bugGnash - The GNU Flash player - Bugs: bug #18120, Segmentation fault on mouse button...

 
 

bug #18120: Segmentation fault on mouse button event

Submitted by:  None
Submitted on:  Thu 26 Oct 2006 01:07:28 PM UTC  
 
Category: coreSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 07 Nov 2006 04:31:13 PM UTC, comment #31:

Click & Coredump bug is ready for test.
Expected result now is Click & GetABlankRectangleOnTop
(in release branch - will fwd port shortly)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 07 Nov 2006 02:40:10 PM UTC, comment #30:

I added the assertions locally, so I see
that the problem originates in begin_display()
where the following would not succeeed.

assert(m_clip_xmax > m_clip_xmin);
assert(m_clip_ymax > m_clip_ymin);

Where does the renderer get those values from ?
Seems originating from set_invalidated_bounds...
Maybe the call in GTK's expose event is just wrong ?
Addin assertions checking inside it would help.
Also, using those big numbers doesn't seem safe to me.
Btw, m_clip_* are never initialized

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 07 Nov 2006 02:33:27 PM UTC, comment #29:

No, as I already pointed out the negative value becomes a very large positive value when converted to an unsigned int. This leads into clear_framebuffer() trying to set somewhat near 2^32 bytes for each line - no wonder this causes a segfault.

The negative value means that the invalidated bounds passed are min > max

Strange.

Udo Giacomozzi <udog>
Project Member
Tue 07 Nov 2006 12:55:15 PM UTC, comment #28:

mm.. if theres' no reason for width/height to be negative
you should keep the unsigned signature.
Rather, what triggers the segfault ? I assume you're
writing beyond an allocated buffer. In taht case
please add an assertion in the function body checking
for consistency so we can back-trace.

Yes, I get the warnings (2):
clear_framebuffer() called with width=-27

Considet that I'm now trying to fix a bug that's exposed
when you click on any of the text button, but if
the above warning does really tell that memory is corrupted
it would be much better to stop there as any new bug
would be hell to track.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 07 Nov 2006 12:35:43 PM UTC, comment #27:

Backported.
However, this is not a correct bugfix as there is no reason why clear_framebuffer() should be called with negative width or height...

Patch can be seen at
http://cvs.savannah.gnu.org/viewcvs/gnash/backend/render_handler_agg.cpp?cvsroot=gnash&only_with_tag=release_0_7_2&r1=1.29.2.13&r2=1.29.2.14

Udo Giacomozzi <udog>
Project Member
Tue 07 Nov 2006 11:54:31 AM UTC, comment #26:

Meanwhile it seems I made some progress with the button event thing. The patch I have, which fixes the segfault for me, is
pretty destructive... it basically removes all uses of weak_ptr
objects, adds some more smart_ptr usages (it seems we were
not properly incrementing ref count on some references).

What I could do is commit this in head, but before doing
it I'd like someone else to reproduce the bug in head.

The bug, as I reproduce it, is with GLIBCPP_FORCE_NEW
set to 1 (force real deletion when asked so) and clicking
on any small text of that movie.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 07 Nov 2006 11:30:56 AM UTC, comment #25:

I can confirm this... Crashes 0.7.2-agg, but not head-agg. OpenGl plays it fine in both 0.7.2 and head.

Tomas Groth <tgc>
Tue 07 Nov 2006 10:54:15 AM UTC, comment #24:

I confirm the AGG segfault is fixed in head, please back-port it.
Still, this bug should remain opened, as it seems to be exposing
the "character-disappeared-due-to-event" which we discussed
about.

In head it just segfault after you press a button.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 07 Nov 2006 10:09:59 AM UTC, comment #23:

This is a duplicate of #18211. Please try with CVS-HEAD and tell if it works.

Udo Giacomozzi <udog>
Project Member
Tue 07 Nov 2006 09:40:52 AM UTC, comment #22:

This I get with gtk/cairo:

[Switching to Thread -1225783616 (LWP 13195)]
0x000000ff in ?? ()
(gdb) bt
#0 0x000000ff in ?? ()
#1 0xb7e250f3 in ~button_character_instance (this=0x814a520)
at button_character_instance.h:76
#2 0xb7e1764d in gnash::generate_mouse_button_events (ms=0x8112830)
at ref_counted.h:71
#3 0xb7e178e7 in gnash::movie_root::fire_mouse_event (this=0x81127c0)
at /usr/src/gnash/gnash-0.7.2-branch/server/movie_root.cpp:337

Seems really related to button events.
We keep pointers to char_below_the_mouse using a weak_ptr.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 07 Nov 2006 09:19:04 AM UTC, comment #21:

Still with 0.7.2, gt/agg, no mouse intervention:

(gdb) bt
#0 0x4008b88a in agg::pixfmt_alpha_blend_rgb<agg::blender_rgb<agg::rgba8, agg::order_rgb>, agg::row_accessor<unsigned char> >::copy_hline (this=0x80cf660,
x=0, y=0, len=4294665533, c=@0xbffff104) at agg_pixfmt_rgb.h:321
#1 0x4008b825 in gnash::render_handler_agg<agg::pixfmt_alpha_blend_rgb<agg::blender_rgb<agg::rgba8, agg::order_rgb>, agg::row_accessor<unsigned char> > >::clear_framebuffer (this=0x80c1bb8, left=0, top=0, width=4294967269, height=271,
color={r = 46 '.', g = 96 '`', b = 170 'ª', a = 255 'ÿ'})
at /home/strk/src/gnash/gnash-0.7.2-branch/backend/render_handler_agg.cpp:532
#2 0x4006c346 in gnash::render_handler_agg<agg::pixfmt_alpha_blend_rgb<agg::blender_rgb<agg::rgba8, agg::order_rgb>, agg::row_accessor<unsigned char> > >::begin_display (this=0x80c1bb8, background_color=
{m_r = 46 '.', m_g = 96 '`', m_b = 170 'ª', m_a = 255 'ÿ'})
at /home/strk/src/gnash/gnash-0.7.2-branch/backend/render_handler_agg.cpp:503
#3 0x40223159 in gnash::render::begin_display (background_color=
{m_r = 46 '.', m_g = 96 '`', m_b = 170 'ª', m_a = 255 'ÿ'},
viewport_x0=0, viewport_y0=0, viewport_width=492, viewport_height=340,
x0=0, x1=9840, y0=0, y1=6800)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 07 Nov 2006 09:15:27 AM UTC, comment #20:

Oh, I can click on it (with MovieTester) :)
Good to know this is related to events, as might be related to another stack smashing bug (18100).

It seems that an event truggers deletion of a character (a button?)

Anyway, I might be really burned but I do can produce a segfault
by playing sugarbowl_1.swf with -r0 flag :/

Seems generated in the URL class.

Does anyone else see this bug at all ?!

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 07 Nov 2006 08:52:46 AM UTC, comment #19:

r0 and r2 disable rendering, so I can't click on the link on the file.
Can't compile AGG on my Slackware 10.2. Filed a bug report here:
http://sourceforge.net/tracker/index.php?func=detail&aid=1585861&group_id=42020&atid=431925
but no response so far.

Anonymous
Tue 07 Nov 2006 08:46:19 AM UTC, comment #18:

Can you reproduce the same thing by running gnash with the -r0 flag ? and with the -r2 flag ? and with AGG renderer ?

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 07 Nov 2006 08:07:23 AM UTC, comment #17:

1) OK, I enabled debugging and compiled current 0.7.2 with --enable-i810-lod-bias
2) Now fails with:
pure virtual method called
Aborted

Backtrace:
{{{
$ sudo gdb gnash
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-slackware-linux"...Using host libthread_db library "/lib/tls/libthread_db.so.1".

(gdb) run sugarbowl_1.swf
Starting program: /usr/local/bin/gnash sugarbowl_1.swf
[Thread debugging using libthread_db enabled]
[New Thread -1226864960 (LWP 18711)]
Detaching after fork from child process 18714.
Detaching after fork from child process 18715.

Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread -1226864960 (LWP 18711)]
0xb6d5badc in _mesa_test_os_sse_exception_support () from /usr/X11R6/lib/modules/dri/i915_dri.so
(gdb) c
Continuing.
[New Thread -1270588496 (LWP 18716)]
[Thread -1270588496 (zombie) exited]
pure virtual method called

Program received signal SIGABRT, Aborted.
0xb6f9a027 in raise () from /lib/tls/libc.so.6
(gdb) bt
#0 0xb6f9a027 in raise () from /lib/tls/libc.so.6
#1 0xb6f9b747 in abort () from /lib/tls/libc.so.6
#2 0xb7148694 in __cxa_call_unexpected () from /usr/lib/./libstdc++.so.5
#3 0xb71486d1 in std::terminate () from /usr/lib/./libstdc++.so.5
#4 0xb7148c08 in __cxa_pure_virtual () from /usr/lib/./libstdc++.so.5
#5 0xb7d9c6b0 in gnash::button_character_instance::get_root (this=0x8340268) at button_character_instance.h:76
#6 0xb7d9a7dc in ~button_character_instance (this=0x8340268) at button_character_instance.cpp:191
#7 0xb7ee8c68 in gnash::ref_counted::drop_ref (this=0x8340268) at ref_counted.h:71
#8 0xb7d8cbe5 in ~smart_ptr (this=0xbf92fda0) at smart_ptr.h:55
#9 0xb7d8bf86 in gnash::generate_mouse_button_events (ms=0x82b5b84) at movie_root.cpp:323
#10 0xb7d8c068 in gnash::movie_root::fire_mouse_event (this=0x82b5b20) at movie_root.cpp:337
#11 0xb7d8b94f in gnash::movie_root::notify_mouse_clicked (this=0x82b5b20, mouse_pressed=true, button_mask=1)
at movie_root.cpp:121
#12 0xb7bbf2a5 in gnash::Gui::notify_mouse_clicked (this=0x8051560, mouse_pressed=true, mask=1) at gui.cpp:216
#13 0xb7bbdfc5 in gnash::GtkGui::button_press_event (event=0x80ffd30, data=0x8051560) at gtk.cpp:786
#14 0xb74760ce in gtk_marshal_VOID__UINT_STRING () from /usr/lib/./libgtk-x11-2.0.so.0
#15 0xb7217cb6 in g_closure_invoke () from /usr/lib/./libgobject-2.0.so.0
#16 0xb722948f in g_signal_emit_by_name () from /usr/lib/./libgobject-2.0.so.0
#17 0xb722833a in g_signal_emit_valist () from /usr/lib/./libgobject-2.0.so.0
#18 0xb72287e6 in g_signal_emit () from /usr/lib/./libgobject-2.0.so.0
#19 0xb75658a7 in gtk_widget_send_expose () from /usr/lib/./libgtk-x11-2.0.so.0
#20 0xb7474be2 in gtk_propagate_event () from /usr/lib/./libgtk-x11-2.0.so.0
#21 0xb7473a36 in gtk_main_do_event () from /usr/lib/./libgtk-x11-2.0.so.0
#22 0xb731e085 in gdk_x11_register_standard_event_type () from /usr/lib/./libgdk-x11-2.0.so.0
#23 0xb71aac02 in g_main_depth () from /usr/lib/./libglib-2.0.so.0
#24 0xb71abc78 in g_main_context_dispatch () from /usr/lib/./libglib-2.0.so.0
#25 0xb71abfb0 in g_main_context_dispatch () from /usr/lib/./libglib-2.0.so.0
#26 0xb71ac553 in g_main_loop_run () from /usr/lib/./libglib-2.0.so.0
#27 0xb74732e3 in gtk_main () from /usr/lib/./libgtk-x11-2.0.so.0
#28 0xb7bbcb9d in gnash::GtkGui::run (this=0x8051560) at gtk.cpp:272
#29 0x0804e1c4 in gnash::Player::run (this=0xbf930540, argc=2, argv=0xbf930624, infile=0xbf9315fd "sugarbowl_1.swf",
url=0x0) at Player.cpp:342
#30 0x0804bad5 in main (argc=2, argv=0xbf930624) at gnash.cpp:309
}}}

Anonymous
Mon 06 Nov 2006 05:04:53 PM UTC, comment #16:

ok, a couple more requests:

1) build gnash from the release_0_7_2 branch and enable debugging symbols (CXXFLAGS=-g)
2) run the test again and again show gdb backtrace if still failing

Thanks

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Nov 2006 05:00:18 PM UTC, comment #15:

I get this:

(gdb) bt
#0 0xb7177027 in raise () from /lib/tls/libc.so.6
#1 0xb7178747 in abort () from /lib/tls/libc.so.6
#2 0xb717085f in __assert_fail () from /lib/tls/libc.so.6
#3 0xb7fa3075 in render_handler_ogl::fill_style_bitmap () from /usr/local/lib/libgnashbackend.so.0
#4 0xb7e7b1b5 in gnash::button_character_instance::~button_character_instance () from /usr/local/lib/libgnashserver.so.0
#5 0xb7e6982c in gnash::generate_mouse_button_events () from /usr/local/lib/libgnashserver.so.0
#6 0xb7e6996f in gnash::movie_root::fire_mouse_event () from /usr/local/lib/libgnashserver.so.0
#7 0xb7e69308 in gnash::movie_root::notify_mouse_clicked () from /usr/local/lib/libgnashserver.so.0
#8 0xb7d9b752 in gnash::Gui::notify_mouse_clicked () from /usr/local/lib/libgnashgui.so.0
#9 0xb7d9a963 in gnash::GtkGui::button_press_event () from /usr/local/lib/libgnashgui.so.0
#10 0xb76530ce in gtk_marshal_VOID__UINT_STRING () from /usr/lib/./libgtk-x11-2.0.so.0
#11 0xb73f4cb6 in g_closure_invoke () from /usr/lib/./libgobject-2.0.so.0
#12 0xb740648f in g_signal_emit_by_name () from /usr/lib/./libgobject-2.0.so.0
#13 0xb740533a in g_signal_emit_valist () from /usr/lib/./libgobject-2.0.so.0
#14 0xb74057e6 in g_signal_emit () from /usr/lib/./libgobject-2.0.so.0
#15 0xb77428a7 in gtk_widget_send_expose () from /usr/lib/./libgtk-x11-2.0.so.0
#16 0xb7651be2 in gtk_propagate_event () from /usr/lib/./libgtk-x11-2.0.so.0
#17 0xb7650a36 in gtk_main_do_event () from /usr/lib/./libgtk-x11-2.0.so.0
#18 0xb74fb085 in gdk_x11_register_standard_event_type () from /usr/lib/./libgdk-x11-2.0.so.0
#19 0xb7387c02 in g_main_depth () from /usr/lib/./libglib-2.0.so.0
#20 0xb7388c78 in g_main_context_dispatch () from /usr/lib/./libglib-2.0.so.0
#21 0xb7388fb0 in g_main_context_dispatch () from /usr/lib/./libglib-2.0.so.0
#22 0xb7389553 in g_main_loop_run () from /usr/lib/./libglib-2.0.so.0
#23 0xb76502e3 in gtk_main () from /usr/lib/./libgtk-x11-2.0.so.0
#24 0xb7d996a1 in gnash::GtkGui::run () from /usr/local/lib/libgnashgui.so.0
#25 0x0804cd5c in gnash::Player::run ()
#26 0x0804ae2c in main ()

Anonymous
Mon 06 Nov 2006 04:55:06 PM UTC, comment #14:

Give 'bt' (backtrace) to gdb instead of 'c' (continue) the second time it stops (when you get the Assertion)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Nov 2006 04:50:09 PM UTC, comment #13:

Attached the valgrind output with --enable-i810-lod-bias (seems the same to me).

Backtrace(This is the first time I try gdb):

$ sudo gdb gnash
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-slackware-linux"...Using host libthread_db library "/lib/tls/libthread_db.so.1".

(gdb) run sugarbowl_1.swf
Starting program: /usr/local/bin/gnash sugarbowl_1.swf
[Thread debugging using libthread_db enabled]
[New Thread -1225230656 (LWP 24480)]
Detaching after fork from child process 24483.
Detaching after fork from child process 24484.

Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread -1225230656 (LWP 24480)]
0xb6eeaadc in _mesa_test_os_sse_exception_support () from /usr/X11R6/lib/modules/dri/i915_dri.so
(gdb) c
Continuing.
[New Thread -1268954192 (LWP 24485)]
[Thread -1268954192 (zombie) exited]
gnash: render_handler_ogl.cpp:524: virtual void render_handler_ogl::fill_style_bitmap(int, const gnash::bitmap_info*, const gnash::matrix&, gnash::render_handler::bitmap_wrap_mode): Assertion `fill_side >= 0 && fill_side < 2' failed.

Program received signal SIGABRT, Aborted.
0xb7129027 in raise () from /lib/tls/libc.so.6
(gdb) c
Continuing.
Couldn't get registers: No such process.

Anonymous
Mon 06 Nov 2006 03:46:17 PM UTC, comment #12:

Ok, read it.
Well, it really looks like a DRI bug.
Is it withOUT --enable-i810-lod-bias ?

I was interested in the other one, the one
you get with --enabl-i810-lod-bias ...
That's interesting to me (as it looks like a gnash bug)

Any chance you can send a backtrace of the Abort ?

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Nov 2006 03:34:00 PM UTC, comment #11:

It'a a gzip file, works fine with me.

Anonymous
Mon 06 Nov 2006 03:16:36 PM UTC, comment #10:

mmm.. the attached .zip seems corrupted, or at least I can't
unzip after download. Yes, I'm interested in it.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Nov 2006 03:12:28 PM UTC, comment #9:

Note that I get the same error even without --enable-i810-lod-bias . If can be of help I put again the output of valgrind with current 0.7.2:

$ sudo gnash --version
Gnash 0.7.2
Copyright (C) 2006 Free Software Foundation, Inc.
Gnash comes with NO WARRANTY, to the extent permitted by law.
You may redistribute copies of Gnash under the terms of the GNU General
Public License. For more information, see the file named COPYING.
Build options 0.7.2
Renderer: opengl GUI: gtk Sound handler: sdl Decoder: mad

Anonymous
Mon 06 Nov 2006 02:41:39 PM UTC, comment #8:

nothing sorry, was about to ask you to reproduce with gprocessor, but that would not use the ogl.cpp file.
Somoone will need to try at reproducing this. It seems 0.7.2 could
wait for another month :)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Nov 2006 02:36:05 PM UTC, comment #7:

Please? :)

Anonymous
Mon 06 Nov 2006 02:09:48 PM UTC, comment #6:

Please

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Nov 2006 01:53:05 PM UTC, comment #5:

I build current 0.7.2 with --enable-i810-lod-bias and now I get this:

gnash: render_handler_ogl.cpp:524: virtual void render_handler_ogl::fill_style_bitmap(int, const gnash::bitmap_info*, const gnash::matrix&, gnash::render_handler::bitmap_wrap_mode): Assertion `fill_side >= 0 && fill_side < 2' failed.
Aborted

Anonymous
Fri 03 Nov 2006 10:19:49 AM UTC, comment #4:

Seem to be a MESA/DRI/DRM issue, so this should go upstreams... AGG might however be to prefer as backend. Might try to enable the i810 LOD Bias hack and see if that works...

Markus Gothe <nihilus>
Project Member
Fri 03 Nov 2006 09:32:41 AM UTC, comment #3:

This is still present in current CVS, 0.7.2 branch.
valgrind output attached.

Anonymous
Fri 27 Oct 2006 12:27:07 PM UTC, comment #2:

I am on a Slackware 10.2. gnash is current CVS:

$ uname -a
Linux pedretti-linux-box 2.6.13 #1 Sat Sep 3 21:11:20 PDT 2005 i686 unknown unknown GNU/Linux

$ gnash --version
Gnash 0.7.1-cvs-20061027

Anonymous
Fri 27 Oct 2006 10:17:57 AM UTC, comment #1:

Could you provide more information please, system, gnash version etc...

Markus Gothe <nihilus>
Project Member
Thu 26 Oct 2006 01:07:28 PM UTC, original submission:

Clicking on a link of file #1974 with gnash I get a Segmentation fault

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #11172:  valgrind_output.gz added by None (6KiB - application/x-gzip - output with --enable-i810-lod-bias)
file #11170:  valgring_output.gz added by None (6KiB - application/x-gzip - valgrind output with current 0.7.2)
file #11147:  valgrind_debug.gz added by None (7KiB - application/x-gzip)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 17 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Wed 08 Nov 2006 11:11:34 AM UTCstrkStatusReady For Test=>Fixed
  Open/ClosedOpen=>Closed
Tue 07 Nov 2006 04:31:12 PM UTCstrkStatusNone=>Ready For Test
Tue 07 Nov 2006 02:12:43 PM UTCstrkCategoryrenderer=>core
  Assigned tonihilus=>strk
  SummarySegmentation fault=>Segmentation fault on mouse button event
Mon 06 Nov 2006 04:50:09 PM UTCNoneAttached File-=>Added valgrind_output.gz, #11172
Mon 06 Nov 2006 03:12:28 PM UTCNoneAttached File-=>Added valgring_output.gz, #11170
Mon 06 Nov 2006 02:09:48 PM UTCstrkCategoryNone=>renderer
  Severity3 - Normal=>5 - Blocker
  StatusWont Fix=>None
  Open/ClosedClosed=>Open
Fri 03 Nov 2006 10:19:49 AM UTCnihilusStatusNeed Info=>Wont Fix
  Open/ClosedOpen=>Closed
Fri 03 Nov 2006 09:32:42 AM UTCNoneAttached File-=>Added valgrind_debug.gz, #11147
Fri 27 Oct 2006 10:17:57 AM UTCnihilusStatusNone=>Need Info
  Assigned toNone=>nihilus

Back to the top


Powered by Savane 3.1-cleanup1