[Gnash-commit] [bug #39404] invalid read from XMLNode_as::clearChildren()

[Sandro Santilli]

Follow-up Comment #9, bug #39404 (project gnash):

Here's a test that makes valgrind capable of finding the problem:

 var x = new XML('<t></t>');
 x.appendChild(new XML('<t></t>'));
 var x2 = new XML('<t></t>');
 x2.appendChild(x);
 // many allocations force GC run
 for (var i=0; i<10000; ++i) x = {};

Build in version 6, possibly uncompressed.
Run with gprocessor. Valgrind reports:

==9087== Invalid read of size 8
==9087==    at 0x51EDA1C: gnash::XMLNode_as::clearChildren()
(XMLNode_as.cpp:384)
==9087==    by 0x51EDA95: gnash::XMLNode_as::~XMLNode_as()
(XMLNode_as.cpp:113)
==9087==    by 0x51EBFB0: gnash::XML_as::~XML_as() (XML_as.h:77)
==9087==    by 0x50A6491: gnash::as_object::~as_object()
(checked_delete.hpp:34)
==9087==    by 0x564DF9E: gnash::GC::~GC() (GC.cpp:62)
==9087==    by 0x50E5B41: gnash::movie_root::~movie_root()
(movie_root.cpp:190)
==9087==    by 0x111CCE: play_movie(std::string const&, gnash::RunResources
const&) (processor.cpp:602)
==9087==    by 0x110AFB: main (processor.cpp:368)
==9087==  Address 0x15f8c620 is 32 bytes inside a block of size 136 free'd
==9087==    at 0x4C2A4BC: operator delete(void*) (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9087==    by 0x50A6491: gnash::as_object::~as_object()
(checked_delete.hpp:34)
==9087==    by 0x564DF9E: gnash::GC::~GC() (GC.cpp:62)
==9087==    by 0x50E5B41: gnash::movie_root::~movie_root()
(movie_root.cpp:190)
==9087==    by 0x111CCE: play_movie(std::string const&, gnash::RunResources
const&) (processor.cpp:602)
==9087==    by 0x110AFB: main (processor.cpp:368)


    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?39404>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/