Wed 31 Oct 2007 08:28:47 AM UTC, comment #2:
Found the probnlem.
ActionNewAdd takes a reference of a stack value,
then calls to_primitive which trigger a function call thus
pushing some more values on the stack.
Pushing value on the stack makes the stack element reference
invalid !! (stack is likely reallocated).
It's fixed by not using the reference again after any possibly pushing-on-stack call.
Chad's "safe stack" would likely fix all the others we're not noticing... time to start an integration plan ?
|
Wed 31 Oct 2007 08:06:40 AM UTC, comment #1:
a debugging build reports:
lt-gprocessor: /usr/include/boost/variant/detail/visitation_impl.hpp:203: typename Visitor::result_type boost::detail::variant::visitation_impl(int, int, Visitor&, VPCV, mpl_::true_, NBF, W, S) [with W = mpl_::int_<20>, S = boost::detail::variant::visitation_impl_step<boost::mpl::l_iter<boost::mpl::l_end>, boost::mpl::l_iter<boost::mpl::l_end> >, Visitor = boost::detail::variant::copy_into, VPCV = const void*, NBF = boost::variant<boost::blank, double, bool, boost::intrusive_ptr<gnash::as_object>, gnash::as_value::SpriteProxy, std::basic_string<char, std::char_traits<char>, std::allocator<char> >, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_>::has_fallback_type_]: Assertion `false' failed.
Aborted (core dumped)
|
Tue 30 Oct 2007 07:32:06 PM UTC, original submission:
The movie has been compiled from the attached testSWFDEC.as
and is attached as out.swf
VL report:
==30847== Invalid write of size 4
==30847== at 0x43A3033: std::string::assign(std::string const&) (in /usr/lib/libstdc++.so.6.0.8)
==30847== by 0x40C8E00: gnash::as_value::operator=(gnash::as_value const&) (basic_string.h:486)
==30847== by 0x4222995: gnash::SWF::SWFHandlers::ActionNewAdd(gnash::ActionExec&) (ASHandlers.cpp:2839)
==30847== by 0x420DD01: gnash::SWF::ActionHandler::execute(gnash::ActionExec&) const (ASHandlers.cpp:174)
==30847== by 0x4210CC5: gnash::SWF::SWFHandlers::execute(gnash::SWF::action_type, gnash::ActionExec&) const (ASHandlers.cpp:453)
==30847== by 0x4244C40: gnash::ActionExec::operator()() (ActionExec.cpp:344)
==30847== by 0x40F3E5D: gnash::GlobalCode::execute() (ExecutableCode.h:77)
==30847== by 0x40EEEE9: gnash::movie_root::processActionQueue() (movie_root.cpp:1148)
==30847== by 0x40F1012: gnash::movie_root::setRootMovie(gnash::movie_instance*) (movie_root.cpp:152)
==30847== by 0x804A886: main (processor.cpp:352)
==30847== Address 0x53C8E70 is 24 bytes inside a block of size 64 free'd
==30847== at 0x40213B6: operator delete(void*) (vg_replace_malloc.c:244)
==30847== by 0x40AF320: std::vector<gnash::as_value, std::allocator<gnash::as_value> >::_M_insert_aux(__gnu_cxx::__normal_iterator<gnash::as_value*, std::ve
ctor<gnash::as_value, std::allocator<gnash::as_value> > >, gnash::as_value const&) (new_allocator.h:94)
==30847== by 0x4219237: gnash::SWF::SWFHandlers::ActionPushData(gnash::ActionExec&) (stl_vector.h:610)
==30847== by 0x420DD01: gnash::SWF::ActionHandler::execute(gnash::ActionExec&) const (ASHandlers.cpp:174)
==30847== by 0x4210CC5: gnash::SWF::SWFHandlers::execute(gnash::SWF::action_type, gnash::ActionExec&) const (ASHandlers.cpp:453)
==30847== by 0x4244C40: gnash::ActionExec::operator()() (ActionExec.cpp:344)
==30847== by 0x41178A0: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:337)
==30847== by 0x4248806: gnash::call_method(gnash::as_value const&, gnash::as_environment, gnash::as_object, int, int) (action.cpp:155)
==30847== by 0x4248CDA: gnash::call_method0(gnash::as_value const&, gnash::as_environment, gnash::as_object) (action.cpp:184)
==30847== by 0x40C8802: gnash::as_value::to_primitive(gnash::as_environment&, gnash::as_value::type) const (as_value.cpp:253)
==30847== by 0x40C895D: gnash::as_value::to_primitive(gnash::as_environment&) const (as_value.cpp:231)
==30847== by 0x42228FA: gnash::SWF::SWFHandlers::ActionNewAdd(gnash::ActionExec&) (ASHandlers.cpp:2816)
|