bugGnash - The GNU Flash player - Bugs: bug #17602, Gnash plugin crashs Firefox...

 
 

bug #17602: Gnash plugin crashs Firefox ("double free or corruption") frequently

Submitted by:  Douglas A. Augusto <daaugusto>
Submitted on:  Sun 03 Sep 2006 11:25:03 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Release: NoneStatus: Need Info
Privacy: PublicAssigned to: Markus Gothe <nihilus>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 06 Jul 2007 11:20:24 AM UTC, comment #4:

The original bug report is against Gnash 0.7.1-cvs-20060903 and I just configured and built the same combination on the same CPU - the firefox plugin plays it fine.

I am closing this bug - if it recurs please get back in touch.

The workaround is interesting and suggests that the problem was caused by picking up an old version of libgnashplugin.so

In fact they were configuring with --with-plugindir=/usr/lib/mozilla/plugins/ but firefox does not check in /usr/lib/mozilla/plugins.
It looks in ~/.mozilla/plugins (where gnash "make install"s it by default) and in /usr/lib/firefox/plugins
(Or on Debian in /usr/lib/iceweasel/plugins :( :( :( deb-heads!)

So I guess this was caused by installing a new version but running an ancient one.

Martin Guy <martinwguy>
Thu 14 Sep 2006 05:10:40 PM UTC, comment #3:

I used the following workaround (bug #15925):

$ export LD_PRELOAD="/usr/lib/mozilla/plugins/libgnashplugin.so" && ./firefox /tmp/offspring.swf

That solves the problem:

13:54:59: xEmbed supported in this Mozilla version
13:54:59: Gtk2+ supported in this Mozilla version
13:54:59: plugin.cpp:413: The full URL is file:///tmp/offspring.swf
13:54:59: Loading Flash movie /tmp/offspring.swf
13:54:59: Finished downloading Flash movie /tmp/offspring.swf. Playing...
13:54:59: Starting process: /usr/local/bin/gnash -v -x 23068884 -j 1053 -k 705 -u file:///tmp/offspring.swf -P height=100% -P name=plugin -P src=file:///tmp/offspring.swf -P type=application/x-shockwave-flash -P width=100% /tmp/offspring.swf
13:54:59: Forked sucessfully, child process PID is 31318
13:54:59: Verbose output turned on
13:54:59: Setting width to: 1053
13:54:59: Setting height to: 705
13:54:59: Setting root URL to: file:///tmp/offspring.swf
13:54:59: OpenGL extension version - 1.3
13:54:59: Got double-buffered visual.
13:54:59: Created XEmbedded window
13:54:59: note: couldn't open cache file 'file:///tmp/offspring.swf.gsc'

Douglas A. Augusto <daaugusto>
Thu 14 Sep 2006 04:32:54 PM UTC, comment #2:

./firefox -g --debugger gdb --sync /tmp/offspring.swf

13:27:48: xEmbed supported in this Mozilla version
13:27:48: Gtk2+ supported in this Mozilla version
13:27:48: plugin.cpp:413: The full URL is file:///tmp/offspring.swf
13:27:48: Loading Flash movie /tmp/offspring.swf
13:27:48: Finished downloading Flash movie /tmp/offspring.swf. Playing...

      • glibc detected *** double free or corruption (out): 0x090ba2d8 ***

Program received signal SIGABRT, Aborted.
[Switching to Thread -1221605696 (LWP 30341)]
0xb74a9947 in raise () from /lib/tls/libc.so.6

(gdb) bt
#0 0xb74a9947 in raise () from /lib/tls/libc.so.6
#1 0xb74ab0c9 in abort () from /lib/tls/libc.so.6
#2 0xb74defda in __fsetlocking () from /lib/tls/libc.so.6
#3 0xb74e689f in mallopt () from /lib/tls/libc.so.6
#4 0xb74e6942 in free () from /lib/tls/libc.so.6
#5 0xb51a5591 in operator delete () from /usr/lib/libstdc++.so.6
#6 0xb518211d in std::string::_Rep::_M_destroy () from /usr/lib/libstdc++.so.6
#7 0xb4fcdc4a in nsPluginInstance::DestroyStream (this=0x24)
at /usr/lib/gcc/i486-linux-gnu/4.1.2/../../../../include/c++/4.1.2/bits/basic_string.h:233
#8 0xb4fd1944 in NPP_DestroyStream (instance=0x90c4bac, stream=0x90b9ddc, reason=0) at mozilla-sdk/npp_gate.cpp:160
#9 0x081daa68 in XmlInitUnknownEncodingNS ()
#10 0x081db128 in XmlInitUnknownEncodingNS ()
#11 0x081cc3f5 in XmlInitUnknownEncodingNS ()
#12 0x084c4106 in nsReadingIterator<unsigned short>::advance ()
#13 0x084f4530 in nsXPTCVariant::Init ()
#14 0x08109dc3 in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#15 0x080d4c8d in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#16 0x080d4a01 in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#17 0xb7ec3b20 in nsInputStreamReadyEvent::EventHandler () from ./libxpcom_core.so
#18 0xb7ed4cd3 in PL_HandleEvent () from ./libxpcom_core.so
#19 0xb7ed4c26 in PL_ProcessPendingEvents () from ./libxpcom_core.so
#20 0xb7ed6253 in nsEventQueueImpl::CheckForDeactivation () from ./libxpcom_core.so
#21 0x081efc40 in XmlInitUnknownEncodingNS ()
#22 0xb799c7df in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0
#23 0xb7973e2c in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#24 0xb7977176 in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#25 0xb7977537 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#26 0xb7c3a141 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#27 0x081efee4 in XmlInitUnknownEncodingNS ()
#28 0x0863ba80 in nsXPTCVariant::Init ()
#29 0x0807afd4 in ?? ()
#30 0x08a8b3c8 in ?? ()
#31 0xb7fa9cc0 in _dl_argv () from /lib/ld-linux.so.2
#32 0x00000000 in ?? ()

Douglas A. Augusto <daaugusto>
Thu 14 Sep 2006 04:04:50 PM UTC, comment #1:

A backtrace from gdb would be good.

Markus Gothe <nihilus>
Project MemberIn charge of this item.
Sun 03 Sep 2006 11:25:03 AM UTC, original submission:

While preparing to play (forking?) an arbitrary SWF file, Gnash crashs Firefox (at least in Firefox 1.5.0.6, 2.0b1 and 2.0b2), but not every time.

For example, while trying to play 'offspring.swf' (from Gnash CVS repository), Gnash was able to play it at the first time, but crashed during the next try:

07:28:19: xEmbed supported in this Mozilla version
07:28:19: Gtk2+ supported in this Mozilla version
07:28:19: plugin.cpp:401: The full URL is http://cvs.savannah.gnu.org/viewcvs/checkout/gnash/testsuite/media/offspring.swf?root=gnash
07:28:19: Loading Flash movie /tmp/offspring.swf
07:28:21: Finished downloading Flash movie /tmp/offspring.swf. Playing...
07:28:21: Starting process: /usr/local/bin/gnash -x 33562888 -j 1039 -k 701 -u http://cvs.savannah.gnu.org/viewcvs/checkout/gnash/testsuite/media/offspring.swf?root=g
nash /tmp/offspring.swf
07:28:21: Forked sucessfully, child process PID is 20472
07:28:39: xEmbed supported in this Mozilla version
07:28:39: Gtk2+ supported in this Mozilla version
07:28:39: plugin.cpp:401: The full URL is http://cvs.savannah.gnu.org/viewcvs/checkout/gnash/testsuite/media/offspring.swf?rev=1.1&root=gnash
07:28:39: Loading Flash movie /tmp/offspring.swf

      • glibc detected *** double free or corruption (out): 0x0912cbd0 ***

My box:

- Gnash 0.7.1-cvs-20060903

$ gcc -v
Using built-in specs.
Target: i486-linux-gnu
Configured with: ../src/configure -v --enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --program-suffix=-4.1 --enable-__cxa_atexit --enable-clocale=gnu --enable-libstdcxx-debug --enable-mpfr --with-tune=i686 --enable-checking=release i486-linux-gnu
Thread model: posix
gcc version 4.1.2 20060814 (prerelease) (Debian 4.1.1-11)

$ uname -a
Linux athlon 2.6.17.11 #1 PREEMPT Wed Aug 30 23:08:19 BRT 2006 i686 GNU/Linux

- Configured with:

./configure --enable-plugin --enable-sound=GST --with-plugindir=/usr/lib/mozilla/plugins/

PS: This doesn't happens in the standalone player.

$ ldd /usr/local/bin/gnash

linux-gate.so.1 => (0xffffe000)
libpango-1.0.so.0 => /usr/lib/libpango-1.0.so.0 (0xb7ecf000)
libgobject-2.0.so.0 => /usr/lib/libgobject-2.0.so.0 (0xb7e95000)
libpangox-1.0.so.0 => /usr/lib/libpangox-1.0.so.0 (0xb7e8a000)
libgtkglext-x11-1.0.so.0 => /usr/lib/libgtkglext-x11-1.0.so.0 (0xb7e87000)
libgdkglext-x11-1.0.so.0 => /usr/lib/libgdkglext-x11-1.0.so.0 (0xb7e36000)
libgnashgui.so.0 => /usr/local/lib/libgnashgui.so.0 (0xb7e2d000)
libgnashamf.so.0 => /usr/local/lib/libgnashamf.so.0 (0xb7e24000)
libgnashbackend.so.0 => /usr/local/lib/libgnashbackend.so.0 (0xb7e1a000)
libgnashserver.so.0 => /usr/local/lib/libgnashserver.so.0 (0xb7cc4000)
libxml2.so.2 => /usr/lib/libxml2.so.2 (0xb7bab000)
libgnashbase.so.0 => /usr/local/lib/libgnashbase.so.0 (0xb7b67000)
libjpeg.so.62 => /usr/lib/libjpeg.so.62 (0xb7b47000)
libdirectfb-0.9.so.25 => /usr/lib/libdirectfb-0.9.so.25 (0xb7af0000)
libfusion-0.9.so.25 => /usr/lib/libfusion-0.9.so.25 (0xb7aea000)
libdirect-0.9.so.25 => /usr/lib/libdirect-0.9.so.25 (0xb7adc000)
libGL.so.1 => /usr/lib/libGL.so.1 (0xb7a57000)
libvorbisfile.so.3 => /usr/lib/libvorbisfile.so.3 (0xb7a4f000)
libvorbis.so.0 => /usr/lib/libvorbis.so.0 (0xb7a26000)
libogg.so.0 => /usr/lib/libogg.so.0 (0xb7a21000)
libsmpeg-0.4.so.0 => /usr/lib/libsmpeg-0.4.so.0 (0xb79c7000)
libSDL-1.2.so.0 => /usr/lib/libSDL-1.2.so.0 (0xb7916000)
libasound.so.2 => /usr/lib/libasound.so.2 (0xb7854000)
libartsc.so.0 => /usr/lib/libartsc.so.0 (0xb784d000)
libgmodule-2.0.so.0 => /usr/lib/libgmodule-2.0.so.0 (0xb784a000)
libgthread-2.0.so.0 => /usr/lib/libgthread-2.0.so.0 (0xb7846000)
libglib-2.0.so.0 => /usr/lib/libglib-2.0.so.0 (0xb77bf000)
libesd.so.0 => /usr/lib/libesd.so.0 (0xb77b6000)
libaudiofile.so.0 => /usr/lib/libaudiofile.so.0 (0xb7792000)
libaa.so.1 => /usr/lib/libaa.so.1 (0xb7776000)
libgnashgeo.so.0 => /usr/local/lib/libgnashgeo.so.0 (0xb7765000)
libSDL_mixer-1.2.so.0 => /usr/lib/libSDL_mixer-1.2.so.0 (0xb76f5000)
libXmu.so.6 => /usr/lib/libXmu.so.6 (0xb76df000)
libSM.so.6 => /usr/lib/libSM.so.6 (0xb76d6000)
libICE.so.6 => /usr/lib/libICE.so.6 (0xb76be000)
libXinerama.so.1 => /usr/lib/libXinerama.so.1 (0xb76ba000)
libXrandr.so.2 => /usr/lib/libXrandr.so.2 (0xb76b6000)
libXcursor.so.1 => /usr/lib/libXcursor.so.1 (0xb76ad000)
libXfixes.so.3 => /usr/lib/libXfixes.so.3 (0xb76a8000)
libfontconfig.so.1 => /usr/lib/libfontconfig.so.1 (0xb7678000)
libpng12.so.0 => /usr/lib/libpng12.so.0 (0xb7654000)
libXrender.so.1 => /usr/lib/libXrender.so.1 (0xb764b000)
libz.so.1 => /usr/lib/libz.so.1 (0xb7637000)
libGLU.so.1 => /usr/lib/libGLU.so.1 (0xb75bd000)
librt.so.1 => /lib/tls/librt.so.1 (0xb75b5000)
libXi.so.6 => /usr/lib/libXi.so.6 (0xb75ad000)
libdl.so.2 => /lib/tls/libdl.so.2 (0xb75a9000)
libaudio.so.2 => /usr/lib/libaudio.so.2 (0xb7592000)
libXt.so.6 => /usr/lib/libXt.so.6 (0xb7542000)
libXext.so.6 => /usr/lib/libXext.so.6 (0xb7534000)
libvga.so.1 => /usr/lib/libvga.so.1 (0xb74d4000)
libncurses.so.5 => /lib/libncurses.so.5 (0xb7492000)
libslang.so.2 => /lib/libslang.so.2 (0xb73d0000)
libX11.so.6 => /usr/lib/libX11.so.6 (0xb7309000)
libpthread.so.0 => /lib/tls/libpthread.so.0 (0xb72f7000)
libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0xb7216000)
libm.so.6 => /lib/tls/libm.so.6 (0xb71f1000)
libgcc_s.so.1 => /lib/libgcc_s.so.1 (0xb71e6000)
libc.so.6 => /lib/tls/libc.so.6 (0xb70b4000)
libgtk-x11-2.0.so.0 => /usr/lib/libgtk-x11-2.0.so.0 (0xb6dbf000)
libgdk-x11-2.0.so.0 => /usr/lib/libgdk-x11-2.0.so.0 (0xb6d3d000)
libatk-1.0.so.0 => /usr/lib/libatk-1.0.so.0 (0xb6d23000)
libgdk_pixbuf-2.0.so.0 => /usr/lib/libgdk_pixbuf-2.0.so.0 (0xb6d0d000)
libpangocairo-1.0.so.0 => /usr/lib/libpangocairo-1.0.so.0 (0xb6d05000)
libcairo.so.2 => /usr/lib/libcairo.so.2 (0xb6ca2000)
libgstreamer-0.10.so.0 => /usr/lib/libgstreamer-0.10.so.0 (0xb6c10000)
libGLcore.so.1 => /usr/lib/libGLcore.so.1 (0xb644d000)
libnvidia-tls.so.1 => /usr/lib/tls/libnvidia-tls.so.1 (0xb644b000)
libgpm.so.1 => /usr/lib/libgpm.so.1 (0xb6444000)
libfreetype.so.6 => /usr/lib/libfreetype.so.6 (0xb63d8000)
libexpat.so.1 => /usr/lib/libexpat.so.1 (0xb63b8000)
/lib/ld-linux.so.2 (0xb7f28000)
libXau.so.6 => /usr/lib/libXau.so.6 (0xb63b5000)
libXdmcp.so.6 => /usr/lib/libXdmcp.so.6 (0xb63af000)
libpangoft2-1.0.so.0 => /usr/lib/libpangoft2-1.0.so.0 (0xb638a000)

Douglas A. Augusto <daaugusto>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Fri 06 Jul 2007 11:20:24 AM UTCmartinwguyOpen/ClosedOpen=>Closed
Thu 21 Sep 2006 06:10:18 AM UTCnihilusAssigned toNone=>nihilus
Thu 14 Sep 2006 04:04:49 PM UTCnihilusStatusNone=>Need Info

Back to the top


Powered by Savane 3.1-cleanup1