Description: TODO: Put a short summary on the line above and replace this paragraph with a longer explanation of this change. Complete the meta-information with other relevant fields (see below for details). To make it easier, the information below has been extracted from the changelog. Adjust it or drop it. . firefox (50.0.2-1) unstable; urgency=medium . * New upstream release. * Fixes for mfsa2016-{91-92}, also known as: CVE-2016-9078, CVE-2016-9079. . * widget/gtk/mozgtk/mozgtk.c: work around race in system Cairo's XShm usage. bz#1271100. Author: Mike Hommey --- The information above should follow the Patch Tagging Guidelines, please checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here are templates for supplementary fields that you might want to add: Origin: , Bug: Bug-Debian: https://bugs.debian.org/ Bug-Ubuntu: https://launchpad.net/bugs/ Forwarded: Reviewed-By: Last-Update: 2016-12-11 Index: firefox-50.0.2/js/src/jsscript.h =================================================================== --- firefox-50.0.2.orig/js/src/jsscript.h +++ firefox-50.0.2/js/src/jsscript.h @@ -94,6 +94,10 @@ enum JSTryNoteKind { struct JSTryNote { uint8_t kind; /* one of JSTryNoteKind */ uint32_t stackDepth; /* stack depth upon exception handler entry */ +#if defined(__sparc__) + uint8_t pad1; + uint16_t pad2; +#endif uint32_t start; /* start of the try statement or loop relative to script->main */ uint32_t length; /* length of the try statement or loop */ Index: firefox-50.0.2/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_sparc64_linux.s =================================================================== --- /dev/null +++ firefox-50.0.2/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_sparc64_linux.s @@ -0,0 +1,86 @@ +/* -*- Mode: asm; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* + Platform specific code to invoke XPCOM methods on native objects + for sparcv9 GNU/Linux. + + See the SPARC Compliance Definition (SCD) Chapter 3 + for more information about what is going on here, including + the use of BIAS (0x7ff). + The SCD is available from http://www.sparc.com/. +*/ + + .global NS_InvokeByIndex_P + .type NS_InvokeByIndex_P, #function + +/* + NS_InvokeByIndex_P(nsISupports* that, uint32_t methodIndex, + uint32_t paramCount, nsXPTCVariant* params); + +*/ +NS_InvokeByIndex_P: + save %sp,-(128 + 64),%sp ! room for the register window and + ! struct pointer, rounded up to 0 % 64 + sll %i2,4,%l0 ! assume the worst case + ! paramCount * 2 * 8 bytes + cmp %l0, 0 ! are there any args? If not, + be .invoke ! no need to copy args to stack + nop + + sub %sp,%l0,%sp ! create the additional stack space + add %sp,0x7ff+136,%o0 ! step past the register window, the + ! struct result pointer and the 'this' slot + mov %i2,%o1 ! paramCount + call invoke_copy_to_stack + mov %i3,%o2 ! params + +! +! load arguments from stack into the outgoing registers +! BIAS is 0x7ff (2047) +! + +! load the %o1..5 64bit (extended word) output registers registers + ldx [%sp + 0x7ff + 136],%o1 ! %i1 + ldx [%sp + 0x7ff + 144],%o2 ! %i2 + ldx [%sp + 0x7ff + 152],%o3 ! %i3 + ldx [%sp + 0x7ff + 160],%o4 ! %i4 + ldx [%sp + 0x7ff + 168],%o5 ! %i5 + +! load the even number double registers starting with %f2 + ldd [%sp + 0x7ff + 136],%f2 + ldd [%sp + 0x7ff + 144],%f4 + ldd [%sp + 0x7ff + 152],%f6 + ldd [%sp + 0x7ff + 160],%f8 + ldd [%sp + 0x7ff + 168],%f10 + ldd [%sp + 0x7ff + 176],%f12 + ldd [%sp + 0x7ff + 184],%f14 + ldd [%sp + 0x7ff + 192],%f16 + ldd [%sp + 0x7ff + 200],%f18 + ldd [%sp + 0x7ff + 208],%f20 + ldd [%sp + 0x7ff + 216],%f22 + ldd [%sp + 0x7ff + 224],%f24 + ldd [%sp + 0x7ff + 232],%f26 + ldd [%sp + 0x7ff + 240],%f28 + ldd [%sp + 0x7ff + 248],%f30 + +! +! calculate the target address from the vtable +! +.invoke: + sll %i1,3,%l0 ! index *= 8 +! add %l0,16,%l0 ! there are 2 extra entries in the vTable (16bytes) + ldx [%i0],%l1 ! *that --> address of vtable + ldx [%l0 + %l1],%l0 ! that->vtable[index * 8 + 16] --> address + + jmpl %l0,%o7 ! call the routine + mov %i0,%o0 ! move 'this' pointer to out register + + mov %o0,%i0 ! propagate return value + ret + restore + + .size NS_InvokeByIndex_P, .-NS_InvokeByIndex_P Index: firefox-50.0.2/xpcom/reflect/xptcall/md/unix/xptcinvoke_sparc64_linux.cpp =================================================================== --- /dev/null +++ firefox-50.0.2/xpcom/reflect/xptcall/md/unix/xptcinvoke_sparc64_linux.cpp @@ -0,0 +1,69 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + +/* Platform specific code to invoke XPCOM methods on native objects */ + +#include "xptcprivate.h" + +#if !defined(__sparc) && !defined(__sparc__) +#error "This code is for Sparc only" +#endif + +extern "C" uint64_t +invoke_copy_to_stack(uint64_t* d, uint32_t paramCount, nsXPTCVariant* s) +{ + /* + We need to copy the parameters for this function to locals and use them + from there since the parameters occupy the same stack space as the stack + we're trying to populate. + */ + uint64_t *l_d = d; + nsXPTCVariant *l_s = s; + uint64_t l_paramCount = paramCount; + uint64_t regCount = 0; // return the number of registers to load from the stack + + for(uint64_t i = 0; i < l_paramCount; i++, l_d++, l_s++) + { + if (regCount < 5) regCount++; + + if (l_s->IsPtrData()) + { + *l_d = (uint64_t)l_s->ptr; + continue; + } + switch (l_s->type) + { + case nsXPTType::T_I8 : *((int64_t*)l_d) = l_s->val.i8; break; + case nsXPTType::T_I16 : *((int64_t*)l_d) = l_s->val.i16; break; + case nsXPTType::T_I32 : *((int64_t*)l_d) = l_s->val.i32; break; + case nsXPTType::T_I64 : *((int64_t*)l_d) = l_s->val.i64; break; + + case nsXPTType::T_U8 : *((uint64_t*)l_d) = l_s->val.u8; break; + case nsXPTType::T_U16 : *((uint64_t*)l_d) = l_s->val.u16; break; + case nsXPTType::T_U32 : *((uint64_t*)l_d) = l_s->val.u32; break; + case nsXPTType::T_U64 : *((uint64_t*)l_d) = l_s->val.u64; break; + + /* in the case of floats, we want to put the bits in to the + 64bit space right justified... floats in the parameter array on + sparcv9 use odd numbered registers.. %f1, %f3, so we have to skip + the space that would be occupied by %f0, %f2, etc. + */ + case nsXPTType::T_FLOAT : *(((float*)l_d) + 1) = l_s->val.f; break; + case nsXPTType::T_DOUBLE: *((double*)l_d) = l_s->val.d; break; + case nsXPTType::T_BOOL : *((int64_t*)l_d) = l_s->val.b; break; + case nsXPTType::T_CHAR : *((uint64_t*)l_d) = l_s->val.c; break; + case nsXPTType::T_WCHAR : *((int64_t*)l_d) = l_s->val.wc; break; + + default: + // all the others are plain pointer types + *((void**)l_d) = l_s->val.p; + break; + } + } + + return regCount; +} Index: firefox-50.0.2/xpcom/reflect/xptcall/md/unix/xptcstubs_asm_sparc64_linux.s =================================================================== --- /dev/null +++ firefox-50.0.2/xpcom/reflect/xptcall/md/unix/xptcstubs_asm_sparc64_linux.s @@ -0,0 +1,50 @@ +/* -*- Mode: asm; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + .global SharedStub + +/* + in the frame for the function that called SharedStub are the + rest of the parameters we need + +*/ + +SharedStub: +! we don't create a new frame yet, but work within the frame of the calling +! function to give ourselves the other parameters we want + + mov %o0, %o1 ! shuffle the index up to 2nd place + mov %i0, %o0 ! the original 'this' + add %fp, 0x7ff + 136, %o2 ! previous stack top adjusted to the first argument slot (beyond 'this') + +! save off the original incoming parameters that arrived in +! registers, the ABI guarantees the space for us to do this + stx %i1, [%fp + 0x7ff + 136] + stx %i2, [%fp + 0x7ff + 144] + stx %i3, [%fp + 0x7ff + 152] + stx %i4, [%fp + 0x7ff + 160] + stx %i5, [%fp + 0x7ff + 168] +! now we can build our own stack frame + save %sp,-(128 + 64),%sp ! room for the register window and + ! struct pointer, rounded up to 0 % 64 +! our function now appears to have been called +! as SharedStub(nsISupports* that, uint32_t index, uint32_t* args) +! so we can just copy these through + + mov %i0, %o0 + mov %i1, %o1 + mov %i2, %o2 + call PrepareAndDispatch + nop + mov %o0,%i0 ! propagate return value + b .LL1 + nop +.LL1: + ret + restore + + .size SharedStub, .-SharedStub + .type SharedStub, #function Index: firefox-50.0.2/xpcom/reflect/xptcall/md/unix/xptcstubs_sparc64_linux.cpp =================================================================== --- /dev/null +++ firefox-50.0.2/xpcom/reflect/xptcall/md/unix/xptcstubs_sparc64_linux.cpp @@ -0,0 +1,104 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Implement shared vtbl methods. */ + +#include "xptcprivate.h" +#include "xptiprivate.h" + +#if defined(sparc) || defined(__sparc__) + +extern "C" nsresult +PrepareAndDispatch(nsXPTCStubBase* self, uint64_t methodIndex, uint64_t* args) +{ + +#define PARAM_BUFFER_COUNT 16 + + nsXPTCMiniVariant paramBuffer[PARAM_BUFFER_COUNT]; + nsXPTCMiniVariant* dispatchParams = NULL; + const nsXPTMethodInfo* info; + uint8_t paramCount; + uint8_t i; + nsresult result = NS_ERROR_FAILURE; + + NS_ASSERTION(self,"no self"); + + self->mEntry->GetMethodInfo(uint16_t(methodIndex), &info); + NS_ASSERTION(info,"no interface info"); + + paramCount = info->GetParamCount(); + + // setup variant array pointer + if(paramCount > PARAM_BUFFER_COUNT) + dispatchParams = new nsXPTCMiniVariant[paramCount]; + else + dispatchParams = paramBuffer; + + NS_ASSERTION(dispatchParams,"no place for params"); + if (!dispatchParams) + return NS_ERROR_OUT_OF_MEMORY; + + uint64_t* ap = args; + for(i = 0; i < paramCount; i++, ap++) + { + const nsXPTParamInfo& param = info->GetParam(i); + const nsXPTType& type = param.GetType(); + nsXPTCMiniVariant* dp = &dispatchParams[i]; + + if(param.IsOut() || !type.IsArithmetic()) + { + dp->val.p = (void*) *ap; + continue; + } + // else + switch(type) + { + case nsXPTType::T_BOOL : dp->val.b = *((int64_t*) ap); break; + case nsXPTType::T_CHAR : dp->val.c = *((uint64_t*) ap); break; + case nsXPTType::T_WCHAR : dp->val.wc = *((int64_t*) ap); break; + case nsXPTType::T_I8 : dp->val.i8 = *((int64_t*) ap); break; + case nsXPTType::T_I16 : dp->val.i16 = *((int64_t*) ap); break; + case nsXPTType::T_I32 : dp->val.i32 = *((int64_t*) ap); break; + case nsXPTType::T_I64 : dp->val.i64 = *((int64_t*) ap); break; + case nsXPTType::T_U8 : dp->val.u8 = *((uint64_t*) ap); break; + case nsXPTType::T_U16 : dp->val.u16 = *((uint64_t*)ap); break; + case nsXPTType::T_U32 : dp->val.u32 = *((uint64_t*)ap); break; + case nsXPTType::T_U64 : dp->val.u64 = *((uint64_t*) ap); break; + case nsXPTType::T_FLOAT : dp->val.f = ((float*) ap)[1]; break; + case nsXPTType::T_DOUBLE : dp->val.d = *((double*) ap); break; + default: + NS_ERROR("bad type"); + break; + } + } + + result = self->mOuter->CallMethod((uint16_t)methodIndex, info, dispatchParams); + + if(dispatchParams != paramBuffer) + delete [] dispatchParams; + + return result; +} + +extern "C" int SharedStub(int, int*); + +#define STUB_ENTRY(n) \ +nsresult nsXPTCStubBase::Stub##n() \ +{ \ + int dummy; /* defeat tail-call optimization */ \ + return SharedStub(n, &dummy); \ +} + +#define SENTINEL_ENTRY(n) \ +nsresult nsXPTCStubBase::Sentinel##n() \ +{ \ + NS_ERROR("nsXPTCStubBase::Sentinel called"); \ + return NS_ERROR_NOT_IMPLEMENTED; \ +} + +#include "xptcstubsdef.inc" + +#endif /* sparc || __sparc__ */