bugGnash - The GNU Flash player - Bugs: bug #40440, Infinite loop in GC mark phase for...

 
 

bug #40440: Infinite loop in GC mark phase for XML objects

Submitted by:  Sandro Santilli <strk>
Submitted on:  Thu 31 Oct 2013 09:16:56 PM UTC  
 
Category: coreSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 12 Jun 2014 02:45:59 PM UTC, comment #6:

Fixed in 05553ba.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 12 Jun 2014 08:12:10 AM UTC, comment #5:

A bit more testing shows that moving a node within a tree is permitted, provided that the move would not result in the node being moved in among its own children. (Presumably, doing so would lose the connection to the rest of the tree.)

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Wed 11 Jun 2014 08:21:37 PM UTC, comment #4:

It seems there is more to the story. Doing anything with the tree created in the testcase below (such as calling toString()) also creates an infinite loop.

I am writing a testcase now, which seems to indicate that the pp silently ignores any attempts to move a XMLNode within the same tree (when using appendChild()).

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Fri 01 Nov 2013 01:11:53 PM UTC, comment #3:

Fixed by http://git.savannah.gnu.org/cgit/gnash.git/commit/?id=7565dad5522580c9889209d3cf80c79de9a1bb11

Sandro Santilli <strk>
Project Member
Fri 01 Nov 2013 08:28:45 AM UTC, comment #2:

Also affected: Gnash 0.8.10 (release_0_8_10-21522-2e609a6)

Sandro Santilli <strk>
Project Member
Thu 31 Oct 2013 09:29:36 PM UTC, comment #1:

The problem was probably introduced when XMLNode became a "Relay" object, in that "Relay" is not a "GcResource" thus not properly protected by circular depencency.

I wonder if we should make it a "GcResource" or re-implement the same setReachable/markReachableResource.

I'd like to have the opinion of Benjamin on this one

Sandro Santilli <strk>
Project Member
Thu 31 Oct 2013 09:16:56 PM UTC, original submission:

Tried to write a testcase for bug #40439 by slighly modifying the one provided for bug #39404 I handled to produce an infinite loop.
Oh what fun !

==12063== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==12063== Access not within mapped region at address 0x7FE801FF8
==12063== at 0x4FFC345: gnash::XMLNode_as::setReachable() (XMLNode_as.cpp:474)

The source:

var x = new XML('<t></t>');
var x2 = new XML('<t></t>');
x2.appendChild(x);
x.appendChild(x2);

Sandro Santilli <strk>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bjacques (Posted a comment)
  • -unavailable- added by strk
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 12 Jun 2014 09:20:47 AM UTCbjacquesStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Wed 11 Jun 2014 08:21:37 PM UTCbjacquesStatusFixed=>In Progress
      Assigned tostrk=>bjacques
      Open/ClosedClosed=>Open
    Fri 01 Nov 2013 09:22:05 PM UTCstrkOpen/ClosedOpen=>Closed
    Fri 01 Nov 2013 01:11:53 PM UTCstrkStatusNone=>Fixed
      Assigned toNone=>strk
    Thu 31 Oct 2013 09:29:36 PM UTCstrkCarbon-Copy-=>Added bwy

    Back to the top


    Powered by Savane 3.1-cleanup1