Mon 20 Nov 2006 10:35:30 PM UTC, comment #38:
Good finding, closing this little bad bug
|
Mon 20 Nov 2006 10:22:03 PM UTC, comment #37:
This is confirmed as a compiler bug where, on rare occasions, gcc generates bad asm. It's fixed in the OpenBSD gnash port by adjusting the stack variables slightly to avoid tripping it, as below. Please close the bug; if it shows up in the next release we'll find a similar workaround.
Thank you.
--- server/sprite_instance.cpp.orig Fri Nov 17 14:08:21 2006
+++ server/sprite_instance.cpp Fri Nov 17 20:38:51 2006
@@ -1210,12 +1210,12 @@ bool sprite_instance::on_event(event_id
// Keep m_as_environment alive during any method calls!
// Don't do this, make sure caller is keeping us alive instead
//smart_ptr<as_object> this_ptr(this);
+ as_value method;
bool called = false;
// First, check for built-in event handler.
{
- as_value method;
if (get_event_handler(id, &method))
{
// Dispatch.
@@ -1235,7 +1235,6 @@ bool sprite_instance::on_event(event_id
const tu_stringi& method_name = id.get_function_name();
if (method_name.length() > 0)
{
- as_value method;
if (get_member(method_name, &method))
{
call_method0(method, &m_as_environment, this);
|
Fri 17 Nov 2006 07:00:20 PM UTC, comment #36:
This has now been tested on a variety of OpenBSD hardware platforms (amd64, macppc and zaurus) and is not reproducible. It seems to only show up on i386 with optimization turned off, so it seems like some kind of compiler bug. You may want to turn down the severity or close the bug here until the exact cause is found. At this point it does not appear to be gnash, but I'm not 100% positive. In any case it shoud not be marked 'blocker'.
|
Mon 13 Nov 2006 08:23:15 AM UTC, comment #35:
I've committed a patch removing all self-assignments to smart_ptr
and adding consistency checks in a few public methods (testInvariant). Hopefully this exposes the bug earier.
Can you try again and see if stack corruption happens earlier ?
About the comment-out-pieces-of-code process you were following,
to go deeper, you might try making the sprite_instance::on_event()
function body empty and see what happens, then incrementally adding
blocks of code there.
|
Sun 12 Nov 2006 12:31:57 AM UTC, comment #34:
This change fixes the coredump with gprocessor. This is something I was tracing with strk and I think a note should be made here.
--- processor.cpp.orig Sat Nov 11 19:11:53 2006
+++ processor.cpp Sat Nov 11 19:26:58 2006
@@ -274,7 +274,7 @@
// safety margin on scaled shapes.
size_t last_frame = m->get_current_frame();
- m->advance(0.010f);
+// m->advance(0.010f);
m->display();
if (m->get_current_frame() == md->get_frame_count() - 1) {
|
Sat 11 Nov 2006 05:52:22 PM UTC, comment #33:
gprocessor exits without errors with the main function empty.
$ pwd
/usr/ports/mystuff/www/gnash/w-gnash-cvs-111106/gnash/utilities
$ libtool --mode=execute ./gprocessor ../testsuite/movies.all/gravity.swf
$ echo $?
0
$
|
Sat 11 Nov 2006 05:01:56 PM UTC, comment #32:
I've been working on removing mudflap-reported errors and done some
work in that direction (all committed). I still have errors that seems to originate in the STL, anyway I would like to know from you Deanna, if you can handle to have the stack corruption by running a copy of gprocessor with an empty main() function. This would confirm my assumptions about the problem being in static initialization (yes, mudflap build does report stack corruption in this case). The code is in utilities/processor.cpp
|
Fri 10 Nov 2006 05:17:08 PM UTC, comment #31:
Yes sorry, found out that my assumptions were wrong, never really handled to reproduce it, was a bug of mine...
Unless somebody else can confirm this there's an high probability of considering this bug invalid...
Note that bjacques does have SSP enabled and can not reproduce it.
Can't you really give any of gnash developers a shell access on that host ?
|
Fri 10 Nov 2006 04:52:03 PM UTC, comment #30:
It sill dumps core with this patch applied.
I'm testing with gprocessor and a very simple 2-line flash that strk gave me.
|
Fri 10 Nov 2006 08:36:26 AM UTC, comment #29:
It seems I was able to reproduce the error.. seems related to tu_free (tu_string dtor).
Sounds like the static initialization/destruction of the event_id function names goes woo woo. Changing the event_id::get_function_name function to initialize char* instead of tu_string and return that fixes it for me.
The patch is attached, is for the release branch.
Please test (event_id.patch).
|
Fri 10 Nov 2006 06:57:11 AM UTC, comment #28:
deanna, if you can provide me with a shell on the system with propolice activated (still no success for me enabling it)
I'll more easily track the problem. I want this fixed for 0.7.2.
|
Fri 10 Nov 2006 06:38:06 AM UTC, comment #27:
I did try stepping back in time a little, but all I can really say is that it was in mid or early october. There are just too many other bugs that I have to patch by hand with each datespec checkout. Sorry.
Someone suggested I try undef'ing LOAD_MOVIES_IN_A_SEPARATE_THREAD in server/parser/movie_def_impl.cpp, which I did, and it didn't change anything. Still aborting with :
stack overflow in function virtual bool gnash::sprite_instance::on_event(gnash::event_id)
|
Mon 06 Nov 2006 11:37:32 PM UTC, comment #26:
Yes, that would help.
You can use that info to update your working copy and find the exact commit that introduced the bug. Seems a long task...
(and I know you guys suspect my thouching of smart_ptr.h, which
could really be)
|
Mon 06 Nov 2006 11:06:01 PM UTC, comment #25:
I have syslog entries dating back to when this bug was introduced. They always say the same thing:
Oct 23 20:18:35 poa-alpina gnash: stack overflow in function virtual bool gnash::sprite_instance::on_event(gnash::event_id)
And that's the very first one. Maybe the date will help pinpoint it?
|
Mon 06 Nov 2006 11:02:49 PM UTC, comment #24:
Right, strk's larger patch doesn't seem to have an effect.
[/usr/ports/mystuff/www/gnash/w-gnash-110606/gnash/utilities] poa-alpina% libtool --mode=execute gdb --args ../testsuite/movies.all/gravity.swf gprocessor
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-unknown-openbsd4.0"..."/usr/ports/mystuff/www/gnash/w-gnash-110606/gnash/testsuite/movies.all/gravity.swf": not in executable format: File format not recognized
[/usr/ports/mystuff/www/gnash/w-gnash-110606/gnash/utilities] poa-alpina% libtool --mode=execute gdb gprocessor
GNU gdb 6.3
(gdb) run
Starting program: /usr/ports/mystuff/www/gnash/w-gnash-110606/gnash/utilities/.libs/gprocessor ../testsuite/movies.all/gravity.swf
[New process 21768, thread 0x7fddf000]
Program received signal SIGABRT, Aborted.
[Switching to process 21768, thread 0x7fddf000]
0x05e02ca5 in kill () from /usr/lib/libc.so.40.1
(gdb) bt
#0 0x05e02ca5 in kill () from /usr/lib/libc.so.40.1
#1 0x05e48834 in __stack_smash_handler (func=0x243c11e0 "virtual bool gnash::sprite_instance::on_event(gnash::event_id)",
damaged=0) at /usr/src/lib/libc/sys/stack_protector.c:89
#2 0x0452d249 in gnash::sprite_instance::on_event(gnash::event_id) (this=0x856eea00, id=
{m_id = 30 '\036', m_key_code = 0 '\0'}) at sprite_instance.cpp:1186
#3 0x044efeb9 in gnash::DisplayList::place_character(gnash::character*, unsigned short, gnash::cxform const&, gnash::matrix const&, float, unsigned short) (this=0x856ee8bc, ch=0x856eea00, depth=1, color_xform=@0x86687510, mat=@0x86687530, ratio=0,
clip_depth=0) at dlist.cpp:203
#4 0x0452f131 in gnash::sprite_instance::add_display_object(unsigned short, char const, std::vector<gnash::swf_event, std::allocator<gnash::swf_event*> > const&, unsigned short, bool, gnash::cxform const&, gnash::matrix const&, float, unsigned short) (this=0x856ee800, character_id=2, name=0x7d18f040 "ball", event_handlers=@0x86687554, depth=1,
color_transform=@0x86687510, matrix=@0x86687530, ratio=0, clip_depth=0) at sprite_instance.cpp:1913
#5 0x04574a36 in gnash::SWF::tag_loaders::place_object_2::execute(gnash::movie*) (this=0x86687500, m=0x856ee800)
at swf/tag_loaders.cpp:1045
#6 0x04534286 in std::mem_fun1_t<void, gnash::execute_tag, gnash::movie>::operator()(gnash::execute_tag, gnash::movie*) const (this=0xcf7cb90c, __p=0x86687500, __x=0x856ee800) at stl_function.h:653
#7 0x04534232 in std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> >::operator()(gnash::execute_tag const&) const (this=0xcf7cb90c, __x=@0x8188fd3c) at stl_function.h:396
#8 0x045308f4 in std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> > std::for_each<__gnu_cxx::__normal_iterator<gnash::execute_tag const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> > >(__gnu_cxx::__normal_iterator<gnash::execute_tag* const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, __gnu_cxx::__normal_iterator<gnash::execute_tag const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> >) (__first=
{<std::iterator<std::random_access_iterator_tag, gnash::execute_tag, long, gnash::execute_tag const, gnash::execute_tag const&>> = {<No data fields>}, _M_current = 0x8188fd3c}, __last=
{<std::iterator<std::random_access_iterator_tag, gnash::execute_tag, long, gnash::execute_tag const, gnash::execute_tag const&>> = {<No data fields>}, _M_current = 0x8188fd40}, __f=
{<std::unary_function<gnash::execute_tag, void>> = {<No data fields>}, op = {<std::binary_function<gnash::execute_tag, gnash::movie*, void>> = {<No data fields>}, _M_f = {__pfn = 0x9, __delta = 0}}, value = 0x856ee800}) at stl_algo.h:157
#9 0x0452e5ef in gnash::sprite_instance::execute_frame_tags(unsigned long, bool) (this=0x856ee800, frame=0,
state_only=false) at sprite_instance.cpp:1657
#10 0x0459df25 in gnash::movie_def_impl::create_instance() (this=0x856ee200) at movie_def_impl.cpp:754
#11 0x1c002f03 in play_movie (filename=0xcf7cbdad "../testsuite/movies.all/gravity.swf") at processor.cpp:248
#12 0x1c002ab9 in main (argc=2, argv=0xcf7cbbf8) at processor.cpp:190
(gdb)
|
Mon 06 Nov 2006 10:37:56 PM UTC, comment #23:
I suggest we start again from the beginning.
That gdb output is the call stack at the time of the crash, right?
It seems that the crash happens when the sprite is added to the DisplayList since it crashes in DisplayList::place_character(), more specifically when handling a certain event.
Does this give you an idea?
|
Mon 06 Nov 2006 10:28:08 PM UTC, comment #22:
Yes, there's no movie deletion in gravity.swf, but a patch I sent was initially reported to be fixing the bug, while possibly
exposing the "movie deletion" one...
Anyway, it's all so confusing that I'm getting crazy.
Latest new from Deanna is that the aforementioned patch didn't
really fix the problem (do you confirm Deanna?)
|
Mon 06 Nov 2006 10:18:12 PM UTC, comment #21:
The bug description states that this problem happens with gravity.swf, which does not contain any sprite loading/unloading/replacing code or similar. The smiley ball is added to the stage at design time and is just moved around. So, there should not be any sprite deletion at all...!?
|
Mon 06 Nov 2006 05:55:02 PM UTC, comment #20:
Udo, I think that testcase will help actually.
I attached a second version of the simple patch that Deanna
reports to be fixing the problem for him.
The new version simply adds some assertions and comments about it.
I'd ask Deanna to apply it and run any movie he might find around
reporting eventual new problems (either stack smash or assertions failing).
One of the new assertion failing should be due to premature
deletion of the sprite_instance (what we tried to reproduce with the testcase of Udo) - but it's not guaranteed that the assertions
will work.
Any propolice stack smashing detection will tell us that this patch has nothing to do with our problem (right ?)
|
Sun 05 Nov 2006 05:23:09 PM UTC, comment #19:
well, it is more complete with the 'new instance', anyway I guess it's simpler to just apply that patch and let users find eventual
other bugs introduced by this fix.
Your testcase is still useful, at least to test attachMovie :)
|
Sun 05 Nov 2006 05:21:46 PM UTC, comment #18:
I ask because you can (should) "remove" the MovieClip that's already on the stage (placed there without any ActionScript).
|
Sun 05 Nov 2006 05:19:42 PM UTC, comment #17:
AFAIK MovieClipLoader can be used only to load external SWF files, which is not the case in my example.
I added the "new instance" just for convenience, do you need this at all?
|
Sun 05 Nov 2006 11:38:47 AM UTC, comment #16:
Argh, we don't support attachMovie, it seems :(
Options:
- implement attachMovie (I'm afraid not for tomorrow)
- try another way of creating the instance (MovieClipLoader?)
|
Sun 05 Nov 2006 09:22:44 AM UTC, comment #15:
I've attached a test movie. It contains a MovieClip, which is also made available for runtime access. It also contains three buttons:
=== Button 1 ===
on (release) {
mc1.swapDepths(2); // required by Flash
trace("<"+typeof mc1+">"+mc1+".removeMovieClip() call below");
mc1.removeMovieClip();
}
=== Button 2 ===
on (release) {
trace("unloadMovie(<"+typeof mc1+">"+mc1+") call below");
mc1.unloadMovie();
}
=== Button 3 ===
on (release) {
mc1=this.attachMovie("mc_remove", "mc1", 10);
trace(mc1+" ["+typeof mc1+"] created");
mc1._x = 270;
mc1._y = 54;
}
I hope this helps, not sure it is what you wanted...
|
Sat 04 Nov 2006 08:51:26 PM UTC, comment #14:
FYI, any movie triggers this, but the one I usually test with is gravity.swf.
|
Sat 04 Nov 2006 08:12:22 PM UTC, comment #13:
Ok, the patch below is equivalent to just comment
out the smart_ptr, the 'this_ptr' variable below
is actually NOT used.
Now, I haven't committed it as the comment above
the smart_ptr line warns about a possible problem
araising from actions inside an event removing
the sprite instance from the display list, which
in turn supposedly should decrement the ref-count
which would finally delete the "this" object.
So we should produce a testcase for this situation
to see exactly what would happen.
As for what was happening for deanna I'm really
not sure. The smart_ptr<> assignment should basically
just increment the refcount, and when the function
body ends (which is where propolice detects stack
corruption) the smart_ptr<> dtor is invoked, thus refcount
decremented (possibly deleting the object).
So, at first look what might be happening is that
the function body end triggers self-deletion, trouhgh
virtual destructor of as_object. But if this is
the case, NOT incrementing ref-count should trigger
this self-deletion earlier thus the problem should
be visible earlier (which is not, as for deanna's report).
Another possibility is that the path from as_object
dtor to sprite-instance dtor is not clear (missing
virtual destructors in the chain?).
It seems this is our last show-stopper for 0.7.2 so
I'd like to ask some help to other developers.
In particular, I'd like to ask Udo to produce a testcase
containing a sprite_instance that on some event
(on roll-over, for example) triggers deletion of
the sprite. I'm not sure if this is possible at all
as I think removeObject will be postponed to next
advance. Maybe an unloadMovie would be immediately
executed ? Maybe gravity.swf could (on clik on the
ball) unload itself ?
|
Sat 04 Nov 2006 07:04:52 PM UTC, comment #12:
running with the following change from strk seems to fix this.
--- sprite_instance.cpp.orig Sat Nov 4 11:50:46 2006
+++ sprite_instance.cpp Sat Nov 4 11:52:28 2006
@@ -1111,7 +1111,9 @@
bool sprite_instance::on_event(event_id id)
{
// Keep m_as_environment alive during any method calls!
- smart_ptr<as_object> this_ptr(this);
+// smart_ptr<as_object> this_ptr(this);
+
+ as_object* this_ptr = this;
bool called = false;
|
Sat 04 Nov 2006 04:55:52 PM UTC, comment #11:
... err... it might be better to use -fmudflapth and -lmudflapth
to take threading into accuont (but I dunno what I'm talking about really)
|
Sat 04 Nov 2006 04:51:25 PM UTC, comment #10:
Ok, handled to obtain some debugging from mudflap.
This is just a note to help reproduce it:
apt-get install libmudflap0-dev # or whatever you'd use...
CXXFLAGS=-fmudflap ./configure ...
make LDFLAGS=-lmudflap
utilities/gprocessor testsuite/movies.all/gravity.swf 2> MUDFLAP.log
|
Sat 04 Nov 2006 04:40:42 PM UTC, comment #9:
Tried --disable-shared --enable-static, no luck (maybe could try again after a make clean though, didn't do that)
I'm now trying with -fmudflap thoug...
|
Sat 04 Nov 2006 04:13:16 PM UTC, comment #8:
The only difference between what's installed and what is in the build directory is that the installed versions are stripped.
[/usr/ports/mystuff/www/gnash/w-gnash-110306/gnash] poa-alpina% libtool --mode=execute gdb --args utilities/gprocessor testsuite/movies.all/gravity.swf
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-unknown-openbsd4.0"...
(gdb) run
Starting program: /usr/ports/mystuff/www/gnash/w-gnash-110306/gnash/utilities/.libs/gprocessor testsuite/movies.all/gravity.swf
[New process 12105, thread 0x85384000]
Program received signal SIGABRT, Aborted.
[Switching to process 12105, thread 0x85384000]
0x00f38975 in kill () from /usr/lib/libc.so.40.0
(gdb) bt
#0 0x00f38975 in kill () from /usr/lib/libc.so.40.0
#1 0x00f7e410 in __stack_smash_handler (func=0x2294e160 "virtual bool gnash::sprite_instance::on_event(gnash::event_id)",
damaged=0) at /usr/src/lib/libc/sys/stack_protector.c:89
#2 0x02ab9e1a in gnash::sprite_instance::on_event(gnash::event_id) (this=0x7c7e2800, id=
{m_id = 30 '\036', m_key_code = 0 '\0'}) at sprite_instance.cpp:1150
#3 0x02a7cb09 in gnash::DisplayList::place_character(gnash::character*, unsigned short, gnash::cxform const&, gnash::matrix const&, float, unsigned short) (this=0x7c7e26bc, ch=0x7c7e2800, depth=1, color_xform=@0x82ef1410, mat=@0x82ef1430, ratio=0,
clip_depth=0) at dlist.cpp:203
#4 0x02abbd03 in gnash::sprite_instance::add_display_object(unsigned short, char const, std::vector<gnash::swf_event, std::allocator<gnash::swf_event*> > const&, unsigned short, bool, gnash::cxform const&, gnash::matrix const&, float, unsigned sho
rt) (this=0x7c7e2600, character_id=2, name=0x80da2070 "ball", event_handlers=@0x82ef1454, depth=1,
color_transform=@0x82ef1410, matrix=@0x82ef1430, ratio=0, clip_depth=0) at sprite_instance.cpp:1877
#5 0x02b010c6 in gnash::SWF::tag_loaders::place_object_2::execute(gnash::movie*) (this=0x82ef1400, m=0x7c7e2600)
at swf/tag_loaders.cpp:1045
#6 0x02ac1032 in std::mem_fun1_t<void, gnash::execute_tag, gnash::movie>::operator()(gnash::execute_tag, gnash::movie*) const (this=0xcf7eb2ac, __p=0x82ef1400, __x=0x7c7e2600) at stl_function.h:653
#7 0x02ac0fde in std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> >::operator()(gnash::execute_tag const&) const (this=0xcf7eb2ac, __x=@0x8a1eed44) at stl_function.h:396
#8 0x02abd57c in std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> > std::for_each<__gnu_cxx::__normal_iterator<gnash::execute_tag const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> > >(__gnu_cxx::__normal_iterator<gnash::execute_tag* const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, __gnu_cxx::__normal_iterator<gnash::execute_tag const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> >) (__first=
{<std::iterator<std::random_access_iterator_tag, gnash::execute_tag, long, gnash::execute_tag const, gnash::execute_tag const&>> = {<No data fields>}, _M_current = 0x8a1eed44}, __last=
{<std::iterator<std::random_access_iterator_tag, gnash::execute_tag, long, gnash::execute_tag const, gnash::execute_tag const&>> = {<No data fields>}, _M_current = 0x8a1eed48}, __f=
{<std::unary_function<gnash::execute_tag, void>> = {<No data fields>}, op = {<std::binary_function<gnash::execute_tag, gnash::movie*, void>> = {<No data fields>}, _M_f = {__pfn = 0x9, __delta = 0}}, value = 0x7c7e2600}) at stl_algo.h:157
#9 0x02abb1c1 in gnash::sprite_instance::execute_frame_tags(unsigned long, bool) (this=0x7c7e2600, frame=0,
state_only=false) at sprite_instance.cpp:1621
#10 0x02b2a0dd in gnash::movie_def_impl::create_instance() (this=0x7c7e2200) at movie_def_impl.cpp:754
#11 0x1c002e65 in play_movie (filename=0xcf7eb725 "testsuite/movies.all/gravity.swf") at processor.cpp:248
#12 0x1c002a45 in main (argc=2, argv=0xcf7eb570) at processor.cpp:190
(gdb)
|
Sat 04 Nov 2006 03:03:17 PM UTC, comment #7:
Have you tried reconfiguring with --disable-shared ? At that point it'll be a statically linked executable.
|
Sat 04 Nov 2006 02:32:13 PM UTC, comment #6:
mm.. running .libs/gprocessor will use the installed libs, not the one from the build-tree, could you check that you get the same
behaivour when running
libtool --mode=execute gdb --args utilities/gprocessor <path_to_movie>
(ok, next step for me would be installing the propolice software)
|
Sat 04 Nov 2006 12:14:51 AM UTC, comment #5:
[/usr/ports/mystuff/www/gnash/w-gnash-110306/gnash/utilities/.libs] poa-alpina% gdb gprocessor
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-unknown-openbsd4.0"...
(gdb) set args ../../testsuite/movies.all/gravity.swf
(gdb) run
Starting program: /usr/ports/mystuff/www/gnash/w-gnash-110306/gnash/utilities/.libs/gprocessor ../../testsuite/movies.all/gravity.swf
[New process 15222, thread 0x87e1e000]
Program received signal SIGABRT, Aborted.
[Switching to process 15222, thread 0x87e1e000]
0x02fde975 in kill () from /usr/lib/libc.so.40.0
(gdb) bt
#0 0x02fde975 in kill () from /usr/lib/libc.so.40.0
#1 0x03024410 in __stack_smash_handler (func=0x2d865160 "virtual bool gnash::sprite_instance::on_event(gnash::event_id)",
damaged=0) at /usr/src/lib/libc/sys/stack_protector.c:89
#2 0x0d9d0e1a in gnash::sprite_instance::on_event(gnash::event_id) (this=0x82989800, id=
{m_id = 30 '\036', m_key_code = 0 '\0'}) at sprite_instance.cpp:1150
#3 0x0d993b09 in gnash::DisplayList::place_character(gnash::character*, unsigned short, gnash::cxform const&, gnash::matrix const&, float, unsigned short) (this=0x829896bc, ch=0x82989800, depth=1, color_xform=@0x82bbb410, mat=@0x82bbb430, ratio=0,
clip_depth=0) at dlist.cpp:203
#4 0x0d9d2d03 in gnash::sprite_instance::add_display_object(unsigned short, char const, std::vector<gnash::swf_event, std::allocator<gnash::swf_event*> > const&, unsigned short, bool, gnash::cxform const&, gnash::matrix const&, float, unsigned short) (this=0x82989600, character_id=2, name=0x7ce0f070 "ball", event_handlers=@0x82bbb454, depth=1,
color_transform=@0x82bbb410, matrix=@0x82bbb430, ratio=0, clip_depth=0) at sprite_instance.cpp:1877
#5 0x0da180c6 in gnash::SWF::tag_loaders::place_object_2::execute(gnash::movie*) (this=0x82bbb400, m=0x82989600)
at swf/tag_loaders.cpp:1045
#6 0x0d9d8032 in std::mem_fun1_t<void, gnash::execute_tag, gnash::movie>::operator()(gnash::execute_tag, gnash::movie*) co
nst (this=0xcf7cd93c, __p=0x82bbb400, __x=0x82989600) at stl_function.h:653
#7 0x0d9d7fde in std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> >::operator()(gnash::execute_tag const&) const (this=0xcf7cd93c, __x=@0x8484cd44) at stl_function.h:396
#8 0x0d9d457c in std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> > std::for_each<__gnu_cxx::__normal_iterator<gnash::execute_tag const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> > >(__gnu_cxx::__normal_iterator<gnash::execute_tag* const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, __gnu_cxx::__normal_iterator<gnash::execute_tag const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> >) (__first=
{<std::iterator<std::random_access_iterator_tag, gnash::execute_tag, long, gnash::execute_tag const, gnash::execute_tag const&>> = {<No data fields>}, _M_current = 0x8484cd44}, __last=
{<std::iterator<std::random_access_iterator_tag, gnash::execute_tag, long, gnash::execute_tag const, gnash::execute_tag const&>> = {<No data fields>}, _M_current = 0x8484cd48}, __f=
{<std::unary_function<gnash::execute_tag, void>> = {<No data fields>}, op = {<std::binary_function<gnash::execute_tag, gnash::movie*, void>> = {<No data fields>}, _M_f = {__pfn = 0x9, __delta = 0}}, value = 0x82989600}) at stl_algo.h:157
#9 0x0d9d21c1 in gnash::sprite_instance::execute_frame_tags(unsigned long, bool) (this=0x82989600, frame=0,
state_only=false) at sprite_instance.cpp:1621
#10 0x0da410dd in gnash::movie_def_impl::create_instance() (this=0x82989200) at movie_def_impl.cpp:754
#11 0x1c002e65 in play_movie (filename=0xcf7cddb9 "../../testsuite/movies.all/gravity.swf") at processor.cpp:248
#12 0x1c002a45 in main (argc=2, argv=0xcf7cdc04) at processor.cpp:190
|
Fri 03 Nov 2006 11:37:24 PM UTC, comment #4:
can you reproduce this by only running gprocessor (would simplify things)
|
Fri 03 Nov 2006 04:12:23 PM UTC, comment #3:
No change; it still aborts immediately on any flash I try to play (any of those in movies.all)
from release_0_7_2, less than one hour ago.
|
Thu 02 Nov 2006 10:39:43 PM UTC, comment #2:
My valgrind errors are gone in both HEAD and 0.7.2 branch now, could you try reproducing the segfault ?
Does it happen with gprocessor alone ?
|
Fri 27 Oct 2006 12:52:10 PM UTC, comment #1:
Here's valgrind output (gprocessor -v):
==18682== Conditional jump or move depends on uninitialised value(s)
==18682== at 0x409B859: gnash::DisplayList::place_character(gnash::character*
, unsigned short, gnash::cxform const&, gnash::matrix const&, float, unsigned sh
ort) (movie_interface.h:281)
==18682== by 0x40CB04E: gnash::sprite_instance::add_display_object(unsigned s
hort, char const, std::vector<gnash::swf_event, std::allocator<gnash::swf_even
t*> > const&, unsigned short, bool, gnash::cxform const&, gnash::matrix const&,
float, unsigned short) (smart_ptr.h:66)
==18682== by 0x41258A0: gnash::SWF::tag_loaders::place_object_2::execute(gnas
h::movie*) (tag_loaders.cpp:1063)
==18682== by 0x40CCD8A: std::binder2nd<std::mem_fun1_t<void, gnash::execute_t
ag, gnash::movie*> > std::for_each<__gnu_cxx::__normal_iterator<gnash::execute_t
ag* const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag*>
> >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie*> >
>(__gnu_cxx::__normal_iterator<gnash::execute_tag* const*, std::vector<gnash::ex
ecute_tag, std::allocator<gnash::execute_tag> > >, __gnu_cxx::__normal_iterato
r<gnash::execute_tag* const, std::vector<gnash::execute_tag, std::allocator<gn
ash::execute_tag*> > >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag,
gnash::movie*> >) (stl_function.h:653)
==18682== by 0x40CA373: gnash::sprite_instance::execute_frame_tags(unsigned,
bool) (stl_vector.h:363)
==18682== by 0x4163092: gnash::movie_def_impl::create_instance() (movie_def_i
mpl.cpp:772)
==18682== by 0x8049DA9: play_movie(char const*) (processor.cpp:256)
==18682== by 0x80498AA: main (stl_vector.h:501)
|
Tue 24 Oct 2006 04:09:31 PM UTC, original submission:
I'm getting an abort on any flash I try to play, since yesterday sometime. This is probably only caught on systems that use stack smashing protection (OpenBSD by default, optional on debian, gentoo and others)
zsh: abort (core dumped) gnash ../../testsuite/movies.all/gravity.swf
[/usr/ports/mystuff/www/gnash/w-gnash-102406/gnash/gui/.libs] poa-alpina% gdb gnash gnash.core
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-unknown-openbsd4.0"...
Core was generated by `gnash'.
Program terminated with signal 6, Aborted.
....
(gdb) bt
#0 0x0885f975 in kill () from /usr/lib/libc.so.40.0
#1 0x088a5410 in __stack_smash_handler (func=0x29936f20 "virtual bool gnash::sprite_instance::on_event(gnash::event_id)",
damaged=0) at /usr/src/lib/libc/sys/stack_protector.c:89
#2 0x09aa8d8c in gnash::sprite_instance::on_event(gnash::event_id) (this=0x841f7400, id=
{m_id = 30 '\036', m_key_code = 0 '\0'}) at sprite_instance.cpp:1147
#3 0x09a6bb05 in gnash::DisplayList::place_character(gnash::character*, unsigned short, gnash::cxform const&, gnash::matrix const&, float, unsigned short) (this=0x841f72c0, ch=0x841f7400, depth=1, color_xform=@0x841eb490, mat=@0x841eb4b0, ratio=0,
clip_depth=0) at dlist.cpp:201
#4 0x09aaac05 in gnash::sprite_instance::add_display_object(unsigned short, char const, std::vector<gnash::swf_event, std::allocator<gnash::swf_event*> > const&, unsigned short, bool, gnash::cxform const&, gnash::matrix const&, float, unsigned short) (this=0x841f7200, character_id=2, name=0x8b2b6840 "ball", event_handlers=@0x841eb4d4, depth=1,
color_transform=@0x841eb490, matrix=@0x841eb4b0, ratio=0, clip_depth=0) at sprite_instance.cpp:1865
#5 0x09aedf4a in gnash::SWF::tag_loaders::place_object_2::execute(gnash::movie*) (this=0x841eb480, m=0x841f7200)
at swf/tag_loaders.cpp:1063
#6 0x09aafec6 in std::mem_fun1_t<void, gnash::execute_tag, gnash::movie>::operator()(gnash::execute_tag, gnash::movie*) const (this=0xcf7ebd9c, __p=0x841eb480, __x=0x841f7200) at stl_function.h:653
#7 0x09aafe72 in std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> >::operator()(gnash::execute_tag const&) const (this=0xcf7ebd9c, __x=@0x8a80e03c) at stl_function.h:396
#8 0x09aac438 in std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> > std::for_each<__gnu_cxx::__normal_iterator<gnash::execute_tag const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> > >(__gnu_cxx::__normal_iterator<gnash::execute_tag* const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, __gnu_cxx::__normal_iterator<gnash::execute_tag const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, std::binder2nd<std::mem_fun1_t<void, gnash::execute_tag, gnash::movie> >) (__first=
{<std::iterator<std::random_access_iterator_tag, gnash::execute_tag, long, gnash::execute_tag const, gnash::execute_tag const&>> = {<No data fields>}, _M_current = 0x8a80e03c}, __last=
{<std::iterator<std::random_access_iterator_tag, gnash::execute_tag, long, gnash::execute_tag const, gnash::execute_tag const&>> = {<No data fields>}, _M_current = 0x8a80e040}, __f=
{<std::unary_function<gnash::execute_tag, void>> = {<No data fields>}, op = {<std::binary_function<gnash::execute_tag, gnash::movie*, void>> = {<No data fields>}, _M_f = {__pfn = 0x9, __delta = 0}}, value = 0x841f7200}) at stl_algo.h:157
#9 0x09aaa10e in gnash::sprite_instance::execute_frame_tags(unsigned long, bool) (this=0x841f7200, frame=0,
state_only=false) at sprite_instance.cpp:1616
#10 0x09b15dd9 in gnash::movie_def_impl::create_instance() (this=0x8722be00) at movie_def_impl.cpp:772
#11 0x09a8c652 in gnash::create_library_movie_inst(gnash::movie_definition*) (md=0x8722be00) at impl.cpp:703
#12 0x020ca5d8 in gnash::Player::run(int, char*, char const, char const*) (this=0xcf7ec014, argc=2, argv=0xcf7ec0d0,
infile=0xcf7ec236 "../../testsuite/movies.all/gravity.swf", url=0x0) at Player.cpp:324
#13 0x1c003aff in ~Player (this=0x2) at Player.h:74
#14 0x1c0030e0 in parseCommandLine (argc=2, argv=0xcf7ec0d0, player=@0xcf7ec0dc) at gnash.cpp:151
#15 0x1c00304f in __register_frame_info ()
#16 0xcf7ec230 in ?? ()
#17 0xcf7ec236 in ?? ()
#18 0x00000000 in ?? ()
|