bugGnash - The GNU Flash player - Bugs: bug #34690, Segfault from PropertyList.cpp:66.

 
 

bug #34690: Segfault from PropertyList.cpp:66.

Submitter:  Bastiaan Jacques <bjacques>
Submitted:  Sun 30 Oct 2011 12:26:18 AM UTC
   
 
Category:  core Severity:  3 - Normal
Release:  master Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 30 Oct 2011 09:07:41 AM UTC, comment #2: 

Sounds good to me too, feel free to push.

Sandro Santilli <strk>
Group Member
Sun 30 Oct 2011 07:02:30 AM UTC, comment #1: 

Looks like the correct fix to me.

Benjamin Wolsey <bwy>
Group Member
Sun 30 Oct 2011 12:26:18 AM UTC, original submission:  

Upstream bug is https://bugzilla.redhat.com/show_bug.cgi?id=711518. (Includes stacktrace.)

STR: gui/gnash https://bugzilla.redhat.com/attachment.cgi?id=510587

Useful output from Valgrind suggests that the as_object is improperly GC'd:

==26943== Thread 1:
==26943== Invalid read of size 8
==26943==    at 0x4E56470: gnash::PropertyList::getProperty(gnash::ObjectURI const&) const (PropertyList.cpp:148)
==26943==    by 0x4E7724C: gnash::as_object::getOwnProperty(gnash::ObjectURI const&) (as_object.cpp:934)
==26943==    by 0x4F17D9A: gnash::MovieClip::constructAsScriptObject() (MovieClip.cpp:1694)
==26943==    by 0x4F180C9: gnash::MovieClip::construct(gnash::as_object*) (MovieClip.cpp:1780)
==26943==    by 0x4F162C3: gnash::MovieClip::attachCharacter(gnash::DisplayObject&, int, gnash::as_object*) (MovieClip.cpp:1230)
==26943==    by 0x4FE19E7: gnash::(anonymous namespace)::movieclip_attachMovie(gnash::fn_call const&) (MovieClip_as.cpp:517)
==26943==    by 0x4FBCC55: gnash::NativeFunction::call(gnash::fn_call const&) (NativeFunction.h:65)
==26943==    by 0x50B7D62: gnash::(anonymous namespace)::ActionCallMethod(gnash::ActionExec&) (ASHandlers.cpp:2811)
==26943==    by 0x50AD3EE: gnash::SWF::ActionHandler::execute(gnash::ActionExec&) const (ASHandlers.cpp:239)
==26943==    by 0x50AF812: gnash::SWF::SWFHandlers::execute(gnash::SWF::ActionType, gnash::ActionExec&) const (ASHandlers.cpp:432)
==26943==    by 0x50C4FDA: gnash::ActionExec::operator()() (ActionExec.cpp:260)
==26943==    by 0x4F61A27: gnash::Function2::call(gnash::fn_call const&) (Function2.cpp:219)
==26943==  Address 0x84b8fa8 is 104 bytes inside a block of size 232 free'd
==26943==    at 0x4A062BC: operator delete(void*) (vg_replace_malloc.c:387)
==26943==    by 0x4F609D5: gnash::Function::~Function() (Function.h:77)
==26943==    by 0x5E54DE8: gnash::GC::cleanUnreachable() (GC.cpp:84)
==26943==    by 0x5E54E79: gnash::GC::runCycle() (GC.cpp:125)
==26943==    by 0x4EF1992: gnash::GC::fuzzyCollect() (GC.h:251)
==26943==    by 0x4EE7306: gnash::movie_root::cleanupAndCollect() (movie_root.cpp:311)
==26943==    by 0x4EE98BB: gnash::movie_root::advanceMovie() (movie_root.cpp:980)
==26943==    by 0x4EE968D: gnash::movie_root::advance() (movie_root.cpp:931)
==26943==    by 0x48767A: gnash::Gui::advanceMovie(bool) (gui.cpp:950)
==26943==    by 0x4A8586: gnash::NullGui::run() (NullGui.cpp:44)
==26943==    by 0x499572: gnash::Player::run(int, char**, std::string const&, std::string const&) (Player.cpp:645)
==26943==    by 0x458A1C: playFile(gnash::Player&, int, char**, std::string const&) (gnash.cpp:90)

The attached patch appears to solve the problem.

Being thorougly unfamiliar with this code, assigning this to strk.

Bastiaan Jacques <bjacques>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #24245:  gnash-props-fix.diff added by bjacques (538B - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by strk (Posted a comment)
  • -email is unavailable- added by bwy (Posted a comment)
  • -email is unavailable- added by bjacques (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-10-30 bjacques StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2011-10-30 strk Assigned tostrk bjacques
    2011-10-30 bjacques Attached File- Added gnash-props-fix.diff, #24245

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code