bugGnash - The GNU Flash player - Bugs: bug #40440, Infinite loop in GC mark phase for...

 
 

bug #40440: Infinite loop in GC mark phase for XML objects

Submitter:  Sandro Santilli <strk>
Submitted:  Thu 31 Oct 2013 09:16:56 PM UTC
   
 
Category:  core Severity:  6 - Security
Release:  None Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 12 Jun 2014 02:45:59 PM UTC, comment #6: 

Fixed in 05553ba.

Bastiaan Jacques <bjacques>
Group Member
Thu 12 Jun 2014 08:12:10 AM UTC, comment #5: 

A bit more testing shows that moving a node within a tree is permitted, provided that the move would not result in the node being moved in among its own children. (Presumably, doing so would lose the connection to the rest of the tree.)

Bastiaan Jacques <bjacques>
Group Member
Wed 11 Jun 2014 08:21:37 PM UTC, comment #4: 

It seems there is more to the story. Doing anything with the tree created in the testcase below (such as calling toString()) also creates an infinite loop.

I am writing a testcase now, which seems to indicate that the pp silently ignores any attempts to move a XMLNode within the same tree (when using appendChild()).

Bastiaan Jacques <bjacques>
Group Member
Fri 01 Nov 2013 01:11:53 PM UTC, comment #3: 
Sandro Santilli <strk>
Group Member
Fri 01 Nov 2013 08:28:45 AM UTC, comment #2: 

Also affected: Gnash 0.8.10 (release_0_8_10-21522-2e609a6)

Sandro Santilli <strk>
Group Member
Thu 31 Oct 2013 09:29:36 PM UTC, comment #1: 

The problem was probably introduced when XMLNode became a "Relay" object, in that "Relay" is not a "GcResource" thus not properly protected by circular depencency.

I wonder if we should make it a "GcResource" or re-implement the same setReachable/markReachableResource.

I'd like to have the opinion of Benjamin on this one

Sandro Santilli <strk>
Group Member
Thu 31 Oct 2013 09:16:56 PM UTC, original submission:  

Tried to write a testcase for bug #40439 by slighly modifying the one provided for bug #39404 I handled to produce an infinite loop.
Oh what fun !

==12063== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==12063==  Access not within mapped region at address 0x7FE801FF8
==12063==    at 0x4FFC345: gnash::XMLNode_as::setReachable() (XMLNode_as.cpp:474)


The source:

var x = new XML('<t></t>');
var x2 = new XML('<t></t>');
x2.appendChild(x);
x.appendChild(x2);

Sandro Santilli <strk>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bjacques (Posted a comment)
  • -email is unavailable- added by strk
  • -email is unavailable- added by strk (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-06-12 bjacques StatusIn Progress Fixed
        Open/ClosedOpen Closed
    2014-06-11 bjacques StatusFixed In Progress
        Assigned tostrk bjacques
        Open/ClosedClosed Open
    2013-11-01 strk Open/ClosedOpen Closed
    2013-11-01 strk StatusNone Fixed
        Assigned toNone strk
    2013-10-31 strk Carbon-Copy- Added bwy

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code