[10.x] crash buying in depot with invalid convoy

[sdog]

In a savegame saved with a year old version of a pak some vehicle must have been removed or changed. A depot showed "Convoy 1 of 1" in the first line, but did not show an image or data of that convoy. Selling was not possible either. Buying a new vehicle in this depot caused a segfault.


Since this crash is likely caused by inconsitency in the pak-set, it is rather inconspicious and might be in standard too. (there's no easy way to test it though.)

Code Select Expand



Program received signal SIGSEGV, Segmentation fault.
0x00000000004ac889 in gui_convoy_assembler_t::update_data() ()
(gdb) bt
#0  0x00000000004ac889 in gui_convoy_assembler_t::update_data() ()
#1  0x00000000004d7a9d in depot_frame_t::update_data() ()
#2  0x00000000004aeeb7 in gui_convoy_assembler_t::build_vehicle_lists() ()
#3  0x00000000005f9a10 in wkz_change_depot_t::init(karte_t*, spieler_t*) ()
#4  0x0000000000615931 in karte_t::local_set_werkzeug(werkzeug_t*, spieler_t*)
    ()
#5  0x0000000000615b6b in karte_t::set_werkzeug(werkzeug_t*, spieler_t*) ()
#6  0x00000000005acafc in depot_t::call_depot_tool(char, quickstone_tpl<convoi_t>, char const*, unsigned short) ()
#7  0x00000000004b2847 in gui_convoy_assembler_t::image_from_storage_list(gui_image_list_t::image_data_t*) ()
#8  0x00000000004b2cd2 in gui_convoy_assembler_t::action_triggered(gui_action_creator_t*, value_t) ()
#9  0x00000000004b9bca in gui_image_list_t::infowin_event(event_t const*) ()
#10 0x00000000004f101d in gui_container_t::infowin_event(event_t const*) ()
#11 0x00000000004bd434 in gui_scrollpane_t::infowin_event(event_t const*) ()
#12 0x00000000004be2e9 in gui_tab_panel_t::infowin_event(event_t const*) ()
#13 0x00000000004f101d in gui_container_t::infowin_event(event_t const*) ()
#14 0x00000000004aa639 in gui_convoy_assembler_t::infowin_event(event_t const*)
    ()
#15 0x00000000004f101d in gui_container_t::infowin_event(event_t const*) ()
#16 0x00000000004f2509 in gui_frame_t::infowin_event(event_t const*) ()
#17 0x00000000004d7c53 in depot_frame_t::infowin_event(event_t const*) ()
#18 0x000000000060c6f5 in check_pos_win(event_t*) ()
#19 0x000000000062c745 in karte_t::interactive(unsigned int) ()
#20 0x00000000005d9a73 in simu_main(int, char**) ()
#21 0x000000000040933c in main ()




savegame (v 10.10)

pak128.britain-experimental, simutrans-experimental 10.x, compiled from latest git version, ubuntu 11.10, 64 bit, gcc 4.6.1

[jamespetts]

May I ask - in which depot did you have this problem?

[sdog]

good question. It is the diesel road depot near the main station of shrewsbury (it's in a cluster with other rail depots). There were a couple of RT types i sold before.

[jamespetts]

Thank you for that pointer - I can't reproduce this, though, I'm afraid; at least, not in my debug build. The 4 RT-types show as normal and behave appropriately.

[sdog]

after selling the 4 RT, i still had the window showing me there would be another convoi. I'll check again later today.

[jamespetts]

Hmm, odd - I only get the 4 convoys.

[jk271]

I have revealed a bug that can have something common with this in latest devel (740599314f).
How to reproduce it:
1) I build a road depot. - OK
2) I bought "4 animals" vehicle (for pulling; probably cows NOT horses) - program crashed when I clicked on the icon of a "vehicle".

I am play pak64.experimental 0.2 (in the year 1836)
computer: 32bit, OS: 32bit Debian Linux
Settings: 0.10km per tile
compiler: g++ (Debian 4.4.5-8) 4.4.5

gdb backtrack:

Program received signal SIGFPE, Arithmetic exception.
0xb7db6a6a in __udivdi3 () from /lib/libgcc_s.so.1
(gdb) bt
#0  0xb7db6a6a in __udivdi3 () from /lib/libgcc_s.so.1
#1  0x082598d1 in float32e8_t::operator/ (this=0xbfffd070, x=...)
    at utils/float32e8_t.cc:528
#2  0x081d0480 in convoy_t::calc_min_braking_distance (this=0xbfffd120,
    weight=..., v=...) at convoy.cc:276
#3  0x080ed479 in gui_convoy_assembler_t::zeichnen (this=0x99f9d0c,
    parent_pos=...) at gui/components/gui_convoy_assembler.cc:578
#4  0x08133ef8 in gui_container_t::zeichnen (this=0x99f96a4, offset=...)
    at gui/gui_container.cc:223
#5  0x081356cd in gui_frame_t::zeichnen (this=0x99f96a0, pos=..., gr=...)
    at gui/gui_frame.cc:178
#6  0x08115ad3 in depot_frame_t::zeichnen (this=0x99f96a0, pos=...,
    groesse=...) at gui/depot_frame.cc:688
#7  0x0823719c in display_win (win=1) at simwin.cc:812
#8  0x08237389 in display_all_win () at simwin.cc:845
#9  0x082375f8 in win_display_flush (konto=198443.17000000001)
    at simwin.cc:1401
#10 0x0820589e in intr_refresh_display (dirty=false) at simintr.cc:75
#11 0x082419b0 in karte_t::sync_step (this=0x889bb80, delta_t=43, sync=true,
    display=true) at simworld.cc:3126
#12 0x08205814 in interrupt_check (caller_info=0x82a6216 "simworld.cc:6436")
    at simintr.cc:102
#13 0x082456c2 in karte_t::interactive (this=0x889bb80, quit_month=2147483647)
    at simworld.cc:6436
#14 0x0820c972 in simu_main (argc=1, argv=0xbffff534) at simmain.cc:1155
#15 0x082196a8 in sysmain (argc=1, argv=0xbffff534) at simsys.cc:109
#16 0x0827e9d7 in main (argc=1, argv=0xbffff534) at simsys_s.cc:615
(gdb)

[sdog]

had another crash in a depot. I was sending trains that got stuck out again. Deleted a train that had an impossible consist. It seems like trains don't get properly reordered when sent to depot to unstuck ways. When switching to the next train with the arrow symbols at the top, the program crashed.


ps.: the time before vehicles get sent to convoys is quite a bit too short for me to unstuck something in a private game, where i could pause the game. Quite a bit challenging in an online game.

[jamespetts]

SDog,

thank you for the reports - I shall have to look into these when I get the time. May I ask - how long do you suggest before the vehicles are sent to the depot when they are stuck?

[sdog]

Better ask the people on the server what they think a good balance would be before sending back vehicles.

[sdog]

clicking throug vehicles sent to a depot after being stuck, i got a crash

Code Select Expand


Program received signal SIGSEGV, Segmentation fault.
0x00000000004ac889 in gui_convoy_assembler_t::update_data() ()
(gdb) bt
#0  0x00000000004ac889 in gui_convoy_assembler_t::update_data() ()
#1  0x00000000004d7a9d in depot_frame_t::update_data() ()
#2  0x00000000004aeeb7 in gui_convoy_assembler_t::build_vehicle_lists() ()
#3  0x00000000004d88d0 in depot_frame_t::action_triggered(gui_action_creator_t*, value_t) ()
#4  0x00000000004a48a8 in button_t::infowin_event(event_t const*) ()
#5  0x00000000004f101d in gui_container_t::infowin_event(event_t const*) ()
#6  0x00000000004f2509 in gui_frame_t::infowin_event(event_t const*) ()
#7  0x00000000004d7c53 in depot_frame_t::infowin_event(event_t const*) ()
#8  0x000000000060c705 in check_pos_win(event_t*) ()
#9  0x000000000062c755 in karte_t::interactive(unsigned int) ()
#10 0x00000000005d9a83 in simu_main(int, char**) ()
#11 0x000000000040933c in main ()


another observation, vehicles retain their cargo when they get teleported to a depot, unlike normal vehicles that loose their load before entering a depot. (i noticed my buses couldn't find a route out of depot. empty this would not have hapened)

[dustNbone]

Grrr evil depot teleporting. I think it should take at least a minute, but I guess that could be too long to be stopped on another players network.