Just a note: we should test the original file again
now, after building with -DGNASH_PARANOIA_LEVEL=2.
It will abort if it's related to the missing-unload-tagging
issue.

Segfault seems to have been fixed now. Downgrading to important again.

I just checked in a fix for the SharedObject problem, and now this gets to the next frame, whereas before it was seg faulting. Now I get these messages further on:

32184] 19:08:13: UNIMPLEMENTED: sendAndLoad
32184] 19:08:13: DEBUG: Global instance list grew to 995 entries
32184] 19:08:18: DEBUG: Global instance list grew to 996 entries
32184] 19:08:19: DEBUG: Global instance list grew to 997 entries
32184] 19:08:24: DEBUG: Global instance list grew to 999 entries
32184] 19:08:25: DEBUG: Global instance list grew to 1000 entries
32184] 19:08:30: UNIMPLEMENTED: selection_getfocus

The 2nd frame is mostly blank with a button in it. This is an interesting test case. It uses SharedObject, LocalConnection, and XMLSocket, all a bit of a security issue, and mostly new code as well.

Ah, it seems it just fails creating/opening one due to the unexisting path:

SECURITY: Opening SharedObject file: ./localhost///v4_UserCredentials.sol
ERROR: Couldn't open file: No such file or directory

Can you add the full paths to these created .sol files for me please ?

Can you send me this file ? I can't seem to access it at all. I'd like to fix the Shared Object part at the least. Actually these paths look fine, other than the extra "///" part. The empty .sol files wil get written to later, and the v1_PerfComp.sol should already exist.

Just for a note: https://www.pandora.com/radio/tuner_8_1_0_0_pandora.swf  is not accessible outside the U.S.

which movie are you talking about?

http://www.pandora.com/Secretary.swf   or
https://www.pandora.com/radio/tuner_8_1_0_0_pandora.swf  ??

About the high CPU usage, it seems to me that the problem
is GC runs given the high number of live instances.

Here's the head of a flat profile report from gprof:

Flat profile:

Each sample counts as 0.01 seconds.
  %   cumulative   self              self     total          
 time   seconds   seconds    calls  ms/call  ms/call  name   
 16.61      1.56     1.56  7922844     0.00     0.00  gnash::PropertyList::setReachable() const
 13.74      2.85     1.29      102    12.65    54.33  gnash::GC::collect()
  8.63      3.66     0.81      102     7.94     8.17  gnash::GC::cleanUnreachable()
  8.20      4.43     0.77 27814496     0.00     0.00  gnash::Property::setReachable() const
  4.69      4.87     0.44 28519943     0.00     0.00  gnash::as_value::setReachable() const


While playing you can see number of instances in the global
 "live instances list" growing fast:

13:05:04: DEBUG: Global instance list grew to 1087 entries
13:05:05: DEBUG: Global instance list grew to 1088 entries
13:05:05: DEBUG: Global instance list grew to 1092 entries
13:05:05: DEBUG: Global instance list grew to 1093 entries
13:05:06: DEBUG: Global instance list grew to 1094 entries
13:05:06: DEBUG: Global instance list grew to 1095 entries

Seems about 5 new instances pushed in the global instance list
every second...

We may be missing to unload/destroy some characters.

Confirm the segfault is fixed.

The segfault is consistent at character 199 (a png, though swfextract gives a zlib error when trying to extract anything from this SWF).

The segfault is at ref_counted.h:88 ("delete this"), called by gnash::movie_def_impl::add_bitmap_info(bitmap_info* bi).

bitmap_info is refcounted.

Valgrind gives this after character 199 is loaded:

==27789== Invalid read of size 4
==27789==    at 0x51FC85C: std::vector<boost::intrusive_ptr<gnash::bitmap_info>, std::allocator<boost::intrusive_ptr<gnash::bitmap_info> > >::_M_insert_aux(__gnu_cxx::__normal_iterator<boost::intrusive_ptr<gnash::bitmap_info>*, std::vector<boost::intrusive_ptr<gnash::bitmap_info>, std::allocator<boost::intrusive_ptr<gnash::bitmap_info> > > >, boost::intrusive_ptr<gnash::bitmap_info> const&) (atomicity.h:51)
==27789==    by 0x51FCACA: gnash::movie_def_impl::add_bitmap_info(gnash::bitmap_info*) (stl_vector.h:605)
==27789==    by 0x51F333D: gnash::movie_def_impl::add_bitmap_character_def(int, gnash::bitmap_character_def*) (movie_def_impl.cpp:384)
==27789==    by 0x511A661: gnash::SWF::tag_loaders::define_bits_lossless_2_loader(gnash::stream*, gnash::SWF::tag_type, gnash::movie_definition*) (tag_loaders.cpp:760)
==27789==    by 0x51F2B95: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:793)
==27789==    by 0x817FD5E: boost::function0<void, std::allocator<boost::function_base> >::operator()() const (in /usr/lib64/libboost_thread.so.1.33.1)
==27789==    by 0x817FA0E: (within /usr/lib64/libboost_thread.so.1.33.1)
==27789==    by 0x57592EF: start_thread (in /lib64/libpthread-2.6.1.so)
==27789==    by 0x787BF9C: clone (in /lib64/libc-2.6.1.so)
==27789==  Address 0x1128C700 is 8 bytes inside a block of size 48 free'd
==27789==    at 0x4C1E2BD: operator delete(void*) (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==27789==    by 0x51ECA55: gnash::bitmap_character_def::~bitmap_character_def() (ref_counted.h:88)
==27789==    by 0x51F3369: gnash::movie_def_impl::add_bitmap_character_def(int, gnash::bitmap_character_def*) (ref_counted.h:88)
==27789==    by 0x511A661: gnash::SWF::tag_loaders::define_bits_lossless_2_loader(gnash::stream*, gnash::SWF::tag_type, gnash::movie_definition*) (tag_loaders.cpp:760)
==27789==    by 0x51F2B95: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:793)
==27789==    by 0x817FD5E: boost::function0<void, std::allocator<boost::function_base> >::operator()() const (in /usr/lib64/libboost_thread.so.1.33.1)
==27789==    by 0x817FA0E: (within /usr/lib64/libboost_thread.so.1.33.1)
==27789==    by 0x57592EF: start_thread (in /lib64/libpthread-2.6.1.so)
==27789==    by 0x787BF9C: clone (in /lib64/libc-2.6.1.so)

Fixed by checking tag boundaries in inflate_wrapper (which should also be faster in reading now).

That happens when the tag loader (maybe the bitmap decoder in this case) doesn't make sure it doesn't attempt to read past the end of tag. We should use ensureBytes or similar instead, which IIRC would throw an exception interrupting the parser.

A conseguent thing to do is avoid to completely interrupt
parsing but only drop parsing of a single tag, or even not
throw the exception at all in this case and try to work
with the data we understand.

Finally, the decoder itself might be completely bogus..
(this is known to be true for some sound decoding)

Confirm the fix to Secretary.swf (though I've no idea if it does what it's supposed to).

I can reproduce the segfault, both online and offline. It happens directly after initializing the agg buffer.

[New Thread 1082132816 (LWP 1460)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1082132816 (LWP 1460)]
0x00002b736c8b6754 in std::vector<boost::intrusive_ptr<gnash::bitmap_info>, std::allocator<boost::intrusive_ptr<gnash::bitmap_info> > >::_M_insert_aux (
    this=0x8fd5b8, __position=<value optimized out>, __x=<value optimized out>)
    at ../../libbase/ref_counted.h:88
88                              delete this;


Config:

Target:
   Renderer: agg - GUI: GTK - Media handler: ffmpeg
   Configured with: --enable-gui=gtk --enable-renderer=agg
Ffmpeg version is: Lavc51.40.4

Just tested, gnash doesn't play 0x0 movies, I'm working on it.

"We are deeply, deeply sorry to say that due to licensing constraints, we can no longer allow access to Pandora for most listeners located outside of the U.S." - Not very helpful for debugging.

Of the two movies loaded in the output below,
http://www.pandora.com/Secretary.swf gives the message:

12498] 10:52:00: ERROR: Input movie has collapsed dimensions 0/0. Giving up.

https://www.pandora.com/radio/tuner_8_1_0_0_pandora.swf looks more serious. It gives a segfault with the following backtrace:

#0  0x00002b84a1298754 in std::vector<boost::intrusive_ptr<gnash::bitmap_info>, std::allocator<boost::intrusive_ptr<gnash::bitmap_info> > >::_M_insert_aux (
    this=0x989eb8, __position=<value optimized out>, __x=<value optimized out>)
    at ../../libbase/ref_counted.h:88
#1  0x00002b84a1298883 in gnash::movie_def_impl::add_bitmap_info (
    this=<value optimized out>, bi=<value optimized out>)
    at /usr/lib/gcc/x86_64-mandriva-linux-gnu/4.2.2/../../../../include/c++/4.2.2/bits/stl_vector.h:605
#2  0x00002b84a128fe4b in gnash::movie_def_impl::add_bitmap_character_def (
    this=0x989c90, character_id=<value optimized out>, ch=0xbb0ed0)
    at movie_def_impl.cpp:398
#3  0x00002b84a11a892d in gnash::SWF::tag_loaders::define_bits_lossless_2_loader (in=0xd4fdf0, tag=13954259, m=0x989c90) at swf/tag_loaders.cpp:733
#4  0x00002b84a1291252 in gnash::movie_def_impl::read_all_swf (this=0x989c90)
    at movie_def_impl.cpp:919
#5  0x00002b84a41cbd5f in boost::function0<void, std::allocator<boost::function_base> >::operator() () from /usr/lib64/libboost_thread.so.1
#6  0x00002b84a41cba0f in __cxa_pure_virtual ()
   from /usr/lib64/libboost_thread.so.1
#7  0x00002b84a17a02f0 in start_thread () from /lib64/libpthread.so.0
#8  0x00002b84a38c6f9d in clone () from /lib64/libc.so.6