bugGnash - The GNU Flash player - Bugs: bug #22420, infinite getter-setter recursion

 
 

bug #22420: infinite getter-setter recursion

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Tue 26 Feb 2008 07:24:27 AM UTC  
 
Category: ActionScriptSeverity: 3 - Normal
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Wed 27 Feb 2008 07:24:05 PM UTC, comment #10:

It fixes this case.

Benjamin Wolsey <bwy>
Project Member
Wed 27 Feb 2008 04:27:42 PM UTC, comment #9:

Just a note, with my commit, Gnash always prevents infinite recursions due to getter/setter calling self... which is not 100% compatible in SWF7 or higher.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 27 Feb 2008 04:22:58 PM UTC, comment #8:

Committed a fix and an automated testcase in head. Branch will follow.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 27 Feb 2008 03:00:50 PM UTC, comment #7:

I have a local fix, but I found out that the more complex testcase
(recursiveGetterSetter2.as) compiled as SWF7 or higher, is
actually expected to infinitely recurse..

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 27 Feb 2008 11:32:31 AM UTC, comment #6:

recursiveGetterSetter2.as adds a bit of complexity, showing
that while running a setter, it's just the target member being
"locked" and not other members/properties.

Expected output:
mem1 setter, this is [object Object] (object - name o1)
mem2 setter, this is [object Object] (object - name o2)
mem2 getter, this is [object Object] (object - name o2)
2
mem1 getter, this is [object Object] (object - name o1)
2
mem2 setter, this is [object Object] (object - name o2)
mem1 setter, this is [object Object] (object - name o1)
mem1 getter, this is [object Object] (object - name o1)
3
mem2 getter, this is [object Object] (object - name o2)
3

(file #15128)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 27 Feb 2008 10:53:48 AM UTC, comment #5:

recursiveGetterSetter.as is a simplified testcase for
the bug.

The expected output is:

----------------------------------------------
mem setter, this is [object Object] (object)
mem getter, this is [object Object] (object)
2
----------------------------------------------

(file #15127)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 27 Feb 2008 10:33:00 AM UTC, comment #4:

Alright, I got to the source of problem being
a setter function assigning to the variable it watches:

This comes out from Ming decompiler:

R2.__get__Region = function () {
return this.region;
};

R2.__set__Region = function (regionName) {
this.region = regionName;
return this.__get__Region();
};

Gnash chokes in the setter (__set__Region) which is
the setter for a 'region' property.
"this.region" invokes the setter again.
Looking at the code it seems the 'getter' would do
about the same, as it fetches it's own value again.

Now, the problem might be in a bogus value for 'this',
or in an incompatible handling of an actionscript error.

We should now have the elements for trying to reproduce
the problem with custom test movies and see how the reference
player would handle it.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 26 Feb 2008 11:35:44 AM UTC, comment #3:

NOTE: 0.8.1 did hit the same limit, so if it's a regression,
it is not from 0.8.1.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 26 Feb 2008 11:35:13 AM UTC, comment #2:

The offending code is in an XML.onLoad function:

DEBUG: gnash::as_value gnash::xml_ondata(const gnash::fn_call&) enter
DEBUG: Calling parseXML
DEBUG: Done Calling parseXML, calling onLoad
ERROR: ActionLimits hit during advance: Max stack count reached (255). Disabling scripts

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 26 Feb 2008 09:08:30 AM UTC, comment #1:

It's an endlessly growing series of array objects that seems to be causing the problem; 'super' is involved too.

The stack at a random point looks like this:

Stack: "[function:0xd83b90]" | "[object(gnash::as_object):0xd838b0]" | "[undefined]" | "[object(gnash::as_array_object):0xbb7c90]" | "[object(gnash::as_objec
t):0xd8a9c0]" | "[number:2]" | "[function:0xd491c0]" | "[string:apply]" | "[bool:true]" | "[object(gnash::as_array_object):0xbb7c90]" | "[object(gnash::as_ob
ject):0xd8a9c0]" | "[function:0xd491c0]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object
(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" |
"[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[ob
ject(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region
]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" |
"[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:re
gion]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]
" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[strin
g:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6
a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[s
tring:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0
xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" |
"[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_objec
t):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0
]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_o
bject):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8
a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]" | "[object(gnash::as_object):0xd8a9c0]" | "[string:region]" | "[object(gnash::as_array_object):0xde6a60]"

Benjamin Wolsey <bwy>
Project Member
Tue 26 Feb 2008 07:24:27 AM UTC, original submission:

This movie throws an action limits exception:

http://news.bbc.co.uk/nol/shared/bsp/hi/live_stats/swf/map.swf?returnURL=http://news.bbc.co.uk/1/shared/bsp/hi/live_stats/html/map.stm

It used to work fine. Tt's quite possible that the movie itself has changed, but it also might be a regression. I haven't tested it with the pp.

See this page for the embedded SWF:

http://news.bbc.co.uk/1/shared/bsp/hi/live_stats/html/map.stm

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #15128:  recursiveGetterSetter2.as added by strk (808B - application/x-applix-spreadsheet)
file #15127:  recursiveGetterSetter.as added by strk (285B - application/x-applix-spreadsheet)
file #15117:  bbcmap_stm.swf added by strk (148KiB - application/x-shockwave-flash - the offending movie, reproduces the limit hit offline)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 27 Feb 2008 07:24:05 PM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Wed 27 Feb 2008 04:22:58 PM UTCstrkStatusIn Progress=>Ready For Test
    Wed 27 Feb 2008 11:49:59 AM UTCstrkStatusNone=>In Progress
      Assigned toNone=>strk
      SummaryActionlimits exception thrown (possible regression)=>infinite getter-setter recursion
    Wed 27 Feb 2008 11:32:31 AM UTCstrkAttached File-=>Added recursiveGetterSetter2.as, #15128
    Wed 27 Feb 2008 10:53:48 AM UTCstrkAttached File-=>Added recursiveGetterSetter.as, #15127
    Tue 26 Feb 2008 11:40:06 AM UTCstrkAttached File-=>Added bbcmap_stm.swf, #15117

    Back to the top


    Powered by Savane 3.1-cleanup1