Thu 24 May 2007 01:21:42 PM UTC, comment #2:
Similar problem with 568db6323c3109f.swf.
This time is a double free or corruption message from glib
- glibc detected *** free(): invalid pointer: 0x0811f54c ***
gdb still reports the problem being in :
gnash::SWF::tag_loaders::define_sound_loader
In particular, the 'delete [] data' line.
Data is NOT null, even if set ot NULL before calling the function that supposedly allocates it.
Could it be allocation is not done using new [] ?
|
Thu 24 May 2007 01:12:14 PM UTC, comment #1:
Nah, setting to NULL didn't help... here's valgrind report:
==14686== Thread 2:
==14686== Invalid read of size 1
==14686== at 0x51760E4: GST_sound_handler::create_sound(void*, int, int, gnash::sound_handler::format_type, int, bool) (sound_handler_gst.cpp:97)
==14686== by 0x41C68BA: gnash::SWF::tag_loaders::define_sound_loader(gnash::stream, gnash::SWF::tag_type, gnash::movie_definition) (tag_loaders.cpp:1168)
==14686== by 0x42946EC: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:889)
==14686== by 0x42949B0: gnash::MovieLoader::execute(gnash::movie_def_impl*) (movie_def_impl.cpp:109)
==14686== by 0x42A3B02: void boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl> >::operator()<void ()(gnash::movie_def_impl), boost::_bi::list0>(boost::_bi::type<void>, void ()(gnash::movie_def_impl*)&, boost::_bi::list0&, int) (bind.hpp:229)
==14686== by 0x42A3B52: boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >::operator()() (bind_template.hpp:20)
==14686== by 0x42A3B7C: boost::detail::function::void_function_obj_invoker0<boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >, void>::invoke(boost::detail::function::any_pointer) (function_template.hpp:136)
==14686== by 0x4AE383C: (within /usr/lib/libboost_thread-gcc-mt-1_33_1.so.1.33.1)
==14686== by 0x4AED340: start_thread (in /lib/tls/i686/cmov/libpthread-2.3.6.so)
==14686== by 0x45A44ED: clone (in /lib/tls/i686/cmov/libc-2.3.6.so)
==14686== Address 0x564A28C is 0 bytes after a block of size 140 alloc'd
==14686== at 0x401CD67: operator new[](unsigned) (vg_replace_malloc.c:195)
==14686== by 0x41C4F58: gnash::adpcm_expand(unsigned char&, gnash::stream, int, bool) (tag_loaders.cpp:1774)
==14686== by 0x41C631D: gnash::SWF::tag_loaders::sound_expand(gnash::stream, gnash::sound_handler::format_type&, bool, bool, unsigned char&, unsigned&) (tag_loaders.cpp:1381)
==14686== by 0x41C686D: gnash::SWF::tag_loaders::define_sound_loader(gnash::stream, gnash::SWF::tag_type, gnash::movie_definition) (tag_loaders.cpp:1160)
==14686== by 0x42946EC: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:889)
==14686== by 0x42949B0: gnash::MovieLoader::execute(gnash::movie_def_impl*) (movie_def_impl.cpp:109)
==14686== by 0x42A3B02: void boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl> >::operator()<void ()(gnash::movie_def_impl), boost::_bi::list0>(boost::_bi::type<void>, void ()(gnash::movie_def_impl*)&, boost::_bi::list0&, int) (bind.hpp:229)
==14686== by 0x42A3B52: boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >::operator()() (bind_template.hpp:20)
==14686== by 0x42A3B7C: boost::detail::function::void_function_obj_invoker0<boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >, void>::invoke(boost::detail::function::any_pointer) (function_template.hpp:136)
==14686== by 0x4AE383C: (within /usr/lib/libboost_thread-gcc-mt-1_33_1.so.1.33.1)
==14686== by 0x4AED340: start_thread (in /lib/tls/i686/cmov/libpthread-2.3.6.so)
==14686== by 0x45A44ED: clone (in /lib/tls/i686/cmov/libc-2.3.6.so)
==14686==
==14686== Invalid free() / delete / delete[]
==14686== at 0x401D70A: operator delete[](void*) (vg_replace_malloc.c:256)
==14686== by 0x41C6918: gnash::SWF::tag_loaders::define_sound_loader(gnash::stream, gnash::SWF::tag_type, gnash::movie_definition) (tag_loaders.cpp:1176)
==14686== by 0x42946EC: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:889)
|
Thu 24 May 2007 01:08:16 PM UTC, original submission:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1229300816 (LWP 21546)]
0xb79d2334 in free () from /lib/tls/i686/cmov/libc.so.6
(gdb) bt
#0 0xb79d2334 in free () from /lib/tls/i686/cmov/libc.so.6
#1 0xb7b518b1 in operator delete () from /usr/lib/libstdc++.so.6
#2 0xb7b518fd in operator delete[] () from /usr/lib/libstdc++.so.6
#3 0xb7dcd912 in gnash::SWF::tag_loaders::define_sound_loader (in=0x822cc18, tag=gnash::SWF::DEFINESOUND, m=0x822d5f8) at swf/tag_loaders.cpp:1176
#4 0xb7e9b6e5 in gnash::movie_def_impl::read_all_swf (this=0x822d5f8) at movie_def_impl.cpp:889
#5 0xb7e9b9a9 in gnash::MovieLoader::execute (md=0x822d5f8) at movie_def_impl.cpp:109
It's not clear to me where is 'data' allocated. Anyway it is not initialized to NULL. I'm trying simply initializing it to see if the bug is fixed.
|