bugGnash - The GNU Flash player - Bugs: bug #18545, double free or corruption

 
 

bug #18545: double free or corruption

Submitted by:  Sandro Santilli <strk>
Submitted on:  Mon 18 Dec 2006 03:56:18 PM UTC  
 
Category: sound-sdlSeverity: 3 - Normal
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Tomas Groth <tgc>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 21 Feb 2007 04:48:45 PM UTC, comment #3:

I can't reproduce it anymore. Let's close it :)

Sandro Santilli <strk>
Project Member
Wed 21 Feb 2007 02:53:02 PM UTC, comment #2:

I committed a fix for this which i hope will work... Please test.

Tomas Groth <tgc>In charge of this item.
Thu 18 Jan 2007 08:48:00 AM UTC, comment #1:

I have a feeling that if we kill the parser before we kill the soundhandler, then this issue would go away. I actually also have a similar problem with the soundhandler being killed before the netstream-objects, which then segfaults when trying to remove the video-sounds from the non-existing soundhandler...
I haven't looked into in what order things are shut down, so if someone knowns this, don't hesitate to share :)

Tomas Groth <tgc>In charge of this item.
Mon 18 Dec 2006 03:56:18 PM UTC, original submission:

This was obtained by closing the gnash window while playing elvis.swf with gtk/agg/sdl/mad:

#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb72759a1 in raise () from /lib/tls/i686/cmov/libc.so.6
#2 0xb72772b9 in abort () from /lib/tls/i686/cmov/libc.so.6
#3 0xb72a987a in __fsetlocking () from /lib/tls/i686/cmov/libc.so.6
#4 0xb72affd4 in malloc_usable_size () from /lib/tls/i686/cmov/libc.so.6
#5 0xb72b034a in free () from /lib/tls/i686/cmov/libc.so.6
#6 0xb74508b1 in operator delete () from /usr/lib/libstdc++.so.6
#7 0xb74508fd in operator delete[] () from /usr/lib/libstdc++.so.6
#8 0xb796826d in SDL_sound_handler::fill_stream_data (this=0x8055868, data=0xa360e70, data_bytes=208, sample_count=-1, handle_id=0)
at /home/strk/src/gnash/gnash-head/backend/sound_handler_sdl.cpp:210
#9 0xb77cdd96 in gnash::SWF::tag_loaders::define_bits_lossless_2_loader (in=0x80b1c88, tag=gnash::SWF::SOUNDSTREAMBLOCK, m=0x80b25b0)
at /home/strk/src/gnash/gnash-head/server/swf/tag_loaders.cpp:494
#10 0xb7865b95 in gnash::movie_def_impl::read_all_swf (this=0x80b25b0) at /home/strk/src/gnash/gnash-head/server/parser/movie_def_impl.cpp:868
#11 0xb7865cdf in gnash::movie_def_impl::read_all_swf (this=0x80b25b0) at /home/strk/src/gnash/gnash-head/server/parser/movie_def_impl.cpp:902
#12 0xb6b98341 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#13 0xb73164ee in clone () from /lib/tls/i686/cmov/libc.so.6

Not 100% reproducible, but at least we have a backtrace.

Sandro Santilli <strk>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by tgc (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 21 Feb 2007 04:48:45 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Wed 21 Feb 2007 02:53:02 PM UTCtgcStatusIn Progress=>Ready For Test
    Thu 18 Jan 2007 08:48:00 AM UTCtgcStatusNone=>In Progress

    Back to the top


    Powered by Savane 3.1-cleanup1