[bug v5.1] Click Depot Crash

Topic: [bug v5.1] Click Depot Crash (Read 3094 times) previous topic - next topic

[bug v5.1] Click Depot Crash

July 21, 2009, 08:24:09 am

Sometimes it happens that after clicking on depot game crashes.

Occurs on version 5.1 either, when clicking on tram depot.

crashes in malloc, so reason seems as some memory corruption?
backtrace:
#0 0xb7cedb18 in ?? () from /lib/tls/i686/cmov/libc.so.6
#1 0xb7cef9c5 in malloc () from /lib/tls/i686/cmov/libc.so.6
#2 0xb7ecef47 in operator new () from /usr/lib/libstdc++.so.6
#3 0xb7ecf08d in operator new[] () from /usr/lib/libstdc++.so.6
#4 0x080d2787 in vector_tpl<gui_image_list_t::image_data_t>::resize (this=0xcdf6928, new_size=31) at gui/components/../../tpl/vector_tpl.h:58
#5 0x080ce433 in gui_convoy_****embler_t::build_vehicle_lists (this=0xcdf6290) at gui/components/gui_convoy_****embler.cc:508
#6 0x080cfb63 in gui_convoy_****embler_t (this=0xcdf6290, w=0x97b6e20, wt=tram_wt, player_nr=0 '\0', electrified=true) at gui/components/gui_convoy_****embler.cc:106
#7 0x080f0056 in depot_frame_t (this=0xcdf5d08, depot=0xcc8b340) at gui/depot_frame.cc:50
#8 0x08182499 in depot_t::zeige_info (this=0xcc8b340) at simdepot.cc:168
#9 0x081beb81 in wkz_abfrage_t::work (this=0xc664e50, welt=0x97b6e20, sp=0xcad1080, pos={x = 118, y = 35, z = 0 '\0', static invalid = {x = -1, y = -1, z = -1 'ÿ', static invalid = <same as static member of an already seen type>}}) at simwerkz.cc:342
#10 0x081cdfdf in karte_t::interactive_event (this=0x97b6e20, ev=@0xbfae2608) at simworld.cc:4636
#11 0x081ce3bc in karte_t::interactive (this=0x97b6e20) at simworld.cc:4769
#12 0x081a27c4 in simu_main (argc=704, argv=0xd439218) at simmain.cc:957
#13 0x081ff718 in main (argc=1, argv=0xbfae4744) at simsys_s.cc:737

and in thread about valgrind I put other backtrace from crash after clicking depot. It crashes in some other place, but context on backtrace is similar ( build_vehicle_list ).

Quote

#0 0x0804d024 in einstellungen_t::get_use_timeline (this=0x73) at vehicle/../dataobj/einstellungen.h:396
(gdb) bt
#0 0x0804d024 in einstellungen_t::get_use_timeline (this=0x73) at vehicle/../dataobj/einstellungen.h:396
#1 0x0804d343 in karte_t::get_timeline_year_month (this=0x9c75218) at simworld.h:540
#2 0x080cde38 in gui_convoy_****embler_t::build_vehicle_lists (this=0xb1c64a8) at gui/components/gui_convoy_****embler.cc:481
#3 0x080edb75 in depot_frame_t::check_way_electrified (this=0xb1c5f20) at gui/depot_frame.cc:710
#4 0x080f0006 in depot_frame_t (this=0xb1c5f20, depot=0xa6cdd58) at gui/depot_frame.cc:50
#5 0x08182499 in depot_t::zeige_info (this=0xa6cdd58) at simdepot.cc:168
#6 0x081beb81 in wkz_abfrage_t::work (this=0x9ee9bd0, welt=0x9ca6c90, sp=0x9ca23b0, pos={x = 229, y = 81, z = 3 '\003', static invalid = {x = -1, y = -1, z = -1 'ÿ', static invalid = <same as static member of an already seen type>}}) at simwerkz.cc:342
#7 0x081cdfdf in karte_t::interactive_event (this=0x9ca6c90, ev=@0xbfb8beb8) at simworld.cc:4636
#8 0x081ce3bc in karte_t::interactive (this=0x9ca6c90) at simworld.cc:4769
#9 0x081a27c4 in simu_main (argc=704, argv=0xa69bcd8) at simmain.cc:957
#10 0x081ff788 in main (argc=1, argv=0xbfb8dff4) at simsys_s.cc:737

Ubuntu 9.04, 32-bit, Simutrans 5.1 built from sources
pak128 with modified configs

Re: [bug v5.1] Click Depot Crash

Reply #1 – July 21, 2009, 09:10:19 am

Hanczar,

Thanks a lot for your help.

Actually, the depot crash problem has been around for a long time. Please read the old thread here for your information.

I also agree that this is most likely a memory corruption problem, and this problem has existed ever since v3.11 . This is the reason why I said in the other thread that code that triggers a crash is not necessarily the code that causes the crash (here means the code that corrupts memory in the first place).

Unfortunately, crash reports like yours cannot help to identify the code that causes the problem. I think the only way to find the root cause is to review all ST EXP specific code once.

Re: [bug v5.1] Click Depot Crash

Reply #2 – July 21, 2009, 09:27:57 am

EDIT:<<<<
Sry, I was looking at this problem and don't see your post.

Quote

Thanks a lot for your help.

No problem, It's nice to help with small brick for such great game ;-)

Quote

Unfortunately, crash reports like yours cannot help to identify the code that causes the problem. I think the only way to find the root cause is to review all ST EXP specific code once.

I'll try give as much information as is possible, and I know that backtraces can be sometimes very useful for crashes :-) and sometimes not..
EDIT:>>>>

I look through backtraces and code and such thing is suspicious to me:

In depot_frame_t constructor initializes convoy_****embler by calling check_way_electrified() function, but in check_way_electrified function, convoy_****embler->set_electrified() is called.
So convoy_****embler->set_electrified() it called before convoy_****embler is initialized and proper constructor for this called.

backtrace in quotes in previous comment shows exactly this case:
frame #4 : depot_frame_t (this=0xb1c5f20, depot=0xa6cdd58) at gui/depot_frame.cc:50 <- so constructor for depot here is called
frame #3 : depot_frame_t::check_way_electrified (this=0xb1c5f20) at gui/depot_frame.cc:710 <- check_way_electrified before convoy_****embler is initialized
frame #2 : 0x080cde38 in gui_convoy_****embler_t::build_vehicle_lists (this=0xb1c64a8) at gui/components/gui_convoy_****embler.cc:481 <- build_vehlicle_list is on convoi_****embler called ( from convoy:set_electrified) before it is initialized, and it crashes .

second backtrace crashes 'a few lines of code' later, in constructor of convoy_****embler, but maybe because situation above doesn't crash this time only corrupt some memory

Re: [bug v5.1] Click Depot Crash

Reply #3 – July 21, 2009, 12:08:27 pm

Thank you very much for the detailed investigation - this one has been difficult to track down for a long time. I will have a go at fixing that when I get home.

Edit: I think that I have managed to fix this.

Re: [bug v5.1] Click Depot Crash

Reply #4 – July 26, 2009, 01:22:44 pm

A fix for this issue is now available in version 6.0 and later (the latest version is 6.1).