Unknown crash

[Major Cooke]

[spoiler][/spoiler]

Alright, I'm trying to figure out what's causing this issue to occur. What I want to do is find out what is causing it, and I've been looking through the stack trace to see what's wrong. It just spontaneously crashes when I'm playing (Yes, it's with aeons of death...) and I know this much, it's access violation.

Code: Select all

Unhandled exception at 0x003B1450 in gzdoom.exe: 0xC0000005: Access violation reading location 0xDDDDDDED.

Code: Select all

   291: 	template<class T> inline T *ReadBarrier(T *&obj)
   292: 	{
003B1440  push        ebp  
003B1441  mov         ebp,esp  
   293: 		if (obj == NULL || !(obj->ObjectFlags & OF_EuthanizeMe))
003B1443  mov         eax,dword ptr [obj]  
003B1446  cmp         dword ptr [eax],0  
003B1449  je          GC::ReadBarrier<DHUDMessage>+18h (03B1458h)  
003B144B  mov         ecx,dword ptr [obj]  
003B144E  mov         edx,dword ptr [ecx]  
003B1450  mov         eax,dword ptr [edx+10h]  <-------------------------------------RIGHT HERE
003B1453  and         eax,20h  
003B1456  jne         GC::ReadBarrier<DHUDMessage>+1Fh (03B145Fh)  
   294: 		{
   295: 			return obj;
003B1458  mov         ecx,dword ptr [obj]  
003B145B  mov         eax,dword ptr [ecx]  
003B145D  jmp         GC::ReadBarrier<DHUDMessage>+2Ah (03B146Ah)  
   296: 		}
   297: 		return obj = NULL;
003B145F  mov         edx,dword ptr [obj]  
003B1462  mov         dword ptr [edx],0  
003B1468  xor         eax,eax  
   298: 	}
003B146A  pop         ebp  
003B146B  ret  

Graf, if you need the files yourself, I'll upload them all to google docs and send them to you via PM, but only if you need them. To put it lightly, AEoD is getting yet another update scheduled to come out soon. Though, technically, this could be one of blzut's turf areas as he deals with the sbarinfo stuff.

Here's the crash dump attached -- it's from running gzdoom via an earlier attempt but I have reason to believe it's the same one. Any ideas what might cause it?

[Major Cooke]

Oh wait... Fuck. Now I think I know what it's pointing towards...

Code: Select all

script "s914" (int hudsizex, int hudsizey)
{
	int commoncount = CheckInventory("L4DCommonCount");
	int tankcount = CheckInventory("L4DTankCount");
	int witchcount = CheckInventory("L4DWitchCount");
	int jockeycount = CheckInventory("L4DJockeyCount");
	int spittercount = CheckInventory("L4DSpitterCount");
	int huntercount = CheckInventory("L4DHunterCount");
	int boomercount = CheckInventory("L4DBoomerCount");
	int chargercount = CheckInventory("L4DChargerCount");
	int smokercount = CheckInventory("L4DSmokerCount");
	int maptotal = CheckInventory("L4DMapTotal");
	int currenttotal = CheckInventory("L4DCurrentTotal");
	int ccm = CheckInventory("L4DCCMultiplier");
	int hudyoffset = 200.0;

	SetHudSize(1024,768,0);
	HudMessage(s:"Common:"; HUDMSG_PLAIN,666,CR_BROWN,100.1,hudyoffset+25.1,0.15);
	HudMessage(s:"Tanks:"; HUDMSG_PLAIN,667,CR_BROWN,100.1,hudyoffset+35.1,0.15);
	HudMessage(s:"Witches:"; HUDMSG_PLAIN,668,CR_BROWN,100.1,hudyoffset+45.1,0.15);
	HudMessage(s:"Jockeys:"; HUDMSG_PLAIN,669,CR_BROWN,100.1,hudyoffset+55.1,0.15);
	HudMessage(s:"Spitters:"; HUDMSG_PLAIN,670,CR_BROWN,100.1,hudyoffset+65.1,0.15);
	HudMessage(s:"Hunters:"; HUDMSG_PLAIN,671,CR_BROWN,100.1,hudyoffset+75.1,0.15);
	HudMessage(s:"Boomers:"; HUDMSG_PLAIN,672,CR_BROWN,100.1,hudyoffset+85.1,0.15);
	HudMessage(s:"Chargers:"; HUDMSG_PLAIN,673,CR_BROWN,100.1,hudyoffset+95.1,0.15);
	HudMessage(s:"Smokers:"; HUDMSG_PLAIN,674,CR_BROWN,100.1,hudyoffset+105.1,0.15);
	HudMessage(s:"Map Total:"; HUDMSG_PLAIN,675,CR_BROWN,100.1,hudyoffset+125.1,0.15);
	HudMessage(s:"Current Total:"; HUDMSG_PLAIN,676,CR_BROWN,100.1,hudyoffset+135.1,0.15);
	HudMessage(s:"30000 Kills x"; HUDMSG_PLAIN,677,CR_BROWN,100.1,hudyoffset+145.1,0.15);
	
	HudMessage(i:commoncount; HUDMSG_PLAIN,678,CR_BROWN,300.1,hudyoffset+25.1,0.15);
	HudMessage(i:tankcount; HUDMSG_PLAIN,679,CR_BROWN,300.1,hudyoffset+35.1,0.15);
	HudMessage(i:witchcount; HUDMSG_PLAIN,680,CR_BROWN,300.1,hudyoffset+45.1,0.15);
	HudMessage(i:jockeycount; HUDMSG_PLAIN,681,CR_BROWN,300.1,hudyoffset+55.1,0.15);
	HudMessage(i:spittercount; HUDMSG_PLAIN,682,CR_BROWN,300.1,hudyoffset+65.1,0.15);
	HudMessage(i:huntercount; HUDMSG_PLAIN,683,CR_BROWN,300.1,hudyoffset+75.1,0.15);
	HudMessage(i:boomercount; HUDMSG_PLAIN,684,CR_BROWN,300.1,hudyoffset+85.1,0.15);
	HudMessage(i:chargercount; HUDMSG_PLAIN,685,CR_BROWN,300.1,hudyoffset+95.1,0.15);
	HudMessage(i:smokercount; HUDMSG_PLAIN,686,CR_BROWN,300.1,hudyoffset+105.1,0.15);
	HudMessage(i:maptotal; HUDMSG_PLAIN,687,CR_BROWN,300.1,hudyoffset+125.1,0.15);
	HudMessage(i:currenttotal; HUDMSG_PLAIN,688,CR_BROWN,300.1,hudyoffset+135.1,0.15);
	HudMessage(i:ccm; HUDMSG_PLAIN,689,CR_BROWN,300.1,hudyoffset+145.1,0.15);
	SetHudSize(0,0,0);
	delay(5);
	restart;
}

Only thing is, now I'm not sure about what might possibly be wrong with this setup.

[Graf Zahl]

No idea. You already had the debugger open so you could have made some checks in the calling functions. GC::ReadBarrier is one of the most frequently called functions in the entire engine so that doesn't help one bit.
All I can say is that it tried to access an invalid pointer to a HUD message. No idea why, though.

[Major Cooke]

Alright, how do I make these checks? I'm not sure what to do in that regard.

[Major Cooke]

Also, in that regard I did go back through the locals and I did some searching, it pointed back to the script that I mentioned above. But if there's more, then I'd definitely like to investigate more, so if you could provide any ideas on what to do for this checking you speak of, please do tell. I will happily explore any and all possible paths to finding what causes it.

[Graf Zahl]

What I can see is that the linked list of HUD messages is somehow broken, but I have no idea what happened there. So, if it crashes, the contents of the last valid message in the list may be interesting.

[Major Cooke]

Okay. So what checks can I perform when I have the debugger running and I catch it?

Or would you prefer I just send you the files now? The thing is, it usually takes a half hour or an hour (sometimes sooner if lucky) for it to trigger... I will need to send it via PM 'cause file sizes, and it's not ready for release yet.

[Graf Zahl]

My suspicion is that the garbage collector is responsible, but that's not code I understand well. Best repost the report at the ZDoom forums. Even though Randy is mostly absent he's the only one who can make sense of this...

[Major Cooke]

Done. http://forum.zdoom.org/viewtopic.php?f=2&t=47183

[Major Cooke]

H'uh... After doing some extensive testing with zdoom (both x32 and x64), neither of the maps locked up on me in the areas which usually caused the out of memory or crash area... It's strange. I don't know what to make of it. Mainly, it would run out of memory on Hellbound map 29.

ZDoom never ran out of memory once for me, but GZDoom? It just keeps doing it, and I even updated to when you merged all the other commits most recently.

I'm going to send you a PM with all the files intact like I did Randy.

[Gez]

Are you using one of the texture scalers? (Scalenx or HQnx) They can increase memory consumption quite a lot when loading image-intensive mods.

[Major Cooke]

No. Though I did change a few around (I turned on resize fonts, sprites and textures, along with 'sort draw lists by texture' and 'camera textures offscreen') just recently to see if that would help. Still testing it out.

[spoiler][/spoiler]