best I'll be able to do is fix the crash. On the plus side, the crash fixes I'm cooking up will make the plugin code more robust in general.

[Michael Monreal]

Well this plugin is not the default ATM I think. I was told to give it a try because the old one crashed on tribaltrouble2.com.

[Alp Toker]

Created attachment 24939 [details]
Fix Java plugin segfaults

[Cameron Zwarich (cpst)]

Comment on attachment 24939 [details]
Fix Java plugin segfaults

r=me

[Alp Toker]

Landed in r38184.