bugGnash - The GNU Flash player - Bugs: bug #22239, attempt to decrement a...

 
 

bug #22239: attempt to decrement a dereferenceable (start-of-sequence) iterator.

Submitted by:  Sandro Santilli <strk>
Submitted on:  Wed 06 Feb 2008 02:30:15 PM UTC  
 
Category: ActionScriptSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 07 Feb 2008 11:13:27 AM UTC, comment #3:

sorting a std::list instead of a std::deque fixes this bug
(or at least makes it less likely to happen).

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 06 Feb 2008 08:01:02 PM UTC, comment #2:

Attached test with sources is the smallest one reproducing
the problem. Note that the official player goes into
an infinite loop with it. Better then segfaulting, but
not much smarter.

(file #14976, file #14977)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 06 Feb 2008 06:12:51 PM UTC, comment #1:

Ok, the problem is that the standard sort algorithms in the C++ lib can't deal with invalid comparators, which are comparator not respecting the Strict Weak Ordering constraints:
http://www.sgi.com/tech/stl/StrictWeakOrdering.html

That is, given an unstable comparator, they can corrupt
memory. So we need to code our own sorting algorithm
and take into account randomness of the comparator's results..

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 06 Feb 2008 02:30:15 PM UTC, original submission:

http://pbskids.org/sesame/ernie/jte.swf

/usr/include/c++/4.1.3/debug/safe_iterator.h:240:error: attempt to
decrement a dereferenceable (start-of-sequence) iterator.

Objects involved in the operation:
iterator "this" @ 0x0xbfd731ac {
type = N11__gnu_debug14_Safe_iteratorIN10__gnu_norm15_Deque_iteratorIN5gnash8as_valueERS4_PS4_EEN15__gnu_debug_def5dequeIS4_SaIS4_EEEEE (mutable iterator);
state = dereferenceable (start-of-sequence);
references sequence with type `N15__gnu_debug_def5dequeIN5gnash8as_valueESaIS2_EEE' @ 0x0xbfd731ac
}

Program received signal SIGABRT, Aborted.
[Switching to Thread -1232976192 (LWP 28664)]
0xffffe410 in __kernel_vsyscall ()
(gdb) bt
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb7119875 in raise () from /lib/tls/i686/cmov/libc.so.6
#2 0xb711b201 in abort () from /lib/tls/i686/cmov/libc.so.6
#3 0xb72ac9e6 in __gnu_debug::_Error_formatter::_M_error () from /usr/lib/libstdc++.so.6
#4 0xb7bdd339 in __gnu_debug::_Safe_iterator<__gnu_norm::_Deque_iterator<gnash::as_value, gnash::as_value&, gnash::as_value*>, __gnu_debug_def::deque<gnash::as_value, std::allocator<gnash::as_value> > >::operator-- (this=0xbfd731ac) at /usr/include/c++/4.1.3/debug/safe_iterator.h:238
#5 0xb7be46c8 in std::__unguarded_linear_insert<__gnu_debug::_Safe_iterator<__gnu_norm::_Deque_iterator<gnash::as_value, gnash::as_value&, gnash::as_value*>, __gnu_debug_def::deque<gnash::as_value, std::allocator<gnash::as_value> > >, gnash::as_value, gnash::as_value_custom> (__last=@0xbfd732c0, __val=@0xbfd732f8,
__comp={_comp = @0x834b078, _object = 0x83a8588, _zeroCmp = 0xb7bc3c30 <int_gt>, _env = @0x82d56a4}) at /usr/include/c++/4.1.3/bits/stl_algo.h:2255
#6 0xb7c002f7 in std::__insertion_sort<__gnu_debug::_Safe_iterator<__gnu_norm::_Deque_iterator<gnash::as_value, gnash::as_value&, gnash::as_value*>, __gnu_debug_def::deque<gnash::as_value, std::allocator<gnash::as_value> > >, gnash::as_value_custom> (__first=@0xbfd73420, __last=@0xbfd73400, __comp=
{_comp = @0x834b078, _object = 0x83a8588, _zeroCmp = 0xb7bc3c30 <int_gt>, _env = @0x82d56a4}) at /usr/include/c++/4.1.3/bits/stl_algo.h:2309
#7 0xb7c013f2 in std::__final_insertion_sort<__gnu_debug::_Safe_iterator<__gnu_norm::_Deque_iterator<gnash::as_value, gnash::as_value&, gnash::as_value*>, __gnu_debug_def::deque<gnash::as_value, std::allocator<gnash::as_value> > >, gnash::as_value_custom> (__first=@0xbfd7366c, __last=@0xbfd7364c, __comp=
{_comp = @0x834b078, _object = 0x83a8588, _zeroCmp = 0xb7bc3c30 <int_gt>, _env = @0x82d56a4}) at /usr/include/c++/4.1.3/bits/stl_algo.h:2383
#8 0xb7c0edc7 in std::sort<__gnu_debug::_Safe_iterator<__gnu_norm::_Deque_iterator<gnash::as_value, gnash::as_value&, gnash::as_value*>, __gnu_debug_def::deque<gnash::as_value, std::allocator<gnash::as_value> > >, gnash::as_value_custom> (__first=@0xbfd73af0, __last=@0xbfd73b10, __comp=
{_comp = @0x834b078, _object = 0x83a8588, _zeroCmp = 0xb7bc3c30 <int_gt>, _env = @0x82d56a4}) at /usr/include/c++/4.1.3/bits/stl_algo.h:2751
#9 0xb7bd27f1 in array_sort (fn=@0xbfd73d3c) at /home/strk/src/gnash/gnash-head/server/array.h:221
#10 0xb7afca5b in gnash::builtin_function::operator() (this=0x82e1d08, fn=@0xbfd73d3c) at /home/strk/src/gnash/gnash-head/server/builtin_function.h:83

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #14976:  sortChoke.as added by strk (86B - application/x-applix-spreadsheet)
file #14977:  sortChoke.swf added by strk (184B - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 07 Feb 2008 11:13:27 AM UTCstrkStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Wed 06 Feb 2008 08:01:02 PM UTCstrkAttached File-=>Added sortChoke.as, #14976
      Attached File-=>Added sortChoke.swf, #14977

    Back to the top


    Powered by Savane 3.1-cleanup1