Your message dated Mon, 24 Jun 2019 19:49:33 +0000 with message-id <e1hfuy5-000gya...@fasolo.debian.org> and subject line Bug#930935: fixed in webkit2gtk 2.24.2-2 has caused the Debian Bug report #930935, regarding webkit2gtk: Baseline violation on i386 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 930935: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930935 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Source: webkit2gtk Version: 2.24.1-2 Severity: serious Tags: patch webkit2gtk violates the baseline on i386 by using SSE. While keeping floating point values consistent between 32bit and 64bit is nice in general, it is bad if this makes the code crash on large parts of the supported i386 hardware - most hardware with SSE2 runs the amd64 port, and at least one non-SSE i386 CPU is still in production for embedded systems (AMD Geode). Fix is attached.diff -Nru webkit2gtk-2.24.2/debian/NEWS webkit2gtk-2.24.2/debian/NEWS --- webkit2gtk-2.24.2/debian/NEWS 2019-05-17 17:40:52.000000000 +0300 +++ webkit2gtk-2.24.2/debian/NEWS 2019-05-17 17:40:52.000000000 +0300 @@ -1,12 +1,3 @@ -webkit2gtk (2.24.1-2) unstable; urgency=high - - Since version 2.24.0, i386 builds of WebKitGTK require an SSE2-capable - CPU. This instruction set was first introduced with the Pentium 4 in - year 2000. Support for older processors was dropped in WebKitGTK - upstream and is unfortunately not expected to come back. - - -- Alberto Garcia <be...@igalia.com> Fri, 10 May 2019 15:40:28 +0300 - webkit2gtk (2.20.0-2) unstable; urgency=medium webkit2gtk 2.20.0 contains a security feature named Gigacage that diff -Nru webkit2gtk-2.24.2/debian/patches/i386-no-sse.patch webkit2gtk-2.24.2/debian/patches/i386-no-sse.patch --- webkit2gtk-2.24.2/debian/patches/i386-no-sse.patch 1970-01-01 02:00:00.000000000 +0200 +++ webkit2gtk-2.24.2/debian/patches/i386-no-sse.patch 2019-05-17 17:40:52.000000000 +0300 @@ -0,0 +1,21 @@ +Description: SSE is a baseline violation on i386 +Author: Adrian Bunk <b...@debian.org> + +--- webkit2gtk-2.24.2.orig/Source/cmake/WebKitCompilerFlags.cmake ++++ webkit2gtk-2.24.2/Source/cmake/WebKitCompilerFlags.cmake +@@ -144,15 +144,6 @@ if (COMPILER_IS_GCC_OR_CLANG) + if (CMAKE_COMPILER_IS_GNUCXX) + WEBKIT_PREPEND_GLOBAL_COMPILER_FLAGS(-Wno-expansion-to-defined) + endif () +- +- # Force SSE2 fp on x86 builds. +- if (WTF_CPU_X86 AND NOT CMAKE_CROSSCOMPILING) +- WEBKIT_PREPEND_GLOBAL_COMPILER_FLAGS(-msse2 -mfpmath=sse) +- include(DetectSSE2) +- if (NOT SSE2_SUPPORT_FOUND) +- message(FATAL_ERROR "SSE2 support is required to compile WebKit") +- endif () +- endif () + endif () + + if (COMPILER_IS_GCC_OR_CLANG AND NOT MSVC) diff -Nru webkit2gtk-2.24.2/debian/patches/series webkit2gtk-2.24.2/debian/patches/series --- webkit2gtk-2.24.2/debian/patches/series 2019-05-17 17:40:52.000000000 +0300 +++ webkit2gtk-2.24.2/debian/patches/series 2019-05-17 17:40:52.000000000 +0300 @@ -7,3 +7,4 @@ detect-woff.patch user-agent-branding.patch prefer-pthread.patch +i386-no-sse.patch diff -Nru webkit2gtk-2.24.2/debian/rules webkit2gtk-2.24.2/debian/rules --- webkit2gtk-2.24.2/debian/rules 2019-05-17 17:40:52.000000000 +0300 +++ webkit2gtk-2.24.2/debian/rules 2019-05-17 17:40:52.000000000 +0300 @@ -23,11 +23,6 @@ CFLAGS := $(CFLAGS:-g=-g1) endif -# The 32-bit x86 build requires SSE2 -ifneq (,$(filter $(DEB_HOST_ARCH),i386)) - CFLAGS += -msse2 -mfpmath=sse -endif - # See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81426 ifneq (,$(filter $(DEB_HOST_ARCH),armhf sh3 sh4 powerpc)) CFLAGS := $(CFLAGS:-O2=-O1)
--- End Message ---
--- Begin Message ---Source: webkit2gtk Source-Version: 2.24.2-2 We believe that the bug you reported is fixed in the latest version of webkit2gtk, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 930...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Alberto Garcia <be...@igalia.com> (supplier of updated webkit2gtk package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Mon, 24 Jun 2019 16:34:09 +0300 Source: webkit2gtk Binary: libjavascriptcoregtk-4.0-18 libjavascriptcoregtk-4.0-dev libjavascriptcoregtk-4.0-bin gir1.2-javascriptcoregtk-4.0 libwebkit2gtk-4.0-37 libwebkit2gtk-4.0-dev libwebkit2gtk-4.0-doc gir1.2-webkit2-4.0 libwebkit2gtk-4.0-37-gtk2 webkit2gtk-driver Architecture: source Version: 2.24.2-2 Distribution: unstable Urgency: high Maintainer: Debian WebKit Maintainers <pkg-webkit-maintain...@lists.alioth.debian.org> Changed-By: Alberto Garcia <be...@igalia.com> Description: gir1.2-javascriptcoregtk-4.0 - JavaScript engine library from WebKitGTK - GObject introspection gir1.2-webkit2-4.0 - Web content engine library for GTK - GObject introspection data libjavascriptcoregtk-4.0-18 - JavaScript engine library from WebKitGTK libjavascriptcoregtk-4.0-bin - JavaScript engine library from WebKitGTK - command-line interpret libjavascriptcoregtk-4.0-dev - JavaScript engine library from WebKitGTK - development files libwebkit2gtk-4.0-37 - Web content engine library for GTK libwebkit2gtk-4.0-37-gtk2 - Web content engine library for GTK - GTK 2 plugin process libwebkit2gtk-4.0-dev - Web content engine library for GTK - development files libwebkit2gtk-4.0-doc - Web content engine library for GTK - documentation webkit2gtk-driver - WebKitGTK WebDriver support Closes: 930935 Changes: webkit2gtk (2.24.2-2) unstable; urgency=high . * The WebKitGTK security advisory WSA-2019-0003 lists the following security fixes in the latest versions of WebKitGTK+: + CVE-2019-8571, CVE-2019-8583, CVE-2019-8586, CVE-2019-8594, CVE-2019-8609, CVE-2019-8611, CVE-2019-8622 and CVE-2019-8623 (fixed in 2.24.0). + CVE-2019-6237, CVE-2019-8584, CVE-2019-8587, CVE-2019-8596, CVE-2019-8597, CVE-2019-8601, CVE-2019-8608, CVE-2019-8610 and CVE-2019-8619 (fixed in 2.24.1). + CVE-2019-8595, CVE-2019-8607 and CVE-2019-8615 (fixed in 2.24.2). * Use the CLoop Javascript interpreter in i386 and stop telling gcc to use SSE2 instructions (Closes: #930935). + debian/rules: - Build with -DENABLE_JIT=OFF -DENABLE_C_LOOP=ON and stop using -msse2 -mfpmath=sse. + debian/patches/dont-detect-sse2.patch: - Don't check for SSE2 support. + debian/NEWS: - Remove item about the requirement to have an SSE2-capable CPU. Checksums-Sha1: 155ba4489db55b54f297a085c82fe3dd891f9e5d 4158 webkit2gtk_2.24.2-2.dsc 1ddb94c22da1717b131aecd18eadb214a2058457 61128 webkit2gtk_2.24.2-2.debian.tar.xz b4fbdac4c690a1b8dcc6f694c41f2e9ff6eced26 14148 webkit2gtk_2.24.2-2_source.buildinfo Checksums-Sha256: 5ccdb38ffd032161fce92bab576e9921fd17c23f0f8b42f789d429ca01d1b896 4158 webkit2gtk_2.24.2-2.dsc 6e51125673e17fb2bddb16cbd81913e6577fd4f79d401ca36dc6af173da79d15 61128 webkit2gtk_2.24.2-2.debian.tar.xz 23c3640821d0ed80dadc97e75d9ef4f1c8aee26c223324fbcc5679193d70c349 14148 webkit2gtk_2.24.2-2_source.buildinfo Files: f2897a2f6a4715482c8e7ae93d1d497c 4158 web optional webkit2gtk_2.24.2-2.dsc 0e71c1487435bbd75b9aebec4f98fa69 61128 web optional webkit2gtk_2.24.2-2.debian.tar.xz 199aa8e55abec39902bba8daf6e79c2a 14148 web optional webkit2gtk_2.24.2-2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAl0RJQYACgkQAAyEYu0C 2AKQWw//aZxZZyV7ZQoQXyNI/nwc1k43mQgti4BnIhPsFQ32UZdBYlN8ZGrmVSpz 9J2ONb69YKt7Z6AMpIqpw/eLnmzqrS2g8FyDvK57CafbrzYI+D6VBqejdsdgpEpg /tgr68IXfK3UplNZpUs+jf3ZQqzuZ8yJ/XTBmkzl1EWCowwMA4g5rJ31EU9+0UAn FneLp+5h4bZmro5TNuBWo2sPF3TSaBr2GQJYn4qXkni+ZVGNhBiFlm/wPYA6lMx/ Yv97H7JKU+v1PPuDj+Hl5k+H6emBQWOl4EFxQ/0iTGiWpdnQcpKIyv9CdJdvLkBv DV8c14G6x63Z59495or+686L6ovKwe2XUuoPV+XTAoTjae09O7f8aC4ffGBe8tDd KebOTQbu9FgA0FPEAItIa2vKkH8BeHLmo5yRqZi/MWrOP/qOf9FavmTo+3MvTzVA zL4W3UfdH3z7PLZ8nHeGXqrt//hMePsJAz27C4TRxRJ8O/ZCmMz9zPAchNshNAko DA3mIVwIYYA1hyV1OGIZ13k64/x5tpbf1iW2V4Iha8If91lFPIRR+ywt+Tce8au3 81cQQs65Ylf1SACfsQde72QsdbCaf9CT5XUXDKGrAlGyG7ugBPTX1MHXJxWDy862 q6V2jpt2k9F7GA5oBa7rHc4ZW79c8sNkt5OVPa1/DNVu3kiQyRM= =YvLZ -----END PGP SIGNATURE-----
--- End Message ---
