[Enigma-devel] seg fault on Enigma III #4 (map it out)

[Michael Thomas]

I get a reproducible segmentation fault on Enigma III level 3 "Map it
Out".   I'm running Enigma enigma-1.01 on 64-bit Fedora 7.

To reproduce the problem was easy:  I start that particular level, then
just keep moving left at a quick pace.  At about the 3rd teleporter, the
game crashes.  A backgrace from the crash is below.

--Wart

GNU gdb Red Hat Linux (6.6-8.fc7rh)
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
Using host libthread_db library "/lib64/libthread_db.so.1".
(gdb) run
Starting program: /usr/bin/enigma
[Thread debugging using libthread_db enabled]
[New Thread 46912496233632 (LWP 5953)]
[New Thread 1084229968 (LWP 6811)]

Program received signal SIGABRT, Aborted.
[Switching to Thread 1084229968 (LWP 6811)]
0x00000037592305b5 in raise () from /lib64/libc.so.6
(gdb) thread abp^H^[[K^H^[[Kpply all ^H^[[K^H^[[K^H^[[Kll ^G
Display all 46721 possibilities? (y or n)^G^G^G^G
(gdb) thread apply all bt

Thread 2 (Thread 1084229968 (LWP 6811)):
#0  0x00000037592305b5 in raise () from /lib64/libc.so.6
#1  0x0000003759232060 in abort () from /lib64/libc.so.6
#2  0x0000003759268d0b in __libc_message () from /lib64/libc.so.6
#3  0x000000375926e583 in malloc_consolidate () from /lib64/libc.so.6
#4  0x0000003759270b1d in _int_malloc () from /lib64/libc.so.6
#5  0x00000037592724ed in malloc () from /lib64/libc.so.6
#6  0x0000003361e11b23 in std::basic_streambuf<char,
std::char_traits<char> >::showmanyc () from /usr/lib64/libSDL_mixer-1.2.so.0
#7  0x0000003361e121ae in std::basic_streambuf<char,
std::char_traits<char> >::showmanyc () from /usr/lib64/libSDL_mixer-1.2.so.0
#8  0x000000376de08b9a in std::basic_streambuf<char,
std::char_traits<char> >::showmanyc () from /usr/lib64/libSDL-1.2.so.0
#9  0x000000376de10a07 in std::basic_streambuf<char,
std::char_traits<char> >::showmanyc () from /usr/lib64/libSDL-1.2.so.0
#10 0x000000376de52149 in std::basic_streambuf<char,
std::char_traits<char> >::showmanyc () from /usr/lib64/libSDL-1.2.so.0
#11 0x000000375ba061c5 in start_thread () from /lib64/libpthread.so.0
#12 0x00000037592d062d in clone () from /lib64/libc.so.6

Thread 1 (Thread 46912496233632 (LWP 5953)):
#0  0x00000037592dc5e8 in __lll_mutex_lock_wait () from /lib64/libc.so.6
#1  0x0000003759274cb7 in _L_lock_14740 () from /lib64/libc.so.6
#2  0x0000003759273b11 in free () from /lib64/libc.so.6
#3  0x00000000004278c3 in std::list<display::Model*,
std::allocator<display::Model*> >::remove (this=0x18ade50,
address@hidden)
    at /usr/include/c++/4.1.1/ext/new_allocator.h:94
#4  0x0000000000420f32 in display::ModelLayer::tick (this=0x18ade40,
    dtime=0.01) at display.cc:702
#5  0x0000000000427560 in
std::for_each<__gnu_cxx::__normal_iterator<display::DisplayLayer**,
std::vector<display::DisplayLayer*,
std::allocator<display::DisplayLayer*> > >,
std::binder2nd<std::mem_fun1_t<void, display::DisplayLayer, double> > >
(__first=<value optimized out>, __last={_M_current = 0x1656fb8}, __f=
      {<std::unary_function<display::DisplayLayer*,void>> = {<No data
fields>}, op =
{<std::binary_function<display::DisplayLayer*,double,void>> = {<No data
fields>}, _M_f = <error reading variable>}, value = 0.01})
    at /usr/include/c++/4.1.1/bits/stl_function.h:656
#6  0x000000000041fb58 in display::DisplayEngine::tick (
    this=<value optimized out>, dtime=0.01) at display.cc:513
#7  0x0000000000422d43 in display::GameDisplay::tick (this=0xbc8f60,
    dtime=0.01) at display.cc:1871
#8  0x00000000004183e4 in enigma_client::Tick (dtime=0.02) at client.cc:679
#9  0x000000000043b4cc in enigma_game::StartGame () at game.cc:85
#10 0x00000000004e95c4 in enigma::gui::LevelMenu::on_action (
    this=0x7fff1159b5d0, w=0x252a310) at gui/LevelMenu.cc:237
#11 0x00000000005088aa in enigma::gui::LevelWidget::handle_mousedown (
    this=0x252a310, e=<value optimized out>) at gui/LevelWidget.cc:425
#12 0x0000000000508b2d in enigma::gui::LevelWidget::on_event
(this=0x252a310,
    address@hidden) at gui/LevelWidget.cc:398
#13 0x00000000004e92b6 in enigma::gui::LevelMenu::on_event (
    this=0x7fff1159b5d0, address@hidden) at gui/LevelMenu.cc:183
#14 0x0000000000511ea6 in enigma::gui::Menu::handle_event (
    this=0x7fff1159b5d0, address@hidden) at gui/Menu.cc:115
#15 0x000000000051205b in enigma::gui::Menu::manage (this=0x7fff1159b5d0)
    at gui/Menu.cc:69
#16 0x0000000000504c69 in enigma::gui::LevelPackMenu::on_action (
    this=0x7fff1159b9f0, w=0x25162c0) at gui/LevelPackMenu.cc:419
#17 0x000000000051e1af in enigma::gui::PushButton::on_event (this=0x25162c0,
    e=<value optimized out>) at gui/widgets.cc:708
#18 0x000000000051205b in enigma::gui::Menu::manage (this=0x7fff1159b9f0)
    at gui/Menu.cc:69
#19 0x0000000000505119 in enigma::gui::LevelPackMenu::manage (
    this=0x7fff1159b9f0) at gui/LevelPackMenu.cc:329
#20 0x000000000050ee3c in enigma::gui::MainMenu::on_action (
    this=0x7fff1159bbc0, w=<value optimized out>) at gui/MainMenu.cc:259
#21 0x000000000051e1af in enigma::gui::PushButton::on_event (this=0x18297f0,
    e=<value optimized out>) at gui/widgets.cc:708
#22 0x000000000051205b in enigma::gui::Menu::manage (this=0x7fff1159bbc0)
    at gui/Menu.cc:69
#23 0x00000000005117b1 in enigma::gui::ShowMainMenu () at
gui/MainMenu.cc:370
#24 0x0000000000469718 in main (argc=<value optimized out>,
    argv=<value optimized out>) at main.cc:727
#25 0x000000375921daa4 in __libc_start_main () from /lib64/libc.so.6
#26 0x0000000000409939 in _start ()
#0  0x00000037592305b5 in raise () from /lib64/libc.so.6