objects->calloc crash

Posted by Zeno on Sat 14 Aug 2004 10:51 PM — 14 posts, 33,168 views.

Zeno USA Sat 14 Aug 2004 10:51 PM #0

This slightly deals with some old issues I had with calloc


#0  0x42074d91 in calloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x42074d91 in calloc () from /lib/i686/libc.so.6
#1  0x42075bcc in free () from /lib/i686/libc.so.6
#2  0x080d2ad2 in str_free (str=0x4213920c " \221\023B") at hashstr.c:128
#3  0x080d135f in clean_obj_queue () at handler.c:3568
#4  0x081301aa in update_handler () at update.c:2153
#5  0x080a9fee in game_loop () at comm.c:690
#6  0x080a98e5 in main (argc=8, argv=0xbfffe6e0) at comm.c:304
#7  0x42015967 in __libc_start_main () from /lib/i686/libc.so.6


(gdb) print *obj
$4 = {
  next = 0x839c458,
  prev = 0x83cd1a8,
  next_content = 0x0,
  prev_content = 0x83cd1a8,
  first_content = 0x0,
  last_content = 0x0,
  in_obj = 0x0,
  carried_by = 0x0,
  first_extradesc = 0x0,
  last_extradesc = 0x0,
  first_affect = 0x0,
  last_affect = 0x0,
  pIndexData = 0x8332540,
  in_room = 0x0,
  name = 0x0,
  short_descr = 0x83a37f8 "the long tongue of a large demon",
  description = 0x83acc80 "Twisting as if to taste you, the writhing tongue of a large demon lies here.",
  action_desc = 0x832fe58 "%s savagely devour$q $p!",
  item_type = 61,
  mpscriptpos = 0,
  extra_flags = {
    bits = {0, 0, 0, 0}
  },
  magic_flags = 0,
  wear_flags = 1,
  mpact = 0x0,
  mpactnum = 0,
  wear_loc = -1,
  weight = 2,
  cost = 0,
  level = 0,
  timer = 0,
  value = {14, 0, 0, 0, 0, 0},
  count = 1,
  serial = 9002,
  room_vnum = 1007,
  ashards = 0
}

I don't know why it crashed. Corrupt data maybe. But the last clean compile I did was less than 12 hours before the crash.

Zeno USA Mon 16 Aug 2004 12:06 AM #1

Twice in one day:

#0  0x420751d1 in calloc () from /lib/i686/libc.so.6
#1  0x42074827 in calloc () from /lib/i686/libc.so.6
#2  0x42074544 in calloc () from /lib/i686/libc.so.6
#3  0x080b50e0 in create_mobile (pMobIndex=0x8359e88) at db.c:2552
#4  0x080eccbf in do_mpmload (ch=0x83e9e28, argument=0xbfff9588 "1004") at mud_comm.c:768
#5  0x080d4dd4 in interpret (ch=0x83e9e28, argument=0xbfff9588 "1004") at interp.c:558
#6  0x080f4103 in mprog_do_command (cmnd=0xbfff9180 "\200\222ÿ¿\236\222ÿ¿\177²ÿ¿\200\222ÿ¿\177²ÿ¿", mob=0x83e9e28,
    actor=0x83863f8, obj=0x0, vo=0x0, rndm=0x83863f8, ignore=0 '\0', ignore_ors=0 '\0') at mud_prog.c:2246
#7  0x080f3cb5 in mprog_driver (
    com_list=0x835a010 "mpecho &gAs the demon dies, it gives out a cry, calling another.\n\rmpmload 1004\n\r",
    mob=0x83e9e28, actor=0x83863f8, obj=0x0, vo=0x0, single_step=0 '\0') at mud_prog.c:1944
#8  0x080f492e in mprog_percent_check (mob=0x83e9e28, actor=0x83863f8, obj=0x0, vo=0x0, type=4) at mud_prog.c:2458
#9  0x080f4d2a in mprog_death_trigger (killer=0x83e7518, mob=0x83e9e28) at mud_prog.c:2631
#10 0x080c870e in raw_kill (ch=0x83863f8, victim=0x83e9e28) at fight.c:3396
#11 0x080c71bf in damage (ch=0x83863f8, victim=0x83e9e28, dam=9, dt=1000) at fight.c:2469
#12 0x080c4d58 in one_hit (ch=0x83863f8, victim=0x83e9e28, dt=1000) at fight.c:1364
#13 0x080c3ec7 in multi_hit (ch=0x83863f8, victim=0x83e9e28, dt=1000) at fight.c:865
#14 0x080c9ae6 in do_kill (ch=0x83863f8, argument=0xbffff5d5 "dem") at fight.c:4002
#15 0x080d4dd4 in interpret (ch=0x83863f8, argument=0xbffff5d5 "dem") at interp.c:558
#16 0x080a9fb7 in game_loop () at comm.c:671
#17 0x080a98e5 in main (argc=2, argv=0xbffff9f0) at comm.c:304
#18 0x42015967 in __libc_start_main () from /lib/i686/libc.so.6

#0  0x42074d8e in calloc () from /lib/i686/libc.so.6
#1  0x42075bcc in free () from /lib/i686/libc.so.6
#2  0x080d14c8 in clean_obj_queue () at handler.c:3571
#3  0x081301be in update_handler () at update.c:2153
#4  0x080a9fee in game_loop () at comm.c:690
#5  0x080a98e5 in main (argc=8, argv=0xbfffed60) at comm.c:304
#6  0x42015967 in __libc_start_main () from /lib/i686/libc.so.6

Ugh, seems like corrupt memory, but is there anyway to fix this.

Samson USA Mon 16 Aug 2004 12:45 AM #2

Looks like time to bust out bigger guns than GDB. I'd suggest seeing if you can get Valgrind to take a crack at it.

Zeno USA Mon 16 Aug 2004 01:49 AM #3

Eh, I was thinking about that, but this has happened twice today, but 3 times total this week. Completely random it seems, or just rare.

Zeno USA Tue 17 Aug 2004 06:58 AM #4

Whatever, its happening more.

Running it in valgrind for the day and night.

Zeno USA Thu 20 Jan 2005 05:23 PM #5

It's happened again, so I've compiled a list of all the gdb backtraces when it's happened. Here are all the backtraces, and I still have the latest core. Had to split it up to multiple posts due to limit.

I will sometime convert the code to C++, but I don't know if that will solve this.

New server (Arthmoor):
1/20/05:

#0  0x008617a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x008a1955 in raise () from /lib/tls/libc.so.6
#2  0x008a3319 in abort () from /lib/tls/libc.so.6
#3  0x008d4f8a in __libc_message () from /lib/tls/libc.so.6
#4  0x008daed0 in malloc_consolidate () from /lib/tls/libc.so.6
#5  0x008dbdd3 in _int_malloc () from /lib/tls/libc.so.6
#6  0x008dd906 in calloc () from /lib/tls/libc.so.6
#7  0x080b8642 in write_to_pager (d=0x99eff4, txt=0x818a890 "\033[0;37m", length=1) at color.c:1134
#8  0x080b85b0 in set_pager_color (AType=17, ch=0x8d5fe78) at color.c:1112
#9  0x080bbf11 in nanny (d=0x8d6e080, argument=0x8d5fe78 "") at comm.c:2311
#10 0x080b9799 in game_loop () at comm.c:684
#11 0x080b904c in main (argc=2, argv=0xbfe1a1b0) at comm.c:316

11/30/04:

#0  0x004996c0 in malloc_consolidate () from /lib/tls/libc.so.6
(gdb) bt
#0  0x004996c0 in malloc_consolidate () from /lib/tls/libc.so.6
#1  0x00498e6a in _int_malloc () from /lib/tls/libc.so.6
#2  0x0049892e in calloc () from /lib/tls/libc.so.6
#3  0x080b167b in create_mobile (pMobIndex=0x9aa7730) at db.c:2559
#4  0x080e9e54 in do_mpmload (ch=0x9b383d8, argument=0xfeefb888 "1004") at mud_comm.c:768
#5  0x080cf97d in interpret (ch=0x9b383d8, argument=0xfeefb888 "1004") at interp.c:571
#6  0x080f2271 in mprog_do_command (cmnd=0xfeefc582 "mpmload 1004", mob=0x9b383d8, actor=0x9be6b08, obj=0x0, vo=0x0,
    rndm=0x9be6b08, ignore=0 '\0', ignore_ors=0 '\0') at mud_prog.c:2236
#7  0x080f1e11 in mprog_driver (
    com_list=0x9aa78b8 "mpecho &gAs the demon dies, it gives out a cry, calling another.\n\rmpmload 1004\n\r",
    mob=0x9b383d8, actor=0x9be6b08, obj=0x0, vo=0x0, single_step=0 '\0') at mud_prog.c:1934
#8  0x080f2abc in mprog_percent_check (mob=0x9b383d8, actor=0x9be6b08, obj=0x0, vo=0x0, type=4) at mud_prog.c:2448
#9  0x080f2eb5 in mprog_death_trigger (killer=0x9bf8870, mob=0x9b383d8) at mud_prog.c:2621
#10 0x080c2596 in raw_kill (ch=0x9be6b08, victim=0x9b383d8) at fight.c:3381
#11 0x080c10b8 in damage (ch=0x9be6b08, victim=0x9b383d8, dam=18, dt=1007) at fight.c:2473
#12 0x080bead8 in one_hit (ch=0x9be6b08, victim=0x9b383d8, dt=1007) at fight.c:1362
#13 0x080bd6d8 in multi_hit (ch=0x9be6b08, victim=0x9b383d8, dt=-1) at fight.c:806
#14 0x080c3ab1 in do_kill (ch=0x9be6b08, argument=0xfef018b5 "demon") at fight.c:4000
#15 0x080cf97d in interpret (ch=0x9be6b08, argument=0xfef018b5 "demon") at interp.c:571
#16 0x080a52ab in game_loop () at comm.c:679
#17 0x080a4b4e in main (argc=8, argv=0xfef01cf0) at comm.c:308

Old server (Fredrik):
11/03/04:

#0  0x420751d1 in calloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x420751d1 in calloc () from /lib/i686/libc.so.6
#1  0x42074827 in calloc () from /lib/i686/libc.so.6
#2  0x42074544 in calloc () from /lib/i686/libc.so.6
#3  0x080a8b3e in create_mobile (pMobIndex=0x82d7698) at db.c:2555
#4  0x080ddab3 in do_mpmload (ch=0x83dbaf0, argument=0xbfff8318 "1003")
    at mud_comm.c:768
#5  0x080c577e in interpret (ch=0x83dbaf0, argument=0xbfff8318 "1003")
    at interp.c:571
#6  0x080e4d1f in mprog_do_command (cmnd=0xbfff7f10 "", mob=0x83dbaf0,
    actor=0x836c240, obj=0x0, vo=0x0, rndm=0x836c240, ignore=0 '\0',
    ignore_ors=0 '\0') at mud_prog.c:2236
#7  0x080e48d1 in mprog_driver (
    com_list=0x82d7820 "mpecho &gThe small bear cub makes a low growl, as anothe
r lumbers in.\n\rmpmload 1003\n\r", mob=0x83dbaf0, actor=0x836c240, obj=0x0,
    vo=0x0, single_step=0 '\0') at mud_prog.c:1934
#8  0x080e554a in mprog_percent_check (mob=0x83dbaf0, actor=0x836c240,
    obj=0x0, vo=0x0, type=4) at mud_prog.c:2448
#9  0x080e5946 in mprog_death_trigger (killer=0x83d0cc0, mob=0x83dbaf0)
    at mud_prog.c:2621
#10 0x080b8d80 in raw_kill (ch=0x836c240, victim=0x83dbaf0) at fight.c:3381
#11 0x080b7903 in damage (ch=0x836c240, victim=0x83dbaf0, dam=17, dt=1000)
    at fight.c:2473
#12 0x080b543a in one_hit (ch=0x836c240, victim=0x83dbaf0, dt=1000)
---Type <return> to continue, or q <return> to quit---
    at fight.c:1362
#13 0x080b4288 in multi_hit (ch=0x836c240, victim=0x83dbaf0, dt=-1)
    at fight.c:806
#14 0x080ba286 in do_kill (ch=0x836c240, argument=0xbfffe355 "cub")
    at fight.c:3997
#15 0x080c577e in interpret (ch=0x836c240, argument=0xbfffe355 "cub")
    at interp.c:571
#16 0x0809d424 in game_loop () at comm.c:679
#17 0x0809cd29 in main (argc=2, argv=0xbfffe770) at comm.c:308
#18 0x42015967 in __libc_start_main () from /lib/i686/libc.so.6

Zeno USA Thu 20 Jan 2005 05:24 PM #6

More...

11/02/04:

#0  0x420751d1 in calloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x420751d1 in calloc () from /lib/i686/libc.so.6
#1  0x42074827 in calloc () from /lib/i686/libc.so.6
#2  0x42074544 in calloc () from /lib/i686/libc.so.6
#3  0x0809d70c in new_descriptor (new_desc=5) at comm.c:856
#4  0x0809d166 in accept_new (ctrl=5) at comm.c:564
#5  0x0809d1ce in game_loop () at comm.c:588
#6  0x0809cd29 in main (argc=8, argv=0xbfffe350) at comm.c:308
#7  0x42015967 in __libc_start_main () from /lib/i686/libc.so.6

10/20/04:

#0  0x42074d91 in calloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x42074d91 in calloc () from /lib/i686/libc.so.6
#1  0x42075bcc in free () from /lib/i686/libc.so.6
#2  0x080aa3ad in free_char (ch=0x42139c80) at db.c:3025
#3  0x080c1cb3 in clean_char_queue () at handler.c:3662
#4  0x0812205f in update_handler () at update.c:2222
#5  0x0809d357 in game_loop () at comm.c:690
#6  0x0809cc5f in main (argc=8, argv=0xbfffde50) at comm.c:304
#7  0x42015967 in __libc_start_main () from /lib/i686/libc.so.6

10/18/04:

#0  0x420751ce in calloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x420751ce in calloc () from /lib/i686/libc.so.6
#1  0x42074827 in calloc () from /lib/i686/libc.so.6
#2  0x42074544 in calloc () from /lib/i686/libc.so.6
#3  0x0809d46c in new_descriptor (new_desc=5) at comm.c:848
#4  0x0809cecc in accept_new (ctrl=5) at comm.c:557
#5  0x0809cf34 in game_loop () at comm.c:581
#6  0x0809cabf in main (argc=2, argv=0xbfffdd70) at comm.c:304
#7  0x42015967 in __libc_start_main () from /lib/i686/libc.so.6

10/10/04:

#0  0x420751ce in calloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x420751ce in calloc () from /lib/i686/libc.so.6
#1  0x42074827 in calloc () from /lib/i686/libc.so.6
#2  0x42074544 in calloc () from /lib/i686/libc.so.6
#3  0x0809d2fc in new_descriptor (new_desc=5) at comm.c:848
#4  0x0809cd5c in accept_new (ctrl=5) at comm.c:557
#5  0x0809cdc4 in game_loop () at comm.c:581
#6  0x0809c94f in main (argc=8, argv=0xbfffe4a0) at comm.c:304
#7  0x42015967 in __libc_start_main () from /lib/i686/libc.so.6

10/07/04:

#0  0x420751ce in calloc () from /lib/i686/libc.so.6
#1  0x42074827 in calloc () from /lib/i686/libc.so.6
#2  0x42074544 in calloc () from /lib/i686/libc.so.6
#3  0x080a84a0 in create_mobile (pMobIndex=0x82d8e98) at db.c:2553
#4  0x080dd007 in do_mpmload (ch=0x8370c60, argument=0xbfff8af8 "1004") at mud_comm.c:768
#5  0x080c4e52 in interpret (ch=0x8370c60, argument=0xbfff8af8 "1004") at interp.c:571
#6  0x080e4273 in mprog_do_command (cmnd=0xbfff86f0 "ð\207ÿ¿\r\210ÿ¿ï§ÿ¿ð\207ÿ¿ï§ÿ¿",
    mob=0x8370c60, actor=0x8356da0, obj=0x0, vo=0x0, rndm=0x8356da0, ignore=0 '\0',
    ignore_ors=0 '\0') at mud_prog.c:2236
#7  0x080e3e25 in mprog_driver (
    com_list=0x82d9008 "mpecho &gAs the demon dies, it gives out a cry, calling
another.\n\rmpmload 1004\n\r", mob=0x8370c60, actor=0x8356da0, obj=0x0, vo=0x0,
single_step=0 '\0')
    at mud_prog.c:1934
#8  0x080e4a9e in mprog_percent_check (mob=0x8370c60, actor=0x8356da0, obj=0x0, vo=0x0,
type=4)
    at mud_prog.c:2448
#9  0x080e4e9a in mprog_death_trigger (killer=0x0, mob=0x8370c60) at mud_prog.c:2621
#10 0x080b8628 in raw_kill (ch=0x8356da0, victim=0x8370c60) at fight.c:3381
#11 0x080b71ab in damage (ch=0x8356da0, victim=0x8370c60, dam=22, dt=1000) at fight.c:2473
#12 0x080b4ce2 in one_hit (ch=0x8356da0, victim=0x8370c60, dt=1000) at fight.c:1362
#13 0x080b3b30 in multi_hit (ch=0x8356da0, victim=0x8370c60, dt=-1) at fight.c:806
#14 0x080b9b16 in do_kill (ch=0x8356da0, argument=0xbfffeb32 "de") at fight.c:3996
#15 0x080c4e52 in interpret (ch=0x8356da0, argument=0xbfffeb32 "de") at interp.c:571
#16 0x0809cf0d in game_loop () at comm.c:671
#17 0x0809c847 in main (argc=8, argv=0xbfffef50) at comm.c:304
#18 0x42015967 in __libc_start_main () from /lib/i686/libc.so.6

Zeno USA Thu 20 Jan 2005 05:24 PM #7

Ugh, last one.

10/05/04:

#0  0x420751bf in calloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x420751bf in calloc () from /lib/i686/libc.so.6
#1  0x42074827 in calloc () from /lib/i686/libc.so.6
#2  0x42074544 in calloc () from /lib/i686/libc.so.6
#3  0x080a7f06 in create_mobile (pMobIndex=0x82d9498) at db.c:2552
#4  0x080dca6b in do_mpmload (ch=0x83dc030, argument=0xbfff9478 "1004")
    at mud_comm.c:768
#5  0x080c48b6 in interpret (ch=0x83dc030, argument=0xbfff9478 "1004")
    at interp.c:571
#6  0x080e3cd7 in mprog_do_command (
    cmnd=0xbfff9070 "p\221ÿ¿\216\221ÿ¿o±ÿ¿p\221ÿ¿o±ÿ¿", mob=0x83dc030,
    actor=0x83759d8, obj=0x0, vo=0x0, rndm=0x83759d8, ignore=0 '\0',
    ignore_ors=0 '\0') at mud_prog.c:2236
#7  0x080e3889 in mprog_driver (
    com_list=0x82d9640 "mpecho &gAs the demon dies, it gives out a cry, calling
another.\n\rmpmload 1004\n\r", mob=0x83dc030, actor=0x83759d8, obj=0x0,
    vo=0x0, single_step=0 '\0') at mud_prog.c:1934
#8  0x080e4502 in mprog_percent_check (mob=0x83dc030, actor=0x83759d8,
    obj=0x0, vo=0x0, type=4) at mud_prog.c:2448
#9  0x080e48fe in mprog_death_trigger (killer=0x266f7a20, mob=0x83dc030)
    at mud_prog.c:2621
#10 0x080b808c in raw_kill (ch=0x83759d8, victim=0x83dc030) at fight.c:3381
#11 0x080b6c0f in damage (ch=0x83759d8, victim=0x83dc030, dam=20, dt=1007)
    at fight.c:2473
#12 0x080b4746 in one_hit (ch=0x83759d8, victim=0x83dc030, dt=1007)
    at fight.c:1362
#13 0x080b3594 in multi_hit (ch=0x83759d8, victim=0x83dc030, dt=-1)
    at fight.c:806
#14 0x080b957a in do_kill (ch=0x83759d8, argument=0xbffff4b2 "dem")
    at fight.c:3996
#15 0x080c48b6 in interpret (ch=0x83759d8, argument=0xbffff4b2 "dem")
    at interp.c:571
#16 0x0809c985 in game_loop () at comm.c:671
#17 0x0809c2bf in main (argc=8, argv=0xbffff8d0) at comm.c:304
#18 0x42015967 in __libc_start_main () from /lib/i686/libc.so.6

1/20/05:

#0  0x008617a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x008a1955 in raise () from /lib/tls/libc.so.6
#2  0x008a3319 in abort () from /lib/tls/libc.so.6
#3  0x008d4f8a in __libc_message () from /lib/tls/libc.so.6
#4  0x008daed0 in malloc_consolidate () from /lib/tls/libc.so.6
#5  0x008dbdd3 in _int_malloc () from /lib/tls/libc.so.6
#6  0x008dd906 in calloc () from /lib/tls/libc.so.6
#7  0x080b8642 in write_to_pager (d=0x99eff4, txt=0x818a890
"\033[0;37m",
    length=1) at color.c:1134
#8  0x080b85b0 in set_pager_color (AType=17, ch=0x8d5fe78) at
color.c:1112
#9  0x080bbf11 in nanny (d=0x8d6e080, argument=0x8d5fe78 "") at
comm.c:2311
#10 0x080b9799 in game_loop () at comm.c:684
#11 0x080b904c in main (argc=2, argv=0xbfe1a1b0) at comm.c:316

David Haley USA Thu 20 Jan 2005 06:58 PM #8

Unfortunately these really aren't that useful. What you'd really need is to run it through Valgrind and to see if your memory is being corrupted. My bet is on corrupted memory, i.e. freeing something twice somewhere. Valgrind will nail that and a lot of other stuff for you. :)

Zeno USA Thu 20 Jan 2005 07:00 PM #9

I know. That's why I haven't solved it yet. If you look at the dates with the new server, there is a large time apart from the crashes. I can't run valgrind for 3 months.

David Haley USA Thu 20 Jan 2005 07:12 PM #10

Well, yeah. :P But the error could be anywhere. It isn't necessarily even close to the crashing point. I'd suggest running Valgrind for a day or two, and just seeing what happens. If anything, it'll spot a lot of things that probably should be fixed anyhow.

Samson USA Sat 22 Jan 2005 02:21 AM #11

Indeed. Valgrind will find numerous things that should be fixed. Even stuff as trivial sounding as uninitialized variables can come back later to haunt you.

If it's any consolation, you're not alone in trying to squash issues with your code :/

Zeno USA Sat 22 Jan 2005 02:41 AM #12

Well my MUD is still alpha, so I have a lot of time to fix it before we go beta. I'll run it in valgrind sometime, at the rate this crash happens, I'm not worried about fixing it very soon.

David Haley USA Sat 22 Jan 2005 02:49 AM #13

Were I you, I'd run it even if you're not aiming to fix this bug in particular. Running Valgrind every once in a while can solve all kinds of bugs. As Samson said, sometimes innocent little things can come to haunt you quite nastily later on.