Bug 13167

Summary:	crash firefox if you close tab while playing flash files
Product:	swfdec	Reporter:	Riccardo Magliocchetti <riccardo.magliocchetti>
Component:	library	Assignee:	swfdec ml <swfdec>
Status:	RESOLVED FIXED	QA Contact:	swfdec ml <swfdec>
Severity:	normal
Priority:	medium
Version:	unspecified
Hardware:	x86 (IA32)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Riccardo Magliocchetti 2007-11-10 02:37:41 UTC

version:

git 1453a43c36678b07a4c585e1173a0d4b78bc8e52

how to reproduce:

open http://mediacenter.corriere.it/MediaCenter/action/player?uuid=aee20436-8c92-11dc-a06b-0003ba99c53b
in firefox, start playing the flash files then close the browser tab.


Swfdec-ERROR **: file swfdec_player.c: line 349 (swfdec_player_compress_actions): assertion failed: (action)
aborting...

Program received signal SIGABRT, Aborted.
---Type <return> to continue, or q <return> to quit---
[Switching to Thread 0xb7158920 (LWP 24223)]
0xb73397d6 in raise () from /lib/libc.so.6
(gdb) 
(gdb) bt
#0  0xb73397d6 in raise () from /lib/libc.so.6
#1  0xb733b0f1 in abort () from /lib/libc.so.6
#2  0xb75c5ed9 in g_logv () from /usr/lib/libglib-2.0.so.0
#3  0xb75c5f09 in g_log () from /usr/lib/libglib-2.0.so.0
#4  0xb75c5f80 in g_assert_warning () from /usr/lib/libglib-2.0.so.0
#5  0xb04bd949 in swfdec_player_do_add_action (player=0xa35cf00, importance=2, 
    act=0xbfee55e4) at swfdec_player.c:383
#6  0xb04bdb8f in swfdec_player_add_action (player=0xa35cf00, movie=0xadfdbe0, 
    type=SWFDEC_EVENT_UNLOAD, importance=2) at swfdec_player.c:412
#7  0xb04ae6b8 in swfdec_movie_queue_script (movie=0xadfdbe0, 
    condition=SWFDEC_EVENT_UNLOAD) at swfdec_movie.c:469
#8  0xb04aeb16 in swfdec_movie_do_remove (movie=0xadfdbe0)
    at swfdec_movie.c:272
#9  0xb04aed57 in swfdec_movie_remove (movie=0xadfdbe0) at swfdec_movie.c:292
#10 0xb04aeb30 in swfdec_movie_do_remove (movie=0xe72c228)
    at swfdec_movie.c:262
#11 0xb04aed57 in swfdec_movie_remove (movie=0xe72c228) at swfdec_movie.c:292
#12 0xb04aeb30 in swfdec_movie_do_remove (movie=0xb007610)
    at swfdec_movie.c:262
#13 0xb04aed57 in swfdec_movie_remove (movie=0xb007610) at swfdec_movie.c:292
#14 0xb04aeb30 in swfdec_movie_do_remove (movie=0xb758430)
    at swfdec_movie.c:262
#15 0xb04aed57 in swfdec_movie_remove (movie=0xb758430) at swfdec_movie.c:292
---Type <return> to continue, or q <return> to quit---
#16 0xb04aeb30 in swfdec_movie_do_remove (movie=0xbeec3f8)
    at swfdec_movie.c:262
#17 0xb04aed57 in swfdec_movie_remove (movie=0xbeec3f8) at swfdec_movie.c:292
#18 0xb04aeb30 in swfdec_movie_do_remove (movie=0xf28eba8)
    at swfdec_movie.c:262
#19 0xb04aed57 in swfdec_movie_remove (movie=0xf28eba8) at swfdec_movie.c:292
#20 0xb04aeb30 in swfdec_movie_do_remove (movie=0xd1999e8)
    at swfdec_movie.c:262
#21 0xb04aed57 in swfdec_movie_remove (movie=0xd1999e8) at swfdec_movie.c:292
#22 0xb04aeb30 in swfdec_movie_do_remove (movie=0xb8d1030)
    at swfdec_movie.c:262
#23 0xb04aed57 in swfdec_movie_remove (movie=0xb8d1030) at swfdec_movie.c:292
#24 0xb04aeb30 in swfdec_movie_do_remove (movie=0xb55ebc0)
    at swfdec_movie.c:262
#25 0xb04aeca3 in swfdec_movie_destroy (movie=0xb55ebc0) at swfdec_movie.c:314
#26 0xb04bd34c in swfdec_player_dispose (object=0xa35cf00)
    at swfdec_player.c:848
#27 0xb20209c6 in swfdec_gtk_player_dispose (object=0xa35cf00)
    at swfdec_gtk_player.c:129
#28 0xb763a85c in g_object_unref () from /usr/lib/libgobject-2.0.so.0
#29 0xb0686008 in swfmoz_player_dispose (object=0xb09c850)
    at swfmoz_player.c:339
#30 0xb763a85c in g_object_unref () from /usr/lib/libgobject-2.0.so.0
---Type <return> to continue, or q <return> to quit---
#31 0xb0684911 in swfmoz_player_remove (player=0xb09c850)
    at swfmoz_player.c:708
#32 0xb06823a6 in plugin_destroy (instance=0xd2d960c, save=0xbfee5b04)
    at plugin.c:263
#33 0x082c195d in ?? ()
#34 0x0d2d960c in ?? ()
#35 0xbfee5b04 in ?? ()
#36 0x5990b3ec in ?? ()
#37 0xb7ee2888 in ?? () from /usr/lib/iceweasel/libxpcom_core.so
#38 0x00000000 in ?? ()

Comment 1 Benjamin Otte 2007-11-12 13:30:34 UTC

Wow, we even have a bug for this new crasher.

It should be fixed since 617e03ee5b7af3d2ff46a5d03ec80b7ca6203b29

Comment 2 Riccardo Magliocchetti 2007-11-12 14:17:46 UTC

I'm able to crash firefox with the same actions, justs a different backtrace. Should i open a new bug or just reopen this?

Comment 3 Benjamin Otte 2007-11-12 14:28:39 UTC

Retry again, I just fixed another crasher. And if it's still there, reopen and post a backtrace.

Damnit, we have too many crashers...

Comment 4 Riccardo Magliocchetti 2007-11-13 12:24:40 UTC

This time is sound related :(

Swfdec-ERROR **: file swfdec_sound.c: line 463 (swfdec_sound_buffer_render_stereo): assertion failed: (n_samples < rate)
aborting...

Program received signal SIGABRT, Aborted.
---Type <return> to continue, or q <return> to quit---
[Switching to Thread 0xb70ef920 (LWP 28563)]
0xb72d07d6 in raise () from /lib/libc.so.6
(gdb) bt
#0  0xb72d07d6 in raise () from /lib/libc.so.6
#1  0xb72d20f1 in abort () from /lib/libc.so.6
#2  0xb755ced9 in g_logv () from /usr/lib/libglib-2.0.so.0
#3  0xb755cf09 in g_log () from /usr/lib/libglib-2.0.so.0
#4  0xb755cf80 in g_assert_warning () from /usr/lib/libglib-2.0.so.0
#5  0xb058abd7 in swfdec_sound_buffer_render (dest=<value optimized out>, 
    source=0x9afac18, format=15, previous=0x0, offset=529, n_samples=1047)
    at swfdec_sound.c:463
#6  0xb0551287 in swfdec_audio_flv_render (audio=0xd191f40, dest=0xc8987c0, 
    start=0, n_samples=15052) at swfdec_audio_flv.c:152
#7  0xb054fefe in swfdec_audio_render (audio=0xd191f40, dest=0xc8987c0, 
    start_offset=0, n_samples=15052) at swfdec_audio.c:172
#8  0xb05c8ac6 in try_write (stream=0xdcfe590) at swfdec_playback.c:86
#9  0xb05c8dd1 in swfdec_stream_start (stream=0xdcfe590)
    at swfdec_playback.c:187
#10 0xb05c8fe0 in swfdec_stream_open (sound=0xada09d8, audio=0xd191f40)
    at swfdec_playback.c:262
#11 0xb75dbe6a in g_cclosure_marshal_VOID__OBJECT ()
   from /usr/lib/libgobject-2.0.so.0
#12 0xb75cf619 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#13 0xb75e3e0f in ?? () from /usr/lib/libgobject-2.0.so.0

Comment 5 Benjamin Otte 2007-11-14 00:16:54 UTC

Yay, another one.

This should be fixed wth c58ff55e210c0f8ffb74a3755e0c22599fcd333b.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.