Tue 07 Nov 2006 04:31:13 PM UTC, comment #31:
Click & Coredump bug is ready for test.
Expected result now is Click & GetABlankRectangleOnTop
(in release branch - will fwd port shortly)
|
Tue 07 Nov 2006 02:40:10 PM UTC, comment #30:
I added the assertions locally, so I see
that the problem originates in begin_display()
where the following would not succeeed.
assert(m_clip_xmax > m_clip_xmin);
assert(m_clip_ymax > m_clip_ymin);
Where does the renderer get those values from ?
Seems originating from set_invalidated_bounds...
Maybe the call in GTK's expose event is just wrong ?
Addin assertions checking inside it would help.
Also, using those big numbers doesn't seem safe to me.
Btw, m_clip_* are never initialized
|
Tue 07 Nov 2006 02:33:27 PM UTC, comment #29:
No, as I already pointed out the negative value becomes a very large positive value when converted to an unsigned int. This leads into clear_framebuffer() trying to set somewhat near 2^32 bytes for each line - no wonder this causes a segfault.
The negative value means that the invalidated bounds passed are min > max
Strange.
|
Tue 07 Nov 2006 12:55:15 PM UTC, comment #28:
mm.. if theres' no reason for width/height to be negative
you should keep the unsigned signature.
Rather, what triggers the segfault ? I assume you're
writing beyond an allocated buffer. In taht case
please add an assertion in the function body checking
for consistency so we can back-trace.
Yes, I get the warnings (2):
clear_framebuffer() called with width=-27
Considet that I'm now trying to fix a bug that's exposed
when you click on any of the text button, but if
the above warning does really tell that memory is corrupted
it would be much better to stop there as any new bug
would be hell to track.
|
Tue 07 Nov 2006 12:35:43 PM UTC, comment #27:
Backported.
However, this is not a correct bugfix as there is no reason why clear_framebuffer() should be called with negative width or height...
Patch can be seen at
http://cvs.savannah.gnu.org/viewcvs/gnash/backend/render_handler_agg.cpp?cvsroot=gnash&only_with_tag=release_0_7_2&r1=1.29.2.13&r2=1.29.2.14
|
Tue 07 Nov 2006 11:54:31 AM UTC, comment #26:
Meanwhile it seems I made some progress with the button event thing. The patch I have, which fixes the segfault for me, is
pretty destructive... it basically removes all uses of weak_ptr
objects, adds some more smart_ptr usages (it seems we were
not properly incrementing ref count on some references).
What I could do is commit this in head, but before doing
it I'd like someone else to reproduce the bug in head.
The bug, as I reproduce it, is with GLIBCPP_FORCE_NEW
set to 1 (force real deletion when asked so) and clicking
on any small text of that movie.
|
Tue 07 Nov 2006 11:30:56 AM UTC, comment #25:
I can confirm this... Crashes 0.7.2-agg, but not head-agg. OpenGl plays it fine in both 0.7.2 and head.
|
Tue 07 Nov 2006 10:54:15 AM UTC, comment #24:
I confirm the AGG segfault is fixed in head, please back-port it.
Still, this bug should remain opened, as it seems to be exposing
the "character-disappeared-due-to-event" which we discussed
about.
In head it just segfault after you press a button.
|
Tue 07 Nov 2006 10:09:59 AM UTC, comment #23:
This is a duplicate of #18211. Please try with CVS-HEAD and tell if it works.
|
Tue 07 Nov 2006 09:40:52 AM UTC, comment #22:
This I get with gtk/cairo:
[Switching to Thread -1225783616 (LWP 13195)]
0x000000ff in ?? ()
(gdb) bt
#0 0x000000ff in ?? ()
#1 0xb7e250f3 in ~button_character_instance (this=0x814a520)
at button_character_instance.h:76
#2 0xb7e1764d in gnash::generate_mouse_button_events (ms=0x8112830)
at ref_counted.h:71
#3 0xb7e178e7 in gnash::movie_root::fire_mouse_event (this=0x81127c0)
at /usr/src/gnash/gnash-0.7.2-branch/server/movie_root.cpp:337
Seems really related to button events.
We keep pointers to char_below_the_mouse using a weak_ptr.
|
Tue 07 Nov 2006 09:19:04 AM UTC, comment #21:
Still with 0.7.2, gt/agg, no mouse intervention:
(gdb) bt
#0 0x4008b88a in agg::pixfmt_alpha_blend_rgb<agg::blender_rgb<agg::rgba8, agg::order_rgb>, agg::row_accessor<unsigned char> >::copy_hline (this=0x80cf660,
x=0, y=0, len=4294665533, c=@0xbffff104) at agg_pixfmt_rgb.h:321
#1 0x4008b825 in gnash::render_handler_agg<agg::pixfmt_alpha_blend_rgb<agg::blender_rgb<agg::rgba8, agg::order_rgb>, agg::row_accessor<unsigned char> > >::clear_framebuffer (this=0x80c1bb8, left=0, top=0, width=4294967269, height=271,
color={r = 46 '.', g = 96 '`', b = 170 'ª', a = 255 'ÿ'})
at /home/strk/src/gnash/gnash-0.7.2-branch/backend/render_handler_agg.cpp:532
#2 0x4006c346 in gnash::render_handler_agg<agg::pixfmt_alpha_blend_rgb<agg::blender_rgb<agg::rgba8, agg::order_rgb>, agg::row_accessor<unsigned char> > >::begin_display (this=0x80c1bb8, background_color=
{m_r = 46 '.', m_g = 96 '`', m_b = 170 'ª', m_a = 255 'ÿ'})
at /home/strk/src/gnash/gnash-0.7.2-branch/backend/render_handler_agg.cpp:503
#3 0x40223159 in gnash::render::begin_display (background_color=
{m_r = 46 '.', m_g = 96 '`', m_b = 170 'ª', m_a = 255 'ÿ'},
viewport_x0=0, viewport_y0=0, viewport_width=492, viewport_height=340,
x0=0, x1=9840, y0=0, y1=6800)
|
Tue 07 Nov 2006 09:15:27 AM UTC, comment #20:
Oh, I can click on it (with MovieTester) :)
Good to know this is related to events, as might be related to another stack smashing bug (18100).
It seems that an event truggers deletion of a character (a button?)
Anyway, I might be really burned but I do can produce a segfault
by playing sugarbowl_1.swf with -r0 flag :/
Seems generated in the URL class.
Does anyone else see this bug at all ?!
|
Tue 07 Nov 2006 08:52:46 AM UTC, comment #19:
r0 and r2 disable rendering, so I can't click on the link on the file.
Can't compile AGG on my Slackware 10.2. Filed a bug report here:
http://sourceforge.net/tracker/index.php?func=detail&aid=1585861&group_id=42020&atid=431925
but no response so far.
|
Tue 07 Nov 2006 08:46:19 AM UTC, comment #18:
Can you reproduce the same thing by running gnash with the -r0 flag ? and with the -r2 flag ? and with AGG renderer ?
|
Tue 07 Nov 2006 08:07:23 AM UTC, comment #17:
1) OK, I enabled debugging and compiled current 0.7.2 with --enable-i810-lod-bias
2) Now fails with:
pure virtual method called
Aborted
Backtrace:
{{{
$ sudo gdb gnash
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-slackware-linux"...Using host libthread_db library "/lib/tls/libthread_db.so.1".
(gdb) run sugarbowl_1.swf
Starting program: /usr/local/bin/gnash sugarbowl_1.swf
[Thread debugging using libthread_db enabled]
[New Thread -1226864960 (LWP 18711)]
Detaching after fork from child process 18714.
Detaching after fork from child process 18715.
Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread -1226864960 (LWP 18711)]
0xb6d5badc in _mesa_test_os_sse_exception_support () from /usr/X11R6/lib/modules/dri/i915_dri.so
(gdb) c
Continuing.
[New Thread -1270588496 (LWP 18716)]
[Thread -1270588496 (zombie) exited]
pure virtual method called
Program received signal SIGABRT, Aborted.
0xb6f9a027 in raise () from /lib/tls/libc.so.6
(gdb) bt
#0 0xb6f9a027 in raise () from /lib/tls/libc.so.6
#1 0xb6f9b747 in abort () from /lib/tls/libc.so.6
#2 0xb7148694 in __cxa_call_unexpected () from /usr/lib/./libstdc++.so.5
#3 0xb71486d1 in std::terminate () from /usr/lib/./libstdc++.so.5
#4 0xb7148c08 in __cxa_pure_virtual () from /usr/lib/./libstdc++.so.5
#5 0xb7d9c6b0 in gnash::button_character_instance::get_root (this=0x8340268) at button_character_instance.h:76
#6 0xb7d9a7dc in ~button_character_instance (this=0x8340268) at button_character_instance.cpp:191
#7 0xb7ee8c68 in gnash::ref_counted::drop_ref (this=0x8340268) at ref_counted.h:71
#8 0xb7d8cbe5 in ~smart_ptr (this=0xbf92fda0) at smart_ptr.h:55
#9 0xb7d8bf86 in gnash::generate_mouse_button_events (ms=0x82b5b84) at movie_root.cpp:323
#10 0xb7d8c068 in gnash::movie_root::fire_mouse_event (this=0x82b5b20) at movie_root.cpp:337
#11 0xb7d8b94f in gnash::movie_root::notify_mouse_clicked (this=0x82b5b20, mouse_pressed=true, button_mask=1)
at movie_root.cpp:121
#12 0xb7bbf2a5 in gnash::Gui::notify_mouse_clicked (this=0x8051560, mouse_pressed=true, mask=1) at gui.cpp:216
#13 0xb7bbdfc5 in gnash::GtkGui::button_press_event (event=0x80ffd30, data=0x8051560) at gtk.cpp:786
#14 0xb74760ce in gtk_marshal_VOID__UINT_STRING () from /usr/lib/./libgtk-x11-2.0.so.0
#15 0xb7217cb6 in g_closure_invoke () from /usr/lib/./libgobject-2.0.so.0
#16 0xb722948f in g_signal_emit_by_name () from /usr/lib/./libgobject-2.0.so.0
#17 0xb722833a in g_signal_emit_valist () from /usr/lib/./libgobject-2.0.so.0
#18 0xb72287e6 in g_signal_emit () from /usr/lib/./libgobject-2.0.so.0
#19 0xb75658a7 in gtk_widget_send_expose () from /usr/lib/./libgtk-x11-2.0.so.0
#20 0xb7474be2 in gtk_propagate_event () from /usr/lib/./libgtk-x11-2.0.so.0
#21 0xb7473a36 in gtk_main_do_event () from /usr/lib/./libgtk-x11-2.0.so.0
#22 0xb731e085 in gdk_x11_register_standard_event_type () from /usr/lib/./libgdk-x11-2.0.so.0
#23 0xb71aac02 in g_main_depth () from /usr/lib/./libglib-2.0.so.0
#24 0xb71abc78 in g_main_context_dispatch () from /usr/lib/./libglib-2.0.so.0
#25 0xb71abfb0 in g_main_context_dispatch () from /usr/lib/./libglib-2.0.so.0
#26 0xb71ac553 in g_main_loop_run () from /usr/lib/./libglib-2.0.so.0
#27 0xb74732e3 in gtk_main () from /usr/lib/./libgtk-x11-2.0.so.0
#28 0xb7bbcb9d in gnash::GtkGui::run (this=0x8051560) at gtk.cpp:272
#29 0x0804e1c4 in gnash::Player::run (this=0xbf930540, argc=2, argv=0xbf930624, infile=0xbf9315fd "sugarbowl_1.swf",
url=0x0) at Player.cpp:342
#30 0x0804bad5 in main (argc=2, argv=0xbf930624) at gnash.cpp:309
}}}
|
Mon 06 Nov 2006 05:04:53 PM UTC, comment #16:
ok, a couple more requests:
1) build gnash from the release_0_7_2 branch and enable debugging symbols (CXXFLAGS=-g)
2) run the test again and again show gdb backtrace if still failing
Thanks
|
Mon 06 Nov 2006 05:00:18 PM UTC, comment #15:
I get this:
(gdb) bt
#0 0xb7177027 in raise () from /lib/tls/libc.so.6
#1 0xb7178747 in abort () from /lib/tls/libc.so.6
#2 0xb717085f in __assert_fail () from /lib/tls/libc.so.6
#3 0xb7fa3075 in render_handler_ogl::fill_style_bitmap () from /usr/local/lib/libgnashbackend.so.0
#4 0xb7e7b1b5 in gnash::button_character_instance::~button_character_instance () from /usr/local/lib/libgnashserver.so.0
#5 0xb7e6982c in gnash::generate_mouse_button_events () from /usr/local/lib/libgnashserver.so.0
#6 0xb7e6996f in gnash::movie_root::fire_mouse_event () from /usr/local/lib/libgnashserver.so.0
#7 0xb7e69308 in gnash::movie_root::notify_mouse_clicked () from /usr/local/lib/libgnashserver.so.0
#8 0xb7d9b752 in gnash::Gui::notify_mouse_clicked () from /usr/local/lib/libgnashgui.so.0
#9 0xb7d9a963 in gnash::GtkGui::button_press_event () from /usr/local/lib/libgnashgui.so.0
#10 0xb76530ce in gtk_marshal_VOID__UINT_STRING () from /usr/lib/./libgtk-x11-2.0.so.0
#11 0xb73f4cb6 in g_closure_invoke () from /usr/lib/./libgobject-2.0.so.0
#12 0xb740648f in g_signal_emit_by_name () from /usr/lib/./libgobject-2.0.so.0
#13 0xb740533a in g_signal_emit_valist () from /usr/lib/./libgobject-2.0.so.0
#14 0xb74057e6 in g_signal_emit () from /usr/lib/./libgobject-2.0.so.0
#15 0xb77428a7 in gtk_widget_send_expose () from /usr/lib/./libgtk-x11-2.0.so.0
#16 0xb7651be2 in gtk_propagate_event () from /usr/lib/./libgtk-x11-2.0.so.0
#17 0xb7650a36 in gtk_main_do_event () from /usr/lib/./libgtk-x11-2.0.so.0
#18 0xb74fb085 in gdk_x11_register_standard_event_type () from /usr/lib/./libgdk-x11-2.0.so.0
#19 0xb7387c02 in g_main_depth () from /usr/lib/./libglib-2.0.so.0
#20 0xb7388c78 in g_main_context_dispatch () from /usr/lib/./libglib-2.0.so.0
#21 0xb7388fb0 in g_main_context_dispatch () from /usr/lib/./libglib-2.0.so.0
#22 0xb7389553 in g_main_loop_run () from /usr/lib/./libglib-2.0.so.0
#23 0xb76502e3 in gtk_main () from /usr/lib/./libgtk-x11-2.0.so.0
#24 0xb7d996a1 in gnash::GtkGui::run () from /usr/local/lib/libgnashgui.so.0
#25 0x0804cd5c in gnash::Player::run ()
#26 0x0804ae2c in main ()
|
Mon 06 Nov 2006 04:55:06 PM UTC, comment #14:
Give 'bt' (backtrace) to gdb instead of 'c' (continue) the second time it stops (when you get the Assertion)
|
Mon 06 Nov 2006 04:50:09 PM UTC, comment #13:
Attached the valgrind output with --enable-i810-lod-bias (seems the same to me).
Backtrace(This is the first time I try gdb):
$ sudo gdb gnash
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-slackware-linux"...Using host libthread_db library "/lib/tls/libthread_db.so.1".
(gdb) run sugarbowl_1.swf
Starting program: /usr/local/bin/gnash sugarbowl_1.swf
[Thread debugging using libthread_db enabled]
[New Thread -1225230656 (LWP 24480)]
Detaching after fork from child process 24483.
Detaching after fork from child process 24484.
Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread -1225230656 (LWP 24480)]
0xb6eeaadc in _mesa_test_os_sse_exception_support () from /usr/X11R6/lib/modules/dri/i915_dri.so
(gdb) c
Continuing.
[New Thread -1268954192 (LWP 24485)]
[Thread -1268954192 (zombie) exited]
gnash: render_handler_ogl.cpp:524: virtual void render_handler_ogl::fill_style_bitmap(int, const gnash::bitmap_info*, const gnash::matrix&, gnash::render_handler::bitmap_wrap_mode): Assertion `fill_side >= 0 && fill_side < 2' failed.
Program received signal SIGABRT, Aborted.
0xb7129027 in raise () from /lib/tls/libc.so.6
(gdb) c
Continuing.
Couldn't get registers: No such process.
|
Mon 06 Nov 2006 03:46:17 PM UTC, comment #12:
Ok, read it.
Well, it really looks like a DRI bug.
Is it withOUT --enable-i810-lod-bias ?
I was interested in the other one, the one
you get with --enabl-i810-lod-bias ...
That's interesting to me (as it looks like a gnash bug)
Any chance you can send a backtrace of the Abort ?
|
Mon 06 Nov 2006 03:34:00 PM UTC, comment #11:
It'a a gzip file, works fine with me.
|
Mon 06 Nov 2006 03:16:36 PM UTC, comment #10:
mmm.. the attached .zip seems corrupted, or at least I can't
unzip after download. Yes, I'm interested in it.
|
Mon 06 Nov 2006 03:12:28 PM UTC, comment #9:
Note that I get the same error even without --enable-i810-lod-bias . If can be of help I put again the output of valgrind with current 0.7.2:
$ sudo gnash --version
Gnash 0.7.2
Copyright (C) 2006 Free Software Foundation, Inc.
Gnash comes with NO WARRANTY, to the extent permitted by law.
You may redistribute copies of Gnash under the terms of the GNU General
Public License. For more information, see the file named COPYING.
Build options 0.7.2
Renderer: opengl GUI: gtk Sound handler: sdl Decoder: mad
|
Mon 06 Nov 2006 02:41:39 PM UTC, comment #8:
nothing sorry, was about to ask you to reproduce with gprocessor, but that would not use the ogl.cpp file.
Somoone will need to try at reproducing this. It seems 0.7.2 could
wait for another month :)
|
Mon 06 Nov 2006 02:36:05 PM UTC, comment #7:
Please? :)
|
Mon 06 Nov 2006 02:09:48 PM UTC, comment #6:
Please
|
Mon 06 Nov 2006 01:53:05 PM UTC, comment #5:
I build current 0.7.2 with --enable-i810-lod-bias and now I get this:
gnash: render_handler_ogl.cpp:524: virtual void render_handler_ogl::fill_style_bitmap(int, const gnash::bitmap_info*, const gnash::matrix&, gnash::render_handler::bitmap_wrap_mode): Assertion `fill_side >= 0 && fill_side < 2' failed.
Aborted
|
Fri 03 Nov 2006 10:19:49 AM UTC, comment #4:
Seem to be a MESA/DRI/DRM issue, so this should go upstreams... AGG might however be to prefer as backend. Might try to enable the i810 LOD Bias hack and see if that works...
|
Fri 03 Nov 2006 09:32:41 AM UTC, comment #3:
This is still present in current CVS, 0.7.2 branch.
valgrind output attached.
|
Fri 27 Oct 2006 12:27:07 PM UTC, comment #2:
I am on a Slackware 10.2. gnash is current CVS:
$ uname -a
Linux pedretti-linux-box 2.6.13 #1 Sat Sep 3 21:11:20 PDT 2005 i686 unknown unknown GNU/Linux
$ gnash --version
Gnash 0.7.1-cvs-20061027
|
Fri 27 Oct 2006 10:17:57 AM UTC, comment #1:
Could you provide more information please, system, gnash version etc...
|
Thu 26 Oct 2006 01:07:28 PM UTC, original submission:
Clicking on a link of file #1974 with gnash I get a Segmentation fault
|