bugGnash - The GNU Flash player - Bugs: bug #31766, gnash started by chromium crashes

 
 

bug #31766: gnash started by chromium crashes

Submitter:  Sandro Santilli <strk>
Submitted:  Fri 03 Dec 2010 06:43:40 AM UTC
   
 
Category:  plugin Severity:  5 - Blocker
Release:  master Status:  Ready For Test
Privacy:  Public Assigned to:  strk
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sat 12 Feb 2011 04:43:34 PM UTC, comment #17: 

thanks for testing

Sandro Santilli <strk>
Group Member
Sat 12 Feb 2011 04:38:34 PM UTC, comment #16: 


It works great even on chromium, thanks.

Gabriele Giacone <gg0>
Group Member
Sat 12 Feb 2011 04:23:07 PM UTC, comment #15: 

Pushed in master 9b39d4778c6a5781fce26294122293b5a416b90e

Sandro Santilli <strk>
Group Member
Sat 12 Feb 2011 03:49:10 PM UTC, comment #14: 

Checking some returns from std::string::find makes it a much more stable run for me. Patch here:

http://strk.keybit.net/tmp/0002-Check-return-from-std-string-find.patch

Sandro Santilli <strk>
Group Member
Fri 11 Feb 2011 11:22:35 AM UTC, comment #13: 

disabling processPlayerRequest as a whole fixes the crash here.

Sandro Santilli <strk>
Group Member
Wed 09 Feb 2011 10:24:57 PM UTC, comment #12: 

Bug in comment #11 is now fixed. The string wasn't originally truncated though, but was truncated by gdb.

I'll try passing full screen in the test.

Sandro Santilli <strk>
Group Member
Wed 09 Feb 2011 09:35:46 PM UTC, comment #11: 

Putting the string found in the coredump into test.cpp seems to produce ugly behaviours:

 string xml = "<invoke name=\"reportFlashTiming\" returntype=\"xml\"><arguments><string>reportFlashTiming</string><object><property id=\"7\"><number>1297266478451</number></property><property id=\"6\"><string>fvb</string></";
 parseInvoke(xml);

Seems to enter an infinite loop here.

Sandro Santilli <strk>
Group Member
Wed 09 Feb 2011 06:04:07 PM UTC, comment #10: 

Got the backtrace with : gdb /usr/lib/chromium-browser core

Here it is
#0  0x00000000000002e5 in ?? ()
#1  0x00000000015e4541 in ?? ()
#2  0x00007f4edac65de0 in gnash::plugin::ExternalInterface::parseXML (
    xml=<value optimized out>)
    at /usr/src/gnash/gnash-head/plugin/npapi/external.cpp:321
#3  0x00007f4edac660be in gnash::plugin::ExternalInterface::parseArguments (
    xml=<value optimized out>)
    at /usr/src/gnash/gnash-head/plugin/npapi/external.cpp:416
#4  0x00007f4edac66658 in gnash::plugin::ExternalInterface::parseInvoke (
    xml=<value optimized out>)
    at /usr/src/gnash/gnash-head/plugin/npapi/external.cpp:241
#5  0x00007f4edac47a35 in gnash::nsPluginInstance::processPlayerRequest (
    this=0x7f4edc0bb330,
    buf=0x7f4edc0de2b0 "<invoke name=\"reportFlashTiming\" returntype=\"xml\"><arguments><string>reportFlashTiming</string><object><property id=\"7\"><number>1297266478451</number></property><property id=\"6\"><string>fvb</string></"...,
    linelen=717) at /usr/src/gnash/gnash-head/plugin/npapi/plugin.cpp:775
#6  0x00007f4edac492b4 in gnash::nsPluginInstance::handlePlayerRequests (
    this=<value optimized out>, iochan=0x7f4edc004590,
    cond=<value optimized out>)
    at /usr/src/gnash/gnash-head/plugin/npapi/plugin.cpp:753
#7  0x00007f4ee7ab28c2 in g_main_dispatch (context=0x3e2dfb0)
    at /build/buildd/glib2.0-2.24.0/glib/gmain.c:1960

Sandro Santilli <strk>
Group Member
Wed 09 Feb 2011 04:58:51 PM UTC, comment #9: 

The glib-detected crash (in gnash standalone side) is fixed, but still there's a crash on the plugin side.
I have a core which was dumped by chromium.
Still haven't found a way to get some useful information out of it.

Sandro Santilli <strk>
Group Member
Wed 09 Feb 2011 03:38:04 PM UTC, comment #8: 

The bug identified by Sandro should be fixed in master, so this is ready for test to see if it was the culprit.

Benjamin Wolsey <bwy>
Group Member
Wed 09 Feb 2011 02:47:32 PM UTC, comment #7: 

Still happens after 571f23b, and seems related to ExternalInterface.
Here's a backtrace:


* glibc detected * /extra/gnash-dev/bin/gtk-gnash: double free or corruption
 (!prev): 0x00007f7cd4427890 *
======= Backtrace: =========
/lib/libc.so.6(+0x775b6)[0x7f7cea76d5b6]
/lib/libc.so.6(cfree+0x73)[0x7f7cea773e53]
/extra/gnash-dev/lib/gnash/libgnashcore-0.8.9dev.so(_ZN5gnash17ExternalInterface
18ExternalEventCheckEi+0x2b0)[0x7f7ced5897f0]
/extra/gnash-dev/lib/gnash/libgnashcore-0.8.9dev.so(_ZN5gnash10movie_root23execu
teAdvanceCallbacksEv+0x2d3)[0x7f7ced59c723]
/extra/gnash-dev/lib/gnash/libgnashcore-0.8.9dev.so(_ZN5gnash10movie_root7advanc
eEv+0x51)[0x7f7ced59c941]

Sandro Santilli <strk>
Group Member
Wed 09 Feb 2011 01:11:56 PM UTC, comment #6: 

The fix for bug #32069 might have fixed this too.
Tests welcome. (master 571f23b)

Sandro Santilli <strk>
Group Member
Wed 22 Dec 2010 08:10:31 AM UTC, comment #5: 

Another case: http://www.youtube.com/watch?v=zl9o5wsswyk
Chromium is 5.0.342.9~r43360-0ubuntu2

Sandro Santilli <strk>
Group Member
Tue 21 Dec 2010 07:57:52 PM UTC, comment #4: 

I've found out that setting GNASH_PLUGIN_DEBUG to 0 in plugin.h fixes the issue.

Sandro Santilli <strk>
Group Member
Mon 13 Dec 2010 09:23:39 PM UTC, comment #3: 

Just a note... I've seen the adobe plugin crashing with chromium too (might not be us).

Sandro Santilli <strk>
Group Member
Fri 03 Dec 2010 06:48:11 AM UTC, comment #2: 

this is with ffmpeg media

Sandro Santilli <strk>
Group Member
Fri 03 Dec 2010 06:46:14 AM UTC, comment #1: 

process 5601 is executing new program: /extra/gnash-dev/bin/gtk-gnash
[Thread debugging using libthread_db enabled]
[New Thread 0x7f0ef40b2710 (LWP 5607)]
[Thread 0x7f0ef40b2710 (LWP 5607) exited]
[New Thread 0x7f0ef40b2710 (LWP 5609)]
[Thread 0x7f0ef40b2710 (LWP 5609) exited]
[New Thread 0x7f0ef40b2710 (LWP 5610)]
[Thread 0x7f0ef40b2710 (LWP 5610) exited]
[New Thread 0x7f0ef5340710 (LWP 5611)]
[New Thread 0x7f0ef4b3f710 (LWP 5612)]
[Thread 0x7f0ef4b3f710 (LWP 5612) exited]
[New Thread 0x7f0ef4b3f710 (LWP 5613)]
[New Thread 0x7f0ef38b1710 (LWP 5614)]
[swscaler @ 0x2b07430]No accelerated colorspace conversion found.
ERROR: Couldn't find Method "onYouTubePlayerReady"
[5532:5532:104100240745:ERROR:chrome/browser/tab_contents/tab_contents.cc(1823)]
 Not implemented reached in virtual void TabContents::OnCrashedPlugin(const File
Path&) convert plugin path to plugin name
[Thread 0x7f0ef38b1710 (LWP 5614) exited]
[Thread 0x7f0ef5340710 (LWP 5611) exited]
gtk-gnash: /usr/include/boost/thread/pthread/mutex.hpp:50: void boost::mutex::lo
ck(): Assertion `!pthread_mutex_lock(&m)' failed.

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7f0ef4b3f710 (LWP 5613)]
0x00007f0f06348a75 in *__GI_raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
        in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0  0x00007f0f06348a75 in *__GI_raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007f0f0634c5c0 in *__GI_abort () at abort.c:92
#2  0x00007f0f06341941 in *__GI___assert_fail (
    assertion=0x7f0f0944cb19 "!pthread_mutex_lock(&m)",
    file=<value optimized out>, line=50,
    function=0x7f0f0957c090 "void boost::mutex::lock()") at assert.c:81
#3  0x00007f0f0929999f in boost::mutex::lock (this=0x271b1a8,
    samples=0x7f0eec0d0790, nSamples=<value optimized out>,
    eof=<value optimized out>)
    at /usr/include/boost/thread/pthread/mutex.hpp:50
#4  boost::unique_lock<boost::mutex>::lock (this=0x271b1a8,
    samples=0x7f0eec0d0790, nSamples=<value optimized out>,
    eof=<value optimized out>) at /usr/include/boost/thread/locks.hpp:338
#5  unique_lock (this=0x271b1a8, samples=0x7f0eec0d0790,
    nSamples=<value optimized out>, eof=<value optimized out>)
    at /usr/include/boost/thread/locks.hpp:224
#6  gnash::BufferedAudioStreamer::fetch (this=0x271b1a8,
    samples=0x7f0eec0d0790, nSamples=<value optimized out>,
    eof=<value optimized out>)
    at /usr/src/gnash/gnash-head/libcore/asobj/NetStream_as.cpp:1536
#7  0x00007f0f08b8d60f in gnash::sound::AuxStream::fetchSamples (
    this=0x2846a50, to=0x15ed, nSamples=6)
    at /usr/src/gnash/gnash-head/libsound/AuxStream.h:47
#8  0x00007f0f08b8c53f in gnash::sound::sound_handler::fetchSamples (
    this=0x1c88dd0, to=0x283d7e0, nSamples=2048)
    at /usr/src/gnash/gnash-head/libsound/sound_handler.cpp:583

Sandro Santilli <strk>
Group Member
Fri 03 Dec 2010 06:43:40 AM UTC, original submission:  

Chromium 5.0.342.9 (43360) Ubuntu

Go to this url:
http://www.youtube.com/watch?v=Q6HKUMp26ms&feature=related

The gnash standalone starts and suddenly crashes.
Actually, any other youtube url triggers this.

Sandro Santilli <strk>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gg0 (Posted a comment)
  • -email is unavailable- added by bwy (Posted a comment)
  • -email is unavailable- added by strk (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 10 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-02-12 strk Open/ClosedOpen Closed
    2011-02-12 strk CategoryNone plugin
        ReleaseNone master
        StatusConfirmed Ready For Test
        Assigned toNone strk
    2011-02-09 strk StatusReady For Test Confirmed
    2011-02-09 bwy StatusConfirmed Ready For Test
    2011-02-09 strk Severity4 - Important 5 - Blocker
        StatusReady For Test Confirmed
    2011-02-09 strk StatusNone Ready For Test

    Back to the top

    Powered by Savane 3.13-b921.
    Corresponding source code