bugGnash - The GNU Flash player - Bugs: bug #21783, server/as_object.cpp:535: void...

 
 

bug #21783: server/as_object.cpp:535: void gnash::as_object::init_readonly_property(const std::string&, gnash::as_function&, int, si

Submitted by:  Sandro Santilli <strk>
Submitted on:  Wed 12 Dec 2007 11:39:06 PM UTC  
 
Category: coreSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Fri 14 Dec 2007 09:03:02 AM UTC, comment #8:

I confirm it seems to have fixed it.

Benjamin Wolsey <bwy>
Project Member
Thu 13 Dec 2007 09:34:28 PM UTC, comment #7:

Found and fixed another uninitialized member, this time the one used for sorting the secondary index maintained by PropertyList.
Seems to fix the valgrind report and the assertion.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 13 Dec 2007 07:04:56 PM UTC, comment #6:

I committed a patch adding more assertion checking and actually triggering the failure more often, for more help in fixing it.
For me, misc-ming.all/loop-test-Runner triggers it.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 13 Dec 2007 05:59:55 PM UTC, comment #5:

I take it back, it's on insert.

I will commit the assertion checking, and let it be killed more consistently rather then occasionally if that helps.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 13 Dec 2007 05:33:27 PM UTC, comment #4:

For completeness:

ERROR: Key 16, Namespace 0 not found right after replace

... fails after replace ...

Here's the relevant code:

container::iterator found = iterator_find(_props, key, nsId);
if (found != _props.end())
{
// copy flags from previous member (even if it's a normal member ?)
as_prop_flags& f = a.getFlags();
f = found->getFlags();
_props.replace(found, a);
{

assert ( getProperty(key, nsId) );

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 13 Dec 2007 05:25:15 PM UTC, comment #3:

Made this experiment:

in:

bool
PropertyList::addGetterSetter(string_table::key key, as_function& getter, as_function& setter, string_table::key nsId)

right before return true (which supposedly tells the caller
that the getter-setter was successfully inserted):

if ( ! getProperty(key, nsId) )
{
log_error("Key %d, Namespace %d not found right after %s", key, nsId, found == _props.end() ? "replace" : "insert");
assert(0);
}
return true;

And, well... it fails ... (halloweenpaint)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 13 Dec 2007 01:45:49 PM UTC, comment #2:

Inside valgrind the assertion failure disappears for me.
As usual I get lots of these:

==29107== Conditional jump or move depends on uninitialised value(s)
==29107== at 0x412C69C: gnash::PropertyList::setValue(unsigned, gnash::as_value, gnash::as_object&, unsigned) (ordered_index.hpp:824)
==29107== by 0x4152B54: gnash::as_object::init_member(unsigned, gnash::as_value const&, int, unsigned, int) (as_object.cpp:458)
==29107== by 0x4155071: gnash::as_object::init_member(std::string const&, gnash::as_value const&, int, unsigned) (as_object.cpp:434)
==29107== by 0x4306A19: gnash::getObjectInterface() (Object.cpp:63)
==29107== by 0x414F1AE: gnash::as_function::as_function() (as_function.cpp:110)
==29107== by 0x4192D52: gnash::builtin_function::builtin_function(gnash::as_value (*)(gnash::fn_call const&)) (builtin_function.h:52)
==29107== by 0x42DFF4D: gnash::Global::Global(gnash::VM&, gnash::ClassHierarchy*) (Global.cpp:443)
==29107== by 0x44116C9: gnash::VM::init(gnash::movie_definition&, gnash::VirtualClock&) (VM.cpp:64)
==29107== by 0x8091359: gnash::Player::run(int, char*, char const, char const*) (Player.cpp:313)
==29107== by 0x80837C3: main (gnash.cpp:427)
==29107==

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 13 Dec 2007 12:10:22 PM UTC, comment #1:

I have backtraces from another movie (SWF4/flashscroll.swf), which also reliably fails that assertion after running for a few seconds. (See bug #20911 for the SWF).

Backtrace 1:

#3 0x00002b331275b916 in gnash::as_object::init_readonly_property (
this=0xa16ec0, key=<value optimized out>, getter=@0xa17cd0, initflags=3,
nsname=0) at as_object.cpp:535
#4 0x00002b33127e5a92 in attachButtonInterface (o=@0xa16ec0)
at button_character_instance.cpp:200
#5 0x00002b33127e691a in button_character_instance (this=0xa16ec0,
def=0x936280, parent=0xa12da0, id=37) at button_character_instance.cpp:264
#6 0x00002b331287ccfd in gnash::button_character_definition::create_character_instance (this=0x936280, parent=0xa12da0, id=37) at button_character_def.cpp:454
#7 0x00002b331279050d in gnash::sprite_instance::add_display_object (
this=0xa12da0, character_id=<value optimized out>, name=0x0,
event_handlers=@0x936f38, depth=-16382, color_transform=@0x936ecc,
mat=@0x936eec, ratio=-1, clip_depth=-1000000) at sprite_instance.cpp:2825
#8 0x00002b33127ab0dd in gnash::SWF::PlaceObject2Tag::execute (this=0x206,
m=0xa12da0) at swf/PlaceObject2Tag.cpp:446
#9 0x00002b33127a32f5 in std::for_each<__gnu_cxx::__normal_iterator<gnash::ControlTag* const, std::vector<gnash::ControlTag, std::allocator<gnash::ControlTag> > >, boost::_bi::bind_t<void, boost::_mfi::cmf1<void, gnash::ControlTag, gnash::sprite_instance>, boost::_bi::list2<boost::arg<1>, boost::_bi::value<gnash::sprite_instance*> > > > (__first=<value optimized out>, __last=
---Type <return> to continue, or q <return> to quit---
{_M_current = 0x935a38}, __f=
{f_ = {f_ = <error reading variable>}, l_ = {a1_ = {<No data fields>}, a2_ = {t_ = 0xa12da0}}}) at /usr/include/boost/bind/mem_fn_template.hpp:195
#10 0x00002b33127909da in gnash::sprite_instance::execute_frame_tags (
this=0xa12da0, frame=0, typeflags=1) at sprite_instance.cpp:2585
#11 0x00002b3312790c0a in gnash::sprite_instance::stagePlacementCallback (
this=0xa12da0) at sprite_instance.cpp:3448
#12 0x00002b33127e949a in gnash::DisplayList::place_character (this=0xa08bb0,
ch=0xa12da0, depth=-16380, color_xform=<value optimized out>,
mat=@0x93a17c, ratio=-1, clip_depth=-1000000) at dlist.cpp:239

Backtrace 2:

#3 0x00002b5d1da77916 in gnash::as_object::init_readonly_property (
this=0x9eb880, key=<value optimized out>, getter=@0x9ec870, initflags=3,
nsname=0) at as_object.cpp:535
#4 0x00002b5d1daae33e in attachMovieClipProperties (o=@0x9eb880)
at sprite_instance.cpp:1640
#5 0x00002b5d1dabadd0 in sprite_instance (this=0x9eb880, def=0x928680,
r=<value optimized out>, parent=<value optimized out>,
id=<value optimized out>) at sprite_instance.cpp:1853
#6 0x00002b5d1dbae5b6 in gnash::sprite_definition::create_character_instance (
this=0x928680, parent=0x9e80e0, id=18) at sprite_definition.cpp:48
#7 0x00002b5d1daac50d in gnash::sprite_instance::add_display_object (
this=0x9e80e0, character_id=<value optimized out>,
name=0x92ab70 "decade1", event_handlers=@0x92af38, depth=-16383,
color_transform=@0x92aecc, mat=@0x92aeec, ratio=-1, clip_depth=-1000000)
at sprite_instance.cpp:2825
#8 0x00002b5d1dac70dd in gnash::SWF::PlaceObject2Tag::execute (this=0x206,
m=0x9e80e0) at swf/PlaceObject2Tag.cpp:446
#9 0x00002b5d1dabf2f5 in std::for_each<__gnu_cxx::__normal_iterator<gnash::ControlTag* const, std::vector<gnash::ControlTag, std::allocator<gnash::ControlTag*> > >, boost::_bi::bind_t<void, boost::_mfi::cmf1<void, gnash::ControlTag, gnas---Type <return> to continue, or q <return> to quit---
h::sprite_instance>, boost::_bi::list2<boost::arg<1>, boost::_bi::value<gnash::sprite_instance> > > > (__first=<value optimized out>, __last=
{_M_current = 0x92af68}, __f=
{f_ = {f_ = <error reading variable>}, l_ = {a1_ = {<No data fields>}, a2_ = {t_ = 0x9e80e0}}}) at /usr/include/boost/bind/mem_fn_template.hpp:195
#10 0x00002b5d1daac9da in gnash::sprite_instance::execute_frame_tags (
this=0x9e80e0, frame=0, typeflags=1) at sprite_instance.cpp:2585
#11 0x00002b5d1daacc0a in gnash::sprite_instance::stagePlacementCallback (
this=0x9e80e0) at sprite_instance.cpp:3448

Benjamin Wolsey <bwy>
Project Member
Wed 12 Dec 2007 11:39:06 PM UTC, original submission:

server/as_object.cpp:535: void gnash::as_object::init_readonly_property(const std::string&, gnash::as_function&, int, size_t): Assertion `_members.getProperty(k, nsname)' failed.

by playing halloweenpaint.swf
md5: 04e8533168e326d2db1b8e670d820030
SWF: 5

Doesn't reproduce when under gdb :/

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 14 Dec 2007 09:07:03 AM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Thu 13 Dec 2007 09:34:28 PM UTCstrkCategoryNone=>core
      StatusNone=>Ready For Test
      Assigned toNone=>strk
    Thu 13 Dec 2007 12:33:51 PM UTCstrkCarbon-Copy-=>Added cmusick

    Back to the top


    Powered by Savane 3.1-cleanup1