Add JDK-8223219 to avoid -fstack-protector overriding -fstack-protector-strong

java-1.8.0-openjdk.spec

@@ -986,7 +986,7 @@ Provides: java-%{javaver}-%{origin}-accessibility = %{epoch}:%{version}-%{releas
 
 Name:    java-%{javaver}-%{origin}
 Version: %{javaver}.%{updatever}.%{buildver}
-Release: 2%{?dist}
+Release: 3%{?dist}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
 # and this change was brought into RHEL-4. java-1.5.0-ibm packages
 # also included the epoch in their virtual provides. This created a
@@ -1194,6 +1194,10 @@ Patch624: jdk8210425-rh1632174-02-compile_with_o2_and_ffp_contract_off_as_for_fd
 # 8210425: [x86] sharedRuntimeTrig/sharedRuntimeTrans compiled without optimization
 #          Zero part of the fix for (arm/s390 arches)
 Patch625: jdk8210425-rh1632174-03-compile_with_o2_and_ffp_contract_off_as_for_fdlibm_zero.patch
+# JDK-8223219: Backport of JDK-8199552 to OpenJDK 8 leads to duplicate -fstack-protector flags,
+#              overriding --with-extra-cflags
+Patch626: jdk8223219-fstack-protector-root.patch
+Patch627: jdk8223219-fstack-protector-hotspot.patch
 
 #############################################
 #
@@ -1602,6 +1606,8 @@ sh %{SOURCE12}
 %patch623
 %patch624
 %patch625
+%patch626
+%patch627
 %patch110
 
 # RPM-only fixes
@@ -2270,6 +2276,9 @@ require "copy_jdk_configs.lua"
 %endif
 
 %changelog
+* Wed May 22 2019 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-3
+- Add JDK-8223219 to avoid -fstack-protector overriding -fstack-protector-strong
+
 * Wed May 15 2019 James Cassell <cyberpear@fedoraproject.org> - 1:1.8.0.212.b04-2
 - mark net.properties as a config file
 

jdk8223219-fstack-protector-hotspot.patch

@@ -0,0 +1,35 @@
+diff --git openjdk.orig/hotspot/make/bsd/makefiles/gcc.make openjdk/hotspot/make/bsd/makefiles/gcc.make
+--- openjdk.orig/hotspot/make/bsd/makefiles/gcc.make
++++ openjdk/hotspot/make/bsd/makefiles/gcc.make
+@@ -190,7 +190,7 @@
+ CFLAGS += -fno-exceptions
+ ifeq ($(USE_CLANG),)
+   CFLAGS += -pthread
+-  CFLAGS += -fcheck-new -fstack-protector
++  CFLAGS += -fcheck-new
+   # version 4 and above support fvisibility=hidden (matches jni_x86.h file)
+   # except 4.1.2 gives pointless warnings that can't be disabled (afaik)
+   ifneq "$(shell expr \( $(CC_VER_MAJOR) \> 4 \) \| \( \( $(CC_VER_MAJOR) = 4 \) \& \( $(CC_VER_MINOR) \>= 3 \) \))" "0"
+diff --git openjdk.orig/hotspot/make/linux/makefiles/gcc.make openjdk/hotspot/make/linux/makefiles/gcc.make
+--- openjdk.orig/hotspot/make/linux/makefiles/gcc.make
++++ openjdk/hotspot/make/linux/makefiles/gcc.make
+@@ -150,7 +150,7 @@
+ CFLAGS += -fno-exceptions
+ CFLAGS += -D_REENTRANT
+ ifeq ($(USE_CLANG),)
+-  CFLAGS += -fcheck-new -fstack-protector
++  CFLAGS += -fcheck-new
+   # version 4 and above support fvisibility=hidden (matches jni_x86.h file)
+   # except 4.1.2 gives pointless warnings that can't be disabled (afaik)
+   ifneq "$(shell expr \( $(CC_VER_MAJOR) \> 4 \) \| \( \( $(CC_VER_MAJOR) = 4 \) \& \( $(CC_VER_MINOR) \>= 3 \) \))" "0"
+diff --git openjdk.orig/hotspot/make/solaris/makefiles/gcc.make openjdk/hotspot/make/solaris/makefiles/gcc.make
+--- openjdk.orig/hotspot/make/solaris/makefiles/gcc.make
++++ openjdk/hotspot/make/solaris/makefiles/gcc.make
+@@ -75,7 +75,6 @@
+ CFLAGS += -fno-exceptions
+ CFLAGS += -D_REENTRANT
+ CFLAGS += -fcheck-new
+-CFLAGS += -fstack-protector
+ 
+ ARCHFLAG = $(ARCHFLAG/$(BUILDARCH))
+ 

jdk8223219-fstack-protector-root.patch

@@ -0,0 +1,33 @@
+diff --git a/common/autoconf/flags.m4 b/common/autoconf/flags.m4
+--- openjdk.orig/common/autoconf/flags.m4
++++ openjdk/common/autoconf/flags.m4
+@@ -388,16 +388,8 @@
+     CFLAGS_JDK="${CFLAGS_JDK} -qchars=signed -q64 -qfullpath -qsaveopt"
+     CXXFLAGS_JDK="${CXXFLAGS_JDK} -qchars=signed -q64 -qfullpath -qsaveopt"
+   elif test "x$TOOLCHAIN_TYPE" = xgcc; then
+-    case $OPENJDK_TARGET_CPU_ARCH in
+-    x86 )
+-      LEGACY_EXTRA_CFLAGS="$LEGACY_EXTRA_CFLAGS -fstack-protector"
+-      LEGACY_EXTRA_CXXFLAGS="$LEGACY_EXTRA_CXXFLAGS -fstack-protector"
+-      ;;
+-    x86_64 )
+-      LEGACY_EXTRA_CFLAGS="$LEGACY_EXTRA_CFLAGS -fstack-protector"
+-      LEGACY_EXTRA_CXXFLAGS="$LEGACY_EXTRA_CXXFLAGS -fstack-protector"
+-      ;;
+-    esac
++    LEGACY_EXTRA_CFLAGS="$LEGACY_EXTRA_CFLAGS -fstack-protector"
++    LEGACY_EXTRA_CXXFLAGS="$LEGACY_EXTRA_CXXFLAGS -fstack-protector"
+     if test "x$OPENJDK_TARGET_OS" != xmacosx; then
+       LDFLAGS_JDK="$LDFLAGS_JDK -Wl,-z,relro"
+       LEGACY_EXTRA_LDFLAGS="$LEGACY_EXTRA_LDFLAGS -Wl,-z,relro"
+@@ -464,10 +456,6 @@
+       ppc )
+         # on ppc we don't prevent gcc to omit frame pointer nor strict-aliasing
+         ;;
+-      x86 )
+-        CCXXFLAGS_JDK="$CCXXFLAGS_JDK -fno-omit-frame-pointer -fstack-protector"
+-        CFLAGS_JDK="${CFLAGS_JDK} -fno-strict-aliasing -fstack-protector"
+-        ;;
+       * )
+         CCXXFLAGS_JDK="$CCXXFLAGS_JDK -fno-omit-frame-pointer"
+         CFLAGS_JDK="${CFLAGS_JDK} -fno-strict-aliasing"