bugGnash - The GNU Flash player - Bugs: bug #22814, libnet.all/test_cque corrupts...

 
 

bug #22814: libnet.all/test_cque corrupts memory

Submitted by:  Sandro Santilli <strk>
Submitted on:  Wed 02 Apr 2008 09:35:33 PM UTC  
 
Category: testsuiteSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Rob Savoye <rsavoye>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 07 Apr 2008 08:43:08 PM UTC, comment #6:

valgrind clean now.

Sandro Santilli <strk>
Project Member
Mon 07 Apr 2008 08:30:41 AM UTC, comment #5:

Was ::merge patch applied ? I still get these:

Starting program: /home/strk/src/gnash/build/head/gtk_agg_gst_debugging/testsuite/libnet.all/.libs/lt-test_cque
[Thread debugging using libthread_db enabled]
[New Thread -1218180496 (LWP 4323)]
RcInitFile: parsing /home/strk/.gnashrc
PASSED: CQue::push(Buffer *)
PASSED: CQue::pushin(Buffer *)
PASSED: CQue::clearall()
PASSED: CQue::peek()
PASSED: CQue::pop()
PASSED: CQue::remove()
/usr/include/c++/4.1.3/debug/safe_iterator.h:130:error: attempt to copy-
construct an iterator from a singular iterator.

Objects involved in the operation:
iterator "this" @ 0x0xbf89779c {
type = N11__gnu_debug14_Safe_iteratorIN10__gnu_norm15_Deque_iteratorIPN3amf6BufferERS5_PS5_EEN15__gnu_debug_def5dequeIS5_SaIS5_EEEEE (mutable iterator);
state = dereferenceable;
references sequence with type `N15__gnu_debug_def5dequeIPN3amf6BufferESaIS3_EEE' @ 0x0xbf89779c
}
iterator "other" @ 0x0x804f650 {
type = N11__gnu_debug14_Safe_iteratorIN10__gnu_norm15_Deque_iteratorIPN3amf6BufferERS5_PS5_EEN15__gnu_debug_def5dequeIS5_SaIS5_EEEEE (mutable iterator);
state = singular;
references sequence with type `N15__gnu_debug_def5dequeIPN3amf6BufferESaIS3_EEE' @ 0x0x804f650
}

(gdb) bt
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb7bf4875 in raise () from /lib/tls/i686/cmov/libc.so.6
#2 0xb7bf6201 in abort () from /lib/tls/i686/cmov/libc.so.6
#3 0xb7d619e6 in __gnu_debug::_Error_formatter::_M_error () from /usr/lib/libstdc++.so.6
#4 0xb7e4a735 in _Safe_iterator (this=0xbf89779c, __x=@0x804f650) at /usr/include/c++/4.1.3/debug/safe_iterator.h:127
#5 0xb7e3f780 in gnash::CQue::merge (this=0xbf8979b4, begin=0xbf897990) at /home/strk/src/gnash/gnash-head/libnet/cque.cpp:218
#6 0x08049e1e in main () at /home/strk/src/gnash/gnash-head/testsuite/libnet.all/test_cque.cpp:156

Sandro Santilli <strk>
Project Member
Sun 06 Apr 2008 06:16:24 PM UTC, comment #4:

All tests in libnet don't leak at all now, but I only incorporated some of these patches, as parts were for code I had already rewritten.

Rob Savoye <rsavoye>
Project AdministratorIn charge of this item.
Wed 02 Apr 2008 10:48:18 PM UTC, comment #3:

Sorry, forgot the header patch as well.
This is just a typedef of the queue container,
to make code more terse.

(file #15387)

Sandro Santilli <strk>
Project Member
Wed 02 Apr 2008 10:43:02 PM UTC, comment #2:

Attached a patch that fixes CQue::merge.
Contains a comment about a possible conceptual bug
in the old code, which the new code replicates.
Basically the buffer resulting from merging the identified
range (from given to first smaller then NETBUFSIZE)
is pushed on the back in the original (and new) implementation,
while I belive it should be put in place of the removed
range. It's one line to uncomment to fix, if confirmed as
a bug.

With this patch I get no more failures under libnet.all

#passed: 7
#real failed: 0

(file #15386)

Sandro Santilli <strk>
Project Member
Wed 02 Apr 2008 09:48:41 PM UTC, comment #1:

The problem here is that CQue::remove erases an iterator
and then tries to advance it.

The attached patch (cque_remove.patch) fixes this problem,

Another, more complex to fix, is in CQue::merge
which both pushes elements and erase elements from
whithin the body of an iterating over them...
that's a no-no.

(file #15385)

Sandro Santilli <strk>
Project Member
Wed 02 Apr 2008 09:35:33 PM UTC, original submission:

When building with -D_GLIBCXX_DEBUG, the gnu stdc++ lib
avoids the corruption by failing an assertion instead:

PASSED: CQue::peek()
PASSED: CQue::pop()
/usr/include/c++/4.1.3/debug/safe_iterator.h:224:error: attempt to
increment a singular iterator.

Objects involved in the operation:
iterator "this" @ 0x0xbff82f38 {
type = N11__gnu_debug14_Safe_iteratorIN10__gnu_norm15_Deque_iteratorIPN3amf6BufferERS5_PS5_EEN15__gnu_debug_def5dequeIS5_SaIS5_EEEEE (mutable iterator);
state = singular;
references sequence with type `N15__gnu_debug_def5dequeIPN3amf6BufferESaIS3_EEE' @ 0x0xbff82f38
}
Aborted (core dumped)

(gdb) bt
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb7b87875 in raise () from /lib/tls/i686/cmov/libc.so.6
#2 0xb7b89201 in abort () from /lib/tls/i686/cmov/libc.so.6
#3 0xb7cf49e6 in __gnu_debug::_Error_formatter::_M_error () from /usr/lib/libstdc++.so.6
#4 0xb7ddfd19 in __gnu_debug::_Safe_iterator<__gnu_norm::_Deque_iterator<amf::Buffer, amf::Buffer&, amf::Buffer*>, __gnu_debug_def::deque<amf::Buffer, std::allocator<amf::Buffer*> > >::operator++ (this=0xbfd3fcc8) at /usr/include/c++/4.1.3/debug/safe_iterator.h:222
#5 0xb7dd3ab3 in gnash::CQue::remove (this=0xbfd3fe44, element=0xbfd3fe38) at /home/strk/src/gnash/gnash-head/libnet/cque.cpp:185
#6 0x08049d7c in main () at /home/strk/src/gnash/gnash-head/testsuite/libnet.all/test_cque.cpp:124

Sandro Santilli <strk>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #15387:  cque_h_merge.patch added by strk (732B - text/x-patch)
file #15386:  cque_merge.patch added by strk (3KiB - text/x-patch)
file #15385:  cque_remove.patch added by strk (680B - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rsavoye (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 07 Apr 2008 08:43:08 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Wed 02 Apr 2008 10:53:21 PM UTCstrkAssigned tostrk=>rsavoye
    Wed 02 Apr 2008 10:48:18 PM UTCstrkAttached File-=>Added cque_h_merge.patch, #15387
    Wed 02 Apr 2008 10:43:02 PM UTCstrkAttached File-=>Added cque_merge.patch, #15386
      StatusNone=>Ready For Test
      Assigned torsavoye=>strk
    Wed 02 Apr 2008 09:48:41 PM UTCstrkAttached File-=>Added cque_remove.patch, #15385

    Back to the top


    Powered by Savane 3.1-cleanup1