Crashes when deleting dead-end road

[zook2]

I was online yesterday when TS crashed, and I *think* I was deleting or just had deleted a number of dead-end roads, where farms etc. had closed. No stops, though. I remember that has been a stability issue a while ago. I can try and do it again later today and see if anything bad happens.

[zook2]

I just deleted any dead-end road on the TS server I could find. Nothing happened. Then I spent some time (15 min?) in the kitchen and when I came back the game had frozen. I disconnected and the server wasn't reachable.

[PJMack]

I have had crashes for deleting dead-end roads in single player as well, and was able to capture one.  I put a stack trace and some local variables below.  The issue is that private car routing thread is reading the properties of the road as it is being deleted.  Changing line 6013 of simcity.cc to "if(way && way->connected_buildings.get_count() > 0)" would suppress the issue, however it would still allow a small window where way->connected_buildings.get_count() could still access deleted/invalid/overwritten data.

Code Select Expand

1 minivec_tpl<gebaeude_t *>::get_count        minivec_tpl.h    174  0x55555571a568
2 private_car_destination_finder_t::is_target simcity.cc       6013 0x555555a51b7b
3 route_t::find_route                         route.cc         286  0x555555716442
4 stadt_t::check_all_private_car_routes       simcity.cc       2734 0x555555a43529
5 check_road_connexions_threaded              simworld.cc      1608 0x555555b35536
6 start_thread                                pthread_create.c 477  0x7ffff7ed6609
7 clone                                       clone.S          95   0x7ffff78f1133

private_car_destination_finder_t::is_target local variables:

Code Select Expand


city 0x0 stadt_t*
gr @0x5555a3a58608 boden_t
k @0x7fff89e65f10 koord
east @0x555555dd5320 koord
from_hang @0x555555dd53e0 koord[81]
from_ribi @0x555555dd53a0 koord[16]
invalid @0x555555dd5318 koord
neighbours @0x555555dd5340 koord[8]
nesw @0x555555dd5330 koord[4]
north @0x555555dd531c koord
second_neighbours @0x555555dd5360 koord[16]
south @0x555555dd5324 koord
west @0x555555dd5328 koord
x 5207 sint16
y 1242 sint16
this @0x7fff89e66180 private_car_destination_finder_t
[test_driver_t] @0x7fff89e66180 test_driver_t
master @0x7fff89e661b0 road_vehicle_t
meters_per_tile_x100 12500 uint16
origin_city @0x55557c9fb860 stadt_t
welt @0x55557973c070 karte_t
way 0x0 weg_t*

I have also captured a one-off crash where in the private car routing thread, gebaeude_t::get_adjusted_visitor_demand() is called but one of the pointers was null (I do not recall the details as I was debugging something else, I think it may have been the tile descriptor). 

It appears that all functions called from the private browsing thread will need to be audited for thread safety.

[jamespetts]

I have split this topic, as crashes should not be reported in the general loss of synchronisation thread.

I am not sure how this is occurring.

Code Select Expand

welt->await_private_car_threads();
is called in the destructor for weg_t objects. This means that the private car route finding thread will pause until next triggered whenever any way object is being deleted. I have added the way && check at the beginning of line 6013 as suggested, however.