Rigs-of-rods: Crash on loading miniredmars map

[Bob-Z]

I have a crash when loading miniredmars map.

GDB back trace, Valgrind trace and dumb attempt follow:

This is gdb back trace:

Rig loading profiler report:
Beam::Beam() | prepare loading: 0.000156 sec
Beam::LoadTruck() | open file: 0.000030 sec
Beam::LoadTruck() | create parser: 0.000011 sec
Beam::LoadTruck() | prepare parser: 0.000015 sec
Beam::LoadTruck() | run parser: 0.000211 sec
Beam::LoadTruck() | finalize parser: 0.000187 sec
Beam::LoadTruck() | post-parse: 0.000013 sec
Beam::LoadTruck() | setup validator: 0.000007 sec
Beam::LoadTruck() | run validator: 0.000002 sec
Beam::LoadTruck() | post-validation: 0.000007 sec
Beam::LoadTruck() | setup spawner: 0.000009 sec
Beam::LoadTruck() | add modules: 0.000000 sec
Beam::LoadTruck() | run spawner: 0.007217 sec
Beam::LoadTruck() | log spawner: 0.000093 sec
Beam::LoadTruck() | process fixes: 0.000001 sec
Beam::LoadTruck() | calc masses: 0.000016 sec
Beam::LoadTruck() | soundsources: 0.000018 sec
Beam::LoadTruck() | calc node graph: 0.000004 sec
Beam::LoadTruck() | bounding boxes: 0.000001 sec
Beam::LoadTruck() | groundmodel: 0.000094 sec
Beam::LoadTruck() | load dashboards: 0.000001 sec
BeamFactory::createLocal() | post-process: 0.000053 sec
RigLoadingProfiler::Report() | compose report: 0.000010 sec
Widget property 'Text_TextAlign' have type prefix - use 'TextAlign' instead [MapEntity.layout]
Widget property 'Text_FontHeight' have type prefix - use 'FontHeight' instead [MapEntity.layout]
static map icon not found: icon_load.dds
===== LOADING VEHICLE: bombinette.load
== Parsing vehicle file: bombinette.load
== Parsing done OK, nothing to report

== Validating vehicle: bombinette
== Validating done OK
== Spawning vehicle: bombinette
duplicate resource name 'DefaultDashFont'
ResourceTrueTypeFont: Font 'DefaultDashFont' using texture size 128 x 128.
ResourceTrueTypeFont: Font 'DefaultDashFont' using real height 18 pixels.
duplicate resource name 'Digital-7'
ResourceTrueTypeFont: Font 'Digital-7' using texture size 512 x 256.
ResourceTrueTypeFont: Font 'Digital-7' using real height 65 pixels.
duplicate resource name 'Digital-7-18'
ResourceTrueTypeFont: Font 'Digital-7-18' using texture size 128 x 256.
ResourceTrueTypeFont: Font 'Digital-7-18' using real height 24 pixels.

Thread 1 "RoR" received signal SIGSEGV, Segmentation fault.
0x00007ffff493c609 in _int_malloc (av=av@entry=0x7ffff4c79b00 ,
bytes=bytes@entry=156) at malloc.c:3762
3762 malloc.c: No such file or directory.
(gdb) bt

0 0x00007ffff493c609 in _int_malloc (

av=av@entry=0x7ffff4c79b00 <main_arena>, bytes=bytes@entry=156)
at malloc.c:3762

1 0x00007ffff493dde4 in __GI___libc_malloc (bytes=156) at malloc.c:2925

2 0x00005555558baccf in FlexMesh::FlexMesh (this=0x55555a431e80, name=...,

nds=<optimized out>, n1=<optimized out>, n2=<optimized out>, 
nstart=<optimized out>, nrays=13, face_material_name="bombinette2", 
band_material_name="bombinette2", rimmed=false, rimratio=<optimized out>)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/physics/flex/FlexMesh.cpp:127

3 0x0000555555883d25 in RigSpawner::CreateWheelVisuals (

this=this@entry=0x7fffffffa790, wheel_index=wheel_index@entry=0, 
node_base_index=node_base_index@entry=11, num_rays=13, 
rim_material_name="bombinette2", band_material_name="bombinette2", 
separate_rim=false, rim_ratio=rim_ratio@entry=1)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/physics/RigSpawner.cpp:5418

4 0x000055555588450b in RigSpawner::CreateWheelVisuals (node_base_index=11,

wheel_def=..., wheel_index=0, this=0x7fffffffa790)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/physics/RigSpawner.cpp:5368

5 RigSpawner::AddWheel (this=this@entry=0x7fffffffa790, wheel_def=...)

at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/physics/RigSpawner.cpp:4990

6 0x00005555558847fa in RigSpawner::ProcessWheel (

this=this@entry=0x7fffffffa790, def=...)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/physics/RigSpawner.cpp:5533

7 0x000055555588e98b in RigSpawner::SpawnRig (this=this@entry=0x7fffffffa790)

at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/physics/RigSpawner_ProcessControl.cpp:226

8 0x000055555583fdc6 in Beam::LoadTruck (this=this@entry=0x55555bc3a1c0,

rig_loading_profiler=rig_loading_profiler@entry=0x7fffffffbd90, 
file_name="bombinette.load", 
parent_scene_node=parent_scene_node@entry=0x7fffa69fbee8, 
spawn_position=..., spawn_rotation=..., spawn_box=0x0, 
cache_entry_number=-1)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/physics/Beam.cpp:6062

9 0x000055555584669d in Beam::Beam (this=0x55555bc3a1c0,

truck_number=<optimized out>, pos=..., rot=..., 
fname=0x7fffffffc850 "bombinette.load", 
rig_loading_profiler=0x7fffffffbd90, _networked=<optimized out>, 
_networking=<optimized out>, spawnbox=0x0, ismachine=false, 
truckconfig=0x0, skin=0x0, freeposition=false, 
preloaded_with_terrain=true, cache_entry_number=-1)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/physics/Beam.cpp:5767

10 0x000055555584d179 in BeamFactory::CreateLocalRigInstance (

this=0x5555568115b0, pos=..., rot=..., fname="bombinette.load", 
cache_entry_number=cache_entry_number@entry=-1, 
spawnbox=spawnbox@entry=0x0, ismachine=ismachine@entry=false, 
truckconfig=truckconfig@entry=0x0, skin=0x0, freePosition=false, 
preloaded_with_terrain=true)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/physics/BeamFactory.cpp:242

11 0x000055555597b157 in TerrainObjectManager::loadPreloadedTrucks (

this=0x5555570344e0)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/terrain/TerrainObjectManager.cpp:1391

12 0x0000555555976326 in TerrainManager::loadPreloadedTrucks (

this=<optimized out>)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/terrain/TerrainManager.cpp:800

13 0x0000555555674c60 in RoR::MainThread::SetupGameplayLoop (

this=this@entry=0x7fffffffd560)
at /home/red/rigs-of-rods/source/rigs-of-rods/source/main/MainThread.cpp:597

14 0x00005555556760c8 in RoR::MainThread::Go (this=0x7fffffffd560)

This is Valgrind trace:

Rig loading profiler report:
Beam::Beam() | prepare loading: 0.000810 sec
Beam::LoadTruck() | open file: 0.000331 sec
Beam::LoadTruck() | create parser: 0.000105 sec
Beam::LoadTruck() | prepare parser: 0.000228 sec
Beam::LoadTruck() | run parser: 0.007769 sec
Beam::LoadTruck() | finalize parser: 0.011152 sec
Beam::LoadTruck() | post-parse: 0.000233 sec
Beam::LoadTruck() | setup validator: 0.000258 sec
Beam::LoadTruck() | run validator: 0.000546 sec
Beam::LoadTruck() | post-validation: 0.000128 sec
Beam::LoadTruck() | setup spawner: 0.000187 sec
Beam::LoadTruck() | add modules: 0.000005 sec
Beam::LoadTruck() | run spawner: 0.186995 sec
Beam::LoadTruck() | log spawner: 0.001232 sec
Beam::LoadTruck() | process fixes: 0.000027 sec
Beam::LoadTruck() | calc masses: 0.000307 sec
Beam::LoadTruck() | soundsources: 0.000433 sec
Beam::LoadTruck() | calc node graph: 0.000131 sec
Beam::LoadTruck() | bounding boxes: 0.000007 sec
Beam::LoadTruck() | groundmodel: 0.002666 sec
Beam::LoadTruck() | load dashboards: 0.000002 sec
BeamFactory::createLocal() | post-process: 0.002434 sec
RigLoadingProfiler::Report() | compose report: 0.000309 sec
Widget property 'Text_TextAlign' have type prefix - use 'TextAlign' instead [MapEntity.layout]
Widget property 'Text_FontHeight' have type prefix - use 'FontHeight' instead [MapEntity.layout]
static map icon not found: icon_load.dds
===== LOADING VEHICLE: bombinette.load
== Parsing vehicle file: bombinette.load
== Parsing done OK, nothing to report

== Validating vehicle: bombinette
== Validating done OK
== Spawning vehicle: bombinette
duplicate resource name 'DefaultDashFont'
ResourceTrueTypeFont: Font 'DefaultDashFont' using texture size 128 x 128.
ResourceTrueTypeFont: Font 'DefaultDashFont' using real height 18 pixels.
duplicate resource name 'Digital-7'
ResourceTrueTypeFont: Font 'Digital-7' using texture size 512 x 256.
ResourceTrueTypeFont: Font 'Digital-7' using real height 65 pixels.
duplicate resource name 'Digital-7-18'
ResourceTrueTypeFont: Font 'Digital-7-18' using texture size 128 x 256.
ResourceTrueTypeFont: Font 'Digital-7-18' using real height 24 pixels.
==14172== Invalid write of size 4
==14172== at 0x46EBB5: operator= (OgreVector2.h:131)
==14172== by 0x46EBB5: FlexMesh::FlexMesh(std::__cxx11::basic_string, std::allocator > const&, node_t, int, int, int, int, std::__cxx11::basic_string, std::allocator > const&, std::__cxx11::basic_string, std::allocator > const&, bool, float) (FlexMesh.cpp:105)
==14172== by 0x437D24: RigSpawner::CreateWheelVisuals(unsigned int, unsigned int, unsigned int, std::__cxx11::basic_string, std::allocator > const&, std::__cxx11::basic_string, std::allocator > const&, bool, float) (RigSpawner.cpp:5418)
==14172== by 0x43850A: CreateWheelVisuals (RigSpawner.cpp:5368)
==14172== by 0x43850A: RigSpawner::AddWheel(RigDef::Wheel&) (RigSpawner.cpp:4990)
==14172== by 0x44298A: RigSpawner::SpawnRig() (RigSpawner_ProcessControl.cpp:226)
==14172== by 0x3F3DC5: Beam::LoadTruck(RoR::RigLoadingProfiler, std::__cxx11::basic_string, std::allocator > const&, Ogre::SceneNode, Ogre::Vector3 const&, Ogre::Quaternion&, collision_box_t, int) (Beam.cpp:6062)
==14172== by 0x3FA69C: Beam::Beam(int, Ogre::Vector3, Ogre::Quaternion, char const, RoR::RigLoadingProfiler, bool, bool, collision_box_t, bool, std::vector, std::allocator >, std::allocator, std::allocator > > > const, Skin, bool, bool, int) (Beam.cpp:5767)
==14172== by 0x401178: BeamFactory::CreateLocalRigInstance(Ogre::Vector3, Ogre::Quaternion, std::__cxx11::basic_string, std::allocator >, int, collision_box_t, bool, std::vector, std::allocator >, std::allocator, std::allocator > > > const, Skin, bool, bool) (BeamFactory.cpp:242)
==14172== by 0x52F156: TerrainObjectManager::loadPreloadedTrucks() (TerrainObjectManager.cpp:1391)
==14172== by 0x228C5F: RoR::MainThread::SetupGameplayLoop() (MainThread.cpp:597)
==14172== by 0x22A0C7: RoR::MainThread::Go() (MainThread.cpp:333)
==14172== by 0x20DA7C: main (main.cpp:111)
==14172== Address 0x13003cd8 is 24 bytes after a block of size 1,728 in arena "client"
==14172==

valgrind: m_mallocfree.c:303 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 1792, hi = 1065353216.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata. If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away. Please try that before reporting this as a bug.

host stacktrace:
==14172== at 0x380882AA: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==14172== by 0x380883C4: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==14172== by 0x3808855A: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==14172== by 0x38096B62: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==14172== by 0x3808149A: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==14172== by 0x3807FB93: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==14172== by 0x3808426D: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==14172== by 0x3807F09A: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==14172== by 0x815649740: ???
==14172== by 0x802EB5F2F: ???
==14172== by 0x8020082DF: ???
==14172== by 0x8020082DF: ???
==14172== by 0x802EB5F2F: ???
==14172== by 0x1BFF: ???

sched status:
running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 14172)
==14172== at 0x46EBBA: operator= (OgreVector2.h:132)
==14172== by 0x46EBBA: FlexMesh::FlexMesh(std::__cxx11::basic_string, std::allocator > const&, node_t, int, int, int, int, std::__cxx11::basic_string, std::allocator > const&, std::__cxx11::basic_string, std::allocator > const&, bool, float) (FlexMesh.cpp:105)
==14172== by 0x437D24: RigSpawner::CreateWheelVisuals(unsigned int, unsigned int, unsigned int, std::__cxx11::basic_string, std::allocator > const&, std::__cxx11::basic_string, std::allocator > const&, bool, float) (RigSpawner.cpp:5418)
==14172== by 0x43850A: CreateWheelVisuals (RigSpawner.cpp:5368)
==14172== by 0x43850A: RigSpawner::AddWheel(RigDef::Wheel&) (RigSpawner.cpp:4990)
==14172== by 0x44298A: RigSpawner::SpawnRig() (RigSpawner_ProcessControl.cpp:226)
==14172== by 0x3F3DC5: Beam::LoadTruck(RoR::RigLoadingProfiler, std::__cxx11::basic_string, std::allocator > const&, Ogre::SceneNode, Ogre::Vector3 const&, Ogre::Quaternion&, collision_box_t, int) (Beam.cpp:6062)
==14172== by 0x3FA69C: Beam::Beam(int, Ogre::Vector3, Ogre::Quaternion, char const, RoR::RigLoadingProfiler, bool, bool, collision_box_t, bool, std::vector, std::allocator >, std::allocator, std::allocator > > > const, Skin, bool, bool, int) (Beam.cpp:5767)
==14172== by 0x401178: BeamFactory::CreateLocalRigInstance(Ogre::Vector3, Ogre::Quaternion, std::__cxx11::basic_string, std::allocator >, int, collision_box_t, bool, std::vector, std::allocator >, std::allocator, std::allocator > > > const, Skin, bool, bool) (BeamFactory.cpp:242)
==14172== by 0x52F156: TerrainObjectManager::loadPreloadedTrucks() (TerrainObjectManager.cpp:1391)
==14172== by 0x228C5F: RoR::MainThread::SetupGameplayLoop() (MainThread.cpp:597)
==14172== by 0x22A0C7: RoR::MainThread::Go() (MainThread.cpp:333)
==14172== by 0x20DA7C: main (main.cpp:111)

Thread 2: status = VgTs_WaitSys (lwpid 14242)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x1707F4D2: ??? (in /usr/lib/x86_64-linux-gnu/dri/r600_dri.so)
==14172== by 0x1707EC16: ??? (in /usr/lib/x86_64-linux-gnu/dri/r600_dri.so)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 3: status = VgTs_WaitSys (lwpid 14285)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x5252278: wait > (condition_variable.hpp:180)
==14172== by 0x5252278: Ogre::DefaultWorkQueue::waitForNextRequest() (OgreDefaultWorkQueueStandard.cpp:163)
==14172== by 0x5250E36: Ogre::DefaultWorkQueue::_threadMain() (OgreDefaultWorkQueueStandard.cpp:191)
==14172== by 0x8D84595: ??? (in /usr/lib/x86_64-linux-gnu/libboost_thread.so.1.61.0)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 4: status = VgTs_WaitSys (lwpid 14286)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x5252278: wait > (condition_variable.hpp:180)
==14172== by 0x5252278: Ogre::DefaultWorkQueue::waitForNextRequest() (OgreDefaultWorkQueueStandard.cpp:163)
==14172== by 0x5250E36: Ogre::DefaultWorkQueue::_threadMain() (OgreDefaultWorkQueueStandard.cpp:191)
==14172== by 0x8D84595: ??? (in /usr/lib/x86_64-linux-gnu/libboost_thread.so.1.61.0)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 5: status = VgTs_WaitSys (lwpid 14287)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x5252278: wait > (condition_variable.hpp:180)
==14172== by 0x5252278: Ogre::DefaultWorkQueue::waitForNextRequest() (OgreDefaultWorkQueueStandard.cpp:163)
==14172== by 0x5250E36: Ogre::DefaultWorkQueue::_threadMain() (OgreDefaultWorkQueueStandard.cpp:191)
==14172== by 0x8D84595: ??? (in /usr/lib/x86_64-linux-gnu/libboost_thread.so.1.61.0)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 6: status = VgTs_WaitSys (lwpid 14288)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x5252278: wait > (condition_variable.hpp:180)
==14172== by 0x5252278: Ogre::DefaultWorkQueue::waitForNextRequest() (OgreDefaultWorkQueueStandard.cpp:163)
==14172== by 0x5250E36: Ogre::DefaultWorkQueue::_threadMain() (OgreDefaultWorkQueueStandard.cpp:191)
==14172== by 0x8D84595: ??? (in /usr/lib/x86_64-linux-gnu/libboost_thread.so.1.61.0)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 7: status = VgTs_WaitSys (lwpid 14340)
==14172== at 0x808E0BD: ??? (syscall-template.S:84)
==14172== by 0x2191A7E0: ??? (in /usr/lib/x86_64-linux-gnu/libpulse.so.0.20.0)
==14172== by 0x2190BFB0: pa_mainloop_poll (in /usr/lib/x86_64-linux-gnu/libpulse.so.0.20.0)
==14172== by 0x2190C64D: pa_mainloop_iterate (in /usr/lib/x86_64-linux-gnu/libpulse.so.0.20.0)
==14172== by 0x2190C6FF: pa_mainloop_run (in /usr/lib/x86_64-linux-gnu/libpulse.so.0.20.0)
==14172== by 0x2191A728: ??? (in /usr/lib/x86_64-linux-gnu/libpulse.so.0.20.0)
==14172== by 0x21D94227: ??? (in /usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-9.0.so)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 8: status = VgTs_WaitSys (lwpid 14344)
==14172== at 0x558868D: ??? (syscall-template.S:84)
==14172== by 0x21D6515D: pa_write (in /usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-9.0.so)
==14172== by 0x2190AF69: pa_mainloop_wakeup (in /usr/lib/x86_64-linux-gnu/libpulse.so.0.20.0)
==14172== by 0x2190B07B: ??? (in /usr/lib/x86_64-linux-gnu/libpulse.so.0.20.0)
==14172== by 0x21916E42: pa_stream_write_ext_free (in /usr/lib/x86_64-linux-gnu/libpulse.so.0.20.0)
==14172== by 0x21917010: pa_stream_write (in /usr/lib/x86_64-linux-gnu/libpulse.so.0.20.0)
==14172== by 0x6A004E8: ALCpulsePlayback_mixerProc (pulseaudio.c:832)
==14172== by 0x6A039B6: althrd_starter (threads.c:526)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 9: status = VgTs_WaitSys (lwpid 14390)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 10: status = VgTs_WaitSys (lwpid 14391)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 11: status = VgTs_WaitSys (lwpid 14392)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 12: status = VgTs_WaitSys (lwpid 14393)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 13: status = VgTs_WaitSys (lwpid 14394)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 14: status = VgTs_WaitSys (lwpid 14395)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 15: status = VgTs_WaitSys (lwpid 14396)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 16: status = VgTs_WaitSys (lwpid 14397)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 17: status = VgTs_WaitSys (lwpid 14553)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 18: status = VgTs_WaitSys (lwpid 14554)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 19: status = VgTs_WaitSys (lwpid 14555)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 20: status = VgTs_WaitSys (lwpid 14556)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 21: status = VgTs_WaitSys (lwpid 14557)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 22: status = VgTs_WaitSys (lwpid 14558)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 23: status = VgTs_WaitSys (lwpid 14559)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Thread 24: status = VgTs_WaitSys (lwpid 14560)
==14172== at 0x5585510: pthread_cond_wait@@GLIBC_2.3.2 (pthread_cond_wait.S:185)
==14172== by 0x779F52B: std::condition_variable::wait(std::unique_lock&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x408C3E: operator() (ThreadPool.h:126)
==14172== by 0x408C3E: _M_invoke<> (functional:1400)
==14172== by 0x408C3E: operator() (functional:1389)
==14172== by 0x408C3E: std::thread::_State_impl ==14172== by 0x77A550E: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22)
==14172== by 0x557F709: start_thread (pthread_create.c:333)
==14172== by 0x809A0AE: clone (clone.S:105)

Note: see also the FAQ in the source distribution.
It contains workarounds to several common problems.
In particular, if Valgrind aborted or crashed after
identifying problems in your program, there's a good chance
that fixing those problems will prevent Valgrind aborting or
crashing, especially if it happened in m_mallocfree.c.

If that doesn't help, please report this bug to: www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what OS and version you are using. Thanks.

Dumb attempt

For what is worth, to avoid the memory corruption, I try to give more memory to what I guess was the faulty memory. So in FlexMesh.cpp I changed line 62 from:

vertices=(float*)malloc(vbufCount*sizeof(float));

to

vertices=(float*)malloc(2*vbufCount*sizeof(float));

And this allow me to load this map. This is in no way a fix, but I hope this will give an additional clue to people more familiar than me with the code.

[only-a-ptr]

I'll take a look for v0.4.8

There's a good chance this is already fixed. I don't believe there's a flaw in FlexBody code, it's more like bad reading of truckfile (faulty truckfiles are a norm).

[only-a-ptr]

Which is the most up-to-date version of the map? Is it this: https://www.rigsofrods.org/old-forum/forums/128-Terrains-objects/80142/page-0001.html ?

[ghost]

Here's the latest 0.4 version: https://www.rigsofrods.org/old-forum/forums/128-Terrains-objects/109425/attached-files/miniredmars.zip

I can't reproduce the crash. Map works perfectly for me.
EDIT: Haven't compiled latest master yet. Doing so now...
EDIT2: Doesn't crash on the latest master for me.

[tritonas00]

I can reproduce the crash: https://pastebin.com/UJk64xBy

Removing bombinette.load and boobytrap.load from the archive fixes the crash for me

[Bob-Z]

I still got the crash. Valgrind trace is roughly the same:

===== LOADING VEHICLE: bombinette.load
== Parsing vehicle file: bombinette.load
== Parsing done OK, nothing to report

== Validating vehicle: bombinette
== Validating done OK
== Spawning vehicle: bombinette
duplicate resource name 'DefaultDashFont'
ResourceTrueTypeFont: Font 'DefaultDashFont' using texture size 128 x 128.
ResourceTrueTypeFont: Font 'DefaultDashFont' using real height 18 pixels.
duplicate resource name 'Digital-7'
ResourceTrueTypeFont: Font 'Digital-7' using texture size 512 x 256.
ResourceTrueTypeFont: Font 'Digital-7' using real height 65 pixels.
duplicate resource name 'Digital-7-18'
ResourceTrueTypeFont: Font 'Digital-7-18' using texture size 128 x 256.
ResourceTrueTypeFont: Font 'Digital-7-18' using real height 24 pixels.
Creating resource group t4@Actor_4
== RigSpawner: WARNING (Keyword ~Unknown~) vehicle uses no GUID, skinning will be impossible
==20396== Invalid write of size 4
==20396== at 0x465D8D: operator= (OgreVector2.h:131)
==20396== by 0x465D8D: FlexMesh::FlexMesh(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, node_t*, int, int, int, int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, float) (FlexMesh.cpp:97)
==20396== by 0x42BDC5: RigSpawner::CreateWheelVisuals(unsigned int, unsigned int, unsigned int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, float) (RigSpawner.cpp:5251)
==20396== by 0x42C3BA: CreateWheelVisuals (RigSpawner.cpp:5203)
==20396== by 0x42C3BA: RigSpawner::AddWheel(RigDef::Wheel&) (RigSpawner.cpp:4814)
==20396== by 0x43B8EA: RigSpawner::SpawnRig() (RigSpawner_ProcessControl.cpp:227)
==20396== by 0x3E760D: Beam::LoadTruck(RoR::RigLoadingProfiler*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Ogre::SceneNode*, Ogre::Vector3 const&, Ogre::Quaternion&, collision_box_t*, int) (Beam.cpp:5994)
==20396== by 0x3EE354: Beam::Beam(RoRFrameListener*, int, Ogre::Vector3, Ogre::Quaternion, char const*, RoR::RigLoadingProfiler*, bool, bool, collision_box_t*, bool, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const*, RoR::SkinDef*, bool, bool, int) (Beam.cpp:5701)
==20396== by 0x3F507D: RoR::BeamFactory::CreateLocalRigInstance(Ogre::Vector3, Ogre::Quaternion, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, int, collision_box_t*, bool, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const*, RoR::SkinDef*, bool, bool) (BeamFactory.cpp:251)
==20396== by 0x5263FF: TerrainObjectManager::loadPreloadedTrucks() (TerrainObjectManager.cpp:1391)
==20396== by 0x253417: RoRFrameListener::SetupGameplayLoop() (RoRFrameListener.cpp:2409)
==20396== by 0x20F844: main (main.cpp:335)
==20396== Address 0x31aa0cc8 is 24 bytes after a block of size 1,728 in arena "client"
==20396==

The bug seems to appear in FlexMesh.cpp:97 which is:

m_vertices[2+2*nrays+(i/2)*4+2].texcoord=Vector2(1.0, 0.0);

m_vertices is allocated at line 59:

size_t vertex_count = 4*nrays+2;
if (m_is_rimmed) vertex_count+=2*nrays;
m_vertices = new FlexMeshVertex[vertex_count];

I have checked that in this case m_is_rimmed = 0 (maybe this is the bug ?)

So m_vertices have a size of 4*nrays+2, which is indeed not enough for line 97 with (i = nrays-1) in this case, it will try to access m_vertices[4*nrays+2] which is out of bound, leading to the memory corruption.

changing +2 by +4 in line 59 fixes this issue:

size_t vertex_count = 4*nrays+4;

But I am not familiar enough with the code to understand what this +2 means and if changing it to +4 is meaningful. Or maybe, just like I said above, it is the rimmed flag which is not passed correctly to this constructor.

[only-a-ptr]

@Bob-Z Hi, thanks for the quick reply and investigation, I'd love you to stick around more.

I'm sorry you're still having the issue, but I'm pretty sure the problem is elsewhere, see https://github.com/RigsOfRods/rigs-of-rods/issues/1366

[tritonas00]

mine report also https://pastebin.com/VGMFdruB

maybe those Invalid write of size are interesting

valgrind: m_mallocfree.c:303 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 75216, hi = 5243122352119686608.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata. If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away.

[tritonas00]

master crashes with this map (not the bombinette crash), please @only-a-ptr test it

[only-a-ptr]

Got it - there's 5 texture layers defined in 'miniredmars-page-0-0.otc', but the 'number of layers' field says 6. I'll make the count correct itself with a warning if it's higher than the actual layer count.

[tritonas00]

Great! Also please reconsider the bombinette proposed fix https://github.com/RigsOfRods/rigs-of-rods/issues/1256#issuecomment-322307172

[only-a-ptr]

@Bob-Z I examined the code properly and wow, it was pretty tricky.

It turns out the vertex count calculation 4*num_rays + 2 is correct and the is_rimmed=false bit is also allright, but there's a bug in the texcoords code you pointed out - it only handles wheels with even number of rays, otherwise it writes past the vertex array and corrupts memory.

I'm not sure why it never blew up before, probably because I shuffled variables in a way that became more sensitive. Anyway, it must have always created a texturing glitch. The fact is, this 'bombinette.load' is the only vehicle I've ever seen to use odd number of rays, even though our docs don't discourage that: http://docs.rigsofrods.org/vehicle-creation/fileformat-truck/#wheels