Crash on svn 964 (repeat of Trac 7391)

[javelin]

Because 7391 won't view right for me, here it is again:

svn up'd to rev 964, reboot, crash on player connection, restarted, crash during restart (probably on @startups). Looks like slab allocation issues.

First crash produced this trace:

Script started on Fri Jun 22 07:23:30 2007
dunemush: ~/soc3/game^[k^[\> gdb netmush core^M
GNU gdb 6.4.90-debian
Core was generated by `netmush /home/dunemush/soc3/game/mush.cnf'.
Program terminated with signal 11, Segmentation fault.
#0  0x08079aa6 in do_second () at cque.c:471
471         if (IsPlayer(point->cause)) {
(gdb) where
#0  0x08079aa6 in do_second () at cque.c:471
#1  0x0812a151 in dispatch () at timer.c:220
#2  0x080582a9 in shovechars (port=4201, sslport=4202) at bsd.c:968
#3  0x08057a54 in main (argc=2, argv=0xbfcebfa4) at bsd.c:612
(gdb) print point
$1 = (BQUE *) 0x9397880
(gdb) p *point
$2 = {next = 0x0, player = 155172944, queued = 0, cause = 155172944, sem = 0,
  semattr = 0x0, left = 0, env = {0x0, 0x0, 0x93fc060
+"\340\351?\t\3704\211\263(DOW1",
    0x0, 0x93fc060 "\340\351?\t\3704\211\263(DOW1", 0x0, 0x0, 0x0, 0x0, 0x0},
+rval = {
    0x93fc070 "\340\351?\t\3704\211\263d/fu!", 0x0, 0x93fc070
+"\340\351?\t\3704\211\263d/fu!", 0x0,
    0x0, 0x0, 0x0, 0x0, 0x93fc080 "\340\351?\t\3704\211\263TD)]\021", 0x0,
    0x93fc080 "\340\351?\t\3704\211\263TD)]\021", 0x0, 0x0, 0x0, 0x0, 0x0,
    0x93fc090 "\340\351?\t\3704\211\263\220", 0x0, 0x93fc090
+"\340\351?\t\3704\211\263\220", 0x0, 0x0,
    0x0, 0x0, 0x0, 0x93fc0a0 "8\217)\t\b5\211\263()].", 0x0,
    0x93fc0a0 "8\217)\t\b5\211\263()].", 0x0, 0x0, 0x0, 0x0, 0x0,
    0x93fe9e8 "\2305\211\263\2305\211\263\021", 0x0,
    0x93fe9e8 "\2305\211\263\2305\211\263\021", 0x0}, comm = 0x0}
Script done on Fri Jun 22 07:24:21 2007

And netmush.log noted:

[06/22 07:22:17] Attempt to free object not allocated by slab allocator 'bvm.asm
node'!
[06/22 07:22:17] Attempt to free object not allocated by slab allocator 'bvm.asm
node'!
[06/22 07:22:17] Attempt to free object not allocated by slab allocator 'bvm.asm
node'!
[06/22 07:22:17] Attempt to free object not allocated by slab allocator 'bvm.asm
node'!
[06/22 07:22:17] Bad attribute name  on object #2038
[06/22 07:22:17] Bad attribute name  on object #2084
[06/22 07:22:17] Attempt to free object not allocated by slab allocator 'bvm.asm
node'!
[06/22 07:22:17] Attempt to free object not allocated by slab allocator 'bvm.asm
node'!

After a ./restart, this was netmush.log:

[06/22 07:24:44] RESTART FINISHED.
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:45] Attempt to free object not allocated by slab allocator 'command
+queues'!
[06/22 07:24:46] Attempt to free object not allocated by slab allocator 'command
+queues'!
*** glibc detected *** double free or corruption (fasttop): 0x08ebe358 ***
info_slave: error writing packet: Connection refused
info_slave: Parent mush process exited unexpectedly! Shutting down.

[Alan Schwartz]

(Oh, I backed this out of M*U*S*H, obviously)

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Javelin@M*U*S*H, once Paul@DuneMUSH | Alan Schwartz <dunemush@pennmush.org>
   (mush.pennmush.org 4201)         |     
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

[raevnos]

I fixed the problems I could reproduce (The cque.c-generated ones, but I bet the changes will fix the boolexp.c-generated ones too), and added a lot more logging to log/checkpt.log. Try again when we're both online?