Re: Icecat crash

[ng0 <contact.ng0@cryptolab.net>]

On 17-02-21 17:44:43, Leo Famulari wrote:
> On Wed, Feb 15, 2017 at 11:12:45PM +0100, Julien Lepiller wrote:
> > Hey, I'm also experiencing crashes with icecat since a few months. It
> > just seems to happen randomly. I've found a note about that on the LFS
> > website on the firefox page that says that using system cairo is
> > causing a crash when it tries to do background rendering. So I've
> > changed our icecat recipe to use the bundled version of cairo, and I
> > don't get any crash anymore. Would something like this patch be
> > acceptable?
> 
> For serious upstream vendors like Mozilla, one of the reasons they
> bundle things is that they are hitting bugs in the 3rd party library
> that are not fixed upstream.
> 
> On the other hand, distros like to unbundle because the upstream vendor
> tends not to patch security vulnerabilities in their bundled copies
> quickly enough, in our opinion.
> 
> So, if we want to use the bundled cairo, we need to understand what
> upstream version of cairo it is based on, and if it contains any
> unpatched security vulnerabilities.
> 
> Of course, denial-of-service is a security issue, and our IceCat is
> currently suffering from it due to this cairo crash.
> 
> Another option is figure out how to build our IceCat using the skia
> rendering backend [0] instead of cairo, which is the work-around that we
> have been recommending to users. Asking users to change this option
> themselves is not a good solution, in my opinion.

I'm all for the skia solution.
I haven't looked at icecat source in a while, but it should be as easy
as modifying/adding "--enable-skia" to the mozconfig

For a real world example, Gentoo uses this by default for firefox:

https://gitweb.gentoo.org/repo/gentoo.git/tree/eclass/mozconfig-v6.51.eclass
https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox/firefox-45.7.0.ebuild#n193

> WDYT?
> 
> [0]
> https://bugzilla.mozilla.org/show_bug.cgi?id=1038800
> https://bugzilla.mozilla.org/show_bug.cgi?id=740200#c44
> 
> > From 89a121bab987caef7f0fbe0f5e24085c3ccae42d Mon Sep 17 00:00:00 2001
> > From: Julien Lepiller <julien@lepiller.eu>
> > Date: Tue, 14 Feb 2017 20:59:15 +0100
> > Subject: [PATCH] gnu: icecat: Fix random crashes.
> > 
> > gnu/packages/gnuzilla.scm (icecat): Remove cairo dependency to fix crashes.
> > ---
> >  gnu/packages/gnuzilla.scm | 5 ++---
> >  1 file changed, 2 insertions(+), 3 deletions(-)
> > 
> > diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
> > index 9279c46b5..90655fd76 100644
> > --- a/gnu/packages/gnuzilla.scm
> > +++ b/gnu/packages/gnuzilla.scm
> > @@ -404,6 +404,8 @@ standards.")
> >                        ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=847568>
> >                        ;;
> >                        ;; TODO: Use system graphite2.
> > +                      ;; TODO: Use system cairo. This currently causes random
> > +                      ;; crash when icecat does background rendering.
> >                        ;;
> >                        "modules/freetype2"
> >                        "modules/zlib"
> > @@ -412,7 +414,6 @@ standards.")
> >                        "media/libjpeg"
> >                        "media/libvpx"
> >                        "security/nss"
> > -                      "gfx/cairo"
> >                        "js/src/ctypes/libffi"
> >                        "db/sqlite3"))
> >            ;; Delete .pyc files, typically present in icecat source tarballs
> > @@ -426,7 +427,6 @@ standards.")
> >      (inputs
> >       `(("alsa-lib" ,alsa-lib)
> >         ("bzip2" ,bzip2)
> > -       ("cairo" ,cairo)
> >         ("cups" ,cups)
> >         ("dbus-glib" ,dbus-glib)
> >         ("gdk-pixbuf" ,gdk-pixbuf)
> > @@ -511,7 +511,6 @@ standards.")
> >                             "--with-system-nspr"
> >                             "--with-system-nss"
> >                             "--enable-system-pixman"
> > -                           "--enable-system-cairo"
> >                             "--enable-system-ffi"
> >                             "--enable-system-hunspell"
> >                             "--enable-system-sqlite"
> > -- 
> > 2.11.1
> > 
> 
> 
>