Found with fuzzer: eel hiding out of water (fmon)

[elunna]

This is a bug I've been running into a lot in HackEM - which I thought was due to adding grass and updating some mechanics related to hiding monsters. However, I decided to start fuzzing Evilhack to see if the problem was there too and it has popped up a couple of times.

The related hackem issue is here: https://github.com/elunna/hackem/issues/106.

The problem seems to originate in the gnomish mines (dnum 2). When I check the square the eel is on, it is a STAIRS(26) tile. So this might be a stair placement issue after the level had run makerivers()

This could also be related to running the fuzzer with wizmakemap bound.

Suddenly, the dungeon collapses.
eel hiding out of water (fmon)
Generating more information you may report:

[0] /home/lunatunez/games/evilhackdir/evilhack(+0x135e38) [0x555555689e38]
[1] /home/lunatunez/games/evilhackdir/evilhack(+0x135dd2) [0x555555689dd2]
[2] /home/lunatunez/games/evilhackdir/evilhack(panic+0x27d) [0x55555568c149]
[3] /home/lunatunez/games/evilhackdir/evilhack(impossible+0x126) [0x5555558400fd]
[4] /home/lunatunez/games/evilhackdir/evilhack(+0x235774) [0x555555789774]
[5] /home/lunatunez/games/evilhackdir/evilhack(mon_sanity_check+0x37) [0x5555557898c1]
[6] /home/lunatunez/games/evilhackdir/evilhack(sanity_check+0x17) [0x5555555f9087]
[7] /home/lunatunez/games/evilhackdir/evilhack(moveloop+0x1ea3) [0x5555555a4b64]
[8] /home/lunatunez/games/evilhackdir/evilhack(main+0x599) [0x55555597e442]
[9] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7ffff7d96083]
[10] /home/lunatunez/games/evilhackdir/evilhack(_start+0x2e) [0x5555555a256e]

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50  ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7d94859 in __GI_abort () at abort.c:79
#2  0x0000555555689df3 in NH_abort () at end.c:236
#3  0x000055555568c149 in panic (str=0x5555559dc348 "%s") at end.c:783
#4  0x00005555558400fd in impossible (s=0x5555559cdb36 "eel hiding out of water (%s)")
    at pline.c:518
#5  0x0000555555789774 in sanity_check_single_mon (mtmp=0x555555bd9ef0, chk_geno=1 '\001', 
    msg=0x5555559cdbb7 "fmon") at mon.c:122
#6  0x00005555557898c1 in mon_sanity_check () at mon.c:146
#7  0x00005555555f9087 in sanity_check () at cmd.c:4860
#8  0x00005555555a4b64 in moveloop (resuming=0 '\000') at allmain.c:740
#9  0x000055555597e442 in main (argc=4, argv=0x7fffffffe628) at ../sys/unix/unixmain.c:353
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Full backtrace:

Program received signal SIGINT, Interrupt.
0x00007ffff744efd2 in __GI___libc_read (fd=0, buf=0x619000000a80, nbytes=1024)
    at ../sysdeps/unix/sysv/linux/read.c:26
26  ../sysdeps/unix/sysv/linux/read.c: No such file or directory.
$1 = {dnum = 2 '\002', dlevel = 1 '\001'}
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {0, 0, 0, 0, 0, 93824992231424, 93824993500108, 335544320, 
            140737351733392, 1073741824, 140737488349266, 93824992231424, 93824992365080, 
            14458514477279307008, 140737488345824, 93824995294924}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1  0x00007ffff7d94859 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x555555574a18, 
            sa_sigaction = 0x555555574a18}, sa_mask = {__val = {14458514477279307008, 
              140737488345824, 93824995294924, 93824992336672, 93824996851109, 206158430232, 
              140737488345840, 140737488345648, 14458514477279307008, 140737353865712, 10, 
              93824999099140, 335544320, 140737351733392, 14458514477279307008, 16}}, 
          sa_flags = 1432919400, sa_restorer = 0x5555555a2540 <_start>}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x0000555555689df3 in NH_abort () at end.c:236
        gdb_prio = 1
        libc_prio = 2
        aborting = 1 '\001'
#3  0x000055555568c149 in panic (str=0x5555559dc348 "%s") at end.c:783
        the_args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffffffddf0, 
            reg_save_area = 0x7fffffffdd30}}
#4  0x00005555558400fd in impossible (s=0x5555559cdb36 "eel hiding out of water (%s)")
    at pline.c:518
        pbuf = "eel hiding out of water (fmon)", '\000' <repeats 850 times>...
        the_args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffffffe3f0, 
            reg_save_area = 0x7fffffffe330}}
#5  0x0000555555789774 in sanity_check_single_mon (mtmp=0x555555bd9ef0, chk_geno=1 '\001', 
    msg=0x5555559cdbb7 "fmon") at mon.c:122
        t = 0x15
        mptr = 0x555555a3fb28 <mons+43784>
        mx = 77
        my = 11
#6  0x00005555557898c1 in mon_sanity_check () at mon.c:146
        x = 78
        y = 18
        mtmp = 0x555555bd9ef0
        m = 0x555555bd6930
#7  0x00005555555f9087 in sanity_check () at cmd.c:4860
No locals.
#8  0x00005555555a4b64 in moveloop (resuming=0 '\000') at allmain.c:740
        moveamt = 10
        wtcap = 0
        change = 0
        monscanmove = 0 '\000'
        timeout_start = 30375
        past_clock = 14551352
        elf_regen = 1 '\001'
        orc_regen = 1 '\001'
#9  0x000055555597e442 in main (argc=4, argv=0x7fffffffe628) at ../sys/unix/unixmain.c:353
        fd = -1
        dir = 0xffffffff <error: Cannot access memory at address 0xffffffff>
        exact_username = 0 '\000'
        resuming = 0 '\000'
        plsel_once = 1 '\001'

[k21971]

Closed via commit 3af5704.