[Gnash-commit] [bug #32985] SIGSEGV in TagLoadersTable::get()

[Bastiaan Jacques]

URL:
  <http://savannah.gnu.org/bugs/?32985>

                 Summary: SIGSEGV in TagLoadersTable::get()
                 Project: Gnash - The GNU Flash player
            Submitted by: bjacques
            Submitted on: Sun 03 Apr 2011 03:16:29 PM CEST
                Category: core
                Severity: 3 - Normal
                 Release: master
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any

    _______________________________________________________

Details:

STR: see bug #32579.


Core was generated by
`/home/bastiaan/gnash/obj-master-optim/gui/.libs/lt-gtk-gnash
http://cdn.widgets'.
Program terminated with signal 11, Segmentation fault.
#0  _M_begin (this=0x65726168)
    at
/usr/lib/gcc/i686-redhat-linux/4.6.0/../../../../include/c++/4.6.0/bits/stl_tree.h:499
499               (this->_M_impl._M_header._M_parent);

Thread 2 (Thread 0xb77e58a0 (LWP 18534)):
#0  0x00f2e416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x44301fe6 in nanosleep () from /lib/libpthread.so.0
No symbol table info available.
#2  0x00e377b3 in gnashSleep (useconds=1000000) at
/home/bastiaan/gnash/master/libbase/GnashSleep.h:42
        m = 1000000
        t = {tv_sec = 1, tv_nsec = 0}
#3  gnash::(anonymous namespace)::CurlSession::~CurlSession (this=0xe8c200,
__in_chrg=<optimized out>) at
/home/bastiaan/gnash/master/libbase/curl_adapter.cpp:251
        code = <optimized out>
        retries = 1
#4  0x4418eb81 in __run_exit_handlers () from /lib/libc.so.6
No symbol table info available.
#5  0x4418ec0d in exit () from /lib/libc.so.6
No symbol table info available.
#6  0x4417543b in __libc_start_main () from /lib/libc.so.6
No symbol table info available.
#7  0x080644f1 in _start ()
No symbol table info available.

Thread 1 (Thread 0x7ac6b70 (LWP 18555)):
#0  _M_begin (this=0x65726168) at
/usr/lib/gcc/i686-redhat-linux/4.6.0/../../../../include/c++/4.6.0/bits/stl_tree.h:499
No locals.
#1  find (__k=<synthetic pointer>, this=0x65726168) at
/usr/lib/gcc/i686-redhat-linux/4.6.0/../../../../include/c++/4.6.0/bits/stl_tree.h:1539
No locals.
#2  find (__x=<synthetic pointer>, this=0x65726168) at
/usr/lib/gcc/i686-redhat-linux/4.6.0/../../../../include/c++/4.6.0/bits/stl_map.h:752
No locals.
#3  gnash::SWF::TagLoadersTable::get (this=0x65726168,
t=gnash::SWF::DEFINESPRITE, address@hidden) at
/home/bastiaan/gnash/master/libcore/swf/TagLoadersTable.cpp:31
        it = <optimized out>
#4  0x00332779 in gnash::SWFParser::read (this=0x7ac60c0, bytes=39182) at
/home/bastiaan/gnash/master/libcore/parser/SWFParser.cpp:94
        lf = 0
#5  0x003399e9 in gnash::SWFMovieDefinition::read_all_swf (this=0xb34891f0) at
/home/bastiaan/gnash/master/libcore/parser/SWFMovieDefinition.cpp:476
        __PRETTY_FUNCTION__ = "void
gnash::SWFMovieDefinition::read_all_swf()"
        floaded = 0
        parser = {_stream = @0xb3489108, _md = 0xb34891f0, _runResources =
@0x9471e48, _bytesRead = 66896, _tagOpen = true, _endRead = 104717,
_nextTagEnd = 12, _tag = gnash::SWF::DEFINESPRITE}
        left = 39182
#6  0x00339fea in gnash::SWFMovieLoader::execute (ml=..., md=0xb34891f0) at
/home/bastiaan/gnash/master/libcore/parser/SWFMovieDefinition.cpp:123
No locals.
#7  0x0033b080 in operator()<void (*)(gnash::SWFMovieLoader&,
gnash::SWFMovieDefinition*), boost::_bi::list0> (a=<synthetic pointer>,
address@hidden, this=0xb34895a0) at /usr/include/boost/bind/bind.hpp:313
No locals.
#8  operator() (this=0xb348959c) at
/usr/include/boost/bind/bind_template.hpp:20
No locals.
#9  boost::detail::thread_data<boost::_bi::bind_t<void, void
(*)(gnash::SWFMovieLoader&, gnash::SWFMovieDefinition*),
boost::_bi::list2<boost::reference_wrapper<gnash::SWFMovieLoader>,
boost::_bi::value<gnash::SWFMovieDefinition*> > > >::run (this=0xb3489498) at
/usr/include/boost/thread/detail/thread.hpp:61
No locals.
#10 0x0097144d in thread_proxy () from /usr/lib/libboost_thread-mt.so.1.46.0
No symbol table info available.
#11 0x442fac8d in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#12 0x442368fe in clone () from /lib/libc.so.6
No symbol table info available.


The problem is that RunResources are shared with the movie (definition/root)
by class Player, but _runResources is destroyed when Player is, while the
movie definition has a longer lifetime due to being reference counted (and
apparently something else holding a reference).

This bug can be fixed in a number of ways:
1) Destroy the movie root completely in the Player destructor.
2) Transfer ownership of the RunResources to the movie root.
3) Hold the RunResources in a shared_ptr.
4) ...




    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?32985>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/