bugGnash - The GNU Flash player - Bugs: bug #22420, infinite getter-setter recursion

 
 

bug #22420: infinite getter-setter recursion

Submitter:  Benjamin Wolsey <bwy>
Submitted:  Tue 26 Feb 2008 07:24:27 AM UTC
   
 
Category:  ActionScript Severity:  3 - Normal
Release:  None Status:  Fixed
Privacy:  Public Assigned to:  strk
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 27 Feb 2008 07:24:05 PM UTC, comment #10: 

It fixes this case.

Benjamin Wolsey <bwy>
Group Member
Wed 27 Feb 2008 04:27:42 PM UTC, comment #9: 

Just a note, with my commit, Gnash always prevents infinite recursions due to getter/setter calling self... which is not 100% compatible in SWF7 or higher.

Sandro Santilli <strk>
Group Member
Wed 27 Feb 2008 04:22:58 PM UTC, comment #8: 

Committed a fix and an automated testcase in head. Branch will follow.

Sandro Santilli <strk>
Group Member
Wed 27 Feb 2008 03:00:50 PM UTC, comment #7: 

I have a local fix, but I found out that the more complex testcase
(recursiveGetterSetter2.as) compiled as SWF7 or higher, is
actually expected to infinitely recurse..

Sandro Santilli <strk>
Group Member
Wed 27 Feb 2008 11:32:31 AM UTC, comment #6: 

recursiveGetterSetter2.as adds a bit of complexity, showing
that while running a setter, it's just the target member being
"locked" and not other members/properties.

Expected output:
 mem1 setter, this is [object Object] (object - name o1)
 mem2 setter, this is [object Object] (object - name o2)
 mem2 getter, this is [object Object] (object - name o2)
 2
 mem1 getter, this is [object Object] (object - name o1)
 2
 mem2 setter, this is [object Object] (object - name o2)
 mem1 setter, this is [object Object] (object - name o1)
 mem1 getter, this is [object Object] (object - name o1)
 3
 mem2 getter, this is [object Object] (object - name o2)
 3


(file #15128)

Sandro Santilli <strk>
Group Member
Wed 27 Feb 2008 10:53:48 AM UTC, comment #5: 

recursiveGetterSetter.as is a simplified testcase for
the bug.

The expected output is:

----------------------------------------------
mem setter, this is [object Object] (object)
mem getter, this is [object Object] (object)
2
----------------------------------------------


(file #15127)

Sandro Santilli <strk>
Group Member
Wed 27 Feb 2008 10:33:00 AM UTC, comment #4: 

Alright, I got to the source of problem being
a setter function assigning to the variable it watches:

This comes out from Ming decompiler:

  R2.__get__Region = function () {
    return this.region;
  };

  R2.__set__Region = function (regionName) {
    this.region = regionName;
    return this.__get__Region();
  };

Gnash chokes in the setter (__set__Region) which is
the setter for a 'region' property.
"this.region" invokes the setter again.
Looking at the code it seems the 'getter' would do
about the same, as it fetches it's own value again.

Now, the problem might be in a bogus value for 'this',
or in an incompatible handling of an actionscript error.

We should now have the elements for trying to reproduce
the problem with custom test movies and see how the reference
player would handle it.

Sandro Santilli <strk>
Group Member
Tue 26 Feb 2008 11:35:44 AM UTC, comment #3: 

NOTE: 0.8.1 did hit the same limit, so if it's a regression,
it is not from 0.8.1.

Sandro Santilli <strk>
Group Member
Tue 26 Feb 2008 11:35:13 AM UTC, comment #2: 

The offending code is in an XML.onLoad function:

DEBUG: gnash::as_value gnash::xml_ondata(const gnash::fn_call&) enter
DEBUG: Calling parseXML
DEBUG: Done Calling parseXML, calling onLoad
ERROR: ActionLimits hit during advance: Max stack count reached (255). Disabling scripts

Sandro Santilli <strk>
Group Member
Tue 26 Feb 2008 09:08:30 AM UTC, comment #1: 

It's an endlessly growing series of array objects that seems to be causing the problem; 'super' is involved too.

The stack at a random point looks like this:

Stack: "[function:0xd83b90]" | "[object(gnash::as_object):0xd838b0]" | "[undefined]" | "[object(gnash::as_array_object):0xbb7c90]" | "[object(gnash::as_objec
t):0xd8a9c0]" | "[number:2]" | "[function:0xd491c0]" | "[string:apply]" | "[bool:true]" | "[object(gnash::as_array_object):0xbb7c90]" | "[object(gnash::as_ob
ject):0xd8a9c0]" | "[function:0xd491c0]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object
(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" |
 "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[ob
ject(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region
]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" |
"[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:re
gion]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]
" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[strin
g:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6
a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[s
tring:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0
xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" |
 "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_objec
t):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0
]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_o
bject):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8
a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]"

Benjamin Wolsey <bwy>
Group Member
Tue 26 Feb 2008 07:24:27 AM UTC, original submission:  

This movie throws an action limits exception:

http://news.bbc.co.uk/nol/shared/bsp/hi/live_stats/swf/map.swf?returnURL=http://news.bbc.co.uk/1/shared/bsp/hi/live_stats/html/map.stm

It used to work fine. Tt's quite possible that the movie itself has changed, but it also might be a regression. I haven't tested it with the pp.

See this page for the embedded SWF:

http://news.bbc.co.uk/1/shared/bsp/hi/live_stats/html/map.stm

Benjamin Wolsey <bwy>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #15128:  recursiveGetterSetter2.as added by strk (808B - application/x-applix-spreadsheet)
file #15127:  recursiveGetterSetter.as added by strk (285B - application/x-applix-spreadsheet)
file #15117:  bbcmap_stm.swf added by strk (148KiB - application/x-shockwave-flash - the offending movie, reproduces the limit hit offline)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by strk (Posted a comment)
  • -email is unavailable- added by bwy (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-02-27 bwy StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2008-02-27 strk StatusIn Progress Ready For Test
    2008-02-27 strk StatusNone In Progress
        Assigned toNone strk
        SummaryActionlimits exception thrown (possible regression) infinite getter-setter recursion
    2008-02-27 strk Attached File- Added recursiveGetterSetter2.as, #15128
    2008-02-27 strk Attached File- Added recursiveGetterSetter.as, #15127
    2008-02-26 strk Attached File- Added bbcmap_stm.swf, #15117

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code