bugGnash - The GNU Flash player - Bugs: bug #18675, Assertion failing when closing...

 
 

bug #18675: Assertion failing when closing youtube's player2.swf

Submitter:  Sandro Santilli <strk>
Submitted:  Tue 02 Jan 2007 11:06:08 PM UTC
   
 
Category:  ActionScript Severity:  4 - Important
Release:  None Status:  Fixed
Privacy:  Public Assigned to:  strk
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 10 Jan 2007 02:53:00 PM UTC, comment #7: 

Tried with 'gnash -r0 -1' intead of 'gprocessor'. It's much slower
and didn't segfault in over 12k iterations (sorry, I killed it).

Then I tried with gprocessor again, but threads disabled: no segfault at over 8.5k iterations.

My suspect number 1 here is "lightweighted" threads from boost.

Sandro Santilli <strk>
Group Member
Wed 10 Jan 2007 02:08:56 PM UTC, comment #6: 


New version of the script to run, as it seems it takes a lot :)

i=0; while :; do
 utilities/gprocessor out.swf || break;
 i=$(($i+1)); echo $i;
done;
echo "Killed at ${i}th iteration"

The segfault here just happened at 883th iteration.
Bastiaan confirmed too.

Sandro Santilli <strk>
Group Member
Thu 04 Jan 2007 10:13:02 AM UTC, comment #5: 

Yes, i get a assertion fault with player2.swf:
lt-gnash: /home/tomas/gnash/gnash/libbase/ref_counted.h:64: void gnash::ref_counted::drop_ref() const: Assertion 'm_ref_count > 0' failed.

Tomas Groth <tgc>
Thu 04 Jan 2007 12:13:38 AM UTC, comment #4: 

Ok, just tested player2.swf on the system that doesn't trigger the segfault on the smaller testcase, it still triggers the assertion failure. Tom, can you reproduce that ? Just feed player2.swf to gnash and then close the window.

Sandro Santilli <strk>
Group Member
Thu 04 Jan 2007 12:08:57 AM UTC, comment #3: 

Well, Thomas reports to be unable to reproduce this, and I can't reproduce myself on debian testing.

So can produce on:

 - Ubuntu dapper gtk/agg/sdl/mad

Cannot reproduce on:

 - Debian testing gtk/agg/gst

Other info ?

Sandro Santilli <strk>
Group Member
Wed 03 Jan 2007 01:03:58 AM UTC, comment #2: 

Actually, the segfault occurs even with a shorter actionscript:

 var a = new Object;
 var b = new Object;
 a.prototype = b;

Again, not always. What I use is:

$ ulimit -c unlimited
$ while :; do utilities/gprocessor -v out.swf || break; done

Attached SWF.
Seems a stack corruption.

(file #11665)

Sandro Santilli <strk>
Group Member
Tue 02 Jan 2007 11:10:53 PM UTC, comment #1: 

This simple testcase occasionally triggers a Segmentation Fault
(not always!)

 var a = new Object;
 var b = new Object;
 a.prototype = b;
 b.prototype = a;

Seems definitely related to circular depencencies

Sandro Santilli <strk>
Group Member
Tue 02 Jan 2007 11:06:08 PM UTC, original submission:  

From the backtrace it seems related to duplicated deletion
of an as_object (in an as_value).

Here's the backtrace:

#0  0xffffe410 in __kernel_vsyscall ()
#1  0xb788c9a1 in raise () from /lib/tls/i686/cmov/libc.so.6
#2  0xb788e2b9 in abort () from /lib/tls/i686/cmov/libc.so.6
#3  0xb7885f51 in __assert_fail () from /lib/tls/i686/cmov/libc.so.6
#4  0xb7dac086 in gnash::ref_counted::drop_ref (this=0x80bed00) at ref_counted.h:71
#5  0xb7dbcc5e in gnash::as_value::drop_refs (this=0x80bec2c) at /home/strk/src/gnash/gnash-head/server/as_value.cpp:575
#6  0xb7dabad8 in ~as_value (this=0x80bec2c) at as_value.h:222
#7  0xb7db0c91 in ~SimpleProperty (this=0x80bec20) at Property.h:126
#8  0xb7dae254 in ~PropertyList (this=0x80beb58) at /home/strk/src/gnash/gnash-head/server/PropertyList.cpp:229
#9  0xb7dba1e1 in ~as_object (this=0x80beb50) at as_object.h:116
#10 0xb7dba296 in ~as_function (this=0x80beb50) at as_function.h:72
#11 0xb7df0cd4 in ~swf_function (this=0x80beb50) at /home/strk/src/gnash/gnash-head/server/swf_function.cpp:47
#12 0xb7dac0b7 in gnash::ref_counted::drop_ref (this=0x80beb50) at ref_counted.h:75
#13 0xb7dbcc30 in gnash::as_value::drop_refs (this=0x80bec9c) at /home/strk/src/gnash/gnash-head/server/as_value.cpp:570
#14 0xb7dabad8 in ~as_value (this=0x80bec9c) at as_value.h:222
#15 0xb7db0c91 in ~SimpleProperty (this=0x80bec90) at Property.h:126
#16 0xb7dae254 in ~PropertyList (this=0x80b5208) at /home/strk/src/gnash/gnash-head/server/PropertyList.cpp:229
#17 0xb7dba1e1 in ~as_object (this=0x80b5200) at as_object.h:116
#18 0xb7e61bbd in ~object_as_object (this=0x80b5200) at /home/strk/src/gnash/gnash-head/server/asobj/Object.cpp:65
#19 0xb7dac0b7 in gnash::ref_counted::drop_ref (this=0x80b5200) at ref_counted.h:75
#20 0xb7dbcc5e in gnash::as_value::drop_refs (this=0x80b523c) at /home/strk/src/gnash/gnash-head/server/as_value.cpp:575
#21 0xb7dabad8 in ~as_value (this=0x80b523c) at as_value.h:222
#22 0xb7db0c91 in ~SimpleProperty (this=0x80b5230) at Property.h:126
#23 0xb7dae254 in ~PropertyList (this=0x8064a28) at /home/strk/src/gnash/gnash-head/server/PropertyList.cpp:229
#24 0xb7dba1e1 in ~as_object (this=0x8064a20) at as_object.h:116
#25 0xb7e55231 in ~Global (this=0x8064a20) at Global.h:38
#26 0xb7dac0b7 in gnash::ref_counted::drop_ref (this=0x8064a20) at ref_counted.h:75
#27 0xb7db5073 in gnash::intrusive_ptr_release<gnash::as_object> (o=0x8064a20) at smart_ptr.h:54
#28 0xb7db50a2 in ~intrusive_ptr (this=0x805858c) at intrusive_ptr.hpp:83
#29 0xb7c7c3d9 in ~VM (this=0x8058588) at /home/strk/src/gnash/gnash-head/server/vm/VM.cpp:84

Sandro Santilli <strk>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #11665:  out.swf added by strk (101B - application/x-shockwave-flash - simple assignment of an object to another object prototype (occasional segfaults))

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tgc (Posted a comment)
  • -email is unavailable- added by strk (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-04-09 strk StatusIn Progress Fixed
        Open/ClosedOpen Closed
    2007-01-10 strk Carbon-Copy- Added bjacques
    2007-01-04 strk Carbon-Copy- Added tgc
    2007-01-03 strk Attached File- Added out.swf, #11665

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code