MantisBT - VCMI
View Issue Details
0001206VCMIMechanics - Town structurespublic2013-02-12 12:062014-05-30 17:41
o01eg 
Tow 
highcrashalways
closedfixed 
amd64Gentoo Linux
 
0.92 
0001206: Crash at buying any building in the Dungeon town [r3191].
Server side:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffede77700 (LWP 12387)]
0x00007ffff781adf3 in CGTownInstance::setPropertyDer (this=0x19688f0, what=11 '\v', val=0) at /mnt/another/tmp/vcmi/lib/CObjectHandler.cpp:1881
1881 bonusingBuildings[val]->setProperty (ObjProperty::VISITORS, visitingHero->id);

(gdb) bt full
#0 0x00007ffff781adf3 in CGTownInstance::setPropertyDer (this=0x19688f0, what=11 '\v', val=0) at /mnt/another/tmp/vcmi/lib/CObjectHandler.cpp:1881
No locals.
#1 0x00007ffff7812bcf in CGObjectInstance::setProperty (this=0x19688f0, what=11 '\v', val=0) at /mnt/another/tmp/vcmi/lib/CObjectHandler.cpp:414
No locals.
0000002 0x00007ffff7819737 in CGDwelling::setProperty (this=0x19688f0, what=11 '\v', val=0) at /mnt/another/tmp/vcmi/lib/CObjectHandler.cpp:1678
No locals.
0000003 0x00007ffff7902128 in SetObjectProperty::applyGs (this=0x7fffede76110, gs=0x15e7210) at /mnt/another/tmp/vcmi/lib/NetPacksLib.cpp:940
        obj = 0x19688f0
        cai = 0x19688f0
0000004 0x00007ffff76fcd9c in CApplyOnGS<SetObjectProperty>::applyOnGS (this=0x1617650, gs=0x15e7210, pack=0x7fffede76110)
    at /mnt/another/tmp/vcmi/lib/CGameState.cpp:83
        ptr = 0x7fffede76110
        lock = {m = 0x15e7440, is_locked = true}
0000005 0x00007ffff7659132 in CGameState::apply (this=0x15e7210, pack=0x7fffede76110) at /mnt/another/tmp/vcmi/lib/CGameState.cpp:1991
        typ = 110
0000006 0x00000000006b4988 in CGameHandler::sendAndApply (this=0x7fffffffd130, info=0x7fffede76110) at /mnt/another/tmp/vcmi/server/CGameHandler.cpp:2249
No locals.
0000007 0x00000000006d12ee in CGameHandler::commitPackage (this=0x7fffffffd130, pack=0x7fffede76110) at /mnt/another/tmp/vcmi/server/CGameHandler.cpp:6144
No locals.
0000008 0x00007ffff78e06c2 in IGameEventRealizer::setObjProperty (this=0x7fffffffd138, objid=7, prop=11, val=0)
    at /mnt/another/tmp/vcmi/lib/IGameCallback.cpp:936
        sob = {<CPackForClient> = {<CPack> = {_vptr.CPack = 0x83c170 <vtable for SetObjectProperty+16>, type = 1001}, <No data fields>}, id = 7,
          what = 11 '\v', val = 0}
0000009 0x00007ffff7821a8f in COPWBonus::onHeroVisit (this=0x1969380, h=0x1970290) at /mnt/another/tmp/vcmi/lib/CObjectHandler.cpp:2894
        iw = {<CPackForClient> = {<CPack> = {_vptr.CPack = 0x83c190 <vtable for InfoWindow+16>, type = 103}, <No data fields>}, text = {<CPack> = {
              _vptr.CPack = 0x83c7b0 <vtable for MetaString+16>, type = 2001}, message = std::vector of length 1, capacity 1 = {0 '\000'},
            localStrings = std::vector of length 0, capacity 0, exactStrings = std::vector of length 1, capacity 1 = {
    "As you near the Mana Vortex your body is filled with new energy. You have doubled your normal spell points."},
            numbers = std::vector of length 0, capacity 0}, components = std::vector of length 0, capacity 0, player = 0 '\000', soundID = 0}
        heroID = 19
0000010 0x00000000006b2b99 in CGameHandler::vistiCastleObjects (this=0x7fffffffd130, t=0x19688f0, h=0x1970290)
    at /mnt/another/tmp/vcmi/server/CGameHandler.cpp:2006
        i =
0000011 0x00000000006b712a in CGameHandler::buildStructure (this=0x7fffffffd130, tid=7, bid=..., force=false)
    at /mnt/another/tmp/vcmi/server/CGameHandler.cpp:2572
        fw = {<CPackForClient> = {<CPack> = {_vptr.CPack = 0x83c610 <vtable for FoWChange+16>, type = 112}, <No data fields>}, tiles = {
            table_ = {<boost::unordered::detail::table<boost::unordered::detail::set<std::allocator<int3>, int3, ShashInt3, std::equal_to<int3> > >> = {<boost::unordered::detail::buckets<std::allocator<int3>, boost::unordered::detail::ptr_bucket, boost::unordered::detail::ptr_node<int3> >> = {buckets_ = 0x0,
                  bucket_count_ = 11, size_ = 0,
                  allocators_ = {<boost::unordered::detail::compressed_base<std::allocator<boost::unordered::detail::ptr_bucket>, 1>> = {<std::allocator<boost::unordered::detail::ptr_bucket>> = {<__gnu_cxx::new_allocator<boost::unordered::detail::ptr_bucket>> = {<No data fields>}, <No data fields>}, <No data fields>}, <boost::unordered::detail::compressed_base<std::allocator<boost::unordered::detail::ptr_node<int3> >, 2>> = {<std::allocator<boost::unordered::detail::ptr_node<int3> >> = {<__gnu_cxx::new_allocator<boost::unordered::detail::ptr_node<int3> >> = {<No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}}, <boost::unordered::detail::functions<ShashInt3, std::equal_to<int3> >> = {current_ = false, funcs_ = {{data_ = {buf = "",
                        align_ = 0 '\000'}}, {data_ = {buf = "", align_ = 0 '\000'}}}}, mlf_ = 1, max_load_ = 0}, <No data fields>}}, player = 0 '\000',
          mode = 1 '\001'}
        t = 0x19688f0
        b = 0x14d78a0
        ns = {<CPackForClient> = {<CPack> = {_vptr.CPack = 0x83c4d0 <vtable for NewStructures+16>, type = 504}, <No data fields>}, tid = 7,
          bid = std::set with 1 elements = {[0] = {num = BuildingID::DWELL_LVL_3_UP}}, builded = 1}
0000012 0x0000000000828a55 in BuildStructure::applyGh (this=0x7fffe8001080, gh=0x7fffffffd130) at /mnt/another/tmp/vcmi/server/NetPacksServer.cpp:113
No locals.
0000013 0x000000000078cd48 in CApplyOnGH<BuildStructure>::applyOnGH (this=0x117e420, gh=0x7fffffffd130, c=0x133e600, pack=0x7fffe8001080, player=0 '\000')
    at /mnt/another/tmp/vcmi/server/CGameHandler.cpp:86
        ptr = 0x7fffe8001080
0000014 0x00000000006aa5fc in CGameHandler::handleConnection (this=0x7fffffffd130, players=std::set with 9 elements = {...}, c=...)
    at /mnt/another/tmp/vcmi/server/CGameHandler.cpp:929
        result = true
        applied = {<CPackForClient> = {<CPack> = {_vptr.CPack = 0x83c790 <vtable for PackageApplied+16>, type = 94}, <No data fields>}, result = 0 '\000',
          packType = 167, requestID = 7, player = 0 '\000'}
        pack = 0x7fffe8001080
        player = 0 '\000'
        requestID = 7
        packType = 167
        apply = 0x117e420
        __PRETTY_FUNCTION__ = "void CGameHandler::handleConnection(std::set<int>, CConnection&)"
0000015 0x000000000078e820 in boost::_mfi::mf2<void, CGameHandler, std::set<int, std::less<int>, std::allocator<int> >, CConnection&>::operator() (
    this=0x1339338, p=0x7fffffffd130, a1=std::set with 9 elements = {...}, a2=...) at /usr/include/boost-1_49/boost/bind/mem_fn_template.hpp:280
No locals.
0000016 0x000000000078e55c in boost::_bi::list3<boost::_bi::value<CGameHandler*>, boost::_bi::value<std::set<int, std::less<int>, std::allocator<int> > >, boost::reference_wrapper<CConnection> >::operator()<boost::_mfi::mf2<void, CGameHandler, std::set<int, std::less<int>, std::allocator<int> >, CConnection&>, boost::_bi::list0> (this=0x1339348, f=..., a=...) at /usr/include/boost-1_49/boost/bind/bind.hpp:392
No locals.
0000017 0x000000000078e331 in boost::_bi::bind_t<void, boost::_mfi::mf2<void, CGameHandler, std::set<int, std::less<int>, std::allocator<int> >, CConnection&>, boost::_bi::list3<boost::_bi::value<CGameHandler*>, boost::_bi::value<std::set<int, std::less<int>, std::allocator<int> > >, boost::reference_wrapper<CConnection> > >::operator() (this=0x1339338) at /usr/include/boost-1_49/boost/bind/bind_template.hpp:20
        a = {<No data fields>}
0000018 0x000000000078c68e in boost::detail::thread_data<boost::_bi::bind_t<void, boost::_mfi::mf2<void, CGameHandler, std::set<int, std::less<int>, std::allocator<int> >, CConnection&>, boost::_bi::list3<boost::_bi::value<CGameHandler*>, boost::_bi::value<std::set<int, std::less<int>, std::allocator<int> > >, boost::reference_wrapper<CConnection> > > >::run (this=0x13391b0) at /usr/include/boost-1_49/boost/thread/detail/thread.hpp:62
No locals.
0000019 0x00007ffff6427687 in ?? () from /usr/lib64/libboost_thread-mt-1_49.so.1.49.0
No symbol table info available.
0000020 0x00007ffff1349764 in ?? () from /usr/lib64/libGL.so.1
No symbol table info available.
0000021 0x00007ffff5b5ed96 in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
0000022 0x00007ffff4e7346d in clone () from /lib64/libc.so.6
No symbol table info available.
(gdb) p visitingHero
$1 = {ptr = 0x0}

Client side:

Error: server failed to close correctly or crashed!
Check /home/o01eg/.vcmi/server_log.txt for more info
ALSA lib pcm.c:7339:(snd_pcm_recover) underrun occurred
*** glibc detected *** /mnt/other/games/vcmi/bin/vcmiclient: double free or corruption (out): 0x00007fffd800dec0 ***
[Thread 0x7fffdf5eb700 (LWP 12326) exited]
/mnt/other/games/vcmi/lib64/vcmi/libvcmi.so(_ZN14CGTownInstance14setPropertyDerEhj+0x85)[0x7ffff781adf3]
/mnt/other/games/vcmi/lib64/vcmi/libvcmi.so(_ZN16CGObjectInstance11setPropertyEhj+0xa9)[0x7ffff7812bcf]
/mnt/other/games/vcmi/lib64/vcmi/libvcmi.so(_ZN10CGDwelling11setPropertyEhj+0x1d7)[0x7ffff7819737]
/mnt/other/games/vcmi/lib64/vcmi/libvcmi.so(_ZN17SetObjectProperty7applyGsEP10CGameState+0x248)[0x7ffff7902128]
Killing console... [Thread 0x7fffe617b700 (LWP 12324) exited]
done!
Connection has been requested to be closed.
[Thread 0x7fffe6f85700 (LWP 12323) exited]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe6f897c0 (LWP 12308)]
0x00007ffff3bd8055 in std::ostream::sentry::sentry(std::ostream&) () from /usr/lib/gcc/x86_64-pc-linux-gnu/4.6.3/libstdc++.so.6

(gdb) bt full
#0 0x00007ffff3bd8055 in std::ostream::sentry::sentry(std::ostream&) () from /usr/lib/gcc/x86_64-pc-linux-gnu/4.6.3/libstdc++.so.6
No symbol table info available.
#1 0x00007ffff3bd8769 in std::basic_ostream<char, std::char_traits<char> >& std::__ostream_insert<char, std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*, long) () from /usr/lib/gcc/x86_64-pc-linux-gnu/4.6.3/libstdc++.so.6
No symbol table info available.
0000002 0x00007ffff3bd8b6f in std::basic_ostream<char, std::char_traits<char> >& std::operator<< <std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*) () from /usr/lib/gcc/x86_64-pc-linux-gnu/4.6.3/libstdc++.so.6
No symbol table info available.
0000003 0x0000000000b29672 in CLogger::operator<< <char [45]> (this=0x1179bf8 <tlog0>, data=...) at /mnt/another/tmp/vcmi/client/../lib/CLogger.h:49
No locals.
0000004 0x0000000000b205af in CClient::stopConnection (this=0x7fffb8763de0) at /mnt/another/tmp/vcmi/client/Client.cpp:543
        close_server = {<CPackForServer> = {<CPack> = {_vptr.CPack = 0x7fffffffd040, type = 53296}, player = 255 '\377', c =
    0x7fffffffd0c0}, <No data fields>}
0000005 0x0000000000b1e22b in CClient::endGame (this=0x7fffb8763de0, closeConnection=true) at /mnt/another/tmp/vcmi/client/Client.cpp:190
No locals.
0000006 0x0000000000bec6b5 in listenForEvents () at /mnt/another/tmp/vcmi/client/CMT.cpp:777
        ev = {type = 4 '\004', active = {type = 4 '\004', gain = 0 '\000', state = 0 '\000'}, key = {type = 4 '\004', which = 0 '\000', state = 0 '\000',
            keysym = {scancode = 16 '\020', sym = 917491, mod = KMOD_NONE, unicode = 0}}, motion = {type = 4 '\004', which = 0 '\000', state = 0 '\000',
            x = 272, y = 634, xrel = -13, yrel = 13}, button = {type = 4 '\004', which = 0 '\000', button = 0 '\000', state = 0 '\000', x = 272, y = 634},
          jaxis = {type = 4 '\004', which = 0 '\000', axis = 0 '\000', value = 272}, jball = {type = 4 '\004', which = 0 '\000', ball = 0 '\000',
            xrel = 272, yrel = 634}, jhat = {type = 4 '\004', which = 0 '\000', hat = 0 '\000', value = 0 '\000'}, jbutton = {type = 4 '\004',
            which = 0 '\000', button = 0 '\000', state = 0 '\000'}, resize = {type = 4 '\004', w = 41550096, h = 917491}, expose = {type = 4 '\004'},
          quit = {type = 4 '\004'}, user = {type = 4 '\004', code = 41550096, data1 = 0xdfff3, data2 = 0x0}, syswm = {type = 4 '\004', msg = 0xdfff3}}
        ret = 0
        resChanged = {parent = @0x11798e0, path = std::vector of length 2, capacity 2 = {"video", "fullscreen"},
          callback = {<boost::function1<void, JsonNode const&>> = {<boost::function_base> = {
                vtable = 0xda2a91 <void boost::function1<void, JsonNode const&>::assign_to<listenForEvents()::{lambda(JsonNode const&)#1}>(listenForEvents()::{lambda(JsonNode const&)#1})::stored_vtable+1>, functor = {obj_ptr = 0x7ffff642756f <boost::thread::start_thread()+95>, type = {
                    type = 0x7ffff642756f <boost::thread::start_thread()+95>, const_qualified = 192, volatile_qualified = 210},
                  func_ptr = 0x7ffff642756f <boost::thread::start_thread()+95>, bound_memfunc_ptr = {
                    memfunc_ptr = &virtual table offset 140737324938606, this adjustment 140737488343744,
                    obj_ptr = 0xbf0f79 <boost::thread::make_thread_info<boost::_bi::bind_t<void, boost::_mfi::mf0<void, CGuiHandler>, boost::_bi::list1<boost::reference_wrapper<CGuiHandler> > > >(boost::_bi::bind_t<void, boost::_mfi::mf0<void, CGuiHandler>, boost::_bi::list1<boost::reference_wrapper<CGuiHandler> > >&&)+46>}, obj_ref = {obj_ptr = 0x7ffff642756f <boost::thread::start_thread()+95>, is_const_qualified = 192, is_volatile_qualified = 210},
                  data = 111 'o'}}, <std::unary_function<JsonNode const&, void>> = {<No data fields>}, static args = <optimized out>,
              static arity = <optimized out>}, <No data fields>}}
        __PRETTY_FUNCTION__ = "void listenForEvents()"
0000007 0x0000000000be9141 in main (argc=1, argv=0x7fffffffd8e8) at /mnt/another/tmp/vcmi/client/CMT.cpp:351
        opts = {static m_default_line_length = 80, m_caption = "Allowed options", m_line_length = 80, m_min_description_length = 40,
          m_options = std::vector of length 9, capacity 16 = {{px = 0x11a9850, pn = {pi_ = 0x11a9990}}, {px = 0x11a9a10, pn = {pi_ = 0x11a9b20}}, {
              px = 0x11a9b40, pn = {pi_ = 0x11a9c60}}, {px = 0x11a9cd0, pn = {pi_ = 0x11a9d80}}, {px = 0x11a9dc0, pn = {pi_ = 0x11a9e80}}, {px = 0x11a9f50,
              pn = {pi_ = 0x11aa010}}, {px = 0x11aa050, pn = {pi_ = 0x11aa120}}, {px = 0x11aa160, pn = {pi_ = 0x11aa230}}, {px = 0x11aa270, pn = {
                pi_ = 0x11aa3d0}}}, belong_to_group = std::vector<bool> of length 9, capacity 64 = {0, 0, 0, 0, 0, 0, 0, 0, 0},
          groups = std::vector of length 0, capacity 0}
        pomtime = {start = 70000, last = 700000, mem = 0}
        video = @0x1668508: {type = JsonNode::DATA_STRUCT, data = {Bool = 160, Float = 1.1608487364182594e-316, String = 0x16684a0, Vector = 0x16684a0,
            Struct = 0x16684a0}}
        vm = <incomplete type>
        total = {start = 70000, last = 6360000, mem = 0}
        res = @0x1662078: {type = JsonNode::DATA_STRUCT, data = {Bool = 224, Float = 9.1929885640892397e-317, String = 0x11beae0, Vector = 0x11beae0,
            Struct = 0x11beae0}}
        loading = {thread_info = {px = 0x0, pn = {pi_ = 0x0}}}
Load given savegame.
Enter to Dungeon town.
Try to buy any building.
Dereferencing of null pointer "visitingHero" at server.

Autosave_4* file are the savegame.
No tags attached.
zip vcmi.zip (227,432) 2013-02-12 12:06
https://bugs.vcmi.eu/file_download.php?file_id=1186&type=bug
Issue History
2013-02-12 12:06o01egNew Issue
2013-02-12 12:06o01egFile Added: vcmi.zip
2013-02-12 13:05TowNote Added: 0003367
2013-02-12 13:05TowAssigned To => Tow
2013-02-12 13:05TowStatusnew => feedback
2013-02-12 13:20TowNote Added: 0003368
2013-02-12 13:20TowStatusfeedback => confirmed
2013-02-12 13:28o01egNote Added: 0003369
2013-02-12 13:31o01egNote Added: 0003370
2013-02-12 13:50TowNote Added: 0003372
2013-02-12 13:50TowNote Edited: 0003372bug_revision_view_page.php?bugnote_id=3372#r2122
2013-02-12 14:41o01egNote Added: 0003373
2013-02-14 06:05o01egNote Added: 0003377
2013-02-14 07:31WarmongerNote Added: 0003378
2013-02-14 13:17TowNote Added: 0003379
2013-02-14 13:20TowNote Added: 0003380
2013-02-14 13:20TowStatusconfirmed => resolved
2013-02-14 13:20TowFixed in Version => 0.92
2013-02-14 13:20TowResolutionopen => fixed
2014-05-30 17:41beegeeStatusresolved => closed

Notes
(0003367)
Tow   
2013-02-12 13:05   
Are you sure the savegame is from r3191? I'm unable to open it.
(0003368)
Tow   
2013-02-12 13:20   
Never mind, stack trace was enough. Yes, that's really beautiful stacktrace you gave. I see finally GDB handles STL containers. :)

Crash is: build mana vertex when hero is in garrison and there is no visiting hero

Side remark: you're playing campaign, campaign support is buggy and not stable.
There is known issue that if you choose beholder's dwelling as your bonus, you'll encounter crash when trying to click it. (should be fixed relatively soon) I believe that's what you referred to as crash on "buying".
(0003369)
o01eg   
2013-02-12 13:28   
Yes, I'am sure. I've just load this savegame from the uploaded archive.

I have mods: Cove creature, In The Wake of Gods, Witchking artifacts, VCMI essential files, Cove heroes, High-res Menu, Cove town.
(0003370)
o01eg   
2013-02-12 13:31   
It is not campaign map. It is a random map.
(0003372)
Tow   
2013-02-12 13:50   
I somehow mixed up your saves with my older saves and opened the wrong one.
I apologise for confusion, your saves are loading fine and are not from campaign.

But then... have you encountered crash on anything else than biolding Mana Vortex in the presented conditions?

(0003373)
o01eg   
2013-02-12 14:41   
No, I've not. But I've not checked other town yet.
(0003377)
o01eg   
2013-02-14 06:05   
I cann't load this savgame at r3201.
(0003378)
Warmonger   
2013-02-14 07:31   
Serialized has changed, making saves incompatible.
(0003379)
Tow   
2013-02-14 13:17   
That happens quite often in trunk. Especially recently, with all the refactorings going on. If you care about continuing game, you can use SVN to downgrade to rev that works with your save. Though, you won't get fixes then.
(0003380)
Tow   
2013-02-14 13:20   
Bug has been fixed in r3202.