deleteRoom crashes in current git

[Vadim Peretokin]

Given the attached map, the attached alias - when used as 'area delete 255' - crashes Mudlet. Here is the backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff51d58f3 in QMapNodeBase::nextNode() const () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5
(gdb) bt
#0 0x00007ffff51d58f3 in QMapNodeBase::nextNode() const () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5
#1 0x0000000000523a7c in QMapNode<int, QString>::nextNode (this=0x3ec5d00) at ../../../Qt5.1.1/5.1.1/gcc_64/include/QtCore/qmap.h:119
#2 0x00000000005206c3 in QMap<int, QString>::const_iterator::operator++ (this=0x7fffffffbb90) at ../../../Qt5.1.1/5.1.1/gcc_64/include/QtCore/qmap.h:486
#3 0x00000000005fb55d in QMap<int, QString>::keys (this=0x3e413b0) at ../../../Qt5.1.1/5.1.1/gcc_64/include/QtCore/qmap.h:946
#4 0x00000000005f9e90 in TRoom::removeAllSpecialExitsToRoom (this=0x3e412a0, _id=11) at TRoom.cpp:289
#5 0x0000000000656e36 in TRoomDB::__removeRoom (this=0x1a153e0, id=11) at TRoomDB.cpp:99
#6 0x00000000005f8fb4 in TRoom::~TRoom (this=0x3e41780, __in_chrg=<optimised out>) at TRoom.cpp:61
#7 0x0000000000657038 in TRoomDB::removeRoom (this=0x1a153e0, id=11) at TRoomDB.cpp:127
#8 0x000000000050466a in TLuaInterpreter::deleteRoom (L=0x19f7a10) at TLuaInterpreter.cpp:6611
#9 0x00007ffff797c23c in ?? () from /usr/lib/x86_64-linux-gnu/liblua5.1.so.0
#10 0x00007ffff7986d88 in ?? () from /usr/lib/x86_64-linux-gnu/liblua5.1.so.0
#11 0x00007ffff797c64d in ?? () from /usr/lib/x86_64-linux-gnu/liblua5.1.so.0
#12 0x00007ffff797b8d7 in ?? () from /usr/lib/x86_64-linux-gnu/liblua5.1.so.0
#13 0x00007ffff797c802 in ?? () from /usr/lib/x86_64-linux-gnu/liblua5.1.so.0
#14 0x00007ffff7978361 in lua_pcall () from /usr/lib/x86_64-linux-gnu/liblua5.1.so.0
#15 0x0000000000512c4c in TLuaInterpreter::call (this=0x19fd268, function=..., mName=...) at TLuaInterpreter.cpp:10178
#16 0x000000000053b95b in TAlias::execute (this=0x2d70490) at TAlias.cpp:426
#17 0x000000000053a953 in TAlias::match (this=0x2d70490, toMatch=...) at TAlias.cpp:275
#18 0x00000000005482be in AliasUnit::processDataStream (this=0x19fd478, data=...) at AliasUnit.cpp:281
#19 0x0000000000468f10 in Host::send (this=0x19fcb40, cmd=..., wantPrint=true, dontExpandAliases=false) at Host.cpp:638
#20 0x0000000000531bf9 in TCommandLine::enterCommand (this=0x1a56280, event=0x7fffffffd900) at TCommandLine.cpp:522
#21 0x00000000005308ba in TCommandLine::event (this=0x1a56280, event=0x7fffffffd900) at TCommandLine.cpp:259
#22 0x00007ffff625ab54 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Widgets.so.5
#23 0x00007ffff625e950 in QApplication::notify(QObject*, QEvent*) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Widgets.so.5
#24 0x00007ffff533ddd4 in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5
#25 0x00007ffff62b2a88 in ?? () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Widgets.so.5
#26 0x00007ffff625ab54 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Widgets.so.5
#27 0x00007ffff625dfe6 in QApplication::notify(QObject*, QEvent*) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Widgets.so.5
#28 0x00007ffff533ddd4 in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5
#29 0x00007ffff5840714 in QGuiApplicationPrivate::processKeyEvent(QWindowSystemInterfacePrivate::KeyEvent*) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Gui.so.5
#30 0x00007ffff584992d in QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Gui.so.5
#31 0x00007ffff5832a98 in QWindowSystemInterface::sendWindowSystemEventsImplementation(QFlags<QEventLoop::ProcessEventsFlag>) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Gui.so.5
#32 0x00007fffebcc5940 in ?? () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/plugins/platforms/libqxcb.so
#33 0x00007ffff3690d53 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#34 0x00007ffff36910a0 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#35 0x00007ffff3691164 in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#36 0x00007ffff5388314 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5
#37 0x00007ffff533cb6b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5
#38 0x00007ffff5340bbe in QCoreApplication::exec() () from /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5
#39 0x0000000000463094 in main (argc=1, argv=0x7fffffffe048) at main.cpp:274
(gdb)

Another, similar backtrace:
0 QMap<int, QString>::size qmap.h 363 0x5fc783
1 QMap<int, QString>::keys qmap.h 942 0x5fb975
2 TRoom::removeAllSpecialExitsToRoom TRoom.cpp 289 0x5fa2f4
3 TRoomDB::__removeRoom TRoomDB.cpp 99 0x65c96a
4 TRoom::~TRoom TRoom.cpp 61 0x5f9418
5 TRoomDB::removeRoom TRoomDB.cpp 127 0x65cb6c
6 TRoomDB::removeArea TRoomDB.cpp 146 0x65cc70
7 TLuaInterpreter::deleteArea TLuaInterpreter.cpp 6588 0x504d35
8 ?? /usr/lib/x86_64-linux-gnu/liblua5.1.so.0 0x7ffff797c23c
9 ?? /usr/lib/x86_64-linux-gnu/liblua5.1.so.0 0x7ffff7986d88
10 ?? /usr/lib/x86_64-linux-gnu/liblua5.1.so.0 0x7ffff797c64d
11 ?? /usr/lib/x86_64-linux-gnu/liblua5.1.so.0 0x7ffff797b8d7
12 ?? /usr/lib/x86_64-linux-gnu/liblua5.1.so.0 0x7ffff797c802
13 lua_pcall /usr/lib/x86_64-linux-gnu/liblua5.1.so.0 0x7ffff7978361
14 TLuaInterpreter::call_luafunction TLuaInterpreter.cpp 10109 0x512d22
15 TTimer::execute TTimer.cpp 259 0x537400
16 mudlet::slot_timer_fires mudlet.cpp 887 0x5cbb17
17 mudlet::qt_static_metacall moc_mudlet.cpp 265 0x689850
18 QMetaObject::activate(QObject*, int, int, void**) /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5 0x7ffff5572261
19 QTimer::timerEvent(QTimerEvent*) /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5 0x7ffff557ef72
20 QObject::event(QEvent*) /home/vadi/Programs/Qt5.1.1/5.1.1/gcc_64/lib/libQt5Core.so.5 0x7ffff5573549
... <More>

[Vadim Peretokin (vperetokin)]

Here is valgrind output if it helps: http://pastebin.com/1yfYcqjx

I tried to investigate this - results are pointing towards the room already being deleted when it is getting deleted again, but I got nothing conclusive.

[Stephen Lyons (slysven)]

Just a thought - there is no chance of a circular exit in the (special
or otherwise) exits of the room being deleted? I.e. an exit that links
to the same room, it CAN happen in some MUDs and should be carefully
handled (or actually skipped) so you don't try to change the exit for
the room at the other end which is the SAME room... 8-S

On 21/09/13 02:13, Vadim Peretokin wrote:
> Here is valgrind output if it helps: http://pastebin.com/1yfYcqjx
>
> I tried to investigate this - results are pointing towards the room
> already being deleted when it is getting deleted again, but I got
> nothing conclusive.
>

[Vadim Peretokin (vperetokin)]

Valid point, although this area does not have such exits - it's part of a
wilderness (overview) area, so it's just the square connections. I checked
the particular room 14182000, and it doesn't have them.

[Stephen Lyons (slysven)]

Gosh there ARE some issues with this map:
Over 2000 "Lost" rooms - not in any area's rooms list.
Areas with an id of -1 or 0 - which some parts of the code will barf on...
A number of rooms that appear in the rooms list of more than ONE area.
A room with an id of "0".
Areas that have an Id number but no name.
Rooms that have an areaId number for a non-existent area.
And that area 255: that has over 40,000 rooms.
All in all, a rich source of things as a test case! 8-)

I think I've got to grips with most of these but the code that loads and initialises maps does seem a bit non-optimal...

[Vadim Peretokin (vperetokin)]

Yep... it's a real-world map that's been built up for quite a while. The
map data wasn't tampered with manually; it's a product of that the API and
the UI allowed to happen.

[Chris (chrismudlet)]

Fixed in latest development branch on github. I believe this change did it:
https://github.com/Mudlet/Mudlet/commit/d94ceda949201476f1f0f2587d519256f81bf5e4