heap-use-after-free Fleet::active()

[Klaus Halfmann]

Another finding from the http://clang.llvm.org/docs/AddressSanitizer.html.

wehn running ./regression_test.py -b ./widelands -r test_cancel_started_expedition_underway_one_ship1

I get:

==46586==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e00025a5d0 at pc 0x000108042354 bp 0x7ffee9a043b0 sp 0x7ffee9a043a8
READ of size 8 at 0x60e00025a5d0 thread T0
    #0 0x108042353 in Widelands::Fleet::active() const (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x101e4e353)
    #1 0x108043116 in Widelands::Fleet::init(Widelands::EditorGameBase&) (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x101e4f116)
    #2 0x106c90a0e in Widelands::Ship::init_fleet(Widelands::EditorGameBase&) (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x100a9ca0e)
    #3 0x106c904d5 in Widelands::Ship::init(Widelands::EditorGameBase&) (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x100a9c4d5)
    #4 0x106a5c088 in Widelands::BobDescr::create(Widelands::EditorGameBase&, Widelands::Player*, Widelands::Coords const&) const (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x100868088)
    #5 0x106875dc4 in Widelands::EditorGameBase::create_bob(Widelands::Coords, Widelands::BobDescr const&, Widelands::Player*)

0x60e00025a5d0 is located 80 bytes inside of 160-byte region [0x60e00025a580,0x60e00025a620)
freed by thread T0 here:
    #1 0x10806fd81 in Widelands::Fleet::~Fleet() (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x101e7bd81)
    #2 0x106ae1c52 in Widelands::MapObject::remove(Widelands::EditorGameBase&) (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x1008edc52)
    #3 0x108049d7d in Widelands::Fleet::merge(Widelands::EditorGameBase&, Widelands::Fleet*) (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x101e55d7d)
    #4 0x108044ebc in Widelands::Fleet::find_other_fleet(Widelands::EditorGameBase&) (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x101e50ebc)
    #5 0x10804310d in Widelands::Fleet::init(Widelands::EditorGameBase&) (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x101e4f10d)

previously allocated by thread T0 here:
    #1 0x106c9094c in Widelands::Ship::init_fleet(Widelands::EditorGameBase&) (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x100a9c94c)
    #2 0x106c904d5 in Widelands::Ship::init(Widelands::EditorGameBase&) (/Users/klaus/develop/widelands-repo/bug_1730204-crash/./widelands:x86_64+0x100a9c4d5)
    #3 0x106a5c088 in Widelands::BobDescr::create(Widelands::EditorGameBase&, Widelands::Player*, Widelands::Coords const&) const (/Users/klaus/develop/widelands-repo/bug_1730204-crash/.

No idea why this happens, yet

[Klaus Halfmann (klaus-halfmann)]

Same for:
test_cancel_started_expedition_on_ship_one_ship
test_cancel_when_port_space_was_reached_one_ships
test_cancel_when_port_space_was_reached_two_ship

Seem some genral Shipping and Handling, aehm handling og Shipping issue.

[Klaus Halfmann (klaus-halfmann)]

These fail as well:
test_portfield_barely_unowned.
test_portfield_neighbour_owned_by_p2
test_portfield_owned_by_p2.lua

[Klaus Halfmann (klaus-halfmann)]

All other test seem ok, will try to reproduce this in Game now ...

[GunChleoc (gunchleoc)]

I'm planning to chase this one down. https://bugs.launchpad.net/widelands/+bug/1734304

[GunChleoc (gunchleoc)]

Fixed in build20-rc1