Bug#931052: unblock: webkit2gtk/2.24.2-2

2019-06-27 Thread Alberto Garcia
On Thu, Jun 27, 2019 at 03:26:32PM +0300, Adrian Bunk wrote:

> > We like to support non-sse2 on i386, but we are not comfortable
> > fixing webkit2gtk at this stage of the release.
> 
> Why is this relatively small change a problem in a package where new
> upstream versions are permitted after the release of stable?

I'll try to explain again with more detail so we all understand the
nature of the proposed changes.

- WebKitGTK has several mechanisms to run JavaScript code, in brief: a
  C-based interpreter (CLoop), an assembler-based interpreter and a
  JIT compiler.

- CLoop is the slowest but it is portable and runs in all platforms.
  It's the one selected at build time when the CPU is unsupported or
  unknown.

- The other two generate CPU-specific code. In an effort to simplify
  them upstream took recently the decision to stop supporting i386
  processors without SSE2 instructions.

- Because of that, WebKitGTK 2.24.1 added a build-time check to detect
  if the compiler can generate SSE2 instructions. For the Debian case
  I had to add -msse2 -mfpmath=sse to CFLAGS, as suggested by
  upstream.

- The consequence of this is that GCC generates SSE2 instructions when
  appropriate when compiling regular C/C++ code, causing crashes like
  the one previously reported.

- However, and this is the part that I originally overlooked, only the
  C-based interpreter is working at the moment in i386. The other two
  are less actively maintained for i386, and stopped working after
  some big changes upstream in the last few months.
  
- So it is possible to remove the compile-time check for SSE2 and
  build the package without those flags in i386.

What this all means is that the only real difference between
webkit2gtk 2.24.2-1 (in buster) and 2.24.2-2 (in sid) is that, for
i386, the former is compiled with -msse2 -mfpmath=sse and the latter
is not. So for floating point operations the former uses SSE2 and the
latter uses x87. This produces some differences in rounding in some
corner cases which could have user-visible consequences.

We don't know when it is going to happen, but once upstream brings
back JIT support to i386 again we would have to make the decision to
either:

 a) keep using CLoop in order to remain compatible with non-SSE2 CPUs
(conservative approach, I'd probably support this one).
 
 b) think of a way to support both sets of users so those with more
modern processors can benefit from the additional performance of
the JIT compiler. This could involve using e.g. /usr/lib/sse2/ for
those binaries.

I hope this clarifies the situation.

Berto



Bug#931052: unblock: webkit2gtk/2.24.2-2

2019-06-27 Thread Adrian Bunk
On Thu, Jun 27, 2019 at 01:27:42PM +0200, Paul Gevers wrote:
> reassign 931052 release-notes
> retitle 931052 webkit2gtk not supported on non-sse2 i386 hardware
>...
> We like to support non-sse2 on i386, but we are not comfortable fixing
> webkit2gtk at this stage of the release.

Why is this relatively small change a problem in a package where
new upstream versions are permitted after the release of stable?

Doing a change in 2.24.2-2 prior to the release sounds less risky than
uploading the same change as part of 2.24.3-1~deb10u1 to buster-pu.

> Therefore, we will not unblock
> this change, but we want the release notes to mention this, so users are
> warned.

This means the default desktop is expected to have crashes due to this.

Many standalone applications like liferea or zenity (#930932)
are also expected to crash.

Please mention in all buster announcements that users on non-SSE i386 
should defer upgrading from stretch until this is fixed in the next 
point release of buster.

> Paul

cu
Adrian

-- 

   "Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
   "Only a promise," Lao Er said.
   Pearl S. Buck - Dragon Seed



Bug#931052: unblock: webkit2gtk/2.24.2-2

2019-06-27 Thread Alberto Garcia
On Thu, Jun 27, 2019 at 01:27:42PM +0200, Paul Gevers wrote:

> We like to support non-sse2 on i386, but we are not comfortable
> fixing webkit2gtk at this stage of the release. Therefore, we will
> not unblock this change, but we want the release notes to mention
> this, so users are warned.

Ok, note that the plan is to offer webkit2gtk security updates during
the buster lifetime, so the first of those updates will anyway work on
non-sse2 i386 CPUs.

Berto



Bug#931052: unblock: webkit2gtk/2.24.2-2

2019-06-27 Thread Paul Gevers
reassign 931052 release-notes
retitle 931052 webkit2gtk not supported on non-sse2 i386 hardware
user release.debian@packages.debian.org
usertags 931052 - unblock
thanks

Hi Alberto,

On 25-06-2019 10:04, Alberto Garcia wrote:
> Please unblock package webkit2gtk
> 
> Upstream WebKitGTK has recently stopped supporting i386 CPUs without
> SSE2 extensions, as other browsers (Chromium, Firefox) already did a
> few years ago.
> 
> There is at least one bug report (#930932, opened two days ago) from a
> user that cannot run Zenity on a machine with an Athlon XP CPU because
> of this, and some hours ago bug #930935 was filed against webkit2gtk.
> 
> WebKit generates SSE2 instructions with its JIT compiler, and the
> build scripts also force gcc to pass the -msse2 compilation flags.
> 
> This upload disables the JIT compiler and enables the CLoop JavaScript
> interpreter, which is slower but works on all CPUs. It also removes
> the gcc SSE2 flags. Only the i386 build is affected by these changes.
> 
> Debdiff attached.
> 
> Note: the changelog includes the list of CVEs from the latest security
> advisory, published shortly after the previous release. This is purely
> informative and has no effects on the package.
> 
> unblock webkit2gtk/2.24.2-2

We like to support non-sse2 on i386, but we are not comfortable fixing
webkit2gtk at this stage of the release. Therefore, we will not unblock
this change, but we want the release notes to mention this, so users are
warned.

Paul



signature.asc
Description: OpenPGP digital signature


Bug#931052: unblock: webkit2gtk/2.24.2-2

2019-06-25 Thread Alberto Garcia
On Tue, Jun 25, 2019 at 11:04:59AM +0300, Alberto Garcia wrote:

> This upload disables the JIT compiler and enables the CLoop
> JavaScript interpreter, which is slower but works on all CPUs. It
> also removes the gcc SSE2 flags. Only the i386 build is affected by
> these changes.

I realized that this is not accurate: in this particular version of
webkit2gtk the JIT compiler is already disabled for i386 (work is
being done upstream to have it enabled back again), so in practice
this line is a no-op because these are already the current values:

> + EXTRA_CMAKE_ARGUMENTS += -DENABLE_JIT=OFF -DENABLE_C_LOOP=ON

I would still keep that line because it will be necessary as soon as
upstream brings back JIT support for x86.

This patch still removes -msse2 -mfpmath=sse from CFLAGS, and that's
what makes the package work in non-SSE2 CPUs.

Berto



Bug#931052: unblock: webkit2gtk/2.24.2-2

2019-06-25 Thread Alberto Garcia
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock package webkit2gtk

Upstream WebKitGTK has recently stopped supporting i386 CPUs without
SSE2 extensions, as other browsers (Chromium, Firefox) already did a
few years ago.

There is at least one bug report (#930932, opened two days ago) from a
user that cannot run Zenity on a machine with an Athlon XP CPU because
of this, and some hours ago bug #930935 was filed against webkit2gtk.

WebKit generates SSE2 instructions with its JIT compiler, and the
build scripts also force gcc to pass the -msse2 compilation flags.

This upload disables the JIT compiler and enables the CLoop JavaScript
interpreter, which is slower but works on all CPUs. It also removes
the gcc SSE2 flags. Only the i386 build is affected by these changes.

Debdiff attached.

Note: the changelog includes the list of CVEs from the latest security
advisory, published shortly after the previous release. This is purely
informative and has no effects on the package.

unblock webkit2gtk/2.24.2-2

-- System Information:
Debian Release: 9.9
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-9-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), 
LANGUAGE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
diff -Nru webkit2gtk-2.24.2/debian/changelog webkit2gtk-2.24.2/debian/changelog
--- webkit2gtk-2.24.2/debian/changelog  2019-05-17 17:40:52.0 +0300
+++ webkit2gtk-2.24.2/debian/changelog  2019-06-24 16:34:09.0 +0300
@@ -1,3 +1,26 @@
+webkit2gtk (2.24.2-2) unstable; urgency=high
+
+  * The WebKitGTK security advisory WSA-2019-0003 lists the following
+security fixes in the latest versions of WebKitGTK+:
++ CVE-2019-8571, CVE-2019-8583, CVE-2019-8586, CVE-2019-8594,
+  CVE-2019-8609, CVE-2019-8611, CVE-2019-8622 and CVE-2019-8623
+  (fixed in 2.24.0).
++ CVE-2019-6237, CVE-2019-8584, CVE-2019-8587, CVE-2019-8596,
+  CVE-2019-8597, CVE-2019-8601, CVE-2019-8608, CVE-2019-8610 and
+  CVE-2019-8619 (fixed in 2.24.1).
++ CVE-2019-8595, CVE-2019-8607 and CVE-2019-8615 (fixed in 2.24.2).
+  * Use the CLoop Javascript interpreter in i386 and stop telling gcc to
+use SSE2 instructions (Closes: #930935).
++ debian/rules:
+  - Build with -DENABLE_JIT=OFF -DENABLE_C_LOOP=ON and stop using
+-msse2 -mfpmath=sse.
++ debian/patches/dont-detect-sse2.patch:
+  - Don't check for SSE2 support.
++ debian/NEWS:
+  - Remove item about the requirement to have an SSE2-capable CPU.
+
+ -- Alberto Garcia   Mon, 24 Jun 2019 16:34:09 +0300
+
 webkit2gtk (2.24.2-1) unstable; urgency=medium
 
   * New upstream release.
diff -Nru webkit2gtk-2.24.2/debian/NEWS webkit2gtk-2.24.2/debian/NEWS
--- webkit2gtk-2.24.2/debian/NEWS   2019-05-17 17:40:52.0 +0300
+++ webkit2gtk-2.24.2/debian/NEWS   2019-06-24 16:34:09.0 +0300
@@ -1,12 +1,3 @@
-webkit2gtk (2.24.1-2) unstable; urgency=high
-
-  Since version 2.24.0, i386 builds of WebKitGTK require an SSE2-capable
-  CPU. This instruction set was first introduced with the Pentium 4 in
-  year 2000. Support for older processors was dropped in WebKitGTK
-  upstream and is unfortunately not expected to come back.
-
- -- Alberto Garcia   Fri, 10 May 2019 15:40:28 +0300
-
 webkit2gtk (2.20.0-2) unstable; urgency=medium
 
   webkit2gtk 2.20.0 contains a security feature named Gigacage that
diff -Nru webkit2gtk-2.24.2/debian/patches/dont-detect-sse2.patch 
webkit2gtk-2.24.2/debian/patches/dont-detect-sse2.patch
--- webkit2gtk-2.24.2/debian/patches/dont-detect-sse2.patch 1970-01-01 
02:00:00.0 +0200
+++ webkit2gtk-2.24.2/debian/patches/dont-detect-sse2.patch 2019-06-24 
16:34:09.0 +0300
@@ -0,0 +1,24 @@
+From: Alberto Garcia 
+Subject: Don't check for SSE2 support on i386
+Bug-Debian: https://bugs.debian.org/930935
+Forwarded: no
+Index: webkitgtk/Source/cmake/WebKitCompilerFlags.cmake
+===
+--- webkitgtk.orig/Source/cmake/WebKitCompilerFlags.cmake
 webkitgtk/Source/cmake/WebKitCompilerFlags.cmake
+@@ -144,15 +144,6 @@ if (COMPILER_IS_GCC_OR_CLANG)
+ if (CMAKE_COMPILER_IS_GNUCXX)
+ WEBKIT_PREPEND_GLOBAL_COMPILER_FLAGS(-Wno-expansion-to-defined)
+ endif ()
+-
+-# Force SSE2 fp on x86 builds.
+-if (WTF_CPU_X86 AND NOT CMAKE_CROSSCOMPILING)
+-WEBKIT_PREPEND_GLOBAL_COMPILER_FLAGS(-msse2 -mfpmath=sse)
+-include(DetectSSE2)
+-if (NOT SSE2_SUPPORT_FOUND)
+-message(FATAL_ERROR "SSE2 support is required to compile WebKit")
+-endif ()
+-endif ()
+ endif ()
+ 
+ if (COMPILER_IS_GCC_OR_CLANG AND NOT MSVC)
diff -Nru webkit2gtk-2.24.2/debian/patches/series 
webkit2gtk-2.24.2/debian/patches/series
--- webkit2gtk-2.24.2/debian/patches/series