bugGnash - The GNU Flash player - Bugs: bug #32445, Using quit from right click menu...

 
 

bug #32445: Using quit from right click menu causes Gnash and browser to crash.

Submitted by:  Brad Smith <brad0>
Submitted on:  Sat 12 Feb 2011 11:05:53 PM UTC  
 
Category: pluginSeverity: 5 - Blocker
Release: masterStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 14 Feb 2011 11:24:49 PM UTC, comment #9:

Thanks for testing!

Bastiaan Jacques <bjacques>
Project Member
Mon 14 Feb 2011 11:22:39 PM UTC, comment #8:

Here it no longer crash.

Gabriele Giacone <gg0>
Project Member
Mon 14 Feb 2011 01:34:10 PM UTC, comment #7:

The following code:

GError* error = 0;

log_debug("testing %s", error->message);

will lead to a segfault with x=@0x8. So it seems like a couple of NULL checks will do the trick.

Bastiaan Jacques <bjacques>
Project Member
Mon 14 Feb 2011 01:24:57 PM UTC, comment #6:

It could also be worth checking that the various pointers passed to g_io_channel_read_line are really pointing to something before using them.

Benjamin Wolsey <bwy>
Project Member
Mon 14 Feb 2011 01:21:02 PM UTC, comment #5:

Compiling without optimizations would give more information in the backtrace.

Possibly the entire plugin object is invalid during the call.

Benjamin Wolsey <bwy>
Project Member
Mon 14 Feb 2011 01:14:44 PM UTC, comment #4:

#2 0x000000021b0440bd in boost::io::detail::feed<char, std::char_traits<char>, std::allocator<char>, char* const&> (self=@0x7f7ffffe54b0, x=@0x8) at feed_args.hpp:263

x here is the second argument passed to log_*(string, x). One of these calls handlePlayerRequests() is passing an invalid pointer, although it isn't clear to me which one.

Bastiaan Jacques <bjacques>
Project Member
Mon 14 Feb 2011 02:09:01 AM UTC, comment #3:

bjacques> gg0: I'm curious to see what would happen if you comment out all log_* function calls in nsPluginInstance::handlePlayerRequests()

Doing this it no longer crashes.

Brad Smith <brad0>
Sun 13 Feb 2011 08:36:01 AM UTC, comment #2:

Seems to be a missing HUP signal catching.

Sandro Santilli <strk>
Project Member
Sun 13 Feb 2011 01:24:39 AM UTC, comment #1:

os is openbsd current-
Backtrace below.

(gdb) bt
#0 0x000000021b043731 in boost::io::detail::put<char, std::char_traits<char>, std::allocator<char>, char* const&> (x=@0x8, specs=@0x2078acd00, res=@0x2078acd08, buf=@0x7f7ffffe5510, loc_p=0x0) at ios_base.h:651
#1 0x000000021b044025 in boost::io::detail::distribute<char, std::char_traits<char>, std::allocator<char>, char* const&> (self=@0x7f7ffffe54b0, x=@0x8) at feed_args.hpp:253
#2 0x000000021b0440bd in boost::io::detail::feed<char, std::char_traits<char>, std::allocator<char>, char* const&> (self=@0x7f7ffffe54b0, x=@0x8) at feed_args.hpp:263
#3 0x000000021b036f05 in gnash::nsPluginInstance::handlePlayerRequests (this=0x20abb1800, iochan=Variable "iochan" is not available.
) at format_class.hpp:64
#4 0x000000021b037144 in gnash::nsPluginInstance::handlePlayerRequestsWrapper (iochan=Variable "iochan" is not available.
) at plugin.cpp:684
#5 0x000000020ba02b93 in g_main_context_dispatch () from /usr/local/lib/libglib-2.0.so.2600.0
#6 0x000000020ba06460 in g_main_context_prepare () from /usr/local/lib/libglib-2.0.so.2600.0
#7 0x000000020ba06a7b in g_main_context_iteration () from /usr/local/lib/libglib-2.0.so.2600.0
#8 0x00000002102e8f59 in nsBaseAppShell::DoProcessNextNativeEvent () from /usr/local/mozilla-firefox/libxul.so.22.2
#9 0x00000002102e942d in nsBaseAppShell::OnProcessNextEvent () from /usr/local/mozilla-firefox/libxul.so.22.2
#10 0x00000002103e5e7f in nsThread::ProcessNextEvent () from /usr/local/mozilla-firefox/libxul.so.22.2
#11 0x00000002103a8c59 in NS_ProcessNextEvent_P () from /usr/local/mozilla-firefox/libxul.so.22.2
#12 0x00000002102e90e3 in nsBaseAppShell::Run () from /usr/local/mozilla-firefox/libxul.so.22.2
#13 0x0000000210168a8e in nsAppStartup::Run () from /usr/local/mozilla-firefox/libxul.so.22.2
#14 0x000000020f8e7cab in XRE_main () from /usr/local/mozilla-firefox/libxul.so.22.2
#15 0x0000000000401468 in __register_frame_info ()
#16 0x0000000000401121 in ?? ()
#17 0x0000000000000000 in ?? ()
(gdb) bt full
#0 0x000000021b043731 in boost::io::detail::put<char, std::char_traits<char>, std::allocator<char>, char* const&> (x=@0x8, specs=@0x2078acd00, res=@0x2078acd08, buf=@0x7f7ffffe5510, loc_p=0x0) at ios_base.h:651
res_beg = Variable "res_beg" is not available.
(gdb)

Gabriele Giacone <gg0>
Project Member
Sat 12 Feb 2011 11:05:53 PM UTC, original submission:

If I right click and to go quit (for gnash) gnash crashes and also crashes the web browser (Firefox 3.6). I have debug verbosity set to 3 and I just see this in the log when this happens...

22655:1] 17:26:01: DEBUG: Setting script limits: recursion 1000, timeout 60
22655:1] 17:26:01: DEBUG: Setting script limits: max recursion 1000, timeout 60 seconds
22655:1] 17:26:01: DEBUG: Global instance list grew to 1 entries
22655:1] 17:26:01: DEBUG: Starting virtual clock
22655:1] 17:26:01: DEBUG: gnash_canvas_size_allocate 1109 581
22655:1] 17:26:03: DEBUG: gnash_canvas_size_allocate 1109 1220
22655:1] 17:26:09: DEBUG: Loading native class Mouse
22655:1] 17:26:09: DEBUG: Loading native class AsBroadcaster
22655:1] 17:26:11: DEBUG: Main loop ended, cleaning up
22655:1] 17:26:11: DEBUG: ~Player - _movieDef refcount: 2 (1 will be dropped now)
22655:1] 17:26:11: DEBUG: ~Gui - _movieDef refcount: 1

Brad Smith <brad0>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by bjacques (Posted a comment)
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by gg0 (Posted a comment)
  • -unavailable- added by brad0 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 14 Feb 2011 11:24:49 PM UTCbjacquesStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Mon 14 Feb 2011 01:54:00 PM UTCbjacquesStatusNone=>Ready For Test
    Sun 13 Feb 2011 08:36:01 AM UTCstrkCategoryNone=>plugin
      Severity3 - Normal=>5 - Blocker

    Back to the top


    Powered by Savane 3.1-cleanup1