summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com>2012-11-23 19:04:59 -0300
committerLisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com>2012-11-23 19:04:59 -0300
commit095ec029cc5350eb5bf62af6315de26072b3364b (patch)
tree55e83188ab27d2a843abe26d6be4260a389b800b
parent855ab1500eead679629f33ac426eda527dcf7d60 (diff)
downloadqt4-x11-095ec029cc5350eb5bf62af6315de26072b3364b.tar.gz
Add a fix for JIT crash on x86_64.
Avoids a 32 bit overflow. Taken from upstream.
-rw-r--r--debian/changelog2
-rw-r--r--debian/patches/fix_jit_crash_on_x86_64.patch283
-rw-r--r--debian/patches/series1
3 files changed, 286 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog
index ce850e3..4202b88 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -6,6 +6,8 @@ qt4-x11 (4:4.8.2+dfsg-3) UNRELEASED; urgency=medium
hyped CRIME attack. Set urgency to medium.
* Build-conflict against libqtwebkit-dev. Upstream said that this should be
the correct way of handling this (Closes: #689265).
+ * Add fix_jit_crash_on_x86_64.patch, which avoids 32-bit branch offset
+ overflows.
-- Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org> Fri, 23 Nov 2012 18:01:31 -0300
diff --git a/debian/patches/fix_jit_crash_on_x86_64.patch b/debian/patches/fix_jit_crash_on_x86_64.patch
new file mode 100644
index 0000000..71f7dde
--- /dev/null
+++ b/debian/patches/fix_jit_crash_on_x86_64.patch
@@ -0,0 +1,283 @@
+From 353d77098aa7c4cd1e795feeb035799cf70f5c72 Mon Sep 17 00:00:00 2001
+From: Kent Hansen <kent.hansen@nokia.com>
+Date: Thu, 8 Jul 2010 17:26:50 +0000
+Subject: [PATCH] Fix JIT crash on x86-64 (avoid 32-bit branch offset
+ overflow)
+
+Cherry-picked from webkit commit
+a5b3261a8c4386b4e14ce40a34c7fc933a5f7001
+
+Task-number: QTBUG-23871
+Change-Id: Ia028fe072b349e3a7883ae0f6f7298941cc1bc9e
+Reviewed-by: Simon Hausmann <simon.hausmann@nokia.com>
+(cherry picked from commit 79ebd39d0d4846cb911ae122d2059e5add568d7e in qtscript)
+---
+ .../javascriptcore/JavaScriptCore/ChangeLog | 27 +++++++++++++++++
+ .../JavaScriptCore/JavaScriptCore.pri | 1 +
+ .../JavaScriptCore/jit/ExecutableAllocator.cpp | 21 +++++++++++++
+ .../jit/ExecutableAllocatorFixedVMPool.cpp | 31 +++++++++++++-------
+ .../jit/ExecutableAllocatorPosix.cpp | 29 ++----------------
+ .../jit/ExecutableAllocatorSymbian.cpp | 2 +-
+ .../JavaScriptCore/jit/ExecutableAllocatorWin.cpp | 2 +-
+ .../javascriptcore/JavaScriptCore/wtf/Platform.h | 10 +++++++
+ 8 files changed, 84 insertions(+), 39 deletions(-)
+
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog b/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
+index 9cbf0c1..5ab23e6 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
+@@ -1,3 +1,30 @@
++2010-07-08 Gavin Barraclough <barraclough@apple.com>
++
++ Reviewed by Sam Weinig.
++
++ https://bugs.webkit.org/show_bug.cgi?id=41641
++
++ Update compile flags to allow use of ExecutableAllocatorFixedVMPool on platforms
++ other than x86-64 (this may be useful on 32-bit platforms, too).
++
++ Simplify ifdefs by dividing into thwo broad allocation strategies
++ (ENABLE_EXECUTABLE_ALLOCATOR_FIXED & ENABLE_EXECUTABLE_ALLOCATOR_DEMAND).
++
++ Rename constant used in the code to have names descriptive of their purpose,
++ rather than their specific value on a given platform.
++
++ * jit/ExecutableAllocator.cpp:
++ (JSC::ExecutableAllocator::reprotectRegion):
++ (JSC::ExecutableAllocator::cacheFlush):
++ * jit/ExecutableAllocatorFixedVMPool.cpp:
++ (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
++ (JSC::FixedVMPoolAllocator::free):
++ (JSC::ExecutablePool::systemAlloc):
++ * jit/ExecutableAllocatorPosix.cpp:
++ * jit/ExecutableAllocatorSymbian.cpp:
++ * jit/ExecutableAllocatorWin.cpp:
++ * wtf/Platform.h:
++
+ 2010-08-24 Oliver Hunt <oliver@apple.com>
+
+ Reviewed by Geoff Garen.
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/javascriptcore/JavaScriptCore/JavaScriptCore.pri
+index b061321..847f69c 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/JavaScriptCore.pri
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/JavaScriptCore.pri
+@@ -100,6 +100,7 @@ SOURCES += \
+ interpreter/CallFrame.cpp \
+ interpreter/Interpreter.cpp \
+ interpreter/RegisterFile.cpp \
++ jit/ExecutableAllocatorFixedVMPool.cpp \
+ jit/ExecutableAllocatorPosix.cpp \
+ jit/ExecutableAllocatorSymbian.cpp \
+ jit/ExecutableAllocatorWin.cpp \
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocator.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocator.cpp
+index f6b27ec..f0ebbab 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocator.cpp
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocator.cpp
+@@ -33,6 +33,27 @@ namespace JSC {
+
+ size_t ExecutableAllocator::pageSize = 0;
+
++#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
++void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSeting setting)
++{
++ if (!pageSize)
++ intializePageSize();
++
++ // Calculate the start of the page containing this region,
++ // and account for this extra memory within size.
++ intptr_t startPtr = reinterpret_cast<intptr_t>(start);
++ intptr_t pageStartPtr = startPtr & ~(pageSize - 1);
++ void* pageStart = reinterpret_cast<void*>(pageStartPtr);
++ size += (startPtr - pageStartPtr);
++
++ // Round size up
++ size += (pageSize - 1);
++ size &= ~(pageSize - 1);
++
++ mprotect(pageStart, size, (setting == Writable) ? PROTECTION_FLAGS_RW : PROTECTION_FLAGS_RX);
++}
++#endif
++
+ }
+
+ #endif // HAVE(ASSEMBLER)
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+index dd1db4e..16d0fb1 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+@@ -27,25 +27,33 @@
+
+ #include "ExecutableAllocator.h"
+
+-#include <errno.h>
++#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+
+-#if ENABLE(ASSEMBLER) && OS(DARWIN) && CPU(X86_64)
++#include <errno.h>
+
+ #include "TCSpinLock.h"
+-#include <mach/mach_init.h>
+-#include <mach/vm_map.h>
+ #include <sys/mman.h>
+ #include <unistd.h>
+ #include <wtf/AVLTree.h>
+ #include <wtf/VMTags.h>
+
++#if CPU(X86_64)
++ // These limits suitable on 64-bit platforms (particularly x86-64, where we require all jumps to have a 2Gb max range).
++ #define VM_POOL_SIZE (2u * 1024u * 1024u * 1024u) // 2Gb
++ #define COALESCE_LIMIT (16u * 1024u * 1024u) // 16Mb
++#else
++ // These limits are hopefully sensible on embedded platforms.
++ #define VM_POOL_SIZE (32u * 1024u * 1024u) // 32Mb
++ #define COALESCE_LIMIT (4u * 1024u * 1024u) // 4Mb
++#endif
++
++// ASLR currently only works on darwin (due to arc4random) & 64-bit (due to address space size).
++#define VM_POOL_ASLR (OS(DARWIN) && CPU(X86_64))
++
+ using namespace WTF;
+
+ namespace JSC {
+
+-#define TWO_GB (2u * 1024u * 1024u * 1024u)
+-#define SIXTEEN_MB (16u * 1024u * 1024u)
+-
+ // FreeListEntry describes a free chunk of memory, stored in the freeList.
+ struct FreeListEntry {
+ FreeListEntry(void* pointer, size_t size)
+@@ -291,9 +299,12 @@ public:
+ // for now instead of 2^26 bits of ASLR lets stick with 25 bits of randomization plus
+ // 2^24, which should put up somewhere in the middle of usespace (in the address range
+ // 0x200000000000 .. 0x5fffffffffff).
+- intptr_t randomLocation = arc4random() & ((1 << 25) - 1);
++ intptr_t randomLocation = 0;
++#if VM_POOL_ASLR
++ randomLocation = arc4random() & ((1 << 25) - 1);
+ randomLocation += (1 << 24);
+ randomLocation <<= 21;
++#endif
+ m_base = mmap(reinterpret_cast<void*>(randomLocation), m_totalHeapSize, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0);
+ if (!m_base)
+ CRASH();
+@@ -387,7 +398,7 @@ public:
+ // 16MB of allocations have been freed, sweep m_freeList
+ // coalescing any neighboring fragments.
+ m_countFreedSinceLastCoalesce += size;
+- if (m_countFreedSinceLastCoalesce >= SIXTEEN_MB) {
++ if (m_countFreedSinceLastCoalesce >= COALESCE_LIMIT) {
+ m_countFreedSinceLastCoalesce = 0;
+ coalesceFreeSpace();
+ }
+@@ -429,7 +440,7 @@ ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t size)
+ SpinLockHolder lock_holder(&spinlock);
+
+ if (!allocator)
+- allocator = new FixedVMPoolAllocator(JIT_ALLOCATOR_LARGE_ALLOC_SIZE, TWO_GB);
++ allocator = new FixedVMPoolAllocator(JIT_ALLOCATOR_LARGE_ALLOC_SIZE, VM_POOL_SIZE);
+ ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(allocator->alloc(size)), size};
+ return alloc;
+ }
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+index 2eb0c87..b04049c 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+@@ -27,7 +27,7 @@
+
+ #include "ExecutableAllocator.h"
+
+-#if ENABLE(ASSEMBLER) && OS(UNIX) && !OS(SYMBIAN)
++#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND) && !OS(WINDOWS) && !OS(SYMBIAN)
+
+ #include <sys/mman.h>
+ #include <unistd.h>
+@@ -35,8 +35,6 @@
+
+ namespace JSC {
+
+-#if !(OS(DARWIN) && !PLATFORM(QT) && CPU(X86_64))
+-
+ void ExecutableAllocator::intializePageSize()
+ {
+ ExecutableAllocator::pageSize = getpagesize();
+@@ -57,29 +55,6 @@ void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
+ ASSERT_UNUSED(result, !result);
+ }
+
+-#endif // !(OS(DARWIN) && !PLATFORM(QT) && CPU(X86_64))
+-
+-#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+-void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSeting setting)
+-{
+- if (!pageSize)
+- intializePageSize();
+-
+- // Calculate the start of the page containing this region,
+- // and account for this extra memory within size.
+- intptr_t startPtr = reinterpret_cast<intptr_t>(start);
+- intptr_t pageStartPtr = startPtr & ~(pageSize - 1);
+- void* pageStart = reinterpret_cast<void*>(pageStartPtr);
+- size += (startPtr - pageStartPtr);
+-
+- // Round size up
+- size += (pageSize - 1);
+- size &= ~(pageSize - 1);
+-
+- mprotect(pageStart, size, (setting == Writable) ? PROTECTION_FLAGS_RW : PROTECTION_FLAGS_RX);
+-}
+-#endif
+-
+ }
+
+-#endif // HAVE(ASSEMBLER)
++#endif
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
+index e82975c..9028f50 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
+@@ -22,7 +22,7 @@
+
+ #include "ExecutableAllocator.h"
+
+-#if ENABLE(ASSEMBLER) && OS(SYMBIAN)
++#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND) && OS(SYMBIAN)
+
+ #include <e32hal.h>
+ #include <e32std.h>
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorWin.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+index e38323c..72a1d5f 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+@@ -27,7 +27,7 @@
+
+ #include "ExecutableAllocator.h"
+
+-#if ENABLE(ASSEMBLER) && OS(WINDOWS)
++#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND) && OS(WINDOWS)
+
+ #include "windows.h"
+
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Platform.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Platform.h
+index 700977e..d930ed7 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Platform.h
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Platform.h
+@@ -1016,6 +1016,16 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
+ #define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
+ #endif
+
++/* Pick which allocator to use; we only need an executable allocator if the assembler is compiled in.
++ On x86-64 we use a single fixed mmap, on other platforms we mmap on demand. */
++#if ENABLE(ASSEMBLER)
++#if CPU(X86_64)
++#define ENABLE_EXECUTABLE_ALLOCATOR_FIXED 1
++#else
++#define ENABLE_EXECUTABLE_ALLOCATOR_DEMAND 1
++#endif
++#endif
++
+ #if !defined(ENABLE_PAN_SCROLLING) && OS(WINDOWS)
+ #define ENABLE_PAN_SCROLLING 1
+ #endif
+--
+1.7.10.4
+
diff --git a/debian/patches/series b/debian/patches/series
index 82bf9bf..9141e0f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -5,6 +5,7 @@ QTBUG-21900_Buttons_in_Qt_applications_not_clickable_when_run_under_gnome-shell.
QElfParser-fix-type-of-sh_size.patch
Fix-cursor-truncate-to-include-line-position.patch
disable-SSL-compression-by-default.patch
+fix_jit_crash_on_x86_64.patch
# qt-copy patches
0195-compositing-properties.diff