SIGABRT caused by singular iterator dereference in process_item()

[cambion]

Looks like this is happening quite infrequently now after #10654 but it still seems to be present in some cases. I'm still working on getting a saved game to the point that it's easily reproducible.

http://pastebin.com/kws98N0t

Pastebin link as requested!

[macrosblackd]

@KA101 - this is probably the same crash I found but couldn't reproduce.

[KA101]

Fair enough.

FWIW I've gotten decent results using pastebin to store the stack trace and posting a link to the paste here (easier to read, Git doesn't create weird links, etc).

[macrosblackd]

You can surround the stack with 3 backticks ` (the key next to '1').

#0 0x00007ffff6ffa2a9 in raise () from /lib64/libc.so.6
#1 0x00007ffff6ffb5e8 in abort () from /lib64/libc.so.6
#2 0x00007ffff7925b45 in __gnu_debug::_Error_formatter::_M_error() const () from /usr/lib/gcc/x86_64-pc-linux-gnu/4.8.3/libstdc++.so.6
#3 0x0000000000472e32 in __gnu_debug::_Safe_iteratorstd::__cxx1998::_List_iterator<item, std::__debug::list > >::operator* (this=0x6172b08) at /usr/lib/gcc/x86_64-pc-linux-gnu/4.8.3/include/g++-v4/debug/safe_iterator.h:262
#4 0x00000000009ac442 in process_item<__gnu_debug::_Safe_iteratorstd::__cxx1998::_List_iterator<item, std::__debug::list > > (items=..., n=..., location=..., activate=false) at src/map.cpp:3065
#5 0x000000000099c442 in process_map_items (items=..., n=..., location=...) at src/map.cpp:3084
#6 0x00000000009b3b6a in map::process_items_in_submap, std::__debug::list > >&, point, std::string)> (this=0x7ffff7f541a8,
current_submap=0x6117340, gridx=0, gridy=5, processor=0x99c3fd >::iterator&, point, std::string)>, signal="") at src/map.cpp:3146
#7 0x00000000009afb55 in map::process_items, std::__debug::list > >&, point, vehicle, int, std::string), bool ()(item_stack&, __gnu_debug::_Safe_iteratorstd::__cxx1998::_List_iterator<item, std::__debug::list > >&, point, std::string)> (this=0x7ffff7f541a8, active=true,
veh_processor=0x99c475 >::iterator&, point, vehicle*, int, std::string)>,
map_processor=0x99c3fd >::iterator&, point, std::string)>, signal="") at src/map.cpp:3125
#8 0x000000000099c854 in map::process_active_items (this=0x7ffff7f541a8) at src/map.cpp:3111
#9 0x0000000000586622 in game::do_turn (this=0x7ffff7f54010) at src/game.cpp:1479
#10 0x00000000009ed58e in main (argc=0, argv=0x7fffffffdbd0) at src/main.cpp:296

[cambion]

And another one, this time in process_items_in_vehicle.

http://pastebin.com/HrwJN7H6

[Zireael07]

@cambion : What build are you on?

[kevingranade]

This might have been fixed by #10684

[hylkevds]

I'm not sure if it's the same problem, but the latest GIT (0.B-2105-gb41c47c) caused the following SIGABRT, and I have a save to reproduce it. I just need to find a place to upload the save.

The zipped save game is here:
https://cloud.usoog.com/public.php?service=files&t=c8cb2546f1a6445e235ffcd99e9ea2ce

It's got one player in it. Load it, take a step and it should crash.

#0  0x00007ffff6aecd27 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff6aee418 in __GI_abort () at abort.c:89
#2  0x00007ffff74507e5 in __gnu_debug::_Error_formatter::_M_error() const () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#3  0x00000000004c2c53 in __gnu_debug::_Safe_iterator<std::__cxx1998::_List_iterator<item>, std::__debug::list<item, std::allocator<item> > >::_Safe_iterator (this=0x7fffffffd690, __x=...) at /usr/include/c++/4.9/debug/safe_iterator.h:164
#4  0x000000000099d492 in map::process_items_in_vehicle<bool (*)(item_stack&, __gnu_debug::_Safe_iterator<std::__cxx1998::_List_iterator<item>, std::__debug::list<item, std::allocator<item> > >&, point, vehicle*, int, std::string)> (this=0x35f38c8, cur_veh=0x5cf9110, current_submap=0x5d178c0, 
    processor=0x980fcd <process_vehicle_items(item_stack&, std::__debug::list<item, std::allocator<item> >::iterator&, point, vehicle*, int, std::string)>, signal="") at src/map.cpp:3176
#5  0x0000000000999c82 in map::process_items_in_vehicles<bool (*)(item_stack&, __gnu_debug::_Safe_iterator<std::__cxx1998::_List_iterator<item>, std::__debug::list<item, std::allocator<item> > >&, point, vehicle*, int, std::string)> (this=0x35f38c8, current_submap=0x5d178c0, 
    processor=0x980fcd <process_vehicle_items(item_stack&, std::__debug::list<item, std::allocator<item> >::iterator&, point, vehicle*, int, std::string)>, signal="") at src/map.cpp:3165
#6  0x00000000009958e1 in map::process_items<bool (*)(item_stack&, __gnu_debug::_Safe_iterator<std::__cxx1998::_List_iterator<item>, std::__debug::list<item, std::allocator<item> > >&, point, vehicle*, int, std::string), bool (*)(item_stack&, __gnu_debug::_Safe_iterator<std::__cxx1998::_List_iterator<item>, std::__debug::list<item, std::allocator<item> > >&, point, std::string)> (this=0x35f38c8, active=true, 
    veh_processor=0x980fcd <process_vehicle_items(item_stack&, std::__debug::list<item, std::allocator<item> >::iterator&, point, vehicle*, int, std::string)>, map_processor=0x980f32 <process_map_items(item_stack&, std::__debug::list<item, std::allocator<item> >::iterator&, point, std::string)>, 
    signal="") at src/map.cpp:3121
#7  0x00000000009813e7 in map::process_active_items (this=0x35f38c8) at src/map.cpp:3110
#8  0x000000000043ad86 in game::do_turn (this=0x35f3730) at src/game.cpp:1479
#9  0x0000000000a2ee11 in main (argc=0, argv=0x7fffffffdec0) at src/main.cpp:296

[cambion]

Have been away due to moving cross country. I'll see if #10684 fixes this tonight.

[kevingranade]

I'm looking at the code for ripping parts off of vehicles, it looks like if you tear off a cargo part, the items in it are simply deleted instead of being removed, which means references to them remain in the active item processing list for the vehicle.
That may or may not be what's causing this.