Crash when eating

[Trokinos]

As my character was hungry, i went into a house and started to eat available food in a kitchen table.
My thrist level went to slaked but i was still hungry so i continued to eat, disregarding the message about stomach full so there would be waste.
It then immediately crashed.

The program has crashed.
See the log file for a stack trace.
CRASH LOG FILE: ./config/crash.log
VERSION: 0d5e8f4
TYPE: Signal
MESSAGE: SIGSEGV: Segmentation fault
STACK TRACE:

#0
(dbghelp: @0x6497e6[cataclysm-tiles.exe+0x2497e6]),
(libbacktrace: Z21debug_write_backtraceRSo+0x56@0x6497e6),
(libbacktrace: 0x6497e6 [unknown src]:0 [unknown func]),
#1
(dbghelp: @0x62c366[cataclysm-tiles.exe+0x22c366]),
(libbacktrace: log_crash+0x526@0x62c366),
(libbacktrace: 0x62c366 [unknown src]:0 [unknown func]),
#2
(dbghelp: @0x62d682[cataclysm-tiles.exe+0x22d682]),
(libbacktrace: signal_handler+0x32@0x62d682),
(libbacktrace: 0x62d682 [unknown src]:0 [unknown func]),
#3
(dbghelp: Mix_EachSoundFont+0x604c0@0x1089960[cataclysm-tiles.exe+0xc89960]),
(libbacktrace: gnu_exception_handler+0x70@0x1089960),
(libbacktrace: 0x1089960 ../gcc-5.5.0.build_/mingw-w64-v6.0.0/mingw-w64-crt/crt/crt_handler.c:223 _gnu_exception_handler),
#4
(dbghelp: _C_specific_handler+0x98@0x7ffc19ad8048[msvcrt.dll+0x28048]),
(backtrace_syminfo failed: errno = -1, msg = no symbol table in PE/COFF executable),
(backtrace_pcinfo failed: errno = -1, msg = no debug info in PE/COFF executable),
#5
(dbghelp: _chkstk+0x11f@0x7ffc19fc121f[ntdll.dll+0xa121f]),
(backtrace_syminfo failed: errno = -1, msg = no symbol table in PE/COFF executable),
(backtrace_pcinfo failed: errno = -1, msg = no debug info in PE/COFF executable),
#6
(dbghelp: RtlRaiseException+0x399@0x7ffc19f8a259[ntdll.dll+0x6a259]),
(backtrace_syminfo failed: errno = -1, msg = no symbol table in PE/COFF executable),
(backtrace_pcinfo failed: errno = -1, msg = no debug info in PE/COFF executable),
#7
(dbghelp: KiUserExceptionDispatcher+0x2e@0x7ffc19fbfe8e[ntdll.dll+0x9fe8e]),
(backtrace_syminfo failed: errno = -1, msg = no symbol table in PE/COFF executable),
(backtrace_pcinfo failed: errno = -1, msg = no debug info in PE/COFF executable),
#8
(dbghelp: @0x6a17be[cataclysm-tiles.exe+0x2a17be]),
(libbacktrace: ZN6effect12set_durationERK13time_durationb+0x1e@0x6a17be),
(libbacktrace: 0x6a17be [unknown src]:0 [unknown func]),
#9
(dbghelp: @0x6a1fab[cataclysm-tiles.exe+0x2a1fab]),
(libbacktrace: ZN6effect12mod_durationERK13time_durationb+0x1b@0x6a1fab),
(libbacktrace: 0x6a1fab [unknown src]:0 [unknown func]),
#10
(dbghelp: @0x59b643[cataclysm-tiles.exe+0x19b643]),
(libbacktrace: ZN9Character5vomitEv+0x3f3@0x59b643),
(libbacktrace: 0x59b643 [unknown src]:0 [unknown func]),
#11
(dbghelp: @0xd79b8f[cataclysm-tiles.exe+0x979b8f]),
(libbacktrace: ZN6player18process_one_effectER6effectb+0xc0f@0xd79b8f),
(libbacktrace: 0xd79b8f [unknown src]:0 [unknown func]),
#12
(dbghelp: @0x63893f[cataclysm-tiles.exe+0x23893f]),
(libbacktrace: ZN8Creature10add_effectERK9string_idI11effect_typeERK13time_duration9body_partbibb+0x45f@0x63893f),
(libbacktrace: 0x63893f [unknown src]:0 [unknown func]),
#13
(dbghelp: @0x59b86a[cataclysm-tiles.exe+0x19b86a]),
(libbacktrace: ZN9Character5vomitEv+0x61a@0x59b86a),
(libbacktrace: 0x59b86a [unknown src]:0 [unknown func]),
#14
(dbghelp: @0x5fed27[cataclysm-tiles.exe+0x1fed27]),
(libbacktrace: ZN6player3eatER4itemb+0x2b7@0x5fed27),
(libbacktrace: 0x5fed27 [unknown src]:0 [unknown func]),
#15
(dbghelp: @0xd66d20[cataclysm-tiles.exe+0x966d20]),
(libbacktrace: ZN6player12consume_itemER4item+0x5d0@0xd66d20),
(libbacktrace: 0xd66d20 [unknown src]:0 [unknown func]),
#16
(dbghelp: @0x4cffb8[cataclysm-tiles.exe+0xcffb8]),
(libbacktrace: ZN13avatar_action3eatER6avatar13item_location+0x48@0x4cffb8),
(libbacktrace: 0x4cffb8 [unknown src]:0 [unknown func]),
#17
(dbghelp: @0x4d02f0[cataclysm-tiles.exe+0xd02f0]),
(libbacktrace: ZN13avatar_action3eatER6avatar+0x40@0x4d02f0),
(libbacktrace: 0x4d02f0 [unknown src]:0 [unknown func]),
#18
(dbghelp: @0x45fced[cataclysm-tiles.exe+0x5fced]),
(libbacktrace: ZNK13activity_type12call_do_turnEP15player_activityP6player+0x4d@0x45fced),
(libbacktrace: 0x45fced [unknown src]:0 [unknown func]),
#19
(dbghelp: @0xd7e91a[cataclysm-tiles.exe+0x97e91a]),
(libbacktrace: ZN15player_activity7do_turnER6player+0xcda@0xd7e91a),
(libbacktrace: 0xd7e91a [unknown src]:0 [unknown func]),
#20
(dbghelp: @0x715d4a[cataclysm-tiles.exe+0x315d4a]),
(libbacktrace: ZN4game16process_activityEv+0x7a@0x715d4a),
(libbacktrace: 0x715d4a [unknown src]:0 [unknown func]),
#21
(dbghelp: @0x76ec6c[cataclysm-tiles.exe+0x36ec6c]),
(libbacktrace: ZN4game7do_turnEv+0x2fc@0x76ec6c),
(libbacktrace: 0x76ec6c [unknown src]:0 [unknown func]),
#22
(dbghelp: IMG_LoadWEBP_RW+0x77d5d8@0x1932e18[cataclysm-tiles.exe+0x1532e18]),
(libbacktrace: main+0x11a8@0x1932e18),
(libbacktrace: 0x1932e18 [unknown src]:0 [unknown func]),
#23
(dbghelp: @0x4013bd[cataclysm-tiles.exe+0x13bd]),
(libbacktrace: tmainCRTStartup+0x23d@0x4013bd),
(libbacktrace: 0x4013bd ../gcc-5.5.0.build/mingw-w64-v6.0.0/mingw-w64-crt/crt/crtexe.c:341 _tmainCRTStartup),
#24
(dbghelp: @0x4014cb[cataclysm-tiles.exe+0x14cb]),
(libbacktrace: WinMainCRTStartup+0x1b@0x4014cb),
(libbacktrace: 0x4014cb ../gcc-5.5.0.build/mingw-w64-v6.0.0/mingw-w64-crt/crt/crtexe.c:197 WinMainCRTStartup),
#25
(dbghelp: BaseThreadInitThunk+0x14@0x7ffc18ea7c24[KERNEL32.DLL+0x17c24]),
(backtrace_syminfo failed: errno = -1, msg = no symbol table in PE/COFF executable),
(backtrace_pcinfo failed: errno = -1, msg = no debug info in PE/COFF executable),
#26
(dbghelp: RtlUserThreadStart+0x21@0x7ffc19f8cea1[ntdll.dll+0x6cea1]),
(backtrace_syminfo failed: errno = -1, msg = no symbol table in PE/COFF executable),
(backtrace_pcinfo failed: errno = -1, msg = no debug info in PE/COFF executable),

[Trokinos]

note the #number links are not mine, i just copy pasted the crash log and github apparently thought those were links.

[Coolthulhu]

Seems that it crashed on set_duration from vomit.
It caused two vomits in one effect processing.

I'll try reproducing it, but it may be a bit tough, since it looks like something RNG-dependent. If anyone gets a reliable way to reproduce it, it would be helpful.

[olanti-p]

From what I discerned from debugger, it crashes when it tries to modify the sentinel value at line 7461

Cataclysm-BN/src/character.cpp

Lines 7460 to 7462 in 2bd90b4

	// TODO: Is it safe to modify sentinel?
	get_effect( effect_foodpoison ).mod_duration( -30_minutes );
	get_effect( effect_drunk ).mod_duration( rng( -10_minutes, -50_minutes ) );

Or, more specifically, at effect.cpp:764 when trying to dereference null eff_type pointer

Cataclysm-BN/src/effect.cpp

Lines 760 to 775 in 2bd90b4

	void effect::set_duration( const time_duration &dur, bool alert )
	{
	duration = dur;
	// Cap to max_duration if it exists
	if( eff_type->max_duration > 0_turns && duration > eff_type->max_duration ) {
	duration = eff_type->max_duration;
	}
	// Force intensity if it is duration based
	if( eff_type->int_dur_factor != 0_turns ) {
	// + 1 here so that the lowest is intensity 1, not 0
	set_intensity( duration / eff_type->int_dur_factor + 1, alert );
	}
	add_msg( m_debug, "ID: %s, Duration %d", get_id().c_str(), to_turns<int>( duration ) );
	}

Gating those 2 calls behind has_effect() fixes the crash, but that's more of a band-aid since get_effect() is used in many places, and the same situation may occur again.

Reproduced by overstuffing myself with cheeseburgers

[Coolthulhu]

I added a check for the existence of effect. It fixed it on my side.

[olanti-p]

Yeah, that works.

Found another crash of the same kind, after shooting myself with mutagenic serum (and pressing 'I'gnore when prompted to stop consuming item):

#0  effect_type::get_int_dur_factor() const (this=0x0) at src/effect.cpp:469
#1  0x0000000001ced5e9 in effect::get_int_dur_factor() const (this=<optimized out>) at src/effect.cpp:1172
#2  0x000000000231eecc in Character::mutate() (this=0x426b580) at src/mutation.cpp:890
#3  0x00000000023210fd in Character::mutate_category(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)
   Python Exception <class 'gdb.error'> There is no member named _M_dataplus.: 
 (this=0x426b580, cat=) at src/mutation.cpp:1085
#4  0x000000000200950b in mutagen_iv_actor::use(player&, item&, bool, tripoint const&) const (this=<optimized out>, p=..., it=...)
    at src/iuse_actor.cpp:4433
#5  0x0000000001fd70de in use_function::call(player&, item&, bool, tripoint const&) const
    (this=<optimized out>, p=..., it=..., active=false, pos=...) at src/iuse.cpp:9761
#6  0x0000000001fa1178 in itype::invoke(player&, item&, tripoint const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) constPython Exception <class 'gdb.error'> There is no member named _M_dataplus.: 
 (this=<optimized out>, p=..., it=..., pos=..., iuse_name=) at src/itype.cpp:115
#7  0x0000000001fa10fd in itype::invoke(player&, item&, tripoint const&) const (this=0xa389798, p=..., it=..., pos=...) at src/itype.cpp:96
#8  0x00000000025265c2 in player::consume_med(item&) (this=0x426b580, target=...) at src/player.cpp:2052
#9  0x000000000252634f in player::consume_item(item&) (this=0x426b580, target=...) at src/player.cpp:2132
#10 0x0000000002526b5b in player::consume(item_location) (this=0x426b580, loc=...) at src/player.cpp:2153
#11 0x0000000001a7eac1 in avatar_action::eat(avatar&, item_location) (you=..., loc=...) at src/avatar_action.cpp:1075
#12 0x0000000001a7ea35 in avatar_action::eat(avatar&) (you=...) at src/avatar_action.cpp:1063
#13 0x000000000196d097 in activity_handlers::eat_menu_do_turn(player_activity*, player*) () at src/activity_handlers.cpp:3025
#14 0x000000000198787f in std::_Function_handler<void (player_activity*, player*), void (*)(player_activity*, player*)>::_M_invoke(std::_Any_data const&, player_activity*&&, player*&&) (__functor=..., __args=<optimized out>, __args=<optimized out>)
    at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300
#15 0x00000000019d01e3 in std::function<void (player_activity*, player*)>::operator()(player_activity*, player*) const
    (this=0x33c43e8, __args=0x426bae0, __args=0x426b580)
    at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688
#16 0x00000000019cf98a in activity_type::call_do_turn(player_activity*, player*) const (this=<optimized out>, act=0x426bae0, p=0x426b580)
    at src/activity_type.cpp:100
#17 0x0000000002541bd1 in player_activity::do_turn(player&) (this=0x426bae0, p=...) at src/player_activity.cpp:298
#18 0x0000000001d9b8c3 in game::process_activity() (this=0x34fd350) at src/game.cpp:1704
#19 0x0000000001d9a1e5 in game::do_turn() (this=<optimized out>) at src/game.cpp:1486
#20 0x00000000020c13c2 in main(int, char**) (argc=<optimized out>, argv=0x7fffffffdea0) at src/main.cpp:698

[Coolthulhu]

Both the crash in title and with the mutagen should be fixed.