Segfault in submap::get_ter during world generation

[l29ah]

I've just started a new game!

VERSION: 0.D-7608-gafeb203bf8-dirty
TYPE: Signal
MESSAGE: SIGSEGV: Segmentation fault
STACK TRACE:

	cataclysm(_Z21debug_write_backtraceRSo+0x33) [0x56068bc09dfa]
	cataclysm(+0x180b23a) [0x56068bbda23a]
	cataclysm(+0x180b446) [0x56068bbda446]
	/lib64/libc.so.6(+0x396b0) [0x7fa339eed6b0]
	cataclysm(_ZNK6submap7get_terERK5point+0x33) [0x56068c25dc97]
	cataclysm(_ZNK3map20has_flag_ter_or_furnERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERK8tripoint+0x8e) [0x56068c22af10]
	cataclysm(_ZNK3map8has_flagERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERK8tripoint+0x2b) [0x56068c22aa85]
	cataclysm(+0x1e6b2c7) [0x56068c23a2c7]
	cataclysm(_ZN3map19add_item_or_chargesERK8tripoint4itemb+0x11c) [0x56068c23a7c2]
	cataclysm(+0x281f8d2) [0x56068cbee8d2]
	cataclysm(_ZN7vehicle11remove_partEi+0x44f) [0x56068cbeedb9]
	cataclysm(_ZN7vehicle5smashEfff5pointf+0x6f9) [0x56068cbe7829]
	cataclysm(_ZN3map18add_vehicle_to_mapESt10unique_ptrI7vehicleSt14default_deleteIS1_EEb+0x8f2) [0x56068c33353e]
	cataclysm(_ZN3map11add_vehicleERK9string_idI17vehicle_prototypeERK8tripointiiib+0x326) [0x56068c332ae8]
	cataclysm(_ZN3map11add_vehicleERK9string_idI17vehicle_prototypeERK5pointiiib+0x7c) [0x56068c332680]
	cataclysm(+0x1eb9f4c) [0x56068c288f4c]
	cataclysm(_ZN9MapExtras14apply_functionERK9string_idI9map_extraER3mapRK8tripoint+0xb7) [0x56068c29bedb]
	cataclysm(_ZN9MapExtras14apply_functionERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEER3mapRK8tripoint+0x53) [0x56068c29c759]
	cataclysm(_ZN3map8generateERK8tripointRK10time_point+0x821) [0x56068c2f8f6b]
	cataclysm(_ZN3map5loadnERK8tripointb+0x470) [0x56068c249afa]

	Attempting to repeat stack trace using debug symbols...
	debug_write_backtrace(std::ostream&)
	.../src/debug.cpp:620
	log_crash
	.../src/crash.cpp:264
	signal_handler
	.../src/crash.cpp:293
	??
	??:0
	submap::get_ter(point const&) const
	.../src/submap.h:86
	map::has_flag_ter_or_furn(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, tripoint const&) const
	.../src/map.cpp:2323
	map::has_flag(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, tripoint const&) const
	.../src/map.cpp:2288
	operator()
	.../src/map.cpp:4282 (discriminator 2)
	map::add_item_or_charges(tripoint const&, item, bool)
	.../src/map.cpp:4320
	operator()
	.../src/vehicle.cpp:1736 (discriminator 3)
	vehicle::remove_part(int)
	.../src/vehicle.cpp:1750 (discriminator 6)
	vehicle::smash(float, float, float, point, float)
	.../src/vehicle.cpp:751
	map::add_vehicle_to_map(std::unique_ptr<vehicle, std::default_delete<vehicle> >, bool)
	.../src/mapgen.cpp:6880
	map::add_vehicle(string_id<vehicle_prototype> const&, tripoint const&, int, int, int, bool)
	.../src/mapgen.cpp:6774 (discriminator 2)
	map::add_vehicle(string_id<vehicle_prototype> const&, point const&, int, int, int, bool)
	.../src/mapgen.cpp:6730
	mx_roadblock
	.../src/map_extras.cpp:631 (discriminator 4)
	MapExtras::apply_function(string_id<map_extra> const&, map&, tripoint const&)
	.../src/map_extras.cpp:2726
	MapExtras::apply_function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, map&, tripoint const&)
	.../src/map_extras.cpp:2783 (discriminator 2)
	map::generate(tripoint const&, time_point const&)
	.../src/mapgen.cpp:162
	map::loadn(tripoint const&, bool)
	.../src/map.cpp:6852

[ZhilkinSerg]

I've seen this kind of error multiple times this year, so there are no certain reproduce steps. It is possibly related to #33640

[BevapDin]

The back trace shows this happens:

• Vehicles are placed on the map.
• New vehicle overlaps existing vehicle, therefor they get smashed into a wreckage. This calls vehicle::smash to simulate the destruction of the overlapping vehicle parts.
• Sometimes this triggers removing the vehicle part (via vehicle::remove_part), which in turn access the global game map (to drop items, and to invalidate caches, place contained monsters, ... ). See all the access to g->m within vehicle::remove_part.

Note that map::add_item_or_charges in this back trace is not called on the tinymap that is used to run the mapgen code. It is called on the main game map g->m!

This means:

• during normal game play, items (or other things) can suddenly appear somewhere on the main map as they are dropped by vehicles smashed during mapgen.
• mapgen is triggered at the start when the map is loaded first. This happens while the main game map is still in an "invalid" state (no submap has yet been generated, so the main game map can not contain any valid submap pointer). Access of the main game map via vehicle::remove_part will not work.

[l29ah]

Your description reminds me of #31264

[BevapDin]

Your description reminds me of #31264

Yes, this is the same thing. Mapgen happens within a tinymap with coordinates in the range (0,0) to (23,23). Those happen to be valid within the main game map as well and refer to the top left area of it.