Thu 31 Mar 2011 01:13:38 PM UTC, comment #8:
It is plausible that the allocation does in fact happen for 256 items, but that 256th object would not be default-constructed. So then Gnash calling a function pointer that is not initialised (because the constructor was not called) would still segfault.
Anyway, the bug is 100% reproducible, so regress-testing should be easy. The only part that needs some work is to create a SWF with an opcode == 255, and then to have the testsuite run it.
|
Tue 29 Mar 2011 11:06:57 PM UTC, original submission:
Immediately prior to the crash, the following message is printed:
ERROR: Unsupported action handler invoked, code at pc is 0xfe
ActionHandler::execute() is trying to execute a _callback which is 0.
Originally reported at https://bugzilla.redhat.com/show_bug.cgi?id=691699
|