Found with fuzzer: obfree: deleting worn obj (4: 512)

[elunna]

Testing convict drow - looks like an issue with droven arrows. I recorded with rr so more debugging is available if needed.

(rr) p toplines
$6 = "A cursed -1 dark elven arrow (in quiver) (1 aum) crumbles into fragments!", '\000' <repeats 226 times>

Suddenly, the dungeon collapses.
obfree: deleting worn obj (4: 512)
Generating more information you may report:

[0] ./evilhackdir/evilhack(+0x1403c1) [0x561fcdaac3c1]
[1] ./evilhackdir/evilhack(+0x140358) [0x561fcdaac358]
[2] ./evilhackdir/evilhack(panic+0x292) [0x561fcdaae85e]
[3] ./evilhackdir/evilhack(impossible+0x12f) [0x561fcdc82357]
[4] ./evilhackdir/evilhack(obfree+0x28a) [0x561fcdcd80a5]
[5] ./evilhackdir/evilhack(delobj_core+0x1fa) [0x561fcdae91f3]
[6] ./evilhackdir/evilhack(delobj+0x21) [0x561fcdae8ff6]
[7] ./evilhackdir/evilhack(breakobj+0x42d) [0x561fcda8f37f]
[8] ./evilhackdir/evilhack(hero_breaks+0x161) [0x561fcda8e011]
[9] ./evilhackdir/evilhack(+0x400138) [0x561fcdd6c138]
[10] ./evilhackdir/evilhack(hmon+0xde) [0x561fcdd618ef]
[11] ./evilhackdir/evilhack(thitmonst+0xba1) [0x561fcda8d0ad]
[12] ./evilhackdir/evilhack(throwit+0x196d) [0x561fcda8ac3f]
[13] ./evilhackdir/evilhack(+0x117810) [0x561fcda83810]
[14] ./evilhackdir/evilhack(dofire+0x2f2) [0x561fcda8439a]
[15] ./evilhackdir/evilhack(rhack+0x74b) [0x561fcda15a3b]
[16] ./evilhackdir/evilhack(moveloop+0x21ed) [0x561fcd9bdeae]
[17] ./evilhackdir/evilhack(main+0x5b4) [0x561fcddd4982]
[18] /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f9dd8401d90]
[19] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f9dd8401e40]

Program received signal SIGABRT, Aborted.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=140315920508736) at ./nptl/pthread_kill.c:44
44  ./nptl/pthread_kill.c: No such file or directory.
(rr) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140315920508736)
    at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=140315920508736)
    at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=140315920508736, signo=signo@entry=6)
    at ./nptl/pthread_kill.c:89
#3  0x00007f9dd841a476 in __GI_raise (sig=sig@entry=6)
    at ../sysdeps/posix/raise.c:26
#4  0x00007f9dd84007f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x0000561fcdaac379 in NH_abort () at end.c:236
#6  0x0000561fcdaae85e in panic (str=0x561fcde32ca8 "%s") at end.c:783
#7  0x0000561fcdc82357 in impossible (
    s=0x561fcde3e050 "obfree: deleting worn obj (%d: %ld)") at pline.c:518
#8  0x0000561fcdcd80a5 in obfree (obj=0x561fceeab410, merge=0x0) at shk.c:1016
#9  0x0000561fcdae91f3 in delobj_core (obj=0x561fceeab410, force=0 '\000')
    at invent.c:1259
#10 0x0000561fcdae8ff6 in delobj (obj=0x561fceeab410) at invent.c:1223
#11 0x0000561fcda8f37f in breakobj (obj=0x561fceeab410, x=18 '\022', 
    y=16 '\020', hero_caused=1 '\001', from_invent=0 '\000') at dothrow.c:2444
#12 0x0000561fcda8e011 in hero_breaks (obj=0x561fceeab410, x=18 '\022', 
    y=16 '\020', breakflags=0) at dothrow.c:2317
#13 0x0000561fcdd6c138 in hmon_hitmon (mon=0x561fceea7760, obj=0x561fceeab410, 
    thrown=1, dieroll=2) at uhitm.c:2043
#14 0x0000561fcdd618ef in hmon (mon=0x561fceea7760, obj=0x561fceeab410, thrown=1, dieroll=2) at uhitm.c:968
#15 0x0000561fcda8d0ad in thitmonst (mon=0x561fceea7760, obj=0x561fceeab410) at dothrow.c:2055
#16 0x0000561fcda8ac3f in throwit (obj=0x561fceeab410, wep_mask=512, twoweap=0 '\000') at dothrow.c:1592
#17 0x0000561fcda83810 in throw_obj (obj=0x561fceeab410, shotlimit=0) at dothrow.c:289
#18 0x0000561fcda8439a in dofire () at dothrow.c:477
#19 0x0000561fcda15a3b in rhack (cmd=0x561fcdeb5340 <in_line> "f") at cmd.c:5544
#20 0x0000561fcd9bdeae in moveloop (resuming=0 '\000') at allmain.c:804
#21 0x0000561fcddd4982 in main (argc=2, argv=0x7ffdc8b93638) at ../sys/unix/unixmain.c:353

[k21971]

Fixed via 1a3cb0b