swfdec-0.5.4 will crash firefox when access www.tudou.com, a video shared website from China. the output from terminal: [freeflying@localhost files]$ firefox OIL: ERROR liboiltest.c 403: oil_test_check_impl(): function sad8x8_8xn_u8_psadbw in class sad8x8_8xn_u8 failed check (246609 > 0) || (outside=0) Unsupported movie property style with value "" Unsupported movie property id with value "playerObject" Unsupported movie property name with value "playerObject" Unsupported movie property quality with value "high" Unsupported movie property allowfullscreen with value "true" Unsupported movie property allowscriptaccess with value "always" unhandled event 19 Loading stream: http://www.tudou.com/static/bin/player_071130.swf Unsupported movie property wmode with value "opaque" Unsupported movie property allowfullscreen with value "true" unhandled event 19 Loading stream: http://www.tudou.com/static/bin/frontpage_player.swf?iid=11994270 SWFDEC: ERROR: swfdec_image.c(125): tag_func_define_bits_jpeg: No global JPEG tables available SWFDEC: ERROR: swfdec_image.c(125): tag_func_define_bits_jpeg: No global JPEG tables available SWFDEC: ERROR: swfdec_sprite_movie.c(288): swfdec_sprite_movie_perform_place: using non-implemented clip events 1024 Loading stream: http://www.tudou.com/player/v.php?id=12018990&1196833313 Loading stream: http://adcontrol.tudou.com/adcontrol/adcontrol?itemId=12018990&juid=ajuqua00lb2&channelId=3&sourceId=11000&rand=65773286 Loading stream: http://img01.p2v.tudou.com/poster/2007/10/1195119657155.jpg Loading stream: http://img01.p2v.tudou.com/poster/2007/8/1188800828662.jpg Loading stream: http://adplay.tudou.com/adcontrol/adplay?75227976 Loading stream: http://img01.p2v.tudou.com/poster/2007/8/1188800828662.jpg (gecko:7307): Swfdec-CRITICAL **: swfdec_buffer_queue_pull: assertion `length > 0' failed 0c5d68d7-78d3-e664-7bc7d99e-44dec256 is dumped OS information: Linux localhost 2.6.22.9-desktop586-2mdv #1 SMP Fri Nov 16 14:02:33 EST 2007 i686 Intel(R) Pentium(R) 4 CPU 3.00GHz GNU/Linux firefox: mozilla-firefox-2.0.0.8-1mdv2008.0 swfdec: libswfdec0.5-0.5.4-1mdv2008.0 swfdec-0.5.4-1mdv2008.0 swfdec-mozilla-0.5.4-1mdv2008.0
Managed to get the same trace with git ddc4d3c38d035cfa50fc37580e15fa34b5c1755b with this url: http://make.blip.tv/?utm_source=featured&utm_medium=featured Loading stream: http://panther2.video.blip.tv/Make-MakeASecretCompartmentBook616.jpg (gecko:3663): Swfdec-CRITICAL **: swfdec_buffer_queue_pull: assertion `length > 0' failed Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb70fe8d0 (LWP 3663)] swfdec_resource_loader_target_parse (target=0x140d6c60, loader=0x1452cc80) at swfdec_resource.c:288 ---Type <return> to continue, or q <return> to quit--- 288 parsed += buffer->length; (gdb) (gdb) bt full #0 swfdec_resource_loader_target_parse (target=0x140d6c60, loader=0x1452cc80) at swfdec_resource.c:288 resource = (SwfdecResource *) 0x140d6c60 buffer = (SwfdecBuffer *) 0x0 dec = (SwfdecDecoder *) 0x11f594b8 status = SWFDEC_STATUS_OK parsed = 65536 __PRETTY_FUNCTION__ = "swfdec_resource_loader_target_parse" #1 0xad40be61 in swfdec_loader_target_parse (target=0x140d6c60, loader=0x1452cc80) at swfdec_loadertarget.c:105 __PRETTY_FUNCTION__ = "swfdec_loader_target_parse" #2 0xad40a64e in swfdec_loader_process (loaderp=0x1452cc80, unused=0x0) at swfdec_loader.c:234 __PRETTY_FUNCTION__ = "swfdec_loader_process" #3 0xad41d087 in swfdec_player_perform_external_actions (player=0xa7ba8c0) at swfdec_player.c:502 i = 1 __PRETTY_FUNCTION__ = "swfdec_player_perform_external_actions" #4 0xad41f760 in swfdec_player_iterate (timeout=0xa7baa74) at swfdec_player.c:1264 player = (SwfdecPlayer *) 0xa7ba8c0 walk = <value optimized out> __PRETTY_FUNCTION__ = "swfdec_player_iterate" ---Type <return> to continue, or q <return> to quit--- #5 0xad41e091 in swfdec_player_do_advance (player=0xa7ba8c0, msecs=20, audio_samples=0) at swfdec_player.c:1335 timeout = (SwfdecTimeout *) 0xa7baa74 target_time = 3863526912 frames_now = 882 __PRETTY_FUNCTION__ = "swfdec_player_do_advance" #6 0xad44219d in swfdec_marshal_VOID__ULONG_UINT (closure=0xb074c20, return_value=0x0, n_param_values=3, param_values=0xbfca4fd4, invocation_hint=0xbfca4edc, marshal_data=0xad41de20) at swfdec_marshal.c:285 data1 = (gpointer) 0xa7ba8c0 data2 = <value optimized out> __PRETTY_FUNCTION__ = "swfdec_marshal_VOID__ULONG_UINT" #7 0xb75d9f39 in ?? () from /usr/lib/libgobject-2.0.so.0
This bug was triggered by loading images greater than 65536 bytes. It's fixed as of git 2834170dc1d8acbae5ae5a32653b34f88952167e.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.