View Issue Details

IDProjectCategoryView StatusLast Update
0000101Gameplay + OpenGL[All Projects] Bugpublic2017-01-31 06:48
ReporterRachael 
Assigned ToGraf Zahl 
PrioritylowSeveritycrashReproducibilityalways
Status resolvedResolutionfixed 
Summary0000101: Crash in restart ccmd
DescriptionThis one is more complicated to reproduce than the previous ones. I think I tried to look at it before but immediately got confused because I am not familiar with the game setup code yet.

Steps To ReproduceTo reproduce, do the following:
> gzdoom -iwad doom2.wad -warp 1 // (Important in this step: open a level first)
Then open the console:
] restart -iwad doom2.wad
] map map01
// boom!

This effect does not occur unless a level has been previously loaded, first.
TagsNo tags attached.

Relationships

Activities

Edward-san

Edward-san

2017-01-22 03:25

developer   ~0000200

To me it crashes while restarting.

Valgrind reports this:

==10873== Invalid read of size 4
==10873==    at 0x8CD70C: GC::Mark(DObject**) (dobjgc.cpp:282)
==10873==    by 0x8CC72B: DObject::PropagateMark() (dobject.cpp:397)
==10873==    by 0x8CD53E: GC::PropagateMark() (dobjgc.cpp:195)
==10873==    by 0x8CDB95: GC::SingleStep() (dobjgc.cpp:445)
==10873==    by 0x8CDCEF: GC::Step() (dobjgc.cpp:498)
==10873==    by 0x8B9D33: GC::CheckGC() (dobject.h:293)
==10873==    by 0x8BB680: NetUpdate() (d_net.cpp:947)
==10873==    by 0x8BDB2C: TryRunTics() (d_net.cpp:1950)
==10873==    by 0x8B34A4: D_DoomLoop() (d_main.cpp:1017)
==10873==    by 0x8B7623: D_DoomMain() (d_main.cpp:2678)
==10873==    by 0x620434: main (i_main.cpp:259)
==10873==  Address 0xe0c9f90 is 6,048 bytes inside an unallocated block of size 15,296 in arena "client"



gdb backtrace:


#0  0x00000000008cd70c in GC::Mark (obj=0xe143390) at /home/edward-san/zdoom/gzdoom/trunk/src/dobjgc.cpp:282
        
lobj = 0xe0c9f70
#1  0x00000000008cc72c in DObject::PropagateMark (this=0xe1432d0) at /home/edward-san/zdoom/gzdoom/trunk/src/dobject.cpp:397
        
offsets = 0x15804098
        info = 0xf9767e0
0000002  0x00000000008cd53f 
in GC::PropagateMark () at /home/edward-san/zdoom/gzdoom/trunk/src/dobjgc.cpp:195
        obj = 0xe1432d0
        __PRETTY_FUNCTION__ = "size_t GC::PropagateMark()"
0000003  0x00000000008cdb96 
in GC::SingleStep () at /home/edward-san/zdoom/gzdoom/trunk/src/dobjgc.cpp:445
        __PRETTY_FUNCTION__ = "size_t GC::SingleStep()"
0000004  
0x00000000008cdcf0 in GC::Step () at /home/edward-san/zdoom/gzdoom/trunk/src/dobjgc.cpp:498
        lim = 4000
        olim = 4000
        __PRETTY_FUNCTION__ = "void GC::Step()"
0000005  
0x00000000008b9d34 in GC::CheckGC () at /home/edward-san/zdoom/gzdoom/trunk/src/./dobject.h:293
No locals.
0000006  
0x00000000008bb681 in NetUpdate () at /home/edward-san/zdoom/gzdoom/trunk/src/d_net.cpp:947
        lowtic = 0
        nowtime = 8966409
        newtics = 0
        i = 0
        j = 0
        realstart = 869981916
        cmddata = 0x22663a0 <netcmds> ""
        resendOnly = false
        count = 9366813
        quitcount = 0
0000007  
0x00000000008bdb2d in TryRunTics () at /home/edward-san/zdoom/gzdoom/trunk/src/d_net.cpp:1950
        i = 8
        lowtic = 17
        realtics = 3646
        availabletics = 17
        counts = 16
        numplaying = 1
        doWait = true


problematic line:

0x00000000008cd70c in GC::Mark (obj=0xe143390) at /home/edward-san/zdoom/gzdoom/trunk/src/dobjgc.cpp:282

282			if (lobj->ObjectFlags & OF_EuthanizeMe)
Graf Zahl

Graf Zahl

2017-01-22 05:22

administrator   ~0000201

Somewhere a stale pointer to a deleted object seems to remain. I haven't found it yet, though.
_mental_

_mental_

2017-01-23 07:16

developer   ~0000215

The first culprit is static pointer in AInventory::CallTryPickup() function. I assume it was done this way for optimization purposes.
The second one is FraggleScript's variables being destructed twice: implicitly by GC::FullGC() at d_main.cpp:2720 and explicitly by DFsScript::ClearVariables() during exiting after restart.
Graf Zahl

Graf Zahl

2017-01-31 06:48

administrator   ~0000298

I hope I got all pending issues here.

Issue History

Date Modified Username Field Change
2017-01-21 21:37 Rachael New Issue
2017-01-22 03:25 Edward-san Note Added: 0000200
2017-01-22 05:22 Graf Zahl Note Added: 0000201
2017-01-22 05:22 Graf Zahl Assigned To => Graf Zahl
2017-01-22 05:22 Graf Zahl Status new => confirmed
2017-01-23 07:16 _mental_ Note Added: 0000215
2017-01-31 06:48 Graf Zahl Status confirmed => resolved
2017-01-31 06:48 Graf Zahl Resolution open => fixed
2017-01-31 06:48 Graf Zahl Note Added: 0000298