bugGnash - The GNU Flash player - Bugs: bug #21620, stack corruption running...

 
 

bug #21620: stack corruption running prototype-addProperty-6.swf from swfdec testsuite

Submitted by:  Sandro Santilli <strk>
Submitted on:  Tue 20 Nov 2007 09:15:44 PM UTC  
 
Category: NoneSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Chad Musick <cmusick>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 22 Nov 2007 11:50:10 AM UTC, comment #6:

Confirmed. BTW, weren't we exploring the possibility to do use a getter-setter for delaying _proto_ construction ?
(AKA crap-compatible-proto-failure-on-first-fetch)

Sandro Santilli <strk>
Project Member
Thu 22 Nov 2007 11:12:14 AM UTC, comment #5:

This should be fixed now -- if we recurse in get_super(), we return NULL. While not correct, this really only arises when _proto_ is a getter/setter itself, which is a bad bad thing.

Chad Musick <cmusick>In charge of this item.
Thu 22 Nov 2007 01:43:11 AM UTC, comment #4:

I've set the builtin_function to push itself into the stack. This has been no help (in this, though it's a necessary change), as the point where a stack limit is checked is never reached by the program, since the problem is a getter-setter _proto_.

I'm exploring some ways to prevent this loop.

Chad Musick <cmusick>In charge of this item.
Wed 21 Nov 2007 11:09:13 PM UTC, comment #3:

After commit of the global call stack the problem persists.
It seems to reduce to builtin_function not pushing self
to the call stack.

Sandro Santilli <strk>
Project Member
Tue 20 Nov 2007 11:04:01 PM UTC, comment #2:

Took a closer look, and now I think the problem is really in get_super which uses _proto_ which is a getter-setter so the getter is invoked which means setting up a 'super' which calls get_super which uses _proto_ which is a getter-setter so the getter is invoked which means setting up a 'super' .....

Sandro Santilli <strk>
Project Member
Tue 20 Nov 2007 09:42:38 PM UTC, comment #1:

Ok, now that I took at look of what changed in as_value I belive the problem is the custom as_environment used in as_value::to_primitive.

We use(d?) the as_environment to keep track of the call stack, which is supposedly limited to a depth of 255, over which we
should interrupt and givup any AS execution.

Custom as_environment will always break the call stack
chain thus failing to hit the call stack limit.

Chad, what's the new plan for call stack limits ?

Sandro Santilli <strk>
Project Member
Tue 20 Nov 2007 09:15:44 PM UTC, original submission:

Gnash enters into an infinite recursion:

#0 0xb7dc9752 in gnash::Property::getDelayedValue (this=0x8080f70, this_ptr=@0x8074a00) at /home/strk/src/gnash/gnash-head/server/Property.cpp:26
#1 0xb7ddcc49 in gnash::as_object::get_prototype (this=0x8074a00) at /home/strk/src/gnash/gnash-head/server/Property.h:150
#2 0xb7dddac9 in gnash::as_object::get_super (this=0x8074a00) at /home/strk/src/gnash/gnash-head/server/as_object.cpp:142
#3 0xb7e2cecf in gnash::swf_function::operator() (this=0x805fd88, fn=@0xbf068338) at /home/strk/src/gnash/gnash-head/server/swf_function.cpp:116
#4 0xb7dc9943 in gnash::Property::getDelayedValue (this=0x8080f70, this_ptr=@0x8074a00) at /home/strk/src/gnash/gnash-head/server/Property.cpp:43
#5 0xb7ddcc49 in gnash::as_object::get_prototype (this=0x8074a00) at /home/strk/src/gnash/gnash-head/server/Property.h:150
#6 0xb7dddac9 in gnash::as_object::get_super (this=0x8074a00) at /home/strk/src/gnash/gnash-head/server/as_object.cpp:142
#7 0xb7e2cecf in gnash::swf_function::operator() (this=0x805fd88, fn=@0xbf068698) at /home/strk/src/gnash/gnash-head/server/swf_function.cpp:116
#8 0xb7dc9943 in gnash::Property::getDelayedValue (this=0x8080f70, this_ptr=@0x8074a00) at /home/strk/src/gnash/gnash-head/server/Property.cpp:43
#9 0xb7ddcc49 in gnash::as_object::get_prototype (this=0x8074a00) at /home/strk/src/gnash/gnash-head/server/Property.h:150
#10 0xb7dddac9 in gnash::as_object::get_super (this=0x8074a00) at /home/strk/src/gnash/gnash-head/server/as_object.cpp:142

Sandro Santilli <strk>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by cmusick (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  • -unavailable- added by strk
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 22 Nov 2007 11:50:10 AM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Thu 22 Nov 2007 11:12:14 AM UTCcmusickStatusNone=>Ready For Test
    Wed 21 Nov 2007 11:09:13 PM UTCstrkAssigned toNone=>cmusick
    Tue 20 Nov 2007 09:15:44 PM UTCstrkCarbon-Copy-=>Added cmusick

    Back to the top


    Powered by Savane 3.1-cleanup1