bugGnash - The GNU Flash player - Bugs: bug #32507, segfault in...

 
 

bug #32507: segfault in DisplayObject::set_child_invalidated()

Submitted by:  Bastiaan Jacques <bjacques>
Submitted on:  Wed 16 Feb 2011 09:50:12 PM UTC  
 
Category: coreSeverity: 6 - Security
Release: masterStatus: Fixed
Privacy: PublicAssigned to: Benjamin Wolsey <bwy>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 17 Feb 2011 10:22:21 AM UTC, comment #6:

Thanks!

Bastiaan Jacques <bjacques>
Project Member
Thu 17 Feb 2011 10:17:46 AM UTC, comment #5:

Fix with 1dabdaa

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Thu 17 Feb 2011 09:52:41 AM UTC, comment #4:

Transform_as seems to be holding a reference to a deleted MovieClip, which may be due to an incorrectly overridden virtual function.

==4794== Invalid read of size 2
==4794== at 0x56E58CE: gnash::(anonymous namespace)::transform_colorTransform(gnash::fn_call const&) (SWFCxForm.h:87)
==4794== by 0x5515B27: gnash::Property::setValue(gnash::as_object&, gnash::as_value const&) const (Property.h:252)
==4794== by 0x552D863: gnash::as_object::executeTriggers(gnash::Property*, gnash::ObjectURI const&, gnash::as_value const&) (as_object.cpp:538)
==4794== by 0x552EF00: gnash::as_object::set_member(gnash::ObjectURI const&, gnash::as_value const&, bool) (as_object.cpp:631)
==4794== by 0x5707E9D: gnash::(anonymous namespace)::ActionSetMember(gnash::ActionExec&) (ASHandlers.cpp:2618)
==4794== by 0x5703F68: gnash::SWF::SWFHandlers::execute(gnash::SWF::ActionType, gnash::ActionExec&) const (ASHandlers.cpp:433)
==4794== by 0x5717E8F: gnash::ActionExec::operator()() (ActionExec.cpp:252)
==4794== by 0x55CA549: gnash::Function2::call(gnash::fn_call const&) (Function2.cpp:215)
==4794== by 0x5614888: gnash::(anonymous namespace)::function_apply(gnash::fn_call const&) (Function_as.cpp:151)
==4794== by 0x5614DD4: gnash::NativeFunction::call(gnash::fn_call const&) (NativeFunction.h:65)
==4794== by 0x570EF2E: gnash::(anonymous namespace)::ActionCallMethod(gnash::ActionExec&) (ASHandlers.cpp:2799)
==4794== by 0x5703F68: gnash::SWF::SWFHandlers::execute(gnash::SWF::ActionType, gnash::ActionExec&) const (ASHandlers.cpp:433)
==4794== Address 0x16f33a30 is 128 bytes inside a block of size 520 free'd
==4794== at 0x4C23E0F: operator delete(void*) (vg_replace_malloc.c:387)
==4794== by 0x5593967: gnash::MovieClip::~MovieClip() (MovieClip.cpp:500)
==4794== by 0x65480C9: gnash::GC::cleanUnreachable() (GC.cpp:84)
==4794== by 0x6548124: gnash::GC::runCycle() (GC.cpp:125)
==4794== by 0x55839EA: gnash::movie_root::advance() (movie_root.cpp:832)
==4794== by 0x43E90F: gnash::Gui::advanceMovie(bool) (gui.cpp:970)
==4794== by 0x45CE3D: gnash::Gui::advance_movie(gnash::Gui*) (gui.h:285)
==4794== by 0x7BD7ECA: ??? (in /lib/libglib-2.0.so.0.2400.2)
==4794== by 0x7BD76F1: g_main_context_dispatch (in /lib/libglib-2.0.so.0.2400.2)
==4794== by 0x7BDB567: ??? (in /lib/libglib-2.0.so.0.2400.2)
==4794== by 0x7BDBA74: g_main_loop_run (in /lib/libglib-2.0.so.0.2400.2)
==4794== by 0x6D266B6: gtk_main (in /usr/lib/libgtk-x11-2.0.so.0.2000.1)

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Thu 17 Feb 2011 09:36:43 AM UTC, comment #3:

And 0.8.7! I guess it's not a regression...

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Thu 17 Feb 2011 09:27:25 AM UTC, comment #2:

Fails also in 0.8.8.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Wed 16 Feb 2011 10:17:11 PM UTC, comment #1:

This bug is reproducible as well for me.

Hicham HAOUARI <hichamhaouari>
Project Member
Wed 16 Feb 2011 09:50:12 PM UTC, original submission:

STR: gui/gtk-gnash http://www.sabrinawattsphotography.com/wedding/wedgalleries/galleryhome/autoviewer.swf -U http://www.sabrinawattsphotography.com/wedding/galleries.htm -P flashvars=xmlURL=wedgalleries/galleryhome/gallery.xml

#0 0x003cc57e in gnash::DisplayObject::set_child_invalidated (this=0xffff0000)
at /home/bastiaan/gnash/master/libcore/DisplayObject.cpp:240
#1 0x003cc5ae in gnash::DisplayObject::set_child_invalidated (this=0x853d368)
at /home/bastiaan/gnash/master/libcore/DisplayObject.cpp:243
#2 0x003cc3dd in gnash::DisplayObject::set_invalidated (this=0x8305db8, debug_file=
0x69cae3 "unknown", debug_line=-1)
at /home/bastiaan/gnash/master/libcore/DisplayObject.cpp:193
#3 0x003cc37e in gnash::DisplayObject::set_invalidated (this=0x8305db8)
at /home/bastiaan/gnash/master/libcore/DisplayObject.cpp:184
#4 0x003d478f in gnash::DisplayObject::setCxForm (this=0x8305db8, cx=...)
at /home/bastiaan/gnash/master/libcore/DisplayObject.h:354
#5 0x006271d0 in gnash::Transform_as::setColorTransform (this=0x830ad98, cx=...)
at /home/bastiaan/gnash/master/libcore/asobj/flash/geom/Transform_as.cpp:78
#6 0x006254b8 in gnash::(anonymous namespace)::transform_colorTransform (fn=...)
at /home/bastiaan/gnash/master/libcore/asobj/flash/geom/Transform_as.cpp:177
#7 0x0034ca12 in gnash::GetterSetter::NativeGetterSetter::set (this=0x830a7c0, fn=...)
at /home/bastiaan/gnash/master/libcore/Property.h:252
#8 0x0035d3b5 in gnash::GetterSetter::Set::operator()<gnash::GetterSetter::NativeGetterSetter, gnash::fn_call const> (this=0xbfff904b, t=..., a=...)
at /home/bastiaan/gnash/master/libcore/Property.h:73
#9 0x0035c7f6 in gnash::GetterSetter::GetSetVisitor<gnash::fn_call, gnash::GetterSetter::Set>::operator()<gnash::GetterSetter::NativeGetterSetter> (this=0xbfff9308, t=...)
at /home/bastiaan/gnash/master/libcore/Property.h:61
#10 0x0035b343 in boost::detail::variant::invoke_visitor<gnash::GetterSetter::GetSetVisitor<gnash::fn_call, gnash::GetterSetter::Set> >::internal_visit<gnash::GetterSetter::NativeGetterSetter> (this=0xbfff9288, operand=...) at /usr/include/boost/variant/variant.hpp:832

Bastiaan Jacques <bjacques>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by hichamhaouari (Posted a comment)
  • -unavailable- added by bjacques (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 17 Feb 2011 10:22:21 AM UTCbjacquesStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Thu 17 Feb 2011 10:17:46 AM UTCbwyStatusConfirmed=>Ready For Test
    Thu 17 Feb 2011 09:59:20 AM UTCbwyStatusNone=>Confirmed
      Assigned toNone=>bwy

    Back to the top


    Powered by Savane 3.1-cleanup1