MantisBT - Zandronum
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0001967Zandronum[All Projects] Bugpublic2014-10-20 03:322020-04-11 00:38
ReporterEnsaladaDeTomate 
Assigned ToTorr Samaho 
PriorityhighSeveritycrashReproducibilityalways
StatusresolvedResolutionfixed 
PlatformMicrosoftOSWindowsOS VersionXP/Vista/7
Product Version1.3 
Target VersionFixed in Version 
Summary0001967: Zandronum crashes for no known reason
DescriptionTitle says it all.
Steps To Reproduce
zandronum -file samsara-v0.3.pk3 samsara_extraheroesv1.1_crashreport.pk3 -host +sv_cheats 1


Select "Caleb" as the class you will play, then warp to a map where you can find a BFG9000, pick it up, (you will need to get some "Ammo 4" type first to make this work, because that weapon doesnt give any ammo when picked), after that, select the BFG tier (slot 7 > "Life Leech" for Caleb class), press "Alt Fire", and wait. (This can be done faster with cheats too, by writing summon bfg9000, and summon ammo4big).

1. zandronum -iwad doom2.wad -file inventory_02.wad -host
2. zandronum -iwad doom2.wad -file inventory_02.wad -connect localhost
3. Join the game.
4. Fire the pistol.
Additional InformationSamsara-0.3.pk3 Link >http://www.best-ever.org/download?file=samsara-v0.3.pk3 [^]

Samsara_ExtraHeroesv1.1_crashreport.pk3 Link >http://www.best-ever.org/download?file=samsara_extraheroesv1.1_crashreport.pk3 [^]
TagsNo tags attached.
Relationships
Attached Files? inventory_02.wad (676) 2015-06-10 08:36
https://zandronum.com/tracker/file_download.php?file_id=1544&type=bug
Issue History
Date ModifiedUsernameFieldChange
2014-10-20 03:32EnsaladaDeTomateNew Issue
2014-10-20 03:58WatermelonNote Added: 0010639
2014-10-20 12:12WatermelonNote Added: 0010640
2014-10-20 12:17WatermelonNote Edited: 0010640bug_revision_view_page.php?rev_id=5816
2014-10-20 12:23WatermelonNote Edited: 0010640bug_revision_view_page.php?rev_id=5817
2014-10-20 12:24WatermelonNote Edited: 0010640bug_revision_view_page.php?rev_id=5818
2014-10-20 12:25WatermelonNote Edited: 0010640bug_revision_view_page.php?rev_id=5819
2014-10-20 12:26WatermelonNote Edited: 0010639bug_revision_view_page.php?bugnote_id=10639#r5821
2014-10-20 12:26WatermelonNote Deleted: 0010640
2014-10-20 12:32WatermelonNote Edited: 0010639bug_revision_view_page.php?bugnote_id=10639#r5822
2014-10-20 12:46WatermelonNote Edited: 0010639bug_revision_view_page.php?bugnote_id=10639#r5823
2014-10-20 12:46WatermelonStatusnew => confirmed
2014-10-20 12:49WatermelonNote Edited: 0010639bug_revision_view_page.php?bugnote_id=10639#r5824
2014-10-20 12:49WatermelonNote Edited: 0010639bug_revision_view_page.php?bugnote_id=10639#r5825
2014-10-20 13:06WatermelonNote Added: 0010641
2014-10-20 17:40Torr SamahoNote Added: 0010643
2014-10-20 19:41Torr SamahoNote Edited: 0010643bug_revision_view_page.php?bugnote_id=10643#r5827
2014-11-23 13:34Torr SamahoSteps to Reproduce Updatedbug_revision_view_page.php?rev_id=6009#r6009
2014-11-23 14:04Torr SamahoNote Added: 0010941
2014-11-23 14:31Torr SamahoAssigned To => Torr Samaho
2014-11-23 14:31Torr SamahoStatusconfirmed => needs testing
2014-11-25 03:37EnsaladaDeTomateNote Added: 0010968
2014-11-25 03:48EnsaladaDeTomateNote Edited: 0010968bug_revision_view_page.php?bugnote_id=10968#r6025
2014-11-25 11:25WatermelonNote Added: 0010970
2014-11-25 17:44Torr SamahoNote Added: 0010973
2014-11-26 01:34EnsaladaDeTomateNote Added: 0010977
2014-12-17 03:32haxmurdererNote Added: 0011071
2014-12-17 11:10Edward-sanNote Added: 0011072
2015-06-10 08:36unknownnaFile Added: inventory_02.wad
2015-06-10 08:36unknownnaSteps to Reproduce Updatedbug_revision_view_page.php?rev_id=7348#r7348
2015-06-10 08:38unknownnaNote Added: 0012627
2015-06-10 08:39unknownnaNote Edited: 0012627bug_revision_view_page.php?bugnote_id=12627#r7350
2015-06-10 08:50unknownnaNote Edited: 0012627bug_revision_view_page.php?bugnote_id=12627#r7351
2015-06-10 09:17Edward-sanNote Added: 0012628
2015-06-10 09:37unknownnaNote Added: 0012630
2015-06-10 09:46unknownnaNote Edited: 0012630bug_revision_view_page.php?bugnote_id=12630#r7353
2015-06-10 16:45EnsaladaDeTomateNote Added: 0012639
2015-06-10 16:48EnsaladaDeTomateNote Edited: 0012639bug_revision_view_page.php?bugnote_id=12639#r7364
2020-04-11 00:38Ru5tK1ngNote Added: 0021259
2020-04-11 00:38Ru5tK1ngStatusneeds testing => resolved
2020-04-11 00:38Ru5tK1ngResolutionopen => fixed

Notes
(0010639)
Watermelon   
2014-10-20 03:58   
(edited on: 2014-10-20 12:49)
I don't know why this is saying my source is different from 1.3 when I pull from the repo at the 1.3 tag... oh well:

The minidump leads me to:

Thingdef expression
ExpVal FxMultiNameState::EvalExpression (AActor *self)
{
    ExpVal ret;
    ret.Type = VAL_State;
    ret.pointer = self->GetClass()->ActorInfo->FindState(names.Size(), &names[0]); <-- Null pointer




Stack trace:


> zandronum.exe!FxMultiNameState::EvalExpression(AActor * self=0x00000000) Line 2681 + 0x4 bytes C++
     zandronum.exe!EvalExpressionState(unsigned int xi=93345208, AActor * self=0x00000000) Line 156 + 0xd bytes C++
     zandronum.exe!DoJumpIfInventory(AActor * owner=0x00000000, AActor * self=0x00000000, AActor * stateowner=0x00000000, FState * CallingState=0x059145e8, int ParameterIndex=58143, StateCallData * statecall=0x00000000) Line 660 + 0x10 bytes C++
     zandronum.exe!AFP_A_JumpIfInventory(AActor * self=0x00000000, AActor * stateowner=0x00000000, FState * CallingState=0x059145e8, int ParameterIndex=58143, StateCallData * statecall=0x00000000) Line 706 C++
     zandronum.exe!P_SetPsprite(player_t * player=0x00000000, int position=0, FState * state=0x05916a70) Line 123 C++
     zandronum.exe!P_MovePsprites(player_t * player=0x00000000) Line 958 + 0xd bytes C++
     zandronum.exe!P_PlayerThink(player_t * player=0x00000000, ticcmd_t * pCmd=0x00000000) Line 3526 C++
     zandronum.exe!server_ProcessMoveCommand(CLIENT_MOVE_COMMAND_s & ClientMoveCmd={...}, const unsigned long ulClient=0) Line 4919 C++
     zandronum.exe!SERVER_Tick() Line 578 C++
     zandronum.exe!D_DoomLoop() Line 1136 C++



================================================



This is from a Linux GDB trace, confirms the above


#0 DObject::GetClass() at doom/zandronum/stable/zandronum_stable/src/dobject.h:460
#1 FxMultiNameState::EvalExpression() at doom/zandronum/stable/zandronum_stable/src/thingdef/thingdef_expression.cpp:2681
0000002 EvalExpressionState() at doom/zandronum/stable/zandronum_stable/src/thingdef/thingdef_expression.cpp:156
0000003 DoJumpIfInventory() at doom/zandronum/stable/zandronum_stable/src/thingdef/thingdef_codeptr.cpp:660
0000004 AFP_A_JumpIfInventory() at doom/zandronum/stable/zandronum_stable/src/thingdef/thingdef_codeptr.cpp:705
0000005 FState::CallAction() at doom/zandronum/stable/zandronum_stable/src/info.h:111
0000006 P_SetPsprite() at doom/zandronum/stable/zandronum_stable/src/p_pspr.cpp:121
0000007 P_MovePsprites() at doom/zandronum/stable/zandronum_stable/src/p_pspr.cpp:958
0000008 P_PlayerThink() at doom/zandronum/stable/zandronum_stable/src/p_user.cpp:3523
0000009 server_ProcessMoveCommand() at doom/zandronum/stable/zandronum_stable/src/sv_main.cpp:4937
0000010 SERVER_Tick() at doom/zandronum/stable/zandronum_stable/src/sv_main.cpp:588
0000011 D_DoomLoop() at doom/zandronum/stable/zandronum_stable/src/d_main.cpp:1135
0000012 D_DoomMain() at doom/zandronum/stable/zandronum_stable/src/d_main.cpp:2645
0000013 main() at doom/zandronum/stable/zandronum_stable/src/sdl/i_main.cpp:288


AActor *self is null @ FxMultiNameState::EvalExpression() at doom/zandronum/stable/zandronum_stable/src/thingdef/thingdef_expression.cpp:2681


Further inspection shows that stateowner is null when calling this:
FState::CallAction() at doom/zandronum/stable/zandronum_stable/src/info.h:111
ActionFunc(self, stateowner, this, ParameterIndex-1, statecall);



It appears in p_pspr.cpp at line 121: player->ReadyWeapon is null

Crash in 1.3
Crash in 1.2.2
Crash in 1.2.1
No crash in 1.2
(0010641)
Watermelon   
2014-10-20 13:06   
I isolated the bug to being introduced in revision 3719: Addition of the client movement buffer.
(0010643)
Torr Samaho   
2014-10-20 17:40   
(edited on: 2014-10-20 19:41)
Since neither 1.2.1, not 1.2.2 had the new buffer, the following two statements contradict each other:
Quote from Watermelon

Crash in 1.3
Crash in 1.2.2
Crash in 1.2.1
No crash in 1.2

Quote from Watermelon

I isolated the bug to being introduced in revision 3719: Addition of the client movement buffer.

Which one is correct?

EDIT: I had a quick look and I'd say the second statement is correct. I'll look at this in more detail.
(0010941)
Torr Samaho   
2014-11-23 14:04   
This should at least fix the crash. To find out what is really happening I need a minimal example wad.
(0010968)
EnsaladaDeTomate   
2014-11-25 03:37   
(edited on: 2014-11-25 03:48)
Arent the provided links working?

If not, i can upload them again.

PD: Also, i already could test'd it, but i havent got enough time atm, university is beign heavily insane.
(0010970)
Watermelon   
2014-11-25 11:25   
That link is working for me
(0010973)
Torr Samaho   
2014-11-25 17:44   
The links are working just fine and I used the example files to develop the tentative fix. But your files are nowhere near a minimal example. To really understand what the mod is doing there and why it's problematic requires an example that is stripped down to the absolute minimum. It's completely infeasible to wade through a mod of Samsara's size to debug this.
(0010977)
EnsaladaDeTomate   
2014-11-26 01:34   
Ohhhhhh kk, i got it now, sorry, sometimes my lack of english just derps over me, i didnt got that u were trying to said that.

Also, i dunno how can i help on that, since i dont have that much experience on WADs.
(0011071)
haxmurderer   
2014-12-17 03:32   
Torr, can you give us a commit number or something to test with? How can I find out which commit you fixed this in?
(0011072)
Edward-san   
2014-12-17 11:10   
There is no fixing commit to test with yet, because no one provided the minimum example wad, as Torr asked many times.
(0012627)
unknownna   
2015-06-10 08:38   
(edited on: 2015-06-10 08:50)
It crashes when it decides whether to jump or not (A_JumpIfInventory) immediately after the weapon has removed itself (A_TakeInventory) from the player's inventory. If the client has no other weapons in the inventory after the weapon has removed itself, the client also crashes.

If I add a single 1 tic frame before A_JumpIfInventory is called or add 1 tic to the frame that calls A_TakeInventory, it stops crashing.

Actor Pistol_02 : Pistol
{
    Weapon.AmmoUse 0
    Weapon.SlotNumber 2
    States
    {
    Ready:
        TNT1 A 0 A_JumpIfInventory ("DummyInventory", 1, "DummyState")
        PISG A 1 A_WeaponReady
        Loop
    Fire:
        PISG A 70
        Goto CrashZandronum
    CrashZandronum:
        TNT1 A 0 A_TakeInventory ("Pistol_02", 1)
        Goto Ready
    DummyState:
        TNT1 A 0
        Goto Ready
    }
}
(0012628)
Edward-san   
2015-06-10 09:17   
Can you crash withhttps://www.dropbox.com/s/76gxuvlsq9yhb9k/zandronum-2.1-150604-1440-9b91f0c-windows.zip?dl=0 [^] ?
(0012630)
unknownna   
2015-06-10 09:37   
(edited on: 2015-06-10 09:46)
No, it's actually fixed in 2.0. I made the example WAD to help Torr with pinpointing out the exact cause, hoping that it would shed some light on what's going on.
(0012639)
EnsaladaDeTomate   
2015-06-10 16:45   
(edited on: 2015-06-10 16:48)
I also noticed in the weapon code that if i keep the A_takeinventory part with 0 tic or if i add 1 tic, the turrets will still not beign spawned, but if i add 2 tics, the turrets will spawn normally. This wasnt happening in zandy 1.2

Edit:(the crash and turrets not beign spawned started since zandy 1.2.1+, as watermelon stated)
(0021259)
Ru5tK1ng   
2020-04-11 00:38   
Marking as resolved based onhttps://zandronum.com/tracker/view.php?id=1967#c12630 [^]