bugGnash - The GNU Flash player - Bugs: bug #18675, Assertion failing when closing...

 
 

bug #18675: Assertion failing when closing youtube's player2.swf

Submitted by:  Sandro Santilli <strk>
Submitted on:  Tue 02 Jan 2007 11:06:08 PM UTC  
 
Category: ActionScriptSeverity: 4 - Important
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Wed 10 Jan 2007 02:53:00 PM UTC, comment #7:

Tried with 'gnash -r0 -1' intead of 'gprocessor'. It's much slower
and didn't segfault in over 12k iterations (sorry, I killed it).

Then I tried with gprocessor again, but threads disabled: no segfault at over 8.5k iterations.

My suspect number 1 here is "lightweighted" threads from boost.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 10 Jan 2007 02:08:56 PM UTC, comment #6:

New version of the script to run, as it seems it takes a lot :)

i=0; while :; do
utilities/gprocessor out.swf || break;
i=$(($i+1)); echo $i;
done;
echo "Killed at ${i}th iteration"

The segfault here just happened at 883th iteration.
Bastiaan confirmed too.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 04 Jan 2007 10:13:02 AM UTC, comment #5:

Yes, i get a assertion fault with player2.swf:
lt-gnash: /home/tomas/gnash/gnash/libbase/ref_counted.h:64: void gnash::ref_counted::drop_ref() const: Assertion 'm_ref_count > 0' failed.

Tomas Groth <tgc>
Thu 04 Jan 2007 12:13:38 AM UTC, comment #4:

Ok, just tested player2.swf on the system that doesn't trigger the segfault on the smaller testcase, it still triggers the assertion failure. Tom, can you reproduce that ? Just feed player2.swf to gnash and then close the window.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 04 Jan 2007 12:08:57 AM UTC, comment #3:

Well, Thomas reports to be unable to reproduce this, and I can't reproduce myself on debian testing.

So can produce on:

- Ubuntu dapper gtk/agg/sdl/mad

Cannot reproduce on:

- Debian testing gtk/agg/gst

Other info ?

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 03 Jan 2007 01:03:58 AM UTC, comment #2:

Actually, the segfault occurs even with a shorter actionscript:

var a = new Object;
var b = new Object;
a.prototype = b;

Again, not always. What I use is:

$ ulimit -c unlimited
$ while :; do utilities/gprocessor -v out.swf || break; done

Attached SWF.
Seems a stack corruption.

(file #11665)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 02 Jan 2007 11:10:53 PM UTC, comment #1:

This simple testcase occasionally triggers a Segmentation Fault
(not always!)

var a = new Object;
var b = new Object;
a.prototype = b;
b.prototype = a;

Seems definitely related to circular depencencies

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 02 Jan 2007 11:06:08 PM UTC, original submission:

From the backtrace it seems related to duplicated deletion
of an as_object (in an as_value).

Here's the backtrace:

#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb788c9a1 in raise () from /lib/tls/i686/cmov/libc.so.6
#2 0xb788e2b9 in abort () from /lib/tls/i686/cmov/libc.so.6
#3 0xb7885f51 in __assert_fail () from /lib/tls/i686/cmov/libc.so.6
#4 0xb7dac086 in gnash::ref_counted::drop_ref (this=0x80bed00) at ref_counted.h:71
#5 0xb7dbcc5e in gnash::as_value::drop_refs (this=0x80bec2c) at /home/strk/src/gnash/gnash-head/server/as_value.cpp:575
#6 0xb7dabad8 in ~as_value (this=0x80bec2c) at as_value.h:222
#7 0xb7db0c91 in ~SimpleProperty (this=0x80bec20) at Property.h:126
#8 0xb7dae254 in ~PropertyList (this=0x80beb58) at /home/strk/src/gnash/gnash-head/server/PropertyList.cpp:229
#9 0xb7dba1e1 in ~as_object (this=0x80beb50) at as_object.h:116
#10 0xb7dba296 in ~as_function (this=0x80beb50) at as_function.h:72
#11 0xb7df0cd4 in ~swf_function (this=0x80beb50) at /home/strk/src/gnash/gnash-head/server/swf_function.cpp:47
#12 0xb7dac0b7 in gnash::ref_counted::drop_ref (this=0x80beb50) at ref_counted.h:75
#13 0xb7dbcc30 in gnash::as_value::drop_refs (this=0x80bec9c) at /home/strk/src/gnash/gnash-head/server/as_value.cpp:570
#14 0xb7dabad8 in ~as_value (this=0x80bec9c) at as_value.h:222
#15 0xb7db0c91 in ~SimpleProperty (this=0x80bec90) at Property.h:126
#16 0xb7dae254 in ~PropertyList (this=0x80b5208) at /home/strk/src/gnash/gnash-head/server/PropertyList.cpp:229
#17 0xb7dba1e1 in ~as_object (this=0x80b5200) at as_object.h:116
#18 0xb7e61bbd in ~object_as_object (this=0x80b5200) at /home/strk/src/gnash/gnash-head/server/asobj/Object.cpp:65
#19 0xb7dac0b7 in gnash::ref_counted::drop_ref (this=0x80b5200) at ref_counted.h:75
#20 0xb7dbcc5e in gnash::as_value::drop_refs (this=0x80b523c) at /home/strk/src/gnash/gnash-head/server/as_value.cpp:575
#21 0xb7dabad8 in ~as_value (this=0x80b523c) at as_value.h:222
#22 0xb7db0c91 in ~SimpleProperty (this=0x80b5230) at Property.h:126
#23 0xb7dae254 in ~PropertyList (this=0x8064a28) at /home/strk/src/gnash/gnash-head/server/PropertyList.cpp:229
#24 0xb7dba1e1 in ~as_object (this=0x8064a20) at as_object.h:116
#25 0xb7e55231 in ~Global (this=0x8064a20) at Global.h:38
#26 0xb7dac0b7 in gnash::ref_counted::drop_ref (this=0x8064a20) at ref_counted.h:75
#27 0xb7db5073 in gnash::intrusive_ptr_release<gnash::as_object> (o=0x8064a20) at smart_ptr.h:54
#28 0xb7db50a2 in ~intrusive_ptr (this=0x805858c) at intrusive_ptr.hpp:83
#29 0xb7c7c3d9 in ~VM (this=0x8058588) at /home/strk/src/gnash/gnash-head/server/vm/VM.cpp:84

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #11665:  out.swf added by strk (101B - application/x-shockwave-flash - simple assignment of an object to another object prototype (occasional segfaults))

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by tgc (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 09 Apr 2007 10:00:37 AM UTCstrkStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Wed 10 Jan 2007 02:08:56 PM UTCstrkCarbon-Copy-=>Added bjacques
    Thu 04 Jan 2007 12:08:57 AM UTCstrkCarbon-Copy-=>Added tgc
    Wed 03 Jan 2007 01:03:58 AM UTCstrkAttached File-=>Added out.swf, #11665

    Back to the top


    Powered by Savane 3.1-cleanup1