Bug 4893 - [botlib] AAS_PredictRoute segfaults reported in oa_dm1
Status: REOPENED
Alias: None
Product: ioquake3
Classification: Unclassified
Component: Misc
Version: unspecified
Hardware: PC Linux
: P3 normal
Assignee: Zachary J. Slater
QA Contact: ioquake3 bugzilla mailing list
URL:
Depends on:
Blocks:
 
Reported: 2011-02-05 09:37 EST by Simon McVittie
Modified: 2015-08-10 14:21:30 EDT
3 users (show)

See Also:


Attachments
backtrace for a crash at botlib/be_aas_route.c:1863 (8.94 KB, text/plain)
2011-02-05 09:37 EST, Simon McVittie
backtrace for a crash at botlib/be_aas_route.c:1860 (9.10 KB, text/plain)
2011-02-05 09:38 EST, Simon McVittie
maybe fix for crash (2.28 KB, patch)
2011-02-06 15:57 EST, Thilo Schulz
Core file of a crash at botlib/be_aas_route.c:1864: debian wheezy i386 (779.06 KB, application/x-bzip)
2012-07-27 02:18 EDT, Markus Koschany
backtrace for a crash at botlib/be_aas_route.c:1864: debian wheezy i386 (25.45 KB, text/x-log)
2012-07-27 02:22 EDT, Markus Koschany
backtrace for a crash at botlib/be_aas_route.c:1864: debian wheezy amd64 (50.52 KB, text/x-log)
2012-07-27 02:25 EDT, Markus Koschany
Patch to add r2385 to ioq3 r2287. (8.74 KB, patch)
2013-02-11 18:25 EST, Zack Middleton

Description Simon McVittie 2011-02-05 09:37:22 EST
Created attachment 2577 [details]
backtrace for a crash at botlib/be_aas_route.c:1863

A couple of segfaults have been reported in Debian's patched ioquake3-server when playing the OpenArena map oa_dm1. Our patches don't touch botlib (apart from some spelling fixes applied in r1853), so these backtraces are probably equally applicable to ioquake3; attaching them here before I work on this myself.

From a cursory look at one of the backtraces, the local variables in BotDeathmatchAI and BotAI look quite scrambled; this might just be from optimization, or it might be a bug in OpenArena's code/game/ leading to bad arguments to AAS_PredictRoute. If the latter, then not checking arguments for validity would still be an engine bug.

This is Debian bug <http://bugs.debian.org/607178>.
Comment 1 Simon McVittie 2011-02-05 09:38:16 EST
Created attachment 2578 [details]
backtrace for a crash at botlib/be_aas_route.c:1860
Comment 2 Simon McVittie 2011-02-05 11:26:24 EST
I can't make much sense out of the backtraces, I'm afraid.
Comment 3 Thilo Schulz 2011-02-06 15:57:43 EST
Created attachment 2580 [details]
maybe fix for crash

I don't know anything about the code, I can only see from the backtraces where it must have crashed. Please try attached patch and tell me whether it prevents the crash.
Comment 4 Thilo Schulz 2011-03-07 17:16:47 EST
Simon, please test the attached patch so I can get rid of the bug or not.
Comment 5 Simon McVittie 2011-03-10 18:28:49 EST
That's a bit difficult since I've never seen this crash myself (running the same configuration as the bug reporter for a while seemed to work fine), but I'll apply it in Debian experimental and ask the bug reporter to try it out...
Comment 6 Thilo Schulz 2011-03-23 11:15:20 EDT
I can't reproduce the crash with the OpenArena version 0.95 that is downloadable from openarena.ws, and I had a server running that map for 2 days with 4 bots. The information is very sparse, I know not what ARCH this is running on, gametype, what compiler flags does noopt/nostrip in DEB_BUILD_OPTIONS enable? etc...

The bug must also lie somewhere else than the displayed codelines, without access to a gdb where this crash bug appeared I cannot help you.

Please note that the patch is buggy and will probably break bot navigation, so I would advise against applying it to debian. Also, the patch is only a workaround for an issue that lies somewhere else in the code. And I'm not going to apply an ugly workaround to svn.

This is the pak file where my oa_dm1.aas resides:

/opt/quake3/baseoa/pak6-misc.pk3
md5sum:
431a43978abaa529335d0cf4e44d0b50  /opt/quake3/baseoa/pak6-misc.pk3

I'll close this bug as WORKSFORME. If you can talk the reporter into providing a shell for me where I can investigate with gdb, by all means, reopen this here.
Comment 7 Markus Koschany 2012-07-27 02:14:13 EDT
Hello, i have discovered the same issues with Ioquake3 and OpenArena version 0.8.5 in Debian Squeeze and OpenArena 0.8.8 in Debian Wheezy running Ioquake 3 svn2287. I therefore would like to reopen this bug report. 

This is Debian bug http://bugs.debian.org/664637 and it is most likely a duplicate of #607178.

The segfaults are triggered by bots and there is a higher probability on oa_dm1 and oa_dm7 that you will be affected by them. The occurrences of this bug have become quite rare after i have switched to the latest version in Wheezy.

I have attached two backtraces and a core file. I hope they are helpful. The first segfault happened on oa_dm7. I was running a 64 bit Debian Squeeze system, OpenArena 0.8.8 and Ioquake3+svn2287.

I could reproduce this on a Pentium II notebook, i386 architecture, which is running Wheezy. There is no reliable way to reproduce this bug. You simply need to be patient and it will crash after two days or maybe two weeks. 

aptitude install openarena-server ioquake3-dbg openarena-dbg, a standard configuration, 4 bots playing only oa_dm7 and oa_dm1 in a deathmatch environment should be sufficient to be successful.
Comment 8 Markus Koschany 2012-07-27 02:18:40 EDT
Created attachment 3254 [details]
Core file of a crash at botlib/be_aas_route.c:1864: debian wheezy i386
Comment 9 Markus Koschany 2012-07-27 02:22:08 EDT
Created attachment 3255 [details]
backtrace for a crash at botlib/be_aas_route.c:1864: debian wheezy i386
Comment 10 Markus Koschany 2012-07-27 02:25:32 EDT
Created attachment 3256 [details]
backtrace for a crash at botlib/be_aas_route.c:1864: debian wheezy amd64
Comment 11 Zack Middleton 2013-02-11 17:26:52 EST
I think this may have been fixed by r2385. It fixed AAS_PredictRoute getting bad arguments in some cases. Could you test git master?
Comment 12 Markus Koschany 2013-02-11 18:09:32 EST
Thanks for working on this. Would it be possible to provide a patch against r2287, the revision Debian uses at the moment? If not it will take a little longer to report back, but i will do it .
Comment 13 Zack Middleton 2013-02-11 18:25:09 EST
Created attachment 3328 [details]
Patch to add r2385 to ioq3 r2287.
Comment 14 Markus Koschany 2013-02-19 09:28:49 EST
I have been testing your patch for a week 24/7 but unfortunately the server crashed twice, one time on oasago2 and also on oa_dm1. I'll continue watching the issue.
Comment 15 Zachary J. Slater 2015-08-10 12:12:56 EDT
It's been two years since the last comment, is this issue still present or can this bug be closed?
Comment 16 Markus Koschany 2015-08-10 14:21:30 EDT
Yes, this is still an issue with the version of OpenArena and ioquake3 in Debian Jessie.