Bug 16241

Summary:	assertion failed: (movie->cache_state <= SWFDEC_MOVIE_INVALID_CHILDREN)
Product:	swfdec	Reporter:	Pavel Roskin <proski>
Component:	library	Assignee:	swfdec ml <swfdec>
Status:	RESOLVED FIXED	QA Contact:	swfdec ml <swfdec>
Severity:	blocker
Priority:	high	CC:	eric225125
Version:	git
Hardware:	x86-64 (AMD64)
OS:	Linux (All)
URL:	http://www.cnn.com/ELECTION/2008/primaries/results/scorecard/#R
Whiteboard:
i915 platform:		i915 features:

Description Pavel Roskin 2008-06-05 15:54:14 UTC

swfdec crashes on the main flash file on http://www.cnn.com/ELECTION/2008/primaries/results/scorecard/#R

The crash can also be reproduced by downloading http://i.cdn.turner.com/cnn/.element/swf/2.0/sect/ELECTION/2008/primaries/scorecard/DelegateScoreCard.swf, creating an empty file called "undefined" in the same directory and running the flash file in swfplay.

Here's assertion message and the firefox backtrace.  Fedora 9 x86_64, Firefox 3.0 beta 5 as provided by Fedora.

** Swfdec:ERROR:(swfdec_movie.c:118):swfdec_movie_invalidate: assertion failed: (movie->cache_state <= SWFDEC_MOVIE_INVALID_CHILDREN)

Program received signal SIGABRT, Aborted.
0x00000031aa832215 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64        return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
Missing separate debuginfos, use: debuginfo-install keyutils.x86_64 libpng.x86_64 libxml2.x86_64 openssl.x86_64
(gdb) where
#0  0x00000031aa832215 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00000031aa833d83 in abort () at abort.c:88
#2  0x0000003f3885cf47 in IA__g_assertion_message (domain=<value optimized out>, 
    file=<value optimized out>, line=<value optimized out>, func=<value optimized out>, 
    message=<value optimized out>) at gtestutils.c:1218
#3  0x0000003f3885d3e2 in IA__g_assertion_message_expr (domain=<value optimized out>, 
    file=<value optimized out>, line=<value optimized out>, func=<value optimized out>, 
    expr=<value optimized out>) at gtestutils.c:1229
#4  0x00007f7a0d0646b0 in swfdec_movie_invalidate (movie=0x4950d10, 
    parent_to_global=0x7fff18bc1fb0, new_contents=0) at swfdec_movie.c:118
#5  0x00007f7a0d0662e3 in swfdec_movie_invalidate_last (movie=0x4950d10) at swfdec_movie.c:147
#6  0x00007f7a0d094c7c in swfdec_text_field_movie_text_changed (buffer=<value optimized out>, 
    text=0x4950d10) at swfdec_text_field_movie.c:778
#7  0x0000003f3900b6dd in IA__g_closure_invoke (closure=<value optimized out>, 
    return_value=<value optimized out>, n_param_values=<value optimized out>, 
    param_values=<value optimized out>, invocation_hint=<value optimized out>)
    at gclosure.c:490
#8  0x0000003f3901f6c1 in signal_emit_unlocked_R (node=<value optimized out>, 
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, instance_and_params=<value optimized out>)
    at gsignal.c:2440
#9  0x0000003f39020b9c in IA__g_signal_emit_valist (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=<value optimized out>) at gsignal.c:2199
#10 0x0000003f390210e3 in IA__g_signal_emit (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>) at gsignal.c:2243
#11 0x00007f7a0d092bc0 in swfdec_text_buffer_delete_text (buffer=0x494cec0, pos=0, length=5)
    at swfdec_text_buffer.c:250
---Type <return> to continue, or q <return> to quit---
#12 0x00007f7a0d093e61 in swfdec_text_field_movie_set_text (text=0x4950d10, 
    str=0x5651561 "<b><font color=\"#CA2027\">9,111</font></b>", html=1)
    at swfdec_text_field_movie.c:1002
#13 0x00007f7a0d099355 in swfdec_text_field_movie_set_htmlText (cx=0x3cd4de0, 
    object=0x4950d10, argc=1, argv=0x45afe50, ret=<value optimized out>)
    at swfdec_text_field_movie_as.c:163
#14 0x00007f7a0d031b32 in swfdec_as_context_run (context=0x3cd4de0) at swfdec_as_context.c:887
#15 0x00007f7a0d0432ae in swfdec_as_object_do_set (object=0x4950d10, 
    variable=0x7f7a0d0b5444 "htmlText", val=0x45afe50, flags=<value optimized out>)
    at swfdec_as_object.c:496
#16 0x00007f7a0d038c12 in swfdec_action_set_member (cx=0x3cd4de0, 
    action=<value optimized out>, data=<value optimized out>, len=<value optimized out>)
    at swfdec_as_interpret.c:740
#17 0x00007f7a0d031a19 in swfdec_as_context_run (context=0x3cd4de0) at swfdec_as_context.c:995
#18 0x00007f7a0d0418aa in swfdec_as_object_call (object=0x439cfc0, name=<value optimized out>, 
    argc=0, argv=0x0, return_value=<value optimized out>) at swfdec_as_object.c:1254
#19 0x00007f7a0d02ac4c in swfdec_actor_execute (actor=0x439cfc0, condition=SWFDEC_EVENT_ENTER, 
    key=0 '\0') at swfdec_actor.c:246
#20 0x00007f7a0d073e65 in swfdec_player_perform_actions (player=0x3cd4de0)
    at swfdec_player.c:525
#21 0x00007f7a0d078035 in swfdec_player_iterate (timeout=<value optimized out>)
    at swfdec_player.c:1760
#22 0x00007f7a0d0769c7 in swfdec_player_do_advance (player=0x3cd4de0, msecs=0, 
    audio_samples=3661) at swfdec_player.c:1819
#23 0x0000003f3900b6dd in IA__g_closure_invoke (closure=<value optimized out>, 
    return_value=<value optimized out>, n_param_values=<value optimized out>, 
    param_values=<value optimized out>, invocation_hint=<value optimized out>)
    at gclosure.c:490
#24 0x0000003f3901f392 in signal_emit_unlocked_R (node=<value optimized out>, 
---Type <return> to continue, or q <return> to quit---
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, instance_and_params=<value optimized out>)
    at gsignal.c:2478
#25 0x0000003f39020b9c in IA__g_signal_emit_valist (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=<value optimized out>) at gsignal.c:2199
#26 0x0000003f390210e3 in IA__g_signal_emit (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>) at gsignal.c:2243
#27 0x00007f7a0d071bc7 in swfdec_player_advance (player=0x3cd4de0, msecs=83)
    at swfdec_player.c:3162
#28 0x00007f7a0d306a58 in swfdec_iterate_dispatch (source_=0x4390160, 
    callback=<value optimized out>, user_data=<value optimized out>) at swfdec_source.c:109
#29 0x0000003f3883749b in IA__g_main_context_dispatch (context=<value optimized out>)
    at gmain.c:2009
#30 0x0000003f3883ac7d in g_main_context_iterate (context=<value optimized out>, 
    block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>)
    at gmain.c:2642
#31 0x0000003f3883ae3b in IA__g_main_context_iteration (context=<value optimized out>, 
    may_block=<value optimized out>) at gmain.c:2705
#32 0x000000300635fea1 in nsBaseAppShell::DoProcessNextNativeEvent (
    this=<value optimized out>, mayWait=<value optimized out>) at nsBaseAppShell.cpp:151
#33 0x0000003006360052 in nsBaseAppShell::OnProcessNextEvent (this=<value optimized out>, 
    thr=<value optimized out>, mayWait=<value optimized out>, 
    recursionDepth=<value optimized out>) at nsBaseAppShell.cpp:278
#34 0x0000003006416a4b in nsThread::ProcessNextEvent (this=<value optimized out>, 
    mayWait=<value optimized out>, result=<value optimized out>) at nsThread.cpp:497
#35 0x00000030063e82f6 in NS_ProcessNextEvent_P (thread=<value optimized out>, 
    mayWait=<value optimized out>) at nsThreadUtils.cpp:227
#36 0x000000300636010d in nsBaseAppShell::Run (this=<value optimized out>)
---Type <return> to continue, or q <return> to quit---
    at nsBaseAppShell.cpp:170
#37 0x00000030062235bd in nsAppStartup::Run (this=<value optimized out>)
    at nsAppStartup.cpp:181
#38 0x0000003005c1f73b in XRE_main (argc=<value optimized out>, argv=<value optimized out>, 
    aAppData=<value optimized out>) at nsAppRunner.cpp:3154
#39 0x0000000000401665 in __gxx_personality_v0 ()
    at ../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#40 0x00000031aa81e32a in __libc_start_main (main=<value optimized out>, 
    argc=<value optimized out>, ubp_av=<value optimized out>, init=<value optimized out>, 
    fini=<value optimized out>, rtld_fini=<value optimized out>, stack_end=Could not find the frame base for "__libc_start_main".
)
    at libc-start.c:220
#41 0x0000000000401159 in __gxx_personality_v0 ()
    at ../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#42 0x00007fff18bc6c38 in ?? ()
#43 0x000000000000001c in ?? ()
#44 0x0000000000000002 in ?? ()
#45 0x00007fff18bc839e in ?? ()
#46 0x00007fff18bc83bf in ?? ()
#47 0x0000000000000000 in ?? ()
(gdb)

Comment 1 Benjamin Otte 2008-06-06 00:55:35 UTC

Yup, it's an issue I'm aware of. It was introduced while trying to make TextField properties update at the correct time. Unfortunately I very much failed.

Unfortunately I'm currently busy with other stuff, so my work on TextField correct property updates will have to wait a while. If this is very annoying for you (or someone else), I might attempt a quickfix, so it stops happening, otherwise I'll just let it as is until I have time.

Side note: Any reproducible crash with a default-compiled swfdec is a blocker.

Comment 2 Pavel Roskin 2008-06-06 11:10:46 UTC

I've bisected it:

3eef13f5b570b3f32e2cdeebc5f808c02f2898a1 is first bad commit
commit 3eef13f5b570b3f32e2cdeebc5f808c02f2898a1
Author: Benjamin Otte <otte@gnome.org>
Date:   Wed May 14 23:01:54 2008 +0200

also queue an update when setting autoSize to a boolean value

Comment 3 Riccardo Magliocchetti 2008-06-17 02:32:24 UTC

*** Bug 16206 has been marked as a duplicate of this bug. ***

Comment 4 Benjamin Otte 2008-06-22 08:23:20 UTC

This should be fixed with git master.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.