bugGnash - The GNU Flash player - Bugs: bug #22592, Assertion failure with sevenload.de

 
 

bug #22592: Assertion failure with sevenload.de

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Fri 14 Mar 2008 04:42:36 PM UTC  
 
Category: NoneSeverity: 4 - Important
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 15 Mar 2008 08:44:55 AM UTC, comment #4:

well, the assertion failure is fixed, so other items for other bugs.

Sandro Santilli <strk>
Project Member
Fri 14 Mar 2008 07:20:17 PM UTC, comment #3:

copy/paste from irc about other parser issues:

20:21 < strk> The f_count is assumed to be 1 unless a gradient filter is used, in which case a byte will be defined here. Note: the maximum number of gradient
is not specified in the Macromedia documentation. It can be assumed to be the same as for the other gradients and thus it either can be 1 to 8
or 1 to 15. I will need to test that too!
20:21 < strk> from: http://www.m2osw.com/swf_alexref.html
20:21 < strk> about: 20846] 20:13:59: ERROR: Unexpected num gradients (9), expected 1 to 8
20:21 < strk> triggered by: http://de.sevenload.com/~page/swf/player.swf
20:22 < strk> referred by https://savannah.gnu.org/bugs/?22592
20:22 < strk> notes in the gnash code:
20:22 < strk> // num_gradients is not 8 bits, it is only the last 4.
20:22 < strk> // at the moment, the first four are unused, so we may
20:22 < strk> // mask, but this needs to be changed.
20:23 < strk> might be the cause for furhter parser issues

Sandro Santilli <strk>
Project Member
Fri 14 Mar 2008 05:56:04 PM UTC, comment #2:

Just a note: assertion failing are not of "security" severity.
Segfaults are.

Sandro Santilli <strk>
Project Member
Fri 14 Mar 2008 05:10:29 PM UTC, comment #1:

Backtrace:

#3 0x00002b290cc8edda in sprite_startDrag (fn=@0x7fff9e367fe0) at ../libgeometry/Range2d.h:181
#4 0x00002b290c973b35 in gnash::builtin_function::operator() (this=0xa949d0, fn=@0x7fff9e367fe0) at ../server/builtin_function.h:83
#5 0x00002b290cdfa15f in gnash::call_method (method=<value optimized out>, env=0xa82868, this_ptr=0x1b73b30, nargs=5, first_arg_bottom_index=32,
super=0x83484a0) at action.cpp:157
#6 0x00002b290cdca8f5 in gnash::SWF::SWFHandlers::ActionCallMethod (thread=@0x7fff9e368840) at ASHandlers.cpp:3574
#7 0x00002b290cdf4b10 in gnash::ActionExec::operator() (this=0x7fff9e368840) at ActionExec.cpp:346
#8 0x00002b290ccb3901 in gnash::swf_function::operator() (this=0xd69520, fn=@0x7fff9e368bd0) at swf_function.cpp:302
#9 0x00002b290cdfa15f in gnash::call_method (method=<value optimized out>, env=0xa82868, this_ptr=0x1b57f80, nargs=0, first_arg_bottom_index=24,
super=0x46c9340) at action.cpp:157
#10 0x00002b290cdca8f5 in gnash::SWF::SWFHandlers::ActionCallMethod (thread=@0x7fff9e369430) at ASHandlers.cpp:3574
#11 0x00002b290cdf4b10 in gnash::ActionExec::operator() (this=0x7fff9e369430) at ActionExec.cpp:346
#12 0x00002b290ccb3901 in gnash::swf_function::operator() (this=0xd67ea0, fn=@0x7fff9e3697c0) at swf_function.cpp:302
#13 0x00002b290cdfa15f in gnash::call_method (method=<value optimized out>, env=0xa82868, this_ptr=0x1b57f80, nargs=0, first_arg_bottom_index=21,
super=0x518f4c0) at action.cpp:157
#14 0x00002b290cdca8f5 in gnash::SWF::SWFHandlers::ActionCallMethod (thread=@0x7fff9e36a020) at ASHandlers.cpp:3574
#15 0x00002b290cdf4b10 in gnash::ActionExec::operator() (this=0x7fff9e36a020) at ActionExec.cpp:346
#16 0x00002b290ccb3901 in gnash::swf_function::operator() (this=0xd6d9d0, fn=@0x7fff9e36a3b0) at swf_function.cpp:302
#17 0x00002b290cdfa15f in gnash::call_method (method=<value optimized out>, env=0xa82868, this_ptr=0x1b57f80, nargs=0, first_arg_bottom_index=18,
super=0xe4f820) at action.cpp:157
#18 0x00002b290cdca8f5 in gnash::SWF::SWFHandlers::ActionCallMethod (thread=@0x7fff9e36ac10) at ASHandlers.cpp:3574
#19 0x00002b290cdf4b10 in gnash::ActionExec::operator() (this=0x7fff9e36ac10) at ActionExec.cpp:346
#20 0x00002b290ccb3901 in gnash::swf_function::operator() (this=0xd64fd0, fn=@0x7fff9e36afa0) at swf_function.cpp:302
#21 0x00002b290cdfa15f in gnash::call_method (method=<value optimized out>, env=0xa82868, this_ptr=0x1a2b080, nargs=2, first_arg_bottom_index=15,
super=0x8b10dd0) at action.cpp:157
#22 0x00002b290cdca8f5 in gnash::SWF::SWFHandlers::ActionCallMethod (thread=@0x7fff9e36b800) at ASHandlers.cpp:3574
#23 0x00002b290cdf4b10 in gnash::ActionExec::operator() (this=0x7fff9e36b800) at ActionExec.cpp:346
#24 0x00002b290ccb3901 in gnash::swf_function::operator() (this=0xd73630, fn=@0x7fff9e36bb90) at swf_function.cpp:302
#25 0x00002b290cdfa15f in gnash::call_method (method=<value optimized out>, env=0xa82868, this_ptr=0x1a2b080, nargs=2, first_arg_bottom_index=10,
super=0x1205e00) at action.cpp:157
#26 0x00002b290cdca8f5 in gnash::SWF::SWFHandlers::ActionCallMethod (thread=@0x7fff9e36c3f0) at ASHandlers.cpp:3574
#27 0x00002b290cdf4b10 in gnash::ActionExec::operator() (this=0x7fff9e36c3f0) at ActionExec.cpp:346
#28 0x00002b290ccb3901 in gnash::swf_function::operator() (this=0xbdea50, fn=@0x7fff9e36c780) at swf_function.cpp:302
#29 0x00002b290cdfa15f in gnash::call_method (method=<value optimized out>, env=0xa82868, this_ptr=0x1aa5140, nargs=1, first_arg_bottom_index=5,
super=0x18b0040) at action.cpp:157
#30 0x00002b290cdca8f5 in gnash::SWF::SWFHandlers::ActionCallMethod (thread=@0x7fff9e36cfe0) at ASHandlers.cpp:3574
#31 0x00002b290cdf4b10 in gnash::ActionExec::operator() (this=0x7fff9e36cfe0) at ActionExec.cpp:346
---Type <return> to continue, or q <return> to quit---
#32 0x00002b290ccb3901 in gnash::swf_function::operator() (this=0xbfecd0, fn=@0x7fff9e36d280) at swf_function.cpp:302
#33 0x00002b290cc321a0 in gnash::function_apply (fn=@0x7fff9e36d4d0) at as_function.h:79
#34 0x00002b290c973b35 in gnash::builtin_function::operator() (this=0xa26dc0, fn=@0x7fff9e36d4d0) at ../server/builtin_function.h:83
#35 0x00002b290cdfa15f in gnash::call_method (method=<value optimized out>, env=0xa82868, this_ptr=0xbfecd0, nargs=2, first_arg_bottom_index=1,
super=0x8b2a030) at action.cpp:157
#36 0x00002b290cdca8f5 in gnash::SWF::SWFHandlers::ActionCallMethod (thread=@0x7fff9e36dd30) at ASHandlers.cpp:3574
#37 0x00002b290cdf4b10 in gnash::ActionExec::operator() (this=0x7fff9e36dd30) at ActionExec.cpp:346
#38 0x00002b290ccb3901 in gnash::swf_function::operator() (this=0x1b3fe00, fn=@0x7fff9e36e0c0) at swf_function.cpp:302
#39 0x00002b290cdfa15f in gnash::call_method (method=<value optimized out>, env=0x1aba308, this_ptr=0x1aba180, nargs=0, first_arg_bottom_index=0, super=0x0)
at action.cpp:157
#40 0x00002b290cdfafa3 in gnash::call_method0 (method=@0x3830, env=0x6, this_ptr=0xffffffffffffffff) at action.cpp:186
#41 0x00002b290cc8750e in gnash::sprite_instance::on_event (this=0x1aba180, id=<value optimized out>) at sprite_instance.cpp:2666
#42 0x00002b290cc6c2a4 in gnash::generate_mouse_button_events (ms=0xa1dc40) at movie_root.cpp:792
#43 0x00002b290cc6deed in gnash::movie_root::fire_mouse_event (this=0xa1dbb0) at movie_root.cpp:846
#44 0x00002b290cc6e5e5 in gnash::movie_root::notify_mouse_clicked (this=0xa1dbb0, mouse_pressed=<value optimized out>, button_mask=<value optimized out>)
at movie_root.cpp:618
#45 0x0000000000425dbc in gnash::Gui::notify_mouse_clicked (this=0x706a40, mouse_pressed=48, mask=6) at gui.cpp:419
#46 0x00000000004375c6 in gnash::GtkGui::button_press_event (event=0x2ab6750, data=0x706a40) at gtk.cpp:1711

Benjamin Wolsey <bwy>
Project Member
Fri 14 Mar 2008 04:42:36 PM UTC, original submission:

http://de.sevenload.com/~page/swf/player.swf

Gnash seems to do a few things wrong with this movie. It registers more than 5300 as_objects with the GC and spits lots of these out:

6945] 17:35:45: ERROR: Character N5gnash21video_stream_instanceE did not override pointInShape() - using pointInBounds() instead
6945] 17:35:45: ERROR: Character N5gnash21video_stream_instanceE did not override pointInShape() - using pointInBounds() instead
6945] 17:35:45: ERROR: Character N5gnash21video_stream_instanceE did not override pointInShape() - using pointInBounds() instead
6945] 17:35:46: ERROR: Character N5gnash21video_stream_instanceE did not override pointInShape() - using pointInBounds() instead
6945] 17:35:46: ERROR: Character N5gnash21video_stream_instanceE did not override pointInShape() - using pointInBounds() instead
6945] 17:35:46: ERROR: Character N5gnash21video_stream_instanceE did not override pointInShape() - using pointInBounds() instead

A few clicks make it fail with the assertion

gtk-gnash: ../libgeometry/Range2d.h:181: gnash::geometry::Range2d<T>::Range2d(T, T, T, T) [with T = float]: Zusicherung »_xmin <= _xmax« nicht erfüllt.

It also makes my console change encoding at this point:

6993] 17:39:10: ERROR: Unexpected num gradients ( ), expected 1 to 8
6993] 17:39:10: ERROR: Unexpected num gradients ( ), expected 1 to 8
6993] 17:39:10: ERROR: Unexpected num gradients (), ␊│⎻␊␌├␊␍ 1 ├⎺ 8
6

probably something to do with a uint8 being interpreted as a char or a %p format not being cast to void* first.

I'll look into the logging and assertion bugs.

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 15 Mar 2008 08:44:55 AM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 14 Mar 2008 05:56:04 PM UTCstrkSeverity6 - Security=>4 - Important
      StatusNone=>Ready For Test

    Back to the top


    Powered by Savane 3.1-cleanup1