442268 - Loading a huge Flv into URLLoader and test movie crashes Flash

Status: VERIFIED FIXED

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Erik Tierney]

Reproduction:
1. Copy the attached Fla and Flv into the same location
2. Open the Fla file and Test Movie

Actual Results:
Crash when test movie " if it did not crash on the first time. please test movie again"
Expected Results:
It should not crash
Workaround:

See bug files at: http://flashqa.macromedia.com/bugfiles/206000-206999/206600-206699/206653/

From Flash Player Bug http://frpbugapp.macromedia.com/bugapp/detail.asp?ID=206653

[wsharp 7/16/07] Out of memory failure with a huge string allocation (101 MB)...

authplay.dll!avmplus::UnicodeUtils::Utf8ToUtf16(const unsigned char * in=0x38370000, int inLen=106851414, unsigned short * out=0x00000008, int outMax=106053936) Line 251	C++
>	authplay.dll!avmplus::String::String(const char * str=0x38370000, int utf8len=106851414, int utf16len=106053937) Line 61 C++
authplay.dll!avmplus::AvmCore::newString(const char * s=0x38370000, int len=106851414) Line 3214 + 0x27 bytes	C++
authplay.dll!avmplus::ByteArrayObject::_toString() + 0x3d bytes	C++

[wsharp 7/16/07] Back to QRB...this is a crash because of a 200 MB allocation (UTF16 string). We can certainly patch this location but it's core avmplus::String constructor code....we should throw an AVM+ exception (as long as we're in a valid AS3 stack frame). A bit of an edge case...maybe it's not worth the risk. The crash is from URLLoader.onComplete doing a toString on the ByteArray because it thinks it's a 'text' download for this test case. There are a variety of places that could cause a similar out of memory crash.

 
 
Transferred Comments:

Chris Peyer - Wed Sep 05 13:08:00 CDT 2007
Need to transfer to Bugzilla

Comment 1

[Erik Tierney]

Attachment: Compiled test case

Add a simple test case

Comment 2

[Erik Tierney]

Attachment: Source for test case

Comment 3

[Erik Tierney]

changed to flash10, since that's what it was in jira

Comment 4

[Erik Tierney]

I believe this is fixed.  Now when I run the test in the shell I get:
error: out of memory

Which seems correct - we should OOM instead of crashing when we run out of memory.

Comment 5

[Chris Peyer]

Also verified that crash does not happen w/ CS5 alpha.