Sat 01 Jul 2006 12:44:04 AM UTC, comment #9:
Forget about this, fixed the last bit of segfaulting behaviours.
Rest in piece, horrible SWF!
|
Sat 01 Jul 2006 12:36:05 AM UTC, comment #8:
Forgot to mention: to reproduce the bug you must click on the
'start' button. Here is the stack trace:
Program received signal SIGSEGV, Segmentation fault.
gnash::DisplayList::advance (this=0x847998c, delta_time=0.0419999994)
at stl_list.h:117
117 { _M_node = _M_node->_M_next; }
(gdb) bt
#0 gnash::DisplayList::advance (this=0x847998c, delta_time=0.0419999994)
at stl_list.h:117
#1 0x407c1e9d in gnash::sprite_instance::advance_sprite (this=0x84798e0,
delta_time=0) at /home/strk/src/gnash/gnash/server/sprite_instance.cpp:1179
#2 0x407c2005 in gnash::sprite_instance::advance (this=0x84798e0,
delta_time=0) at /home/strk/src/gnash/gnash/server/sprite_instance.cpp:1228
#3 0x4078b687 in gnash::DisplayList::advance (this=0x826d2cc,
delta_time=0.0419999994) at /home/strk/src/gnash/gnash/server/dlist.cpp:430
#4 0x407c1e9d in gnash::sprite_instance::advance_sprite (this=0x826d220,
delta_time=0) at /home/strk/src/gnash/gnash/server/sprite_instance.cpp:1179
#5 0x407c1f7d in gnash::sprite_instance::advance_root (this=0x826d220,
delta_time=0.0419999994)
at /home/strk/src/gnash/gnash/server/sprite_instance.cpp:1197
#6 0x40767c0b in gnash::movie_root::advance (this=0x83eb558,
delta_time=0.0419999994)
at /home/strk/src/gnash/gnash/server/movie_root.cpp:236
#7 0x0804bed9 in main (argc=2, argv=0xbffff634)
at /home/strk/src/gnash/gnash/backend/gnash.cpp:887
|
Sat 01 Jul 2006 12:33:49 AM UTC, comment #7:
Just a note, a bug fix just committed triggers a new segfault playing this movie. We know that the movie is bogus, but maybe this is a good chance of making gnash robust in these cases.
Since this bug item already has the movie attached, I'd keep it somehow opened. What's the best way to do this ?
Should I open a new bug and make it refer to this one for the attachment and listswf/flasm information?
|
Sat 01 Jul 2006 12:19:26 AM UTC, comment #6:
I'll close this bug, but I'm interested in bug reports about "Stack underrun" conditions, expecially if the SWF is known
to be correct. In this case Ming also agrees with gnash in
that there's a Stack underrun condition as the first action
in the SWF is an ActionLogicalNot, which expects a value on the stack to which to apply the NOT op. Following is initial Ming's "listswf" output, which also show a duplicated ACTION_CONSTANTPOOL (also looking invalid).
Just in case Ming was wrong I also gave the movie a try
under 'flasm', which reports same problems.
So, kudos to Gnash that's able to not die with this !
[Ming]
File version: 6
File size: 386638
Frame size: (0,11200)x(0,8400)
Frame rate: 31.000000 / sec.
Total frames: 22
Offset: 21 (0x0015)
Block type: 9 (SWF_SETBACKGROUNDCOLOR)
Block length: 3
RGBA: ( 0, 0, 0,ff)
Offset: 26 (0x001a)
Block type: 45 (SWF_SOUNDSTREAMHEAD2)
Block length: 4
Offset: 32 (0x0020)
Block type: 12 (SWF_DOACTION)
Block length: 658
29 Actions
SWFACTION_LOGICALNOT
SWFACTION_IF
BranchOffset: 5
1 Action
SWFACTION_CONSTANTPOOL
SWFACTION_CONSTANTPOOL
[000] polosa
[flasm]
errors during run
Declared constant pool length 648 differs from calculated length 2
Declared constant pool length 39 differs from calculated length 2
Declared constant pool length 37 differs from calculated length 2
Declared constant pool length 8 differs from calculated length 2
Declared constant pool length 633 differs from calculated length 2
Declared constant pool length 396 differs from calculated length 2
Declared constant pool length 19 differs from calculated length 2
initial flm
movie '../../tests/warp-forest.swf' compressed // flash 6, total frames: 22, fra
me rate: 31 fps, 560x420 px
frame 0
not
branchIfTrue label1
constants
|
Fri 30 Jun 2006 11:48:31 PM UTC, comment #5:
I don't know what the swf is supposed to do exactly.
It should resemble a game, it doesn't seem to start for now,
but this is really a separate issue, so this bug should be
closed.
Some errors still appear when started with -v which seems to
be related with Stack underrun, but there are other errors
and it is likely to be a example which is too complex for
gnash for now, so I'll go back to it in the future.
I cannot close the bug, but I believe it should be.
|
Fri 30 Jun 2006 08:07:50 PM UTC, comment #4:
Equipped gnash with checks on stack size on each action handler.
Wheter due to malformed SWF or gnash bugs stack underruns
are now handled safely (ie: no aborts).
The warp-forest doesn't abort now. Fixing it further (assuming that the SWF is correct) requires knowing exactly what should be expected. I would close this item and ask the original submitter about filing a new report stating exactly what is expected and not happening.
|
Thu 29 Jun 2006 12:41:52 AM UTC, comment #3:
Attached.
|
Mon 26 Jun 2006 01:50:07 PM UTC, comment #2:
Updates: the url became invalid. If anyone can attach
the movie to this report we'll eventually try to fix
gnash.
|
Mon 19 Jun 2006 10:23:57 AM UTC, comment #1:
the url of movie (for easy access):
http://media.koreus.com/banner-ads-00028/200606/warp-forest.swf
Generally, it's better to add the -v switch when facing a bug.
In this case, with head we get:
...
ERROR: export error: don't know how to export resource 'shot2'
ERROR: export error: don't know how to export resource 'shot1'
gnash: /home/strk/src/gnash/gnash/server/as_environment.h:126: gnash::as_value& gnash::as_environment::top(unsigned int): Assertion `m_stack.size() > dist' failed.
Basically, at the time ActionLogicalNot is found the stack
is empty. We had a similar problem with ActionPop, and I
made it a warning (if the stack is empty, there's nothing
to pop, just keep going). In this case what should we do ?
Log an error and exit ? Note that altought at the moment
the "empty stack" condition is probably due to some bug
in Gnash, in general it is always possible to have bogus
SWFs instead.
|
Sun 11 Jun 2006 09:26:28 AM UTC, original submission:
gnash segfaults with the flash game located at
http://www.koreus.com/media/warp-forest.html
backtrace:
(gdb) bt
#0 gnash::as_value::to_bool (this=0xffffffe4) at as_value.cpp:243
#1 0x003fa836 in gnash::SWF::SWFHandlers::ActionLogicalNot (env=@0x93405cc)
at swf/ASHandlers.cpp:543
#2 0x003f99e2 in gnash::SWF::ActionHandler::execute (this=0x91e558c, env=@0x93405cc)
at swf/ASHandlers.cpp:121
#3 0x00405e16 in gnash::SWF::SWFHandlers::execute (this=0x454268,
type=gnash::SWF::ACTION_LOGICALNOT, env=@0x93405cc) at swf/ASHandlers.cpp:365
#4 0x003a6126 in gnash::action_buffer::execute (this=0x924e5c4, env=0x93405cc, start_pc=0,
exec_bytes=658, retval=0x0, initial_with_stack=@0xbfe6bbf4, is_function2=false)
at action.cpp:859
#5 0x003a926d in gnash::action_buffer::execute (this=0x924e5c4, env=0x93405cc) at action.cpp:693
#6 0x003e2c3c in gnash::sprite_instance::do_actions (this=0x93404e8) at sprite_instance.cpp:81
#7 0x003e900d in gnash::sprite_instance::on_event_load (this=0x93404e8) at sprite_instance.h:417
#8 0x0038d7f7 in gnash::movie_root::advance (this=0x9340398, delta_time=0) at movie_root.cpp:191
#9 0x0804be23 in main (argc=0, argv=Cannot access memory at address 0xffffffe8
) at gnash.cpp:866
|