Swfdec - Jun 2008 - [Bug 16241] New: assertion failed: (movie->cache_state <= SWFDEC_MOVIE_INVALID_CHILDREN)

http://bugs.freedesktop.org/show_bug.cgi?id=16241

           Summary: assertion failed: (movie->cache_state <               
SWFDEC_MOVIE_INVALID_CHILDREN)
           Product: swfdec
           Version: git
          Platform: x86-64 (AMD64)
               URL: http://www.cnn.com/ELECTION/2008/primaries/results/score
                    card/#R
        OS/Version: Linux (All)
            Status: NEW
          Severity: critical
          Priority: medium
         Component: library
        AssignedTo: swfdec at lists.freedesktop.org
        ReportedBy: proski at gnu.org
         QAContact: swfdec at lists.freedesktop.org


swfdec crashes on the main flash file on
http://www.cnn.com/ELECTION/2008/primaries/results/scorecard/#R

The crash can also be reproduced by downloading
http://i.cdn.turner.com/cnn/.element/swf/2.0/sect/ELECTION/2008/primaries/scorecard/DelegateScoreCard.swf,
creating an empty file called "undefined" in the same directory and
running the
flash file in swfplay.

Here's assertion message and the firefox backtrace.  Fedora 9 x86_64,
Firefox
3.0 beta 5 as provided by Fedora.

** Swfdec:ERROR:(swfdec_movie.c:118):swfdec_movie_invalidate: assertion failed:
(movie->cache_state <= SWFDEC_MOVIE_INVALID_CHILDREN)

Program received signal SIGABRT, Aborted.
0x00000031aa832215 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64        return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
Missing separate debuginfos, use: debuginfo-install keyutils.x86_64
libpng.x86_64 libxml2.x86_64 openssl.x86_64
(gdb) where
#0  0x00000031aa832215 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00000031aa833d83 in abort () at abort.c:88
#2  0x0000003f3885cf47 in IA__g_assertion_message (domain=<value optimized
out>, 
    file=<value optimized out>, line=<value optimized out>,
func=<value
optimized out>, 
    message=<value optimized out>) at gtestutils.c:1218
#3  0x0000003f3885d3e2 in IA__g_assertion_message_expr (domain=<value
optimized
out>, 
    file=<value optimized out>, line=<value optimized out>,
func=<value
optimized out>, 
    expr=<value optimized out>) at gtestutils.c:1229
#4  0x00007f7a0d0646b0 in swfdec_movie_invalidate (movie=0x4950d10, 
    parent_to_global=0x7fff18bc1fb0, new_contents=0) at swfdec_movie.c:118
#5  0x00007f7a0d0662e3 in swfdec_movie_invalidate_last (movie=0x4950d10) at
swfdec_movie.c:147
#6  0x00007f7a0d094c7c in swfdec_text_field_movie_text_changed (buffer=<value
optimized out>, 
    text=0x4950d10) at swfdec_text_field_movie.c:778
#7  0x0000003f3900b6dd in IA__g_closure_invoke (closure=<value optimized
out>,
    return_value=<value optimized out>, n_param_values=<value optimized
out>,
    param_values=<value optimized out>, invocation_hint=<value
optimized out>)
    at gclosure.c:490
#8  0x0000003f3901f6c1 in signal_emit_unlocked_R (node=<value optimized
out>,
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, instance_and_params=<value
optimized
out>)
    at gsignal.c:2440
#9  0x0000003f39020b9c in IA__g_signal_emit_valist (instance=<value optimized
out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=<value optimized out>) at gsignal.c:2199
#10 0x0000003f390210e3 in IA__g_signal_emit (instance=<value optimized
out>,
    signal_id=<value optimized out>, detail=<value optimized out>)
at
gsignal.c:2243
#11 0x00007f7a0d092bc0 in swfdec_text_buffer_delete_text (buffer=0x494cec0,
pos=0, length=5)
    at swfdec_text_buffer.c:250
---Type <return> to continue, or q <return> to quit---
#12 0x00007f7a0d093e61 in swfdec_text_field_movie_set_text (text=0x4950d10, 
    str=0x5651561 "<b><font
color=\"#CA2027\">9,111</font></b>", html=1)
    at swfdec_text_field_movie.c:1002
#13 0x00007f7a0d099355 in swfdec_text_field_movie_set_htmlText (cx=0x3cd4de0, 
    object=0x4950d10, argc=1, argv=0x45afe50, ret=<value optimized out>)
    at swfdec_text_field_movie_as.c:163
#14 0x00007f7a0d031b32 in swfdec_as_context_run (context=0x3cd4de0) at
swfdec_as_context.c:887
#15 0x00007f7a0d0432ae in swfdec_as_object_do_set (object=0x4950d10, 
    variable=0x7f7a0d0b5444 "htmlText", val=0x45afe50, flags=<value
optimized
out>)
    at swfdec_as_object.c:496
#16 0x00007f7a0d038c12 in swfdec_action_set_member (cx=0x3cd4de0, 
    action=<value optimized out>, data=<value optimized out>,
len=<value
optimized out>)
    at swfdec_as_interpret.c:740
#17 0x00007f7a0d031a19 in swfdec_as_context_run (context=0x3cd4de0) at
swfdec_as_context.c:995
#18 0x00007f7a0d0418aa in swfdec_as_object_call (object=0x439cfc0,
name=<value
optimized out>, 
    argc=0, argv=0x0, return_value=<value optimized out>) at
swfdec_as_object.c:1254
#19 0x00007f7a0d02ac4c in swfdec_actor_execute (actor=0x439cfc0,
condition=SWFDEC_EVENT_ENTER, 
    key=0 '\0') at swfdec_actor.c:246
#20 0x00007f7a0d073e65 in swfdec_player_perform_actions (player=0x3cd4de0)
    at swfdec_player.c:525
#21 0x00007f7a0d078035 in swfdec_player_iterate (timeout=<value optimized
out>)
    at swfdec_player.c:1760
#22 0x00007f7a0d0769c7 in swfdec_player_do_advance (player=0x3cd4de0, msecs=0, 
    audio_samples=3661) at swfdec_player.c:1819
#23 0x0000003f3900b6dd in IA__g_closure_invoke (closure=<value optimized
out>,
    return_value=<value optimized out>, n_param_values=<value optimized
out>,
    param_values=<value optimized out>, invocation_hint=<value
optimized out>)
    at gclosure.c:490
#24 0x0000003f3901f392 in signal_emit_unlocked_R (node=<value optimized
out>,
---Type <return> to continue, or q <return> to quit---
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, instance_and_params=<value
optimized
out>)
    at gsignal.c:2478
#25 0x0000003f39020b9c in IA__g_signal_emit_valist (instance=<value optimized
out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=<value optimized out>) at gsignal.c:2199
#26 0x0000003f390210e3 in IA__g_signal_emit (instance=<value optimized
out>,
    signal_id=<value optimized out>, detail=<value optimized out>)
at
gsignal.c:2243
#27 0x00007f7a0d071bc7 in swfdec_player_advance (player=0x3cd4de0, msecs=83)
    at swfdec_player.c:3162
#28 0x00007f7a0d306a58 in swfdec_iterate_dispatch (source_=0x4390160, 
    callback=<value optimized out>, user_data=<value optimized out>)
at
swfdec_source.c:109
#29 0x0000003f3883749b in IA__g_main_context_dispatch (context=<value
optimized
out>)
    at gmain.c:2009
#30 0x0000003f3883ac7d in g_main_context_iterate (context=<value optimized
out>, 
    block=<value optimized out>, dispatch=<value optimized out>,
self=<value
optimized out>)
    at gmain.c:2642
#31 0x0000003f3883ae3b in IA__g_main_context_iteration (context=<value
optimized out>, 
    may_block=<value optimized out>) at gmain.c:2705
#32 0x000000300635fea1 in nsBaseAppShell::DoProcessNextNativeEvent (
    this=<value optimized out>, mayWait=<value optimized out>) at
nsBaseAppShell.cpp:151
#33 0x0000003006360052 in nsBaseAppShell::OnProcessNextEvent (this=<value
optimized out>, 
    thr=<value optimized out>, mayWait=<value optimized out>, 
    recursionDepth=<value optimized out>) at nsBaseAppShell.cpp:278
#34 0x0000003006416a4b in nsThread::ProcessNextEvent (this=<value optimized
out>, 
    mayWait=<value optimized out>, result=<value optimized out>) at
nsThread.cpp:497
#35 0x00000030063e82f6 in NS_ProcessNextEvent_P (thread=<value optimized
out>,
    mayWait=<value optimized out>) at nsThreadUtils.cpp:227
#36 0x000000300636010d in nsBaseAppShell::Run (this=<value optimized out>)
---Type <return> to continue, or q <return> to quit---
    at nsBaseAppShell.cpp:170
#37 0x00000030062235bd in nsAppStartup::Run (this=<value optimized out>)
    at nsAppStartup.cpp:181
#38 0x0000003005c1f73b in XRE_main (argc=<value optimized out>,
argv=<value
optimized out>, 
    aAppData=<value optimized out>) at nsAppRunner.cpp:3154
#39 0x0000000000401665 in __gxx_personality_v0 ()
    at ../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#40 0x00000031aa81e32a in __libc_start_main (main=<value optimized out>, 
    argc=<value optimized out>, ubp_av=<value optimized out>,
init=<value
optimized out>, 
    fini=<value optimized out>, rtld_fini=<value optimized out>,
stack_end=Could not find the frame base for "__libc_start_main".
)
    at libc-start.c:220
#41 0x0000000000401159 in __gxx_personality_v0 ()
    at ../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#42 0x00007fff18bc6c38 in ?? ()
#43 0x000000000000001c in ?? ()
#44 0x0000000000000002 in ?? ()
#45 0x00007fff18bc839e in ?? ()
#46 0x00007fff18bc83bf in ?? ()
#47 0x0000000000000000 in ?? ()
(gdb)


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=16241


Benjamin Otte <otte at gnome.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|critical                    |blocker
             Status|NEW                         |ASSIGNED
           Priority|medium                      |high




--- Comment #1 from Benjamin Otte <otte at gnome.org>  2008-06-06 00:55:35
PST ---
Yup, it's an issue I'm aware of. It was introduced while trying to make
TextField properties update at the correct time. Unfortunately I very much
failed.

Unfortunately I'm currently busy with other stuff, so my work on TextField
correct property updates will have to wait a while. If this is very annoying
for you (or someone else), I might attempt a quickfix, so it stops happening,
otherwise I'll just let it as is until I have time.

Side note: Any reproducible crash with a default-compiled swfdec is a blocker.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=16241





--- Comment #2 from Pavel Roskin <proski at gnu.org>  2008-06-06 11:10:46
PST ---
I've bisected it:

3eef13f5b570b3f32e2cdeebc5f808c02f2898a1 is first bad commit
commit 3eef13f5b570b3f32e2cdeebc5f808c02f2898a1
Author: Benjamin Otte <otte at gnome.org>
Date:   Wed May 14 23:01:54 2008 +0200

also queue an update when setting autoSize to a boolean value


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=16241


Riccardo Magliocchetti <riccardo at datahost.it> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |eric225125 at yahoo.com




--- Comment #3 from Riccardo Magliocchetti <riccardo at datahost.it> 
2008-06-17 02:32:24 PST ---
*** Bug 16206 has been marked as a duplicate of this bug. ***


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=16241


Benjamin Otte <otte at gnome.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED




--- Comment #4 from Benjamin Otte <otte at gnome.org>  2008-06-22 08:23:20
PST ---
This should be fixed with git master.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.