[Bug] Access violation on double-heading: sometimes

[jamespetts]

Symptoms: when adding a locomotive to the front of an existing train, the game crashes shortly after that train emerges from the depot. So far, have only been able to reproduce in PakBritain 0.3: attempts to reproduce in Pak64 and Pak128  have failed. Have reproduced with the latest nightly binary (which, confusingly, gives four different version numbers, but is marked with the date the 28th of February 2009).

Steps to reproduce:

1. Use PakBritain 0.3
2. Buy a GWR Pannier Tank, three GWR droplight carriages and one GWR droplight brake carriage.
3. Set the train to run to any schedule.
4. Recall the train to the depot.
5. Set the depot mode to "put in front".
6. Select the existing convoy.
7. Buy a further Pannier Tank
8. Press "start"
9. The game will crash with an access violation when the train leaves the depot.

With a debugger, I have tracked the access violation to this part of grund.h

Code Select Expand


weg_t *get_weg(waytype_t typ) const {
if(flags&has_way1) {


(the problem being that "flags" is undefined, indicating that the way is a null pointer). That code is, in turn, called from this part of simconvoi.cc

Code Select Expand


if(  fahr[0]->get_waytype()!=air_wt  ) {
// do not prereserve for airplanes
for(unsigned i=0; i<anz_vehikel; i++) {
// eventually reserve this
>> THIS LINE >> schiene_t * sch0 = dynamic_cast<schiene_t *>( welt->lookup(fahr[i]->get_pos())->get_weg(fahr[i]->get_waytype()) );
if(sch0) {
sch0->reserve(this->self);
}
else {
break;
}
}
}


[prissi]

Works fine for me. Maybe again a waypoint with trainlength?

[jamespetts]

What do you mean "a waypoint with trainlength"?

[prissi]

The first coordinate the train is sheduled is before the train has fully exited the depot.

[jamespetts]

Yes, it was, actually. Why would that cause it to crash?

[prissi]

No idea. Maybe because the vehicle was not yet on the map when it had to recalculate its route?

[Dwachs]

moving this to incorporated as the thread opener did not respond, assuming it is fixed