MantisBT - Zandronum
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0002031Zandronum[All Projects] Bugpublic2014-12-20 17:522018-10-01 00:06
ReporterWatermelon 
Assigned ToTorr Samaho 
PrioritynormalSeveritymajorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version1.3 
Target Version1.4Fixed in Version1.4 
Summary0002031: Demo crashes due to NULL pByteStream
DescriptionA player joins the game and it causes the demo to crash. Interestingly, no one crashed in game.

This is the stack trace:

    zandronum.exe!client_SpawnPlayer(BYTESTREAM_s * pByteStream=0x00000000, bool bMorph=true) Line 4146 C++
     zandronum.exe!CLIENT_ProcessCommand(long lCommand=0, BYTESTREAM_s * pByteStream=0x00000000) Line 1534 C++
     zandronum.exe!CLIENTDEMO_ReadPacket() Line 544 + 0xc bytes C++
     zandronum.exe!G_Ticker() Line 1476 C++
     zandronum.exe!TryRunTics() Line 1954 C++
     zandronum.exe!D_DoomLoop() Line 1170 C++
Steps To Reproduce- Start the demo

zandronum -playdemo 2014.12.19_22.07.43_idl2014a.idl2014alobby_1a.hudtimer_v3bpk3.zandrospree2rc2pk3.odaflagxpk3.ctfcap2c1pk3.cld -file idl2014a.wad idl2014alobby_1a.wad hudtimer_v3b.pk3 zandrospree2rc2.pk3 odaflagx.pk3 ctfcap2c1.pk3

- Do skipmap 1-2 times to get to Map29
- Skip around 3 minutes and 50 seconds
- Wait until crash

For immediate crash:
4 x demo_skiptonextmap
Additional Information'https://www.sendspace.com/file/il49fe [^]'
TagsNo tags attached.
Relationships
Attached Filestxt valgrind_2031.txt (13,526) 2014-12-29 02:28
/tracker/file_download.php?file_id=1353&type=bug
Issue History
Date ModifiedUsernameFieldChange
2014-12-20 17:52WatermelonNew Issue
2014-12-20 18:00WatermelonNote Added: 0011077
2014-12-20 18:12WatermelonSteps to Reproduce Updatedbug_revision_view_page.php?rev_id=6150#r6150
2014-12-20 18:12WatermelonAdditional Information Updatedbug_revision_view_page.php?rev_id=6152#r6152
2014-12-20 18:49WatermelonNote Added: 0011078
2014-12-21 16:57WatermelonStatusnew => confirmed
2014-12-22 01:54ZzZomboNote Added: 0011082
2014-12-28 16:27Torr SamahoSteps to Reproduce Updatedbug_revision_view_page.php?rev_id=6168#r6168
2014-12-28 16:28Torr SamahoSteps to Reproduce Updatedbug_revision_view_page.php?rev_id=6169#r6169
2014-12-28 16:30Torr SamahoAssigned To => Torr Samaho
2014-12-28 16:30Torr SamahoStatusconfirmed => assigned
2014-12-28 18:02Torr SamahoNote Added: 0011106
2014-12-29 02:28Edward-sanFile Added: valgrind_2031.txt
2014-12-29 02:29Edward-sanNote Added: 0011117
2014-12-29 08:32Torr SamahoNote Added: 0011118
2014-12-29 09:23Edward-sanNote Added: 0011120
2014-12-29 12:46Torr SamahoNote Added: 0011121
2014-12-29 18:20Edward-sanNote Added: 0011133
2014-12-29 18:21Edward-sanNote Edited: 0011133bug_revision_view_page.php?bugnote_id=11133#r6200
2014-12-29 18:21Edward-sanNote Edited: 0011133bug_revision_view_page.php?bugnote_id=11133#r6201
2014-12-29 19:41Torr SamahoNote Added: 0011134
2014-12-31 12:19Torr SamahoNote Added: 0011152
2014-12-31 12:19Torr SamahoStatusassigned => resolved
2014-12-31 12:19Torr SamahoFixed in Version => 1.4
2014-12-31 12:19Torr SamahoResolutionopen => fixed
2018-10-01 00:06Blzut3Statusresolved => closed

Notes
(0011077)
Watermelon   
2014-12-20 18:00   
This appears to happen as someone connects. I don't know why it's calling spawnPlayer though. Unless coincidentally someone spawned as someone connects and that causes a problem?
(0011078)
Watermelon   
2014-12-20 18:49   
This does not happen on the demo that I have of the same game at the same time.
(0011082)
ZzZombo   
2014-12-22 01:54   
Quote from Watermelon
I don't know why it's calling spawnPlayer though.

How so? A player is connected and put into the world, so of course, a player spawning function is called.
(0011106)
Torr Samaho   
2014-12-28 18:02   
This is really tricky. I can reproduce the crash locally with VC++ in debug mode (and this reveals that pByteStream=0x00000000 is not true, the steam is valid), I can't really see why it crashes yet though. One problem is that the server seems to instruct the client to spawn a morphed spectator. If I fix that, the client crashes when trying to return a flag.
(0011117)
Edward-san   
2014-12-29 02:29   
Per Torr's request, made it run Valgrind on that demo, by using compiled 1.3 (1.4 alpha did not work...). Result (filtered from other messages which are unrelated) is attached.
(0011118)
Torr Samaho   
2014-12-29 08:32   
When you say 1.3 are you referring to changeset 3e26f5eca13742bcaf1f451dd8d3d01fd05771aa?
(0011120)
Edward-san   
2014-12-29 09:23   
Yes.
(0011121)
Torr Samaho   
2014-12-29 12:46   
Thanks! With the Valgrind output I could figure out why the client crashed. The crashes should be fixed now (fixed in 69afd5006b32bfcf5b8bfcea342e8c2f63e74b7e). Unfortunately, the demo is still broken: It can't be parsed properly, but it's not apparent why.

Based on what is happening in the demo before the crash, probably somebody can figure out under which circumstances such a parsing problem can be reproduced.
(0011133)
Edward-san   
2014-12-29 18:20   
(edited on: 2014-12-29 18:21)
I just want to inform you that applying the fix to 1.3 code and running the demo again with Valgrind, I got no errors, just the 'unknown map' message.
(0011134)
Torr Samaho   
2014-12-29 19:41   
Thanks for checking. This is further evidence that the demo stream itself is broken or parsed improperly.
(0011152)
Torr Samaho   
2014-12-31 12:19   
Marking this as resolved, since the crashes are fixed. If somebody encounters new problems with demos recorded by 1.4 or 2.0, please open a new ticket.