Thu 31 Oct 2013 08:42:28 PM UTC, original submission:
XMLNode destructor calling into a deleted string_table:
==28682== Invalid read of size 8
==28682== at 0x576DA1B: boost::multi_index::detail::hashed_index_iterator<boost::multi_index::detail::hashed_index_node<boost::multi_index::detail::hashed_index_node<boost::multi_index::detail::index_node_base<gnash::string_table::svt, std::allocator<gnash::string_table::svt> > > >, boost::multi_index::detail::bucket_array<std::allocator<gnash::string_table::svt> > > boost::multi_index::detail::hashed_index<boost::multi_index::member<gnash::string_table::svt, std::string, &gnash::string_table::svt::value>, boost::hash<std::string>, std::equal_to<std::string>, boost::multi_index::detail::nth_layer<1, gnash::string_table::svt, boost::multi_index::indexed_by<boost::multi_index::hashed_unique<boost::multi_index::tag<gnash::string_table::StringValue, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na>, boost::multi_index::member<gnash::string_table::svt, std::string, &gnash::string_table::svt::value>, mpl_::na, mpl_::na>, boost::multi_index::hashed_unique<boost::multi_index::tag<gnash::string_table::StringID, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na>, boost::multi_index::member<gnash::string_table::svt, unsigned long, &gnash::string_table::svt::id>, mpl_::na, mpl_::na>, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na, mpl_::na>, std::allocator<gnash::string_table::svt> >, boost::mpl::v_item<gnash::string_table::StringValue, boost::mpl::vector0<mpl_::na>, 0>, boost::multi_index::detail::hashed_unique_tag>::find<std::string, boost::hash<std::string>, std::equal_to<std::string> >(std::string const&, boost::hash<std::string> const&, std::equal_to<std::string> const&) const (hashed_index.hpp:443)
==28682== by 0x576C319: gnash::string_table::find(std::string const&, bool) (hashed_index.hpp:431)
==28682== by 0x4F869DE: gnash::arrayKey(gnash::VM&, unsigned long) (VM.h:295)
==28682== by 0x4F86E9E: gnash::(anonymous namespace)::resizeArray(gnash::as_object&, int) (Array_as.cpp:1623)
==28682== by 0x4F89611: gnash::checkArrayLength(gnash::as_object&, gnash::ObjectURI const&, gnash::as_value const&) (Array_as.cpp:923)
==28682== by 0x4ED5D4D: gnash::as_object::set_member(gnash::ObjectURI const&, gnash::as_value const&, bool) (as_object.cpp:596)
==28682== by 0x4FFF3F3: gnash::XMLNode_as::updateChildNodes() (XMLNode_as.cpp:149)
==28682== by 0x4FFF64A: gnash::XMLNode_as::removeChild(gnash::XMLNode_as*) (XMLNode_as.cpp:212)
==28682== by 0x4FFF6C4: gnash::XMLNode_as::~XMLNode_as() (XMLNode_as.cpp:116)
==28682== by 0x4FFF7C8: gnash::XMLNode_as::~XMLNode_as() (XMLNode_as.cpp:120)
==28682== by 0x4ECD655: gnash::as_object::~as_object() (checked_delete.hpp:34)
==28682== by 0x4ECD698: gnash::as_object::~as_object() (as_object.h:174)
==28682== Address 0x1c86a4c8 is 4,584 bytes inside a block of size 12,352 free'd
==28682== at 0x4C2B59C: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28682== by 0x507B0BD: gnash::string_table::~string_table() (new_allocator.h:100)
==28682== by 0x507A529: gnash::VM::~VM() (VM.cpp:69)
==28682== by 0x4F13F92: gnash::movie_root::~movie_root() (movie_root.cpp:190)
==28682== by 0x1560B4: gnash::Player::run(int, char**, std::string const&, std::string const&) (Player.cpp:661)
==28682== by 0x1321AF: playFile(gnash::Player&, int, char**, std::string const&) (gnash.cpp:90)
==28682== by 0x130BD2: main (bind.hpp:457)
Rings a bell, I think recently Bastiaan has been trying to fix something like this, related to XMLNode deallocation order
|