Issue information

Issue ID
#7511
Status
Needs more Info
Severity
None
Started
jTynne
Jul 12, 2013 14:38
Last Post
jTynne
Jul 14, 2013 7:08
Confirmation
N/A

jTynne - Jul 12, 2013 14:38

#0 0x0000000000438128 in ?? ()
No symbol table info available.
#1 0x000000000000005f in ?? ()
No symbol table info available.
#2 <signal handler called>
No symbol table info available.
#3 0x00000000005ad8e7 in guild_send_xy_timer_sub (key=<value optimized out>, data=<value optimized out>, ap=<value optimized out>) at guild.c:348
sd = 0x602720
g = 0x7fffee591564
i = <value optimized out>
#4 0x00000000005d8bca in db_obj_vforeach (self=0x1d883b8, func=0x5ad880 <guild_send_xy_timer_sub>, args=0x7fffffffdf30) at db.c:1937
argscopy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffffffe010, reg_save_area = 0x7fffffffdf50}}
db = 0x1d883b8
sum = 0
node = 0x2fbfe48
parent = <value optimized out>
#5 0x00000000005d7981 in db_obj_foreach (self=<value optimized out>, func=<value optimized out>) at db.c:1983
args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffffffe010, reg_save_area = 0x7fffffffdf50}}
#6 0x00000000005ad97c in guild_send_xy_timer (tid=<value optimized out>, tick=<value optimized out>, id=<value optimized out>, data=<value optimized out>) at guild.c:361
No locals.
#7 0x00000000005d62af in do_timer (tick=143112081) at timer.c:353
tid = 22
diff = -9
__FUNCTION__ = "do_timer"
#8 0x00000000005d1d3f in main (argc=1, argv=<value optimized out>) at core.c:349
next = <value optimized out>

Ind - Jul 13, 2013 18:06

This is troublesome o-o not the crash itself but the report, without #2/#1/#0 I'll end up having to guess hu
#2 is probably clif->guild_xy(sd);
#1 is probably clif->send(buf,packet_len(0x1eb),&sd->bl,GUILD_SAMEMAP_WOS);
buut determining #0 will require me to ask whether you have 'enable_spy' enabled

jTynne - Jul 13, 2013 18:09

Nope, not enabled currently. :(

Haru - Jul 14, 2013 0:30

Hmm, but if gdb mentions "<signal handler called>" in reference to frame #2, I'd dare to say either a signal handler was called, or what we see here is a smashed stack and gdb gets confused.

Also, I confirmed yesterday with jTynne via IRC that line 348 of guild.c is[code=auto:0]if( sd != NULL && sd->fd && (sd->guild_x != sd->bl.x || sd->guild_y != sd->bl.y) && !sd->bg_id )[/code]Which shouldn't be able to cause a crash - unless sd is not NULL, but it is invalid for another reason.

In case the stack is valid, the memory address for frame #1 is a really low address, and isn't supposedly inside the Hercules code, and #0 also has a lower address than the other functions (neither of them have debugging symbols, and gdb has no idea what's there, not even what library owns that memory region - and nor I do have enough knowledge of the OS to be able to)

This is the closest I was able to produce, with a minimal sample program:[code=auto:0]*[=|z] haru@skuld ~ $ cat test.c #include <signal.h> void crash(void) { *(char *)0 = 1; } static void handler(int sig) { crash(); } int main(void) { signal(SIGABRT, handler); // Set the handler kill(0, SIGABRT); // And call it return 0; } *[=|z] haru@skuld ~ $ gcc -ggdb -o test test.c && gdb ./test GNU gdb (Gentoo 7.5.1 p2) 7.5.1 Copyright (C) 2012 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". For bug reporting instructions, please see: <http://bugs.gentoo.org/>... Reading symbols from /home/haru/test...done. (gdb) r Starting program: /home/haru/test warning: Could not load shared library symbols for linux-vdso.so.1. Do you need "set solib-search-path" or "set sysroot"? Program received signal SIGABRT, Aborted. 0x00007ffff7a65df7 in kill () from /lib64/libc.so.6 (gdb) bt #0 0x00007ffff7a65df7 in kill () from /lib64/libc.so.6 #1 0x00000000004005c6 in main () at test.c:13 (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x000000000040058d in crash () at test.c:4 4 *(char *)0 = 1; (gdb) bt #0 0x000000000040058d in crash () at test.c:4 #1 0x00000000004005a2 in handler (sig=6) at test.c:8 #2 <signal handler called> #3 0x00007ffff7a65df7 in kill () from /lib64/libc.so.6 #4 0x00000000004005c6 in main () at test.c:13 (gdb) c Continuing. Program terminated with signal SIGSEGV, Segmentation fault. The program no longer exists. (gdb)[/code]The problem is that in this case both #0 and #1 are within the program's memory.

This post has been edited by Haru on Jul 14, 2013 0:31

jTynne - Jul 14, 2013 7:08

It's possible it's caused by Harmony, then, perhaps? /hmm