View Issue Details

IDProjectCategoryView StatusLast Update
0005538The Dark ModObjectivespublic22.02.2021 15:49
Reporterbwyan Assigned To 
PrioritynormalSeveritycrashReproducibilityalways
Status confirmedResolutionopen 
PlatformLinuxOSUbuntuOS Version20.04.2 LTS
Target VersionTDM 2.10 
Summary0005538: Segmentation fault when receiving a new objective in mission "WS3: Cleighmoor"
DescriptionHello,

This is my first bug report, so any comments on how I could improve this post will be appreciated.

Mission: William Steele 3: Cleighmoor (https://www.thedarkmod.com/missiondetails/?id=82)
Save game file: https://nextcloud.bwyan.dk/index.php/s/A32yPXZtC2W4gmB (compressed .tar.gz file)

When loading "Quicksave_0" and waiting a few seconds for the civilian to finish his dialogue with the guard, a new mission objective is supposed to be received, but instead the game exits to desktop with the following output (cropped to immediately after the save game was created):

NEW OBJECTIVE
signal caught: Segmentation fault
si_code 1
Trying to exit gracefully..
--------- Game Map Shutdown ----------
ModelGenerator memory: 23 LOD entries with 3 users using 2713 bytes.
WARNING:idClipModel::FreeTraceModel: tried to free uncached trace model (index=0)
--------- Game Map Shutdown done -----
Shutting down sound hardware
idRenderSystem::Shutdown()
double free or corruption (out)
double fault Aborted, bailing out
shutdown terminal support
About to exit with code 6
Steps To ReproduceLoad the linked save game for the mission "William Steele 3: Cleighmoor" and wait a few seconds and the game should crash.
Additional InformationThis has only been tested on the recently released version 2.09, but I can't select that as an option in the "Product Version" drop-down.
TagsCrash

Activities

nbohr1more

nbohr1more

16.02.2021 16:51

developer   ~0013691

Confirmed the crash...
nbohr1more

nbohr1more

16.02.2021 17:05

developer   ~0013692

Cannot reproduce in gdb ...
nbohr1more

nbohr1more

16.02.2021 17:32

developer   ~0013693

Reproducible with com_smp 0 and com_fixedTic 0 (not affected by multi-core or uncapped FPS)
bwyan

bwyan

16.02.2021 20:44

reporter   ~0013694

@nbohr1more: Do I understand you correctly that the crash may be due to my chosen in-game settings (chosen in the main menu), or are these settings that you mention exclusive to the dev console?
nbohr1more

nbohr1more

17.02.2021 01:10

developer   ~0013695

@bwyan : Multi-Core and Uncapped FPS are known to be sources of stability issues so I ruled them out.

It is possible that some setting is responsible for this but it seems unlikely now.

As I can tell, the conversation is causing an unhandled clipmodel to be freed.

Probably something that needs to be covered in the Entity destructor...

I will continue to investigate.
nbohr1more

nbohr1more

17.02.2021 05:20

developer   ~0013696

Hmm...

[/game/ai/Conversation/ConversationSystem.cpp ( 160):DEB (CONVERSATION) FR: 79491] Terminating conversation SewellTalksToSmithson due to error.

[/game/ai/Mind.cpp ( 156):INF (AI) FR: 79491] Ending State Conversation (Sewell)
[/game/ai/Mind.cpp ( 156):INF (AI) FR: 79491] Ending State Conversation (Smithson)

End of log
[/game/StimResponse/Response.cpp ( 97):DEB (STIMRESP) FR: 79494] Running ResponseScript
nbohr1more

nbohr1more

17.02.2021 15:20

developer   ~0013700

@grayman : I don't see a "SewellTalksToSmithson" variable in the script for this mission,
do you know how this conversation is initiated?
stgatilov

stgatilov

17.02.2021 15:35

administrator   ~0013701

Can't reproduce on Windows, but can reproduce on Linux.

Here are stack traces:
[Frontend]
#0 0x00007ffff6e2556f in _int_malloc (av=av@entry=0x7fffb0000020, bytes=bytes@entry=7916) at malloc.c:3734
0000001 0x00007ffff6e271d4 in __GI___libc_malloc (bytes=7916) at malloc.c:2920
0000002 0x000000000070bf72 in idHeap::Allocate (bytes=7916, this=<optimized out>) at /mnt/hgfs/thedarkmod/darkmod_src/idlib/Heap.cpp:261
0000003 Mem_Alloc (size=size@entry=7916) at /mnt/hgfs/thedarkmod/darkmod_src/idlib/Heap.cpp:1070
0000004 0x0000000000a22f24 in idClass::operator new (s=7916, s@entry=7912) at /mnt/hgfs/thedarkmod/darkmod_src/game/gamesys/Class.cpp:456
0000005 0x00000000009201b4 in CResponse::TriggerResponse (this=0x2005d660, sourceEntity=0x83880e4, stim=std::shared_ptr (count 1, weak 0) 0x20cfabc0)
    at /mnt/hgfs/thedarkmod/darkmod_src/game/StimResponse/Response.cpp:98
0000006 0x00000000005de515 in idGameLocal::DoResponseAction (this=this@entry=0x20b7c00 <gameLocal>, stim=std::shared_ptr (count 1, weak 0) 0x20cfabc0, numEntities=numEntities@entry=34,
    originator=originator@entry=0x83880e4, stimOrigin=...) at /mnt/hgfs/thedarkmod/darkmod_src/game/Game_local.cpp:7377
0000007 0x00000000005def2f in idGameLocal::ProcessStimResponse (this=this@entry=0x20b7c00 <gameLocal>, ticks=ticks@entry=416610695) at /mnt/hgfs/thedarkmod/darkmod_src/game/Game_local.cpp:7611
#8 0x00000000005df50e in idGameLocal::RunFrame (this=0x20b7c00 <gameLocal>, clientCmds=<optimized out>, timestepMs=<optimized out>) at /mnt/hgfs/thedarkmod/darkmod_src/game/Game_local.cpp:3310
0000009 0x0000000000505408 in idSessionLocal::RunGameTic (this=0x1850100 <sessLocal>, timestepMs=16) at /mnt/hgfs/thedarkmod/darkmod_src/framework/Session.cpp:3071
0000010 0x0000000000508ce7 in idSessionLocal::RunGameTics (this=0x1850100 <sessLocal>) at /mnt/hgfs/thedarkmod/darkmod_src/framework/Session.cpp:3114
0000011 idSessionLocal::FrontendThreadFunction (this=0x1850100 <sessLocal>) at /mnt/hgfs/thedarkmod/darkmod_src/framework/Session.cpp:3160
0000012 0x0000000000508f89 in idSessionLocal::<lambda(void*)>::operator() (__closure=0x0, x=<optimized out>) at /mnt/hgfs/thedarkmod/darkmod_src/framework/Session.cpp:3254
0000013 idSessionLocal::<lambda(void*)>::_FUN(void *) () at /mnt/hgfs/thedarkmod/darkmod_src/framework/Session.cpp:3256
0000014 0x00007ffff7bc16ba in start_thread (arg=0x7fffc9d76700) at pthread_create.c:333
0000015 0x00007ffff6eaa4dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

[Backend]
#0 0x00007ffff6ea0007 in ioctl () at ../sysdeps/unix/syscall-template.S:84
0000001 0x00007fffe18c7478 in drmIoctl () from /usr/lib/x86_64-linux-gnu/libdrm.so.2
0000002 0x00007fffe18ca24f in drmCommandWriteRead () from /usr/lib/x86_64-linux-gnu/libdrm.so.2
0000003 0x00007fffe111b584 in ?? () from /usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so
0000004 0x00007fffe111a092 in ?? () from /usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so
0000005 0x00007fffe112f0d6 in ?? () from /usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so
0000006 0x00007fffe1130a7c in ?? () from /usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so
0000007 0x00007fffe0bff9a5 in ?? () from /usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so
#8 0x00007fffe0b60ac6 in ?? () from /usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so
0000009 0x00007fffe0c038b3 in ?? () from /usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so
0000010 0x00007fffe0b62133 in ?? () from /usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so
0000011 0x00007fffe0b622d2 in ?? () from /usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so
0000012 0x0000000000bcf62b in RenderBackend::DrawLightgem (this=0x2b99920 <renderBackendImpl>, viewDef=0x7fffd03aa900,
    lightgemData=0x4b4a250 "\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022\031\022\022"...) at /mnt/hgfs/thedarkmod/darkmod_src/renderer/backend/RenderBackend.cpp:160
0000013 0x000000000081fc6b in RB_ExecuteBackEndCommands (cmds=0x7fffd03d5b00) at /mnt/hgfs/thedarkmod/darkmod_src/renderer/tr_backend.cpp:846
0000014 0x00000000007d61c5 in R_IssueRenderCommands (frameData=0x27adb40 <smpFrameData>) at /mnt/hgfs/thedarkmod/darkmod_src/renderer/RenderSystem.cpp:140
0000015 idRenderSystemLocal::EndFrame (this=0x27a1580 <tr>, frontEndMsec=0x0, backEndMsec=0x0) at /mnt/hgfs/thedarkmod/darkmod_src/renderer/RenderSystem.cpp:635
0000016 0x00000000005008ac in idSessionLocal::UpdateScreen (this=0x1850100 <sessLocal>, outOfSequence=<optimized out>) at /mnt/hgfs/thedarkmod/darkmod_src/framework/Session.cpp:2757
0000017 0x00000000004b0a8d in idCommonLocal::Frame (this=0x17c5200 <commonLocal>) at /mnt/hgfs/thedarkmod/darkmod_src/framework/Common.cpp:2546
0000018 0x00000000004748ed in main (argc=1, argv=0x7fffffffdeb8) at /mnt/hgfs/thedarkmod/darkmod_src/sys/posix/platform_linux.cpp:580

[Sound thread]
#0 0x0000000000d4512f in res2_inverse ()
0000001 0x0000000000d45a67 in mapping0_inverse ()
0000002 0x0000000000d211e8 in _fetch_and_process_packet.constprop.10 ()
0000003 0x0000000000d25278 in ov_read_float ()
0000004 0x000000000085f348 in idSampleDecoderLocal::DecodeOGG (this=this@entry=0x1eb219e0, sample=sample@entry=0xc79f8a0, sampleOffset44k=sampleOffset44k@entry=0, sampleCount44k=sampleCount44k@entry=8192,
    dest=dest@entry=0x7fffc956c0b0) at /mnt/hgfs/thedarkmod/darkmod_src/sound/snd_decoder.cpp:561
0000005 0x000000000085f683 in idSampleDecoderLocal::Decode (this=0x1eb219e0, sample=0xc79f8a0, sampleOffset44k=<optimized out>, sampleCount44k=<optimized out>, dest=0x7fffc956c0b0)
    at /mnt/hgfs/thedarkmod/darkmod_src/sound/snd_decoder.cpp:440
0000006 0x00000000008692a3 in idSoundChannel::GatherChannelSamples (this=0x1ead1bd8, sampleOffset44k=<optimized out>, sampleCount44k=<optimized out>, dest=<optimized out>)
    at /mnt/hgfs/thedarkmod/darkmod_src/sound/snd_emitter.cpp:278
0000007 0x0000000000877922 in idSoundWorldLocal::AddChannelContribution (this=this@entry=0x6dd33b0, sound=sound@entry=0x1ead1b70, chan=chan@entry=0x1ead1bd8, current44kHz=current44kHz@entry=4878336,
    numSpeakers=numSpeakers@entry=2, finalMixBuffer=finalMixBuffer@entry=0x2a3c450 <soundSystemLocal+48>) at /mnt/hgfs/thedarkmod/darkmod_src/sound/snd_world.cpp:2155
#8 0x0000000000877e13 in idSoundWorldLocal::MixLoop (this=0x6dd33b0, current44kHz=current44kHz@entry=4878336, numSpeakers=numSpeakers@entry=2, finalMixBuffer=0x2a3c450 <soundSystemLocal+48>)
    at /mnt/hgfs/thedarkmod/darkmod_src/sound/snd_world.cpp:559
0000009 0x000000000086e6b8 in idSoundSystemLocal::AsyncUpdateWrite (this=0x2a3c420 <soundSystemLocal>, inTime=110623) at /mnt/hgfs/thedarkmod/darkmod_src/sound/snd_system.cpp:763
0000010 0x00000000004b3ca1 in idCommonLocal::SingleAsyncTic (this=this@entry=0x17c5200 <commonLocal>) at /mnt/hgfs/thedarkmod/darkmod_src/framework/Common.cpp:2632
0000011 0x00000000004b3da8 in idCommonLocal::Async (this=0x17c5200 <commonLocal>) at /mnt/hgfs/thedarkmod/darkmod_src/framework/Common.cpp:2689
0000012 0x0000000000c537f8 in Sys_AsyncThread () at /mnt/hgfs/thedarkmod/darkmod_src/sys/linux/main.cpp:96
0000013 0x00007ffff7bc16ba in start_thread (arg=0x7fffc9575700) at pthread_create.c:333
0000014 0x00007ffff6eaa4dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

When crash happened, gdb showed me frontend thread.
I guess the crash happened inside malloc.
Since size looks OK, this crash most likely means heap corruption somewhere.
It can also explain why it does not lead to crash on Windows.

No idea what to do next. Is it possible to run TDM under valgrind?
grayman

grayman

18.02.2021 16:05

administrator   ~0013704

When Smithson starts his patrol and walks into "trigger_once_entityname_11", a conversation is started ("SewellTalksToSmithson") between him and Sewell.

I have no clue what's causing the issue. The only known crash in Cleighmoor was fixed years ago by this update:

https://www.dropbox.com/s/ph8pa8eyobuh36q/ws3_cleighmoor_map_patch.zip?dl=0
cabalistic

cabalistic

18.02.2021 16:29

developer   ~0013705

How easy is it to reproduce this issue without the savegame? It would be very helpful, I think, to know if this already existed in 2.08 or not, so that we could potentially bisect to the problematic change.
stgatilov

stgatilov

22.02.2021 15:48

administrator   ~0013716

Last edited: 22.02.2021 15:49

View 2 revisions

I tried to reproduce it on Windows with (full) Debug, but there is no issues like heap corruption detected.
Also tried to run TDM under valgrind, but it produces tons of redirection warnigs, after which crashes deep inside VMWare OpenGL driver during glX initialization.

And yes, I don't see instructions how to reproduce from fresh start. I wonder if it is possible.

Issue History

Date Modified Username Field Change
16.02.2021 13:33 bwyan New Issue
16.02.2021 13:35 bwyan OS Version => 20.04.2 LTS
16.02.2021 13:35 bwyan Additional Information Updated View Revisions
16.02.2021 16:30 bwyan Tag Attached: Crash
16.02.2021 16:50 nbohr1more Target Version => TDM 2.10
16.02.2021 16:51 nbohr1more Note Added: 0013691
16.02.2021 16:51 nbohr1more Severity normal => crash
16.02.2021 16:51 nbohr1more Status new => confirmed
16.02.2021 17:05 nbohr1more Note Added: 0013692
16.02.2021 17:32 nbohr1more Note Added: 0013693
16.02.2021 20:44 bwyan Note Added: 0013694
17.02.2021 01:10 nbohr1more Note Added: 0013695
17.02.2021 05:20 nbohr1more Note Added: 0013696
17.02.2021 15:20 nbohr1more Note Added: 0013700
17.02.2021 15:35 stgatilov Note Added: 0013701
18.02.2021 16:05 grayman Note Added: 0013704
18.02.2021 16:29 cabalistic Note Added: 0013705
22.02.2021 15:48 stgatilov Note Added: 0013716
22.02.2021 15:49 stgatilov Note Edited: 0013716 View Revisions