crash when leaving a multiplayer game

[GoogleCodeExporter]

When leaving a multiplayer game (in quadra-sdl, the X11 version works
fine), there is a crash. Here is the stack trace:

0  0x3001ee84 in SDL_FreeFormat ()
#1  0x30024e90 in SDL_FreeSurface ()
#2  0x0007fcc4 in Bitmap::~Bitmap (this=0x5803640) at
skelton/common/bitmap.cpp:49
#3  0x00038db4 in Multi_player::~Multi_player (this=0xa84a00) at
source/multi_player.cpp:161
#4  0x000a1b34 in Executor::remove ()
#5  0x000a1c94 in Executor::step ()
#6  0x000a1fe0 in Overmind::step ()
#7  0x00008550 in start_game () at source/quadra.cpp:2313
#8  0x000acdb4 in SDL_main ()

Original issue reported on code.google.com by pphaneuf on 9 Nov 2008 at 5:57

[GoogleCodeExporter]

I seems to be on that line, on the third iteration of the loop:

http://code.google.com/p/quadra/source/browse/branches/quadra-sdl/source/multi_p
layer.cpp?r=600#157

It looks like memory corruption, with the beginning of the SDL_Surface being
corrupted, but it moves around if I add fprintfs around (to debug), so argh...

Original comment by pphaneuf on 13 Dec 2008 at 11:41

[GoogleCodeExporter]

Valgrind points us further toward the culprit:

==11468== Mismatched free() / delete / delete []
==11468==    at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==11468==    by 0x80B2FE8: Chat_interface::~Chat_interface() (pane.cpp:1149)
==11468==    by 0x808CAD1: Array<Zone*>::deleteall() (array.h:70)
==11468==    by 0x80CD507: Zone_list::deleteall() (zone_list.cpp:24)
==11468==    by 0x808EFC1: Zone_list::~Zone_list() (zone_list.h:33)
==11468==    by 0x80B70DE: Pane::~Pane() (pane.cpp:67)
==11468==    by 0x80B7437: Pane_close::~Pane_close() (pane.cpp:351)
==11468==    by 0x80B8B37: Pane_scoreboard::~Pane_scoreboard() (pane.cpp:1223)
==11468==    by 0x80B8FCA: Pane_chat::~Pane_chat() (pane.cpp:1416)
==11468==    by 0x80E7A39: Executor::remove() (overmind.cpp:103)
==11468==    by 0x80E7B85: Executor::~Executor() (overmind.cpp:99)
==11468==    by 0x80961C9: Multi_player::~Multi_player() (multi_player.cpp:156)
==11468==  Address 0x53be380 is 0 bytes inside a block of size 60 alloc'd
==11468==    at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==11468==    by 0x40646BB: SDL_CreateRGBSurface (in 
/usr/lib/libSDL-1.2.so.0.11.1)
==11468==    by 0x80D29CA: Image::new_surface() const (image_png.cpp:26)
==11468==    by 0x80CD560: Bitmap::Bitmap(Image const&) (bitmap.cpp:45)
==11468==    by 0x8096BF8: Multi_player::Multi_player(int*) 
(multi_player.cpp:55)
==11468==    by 0x809760A: Multi_player_launcher::init() (multi_player.cpp:343)
==11468==    by 0x80E7AD1: Executor::step() (overmind.cpp:115)
==11468==    by 0x80E77BA: Overmind::step() (overmind.cpp:64)
==11468==    by 0x804E886: start_game() (quadra.cpp:2313)
==11468==    by 0x80EDCEA: main (main.cpp:141)

Original comment by pphaneuf on 14 Dec 2008 at 9:37

[GoogleCodeExporter]

Fixed by r659.

Original comment by pphaneuf on 15 Dec 2008 at 12:19

• Changed state: Fixed