bugGnash - The GNU Flash player - Bugs: bug #23248, Segfault in advanceLiveChar

 
 

bug #23248: Segfault in advanceLiveChar

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Tue 13 May 2008 08:59:14 PM UTC  
 
Category: NoneSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Zou Lunkai <zoulunkai>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 15 May 2008 10:46:02 AM UTC, comment #13:

Confirm too.

Benjamin Wolsey <bwy>
Project Member
Thu 15 May 2008 10:40:46 AM UTC, comment #12:

alright, I confirm the bug is fixed.
The memory use is a separate issue, it's probably
due to gnash decoding and keeping in memory about
400 bitmaps of 800x600 in size..

Sandro Santilli <strk>
Project Member
Thu 15 May 2008 09:15:24 AM UTC, comment #11:

DevRocketOverview.swf works here with sound disabled, but very slow.

There are more than one thousand static sprites defined in the swf. events checking, mouse pointer hit testing, GC... all of this would make the CPU busy as expected...

Zou Lunkai <zoulunkai>In charge of this item.
Thu 15 May 2008 07:23:59 AM UTC, comment #10:

The assertion checking is fixed, but now when you click
on the 'forward' button (>>) gnash will take up all memory
while taking up 100% CPU and not letting user-events get
in (unresponsive GUI)

Sandro Santilli <strk>
Project Member
Thu 15 May 2008 07:08:46 AM UTC, comment #9:

Should be fixed now.

bwy: can you try your test file again?

strk: yes, the assertion should be correct.

Zou Lunkai <zoulunkai>In charge of this item.
Wed 14 May 2008 05:27:44 PM UTC, comment #8:

as per
http://wiki.gnashdev.org/Talk:TimelineControl#comments_on_attempt5_4

"clear the new temporary display list" is important at this step, we need a clean temporary list for next gotoFrame.
After this step, characters are either transfered to the old display list or destroyed.

We're not doing what it says, in that we don't destroy
non-unloaded characters and only transfer unloaded ones.

Sandro Santilli <strk>
Project Member
Wed 14 May 2008 04:05:02 PM UTC, comment #7:

I've modified misc-ming.all/loop_test.c to place the character
at depth 64000 (definition-depth). Doing so triggers the assertion
failure I just added in ::mergeDisplayList.

Sandro Santilli <strk>
Project Member
Wed 14 May 2008 10:23:22 AM UTC, comment #6:

By the end of ::mergeDisplayList I added this assertion checking:

// clear the new display list after merge
// ASSERT:
// - Any element in newList._charsByDepth is either marked as unloaded
// or found in this list
#if GNASH_PARANOIA_LEVEL > 1
for (iterator i=newList._charsByDepth.begin(), e=newList._charsByDepth.end(); i!=e; ++i)
{
character* ch = (*i).get();
assert(ch->isUnloaded() || (std::find(_charsByDepth.begin(), _charsByDepth.end(), ch) != _charsByDepth.end()) );
}
#endif

The assertion fails.
Zou, is the assertion wrong ?

Sandro Santilli <strk>
Project Member
Wed 14 May 2008 09:46:36 AM UTC, comment #5:

Note that depth 47616 (64000) is filled by a PLACEOBJECT and there's only one such PLACEOBJECT.
Dumping displaylist of _level0 at time of abort shows
that depth is filled, but by another instance:

ch id:111 name:instance14 depth:47616

The one found non-unloaded is instance36, so something
created later..

Sandro Santilli <strk>
Project Member
Wed 14 May 2008 09:23:50 AM UTC, comment #4:

ERROR: Character _level0.instance36 (gnash::sprite_instance at depth 47616 [64000]) not unloaded and not marked as reachable at advance_live_chars
ERROR: parent _level0 (gnash::movie_instance at depth -16384 [0]) unloaded:0, reachable:1

I suspect a bug in display list merging or something similar.

It really looks like the instance36 sprite (which was a child
of _level0) ends up not being in _level0 displaylist anymore
w/out being marked as unloaded...
I see DisplayList::mergeDisplayList only taking care of the
depth zone between NonRemoved zone to staticZoneEnd, where
this sprite is high up on dynamic zone...

Sandro Santilli <strk>
Project Member
Wed 14 May 2008 08:45:23 AM UTC, comment #3:

more info:

ERROR: Character _level0.instance36 not unloaded and not marked as reachable at advance_live_chars

Sandro Santilli <strk>
Project Member
Wed 14 May 2008 08:41:25 AM UTC, comment #2:

With a debugging build (-DGNASH_PARANOIA_LEVEL=2):

server/movie_root.cpp:1780: void gnash::movie_root::markReachableResources() const: Assertion `(*i)->isReachable()' failed.
Aborted (core dumped)

Sandro Santilli <strk>
Project Member
Tue 13 May 2008 09:06:43 PM UTC, comment #1:

valgrind report:

second part seems to be a plain null-pointer-dereference, first part not so clear.

==32546== Thread 1:
==32546== Invalid read of size 1
==32546== at 0x5387013: gnash::movie_root::advanceLiveChar(boost::intrusive_ptr<gnash::character>) (movie_root.cpp:1937)
==32546== by 0x538EC4F: boost::_bi::bind_t<void, void ()(boost::intrusive_ptr<gnash::character>), boost::_bi::list1<boost::arg<1> > > std::for_each<std::_List_iterator<boost::intrusive_ptr<gnash::character> >, boost::_bi::bind_t<void, void ()(boost::intrusive_ptr<gnash::character>), boost::_bi::list1<boost::arg<1> > > >(std::_List_iterator<boost::intrusive_ptr<gnash::character> >, std::_List_iterator<boost::intrusive_ptr<gnash::character> >, boost::_bi::bind_t<void, void (*)(boost::intrusive_ptr<gnash::character>), boost::_bi::list1<boost::arg<1> > >) (bind.hpp:230)
==32546== by 0x5387009: gnash::movie_root::advanceLiveChars() (movie_root.cpp:1959)
==32546== by 0x538E36D: gnash::movie_root::advance() (movie_root.cpp:1043)
==32546== by 0x43367D: gnash::Gui::advanceMovie() (gui.cpp:926)
==32546== by 0x446838: gnash::Gui::advance_movie(gnash::Gui*) (gui.h:238)
==32546== by 0x69E137A: (within /usr/lib64/libglib-2.0.so.0.1400.1)
==32546== by 0x69E0C23: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.1400.1)
==32546== by 0x69E3F1C: (within /usr/lib64/libglib-2.0.so.0.1400.1)
==32546== by 0x69E4216: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.1400.1)
==32546== by 0x5E59342: gtk_main (in /usr/lib64/libgtk-x11-2.0.so.0.1200.1)
==32546== by 0x442A15: gnash::GtkGui::run() (gtk.cpp:253)
==32546== Address 0x12A34010 is not stack'd, malloc'd or (recently) free'd
==32546==
==32546== Invalid read of size 8
==32546== at 0x5387020: gnash::movie_root::advanceLiveChar(boost::intrusive_ptr<gnash::character>) (movie_root.cpp:1942)
==32546== by 0x538EC4F: boost::_bi::bind_t<void, void ()(boost::intrusive_ptr<gnash::character>), boost::_bi::list1<boost::arg<1> > > std::for_each<std::_List_iterator<boost::intrusive_ptr<gnash::character> >, boost::_bi::bind_t<void, void ()(boost::intrusive_ptr<gnash::character>), boost::_bi::list1<boost::arg<1> > > >(std::_List_iterator<boost::intrusive_ptr<gnash::character> >, std::_List_iterator<boost::intrusive_ptr<gnash::character> >, boost::_bi::bind_t<void, void (*)(boost::intrusive_ptr<gnash::character>), boost::_bi::list1<boost::arg<1> > >) (bind.hpp:230)
==32546== by 0x5387009: gnash::movie_root::advanceLiveChars() (movie_root.cpp:1959)
==32546== by 0x538E36D: gnash::movie_root::advance() (movie_root.cpp:1043)
==32546== by 0x43367D: gnash::Gui::advanceMovie() (gui.cpp:926)
==32546== by 0x446838: gnash::Gui::advance_movie(gnash::Gui*) (gui.h:238)
==32546== by 0x69E137A: (within /usr/lib64/libglib-2.0.so.0.1400.1)
==32546== by 0x69E0C23: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.1400.1)
==32546== by 0x69E3F1C: (within /usr/lib64/libglib-2.0.so.0.1400.1)
==32546== by 0x69E4216: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.1400.1)
==32546== by 0x5E59342: gtk_main (in /usr/lib64/libgtk-x11-2.0.so.0.1200.1)
==32546== by 0x442A15: gnash::GtkGui::run() (gtk.cpp:253)
==32546== Address 0x12A33F18 is not stack'd, malloc'd or (recently) free'd
==32546==
==32546== Jump to the invalid address stated on the next line
==32546== at 0x0: ???
==32546== Address 0x0 is not stack'd, malloc'd or (recently) free'd

Benjamin Wolsey <bwy>
Project Member
Tue 13 May 2008 08:59:14 PM UTC, original submission:

http://www.mvista.com/download/devrocket/DevRocketOverview.swf

17MB, d86812818a03379e8c6874cede15d10f

(Cut version attached)

Happens with -r0 too.

Backtrace:

#1 0x00002b098cb44b98 in gnash::movie_root::advanceLiveChar ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#2 0x00002b098cb4ed03 in boost::_bi::list1<boost::arg<1> ()()>::operator()<void ()(boost::intrusive_ptr<gnash::character>), boost::_bi::list1<boost::intrusive_ptr<gnash::character>&> > ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#3 0x00002b098cb4ed78 in boost::_bi::bind_t<void, void ()(boost::intrusive_ptr<gnash::character>), boost::_bi::list1<boost::arg<1> ()()> >::operator()<boost::intrusive_ptr<gnash::character> > ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#4 0x00002b098cb4eda5 in std::for_each<std::_List_iterator<boost::intrusive_ptr<gnash::character> >, boost::_bi::bind_t<void, void ()(boost::intrusive_ptr<gnash::character>), boost::_bi::list1<boost::arg<1> ()()> > > ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#5 0x00002b098cb44d21 in gnash::movie_root::advanceLiveChars ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#6 0x00002b098cb4c33d in gnash::movie_root::advance ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#7 0x0000000000438bc6 in gnash::Gui::advanceMovie ()
#8 0x00000000004476d7 in gnash::Gui::advance_movie ()
#9 0x00000000004474f6 in gnash::NullGui::run ()
#10 0x0000000000443288 in gnash::Player::run ()

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #15661:  DevRocketOverview.cut.swf added by bwy (250KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by zoulunkai (Posted a comment)
  • -unavailable- added by strk
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 15 May 2008 10:46:02 AM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Thu 15 May 2008 10:40:46 AM UTCstrkStatusIn Progress=>Ready For Test
      Assigned tostrk=>zoulunkai
    Wed 14 May 2008 09:23:50 AM UTCstrkCarbon-Copy-=>Added zou
    Wed 14 May 2008 08:41:25 AM UTCstrkAssigned toNone=>strk
    Wed 14 May 2008 08:41:24 AM UTCstrkStatusNone=>In Progress
    Tue 13 May 2008 08:59:14 PM UTCbwyAttached File-=>Added DevRocketOverview.cut.swf, #15661

    Back to the top


    Powered by Savane 3.1-cleanup1