Trinitycore: InstanceMap::Update crash

[ghost]

Description: Crashed By Object

    Crash(formattedMessage.c_str());
    in GetMap ASSERTION FAILED:
    m_currMap
    obj = 0x7fff356bf000
    updater = {i_timeDiff = 100}
    world_object_update = {i_visitor = @0x7fff4d3fd600}
    grid_object_update = {i_visitor = @0x7fff4d3fd600}

https://gist.github.com/Hir0shi/c62dd95d2df07771dee28aa33f862842

Branch: 3.3.5

TC rev: https://github.com/TrinityCore/TrinityCore/commit/d8fee3c46b70fed660aec905a496e56d6a327aaf
Operating system: debian

[jackpoz]

as the crashlog contains very few informations, this issue requires to rework what kind of informations we log when triggering an assert. I plan on opening a PR about it.

[jackpoz]

Btw @Hir0shi it seems you have an old crashreport.gdb script, please get the new version at https://github.com/TrinityCore/TrinityCore/blob/3.3.5/contrib/debugger/crashreport.gdb

[sirikfoll]

This crash seems to be the same as #21403
I have tried to investigate this, and so far I'm thinking thats something related to multithreading, because it makes no sense, in one line everything is ok, and on the next, whatever function call will cause a crash..
Also, afaik, it only happens in Naxxramas.

[jackpoz]

it's more likely it's Naxxramas script being buggy then multithreading. Do you have any crashlog about it ?

[sirikfoll]

https://gist.github.com/sirikfoll/e9b2c695754629ddb353e73bb111d9df (It'd not clean, i had some things here and there to try and get more info)
I know It's in Naxxramas because I had added a variable to catch mapId, seen by "debugMapID = 533" in the log.
Also know it can crash in anything you put under WorldObject::GetGridActivationRange, or even before that call, i had added some logs just above here, and it crashed as well
https://github.com/TrinityCore/TrinityCore/blob/be47254a4f7ac9fd0497477a597e2a09019561e9/src/server/game/Maps/Map.cpp#L708

[Aokromes]

ofc no, there is no mob with that value on clean tdb 3.3.5a.

[illfated]

TrinityCore rev. be47254a4f7a 2018-11-09 20:51:20 +0100 (3.3.5 branch) (Win64, RelWithDebInfo, Static)

SELECT * FROM `creature_template` WHERE `BaseAttackTime` = 0;

Result: 0 row(s)

I suspect there is more custom content in Hir0shi's source and DB than we know.

[jackpoz]

if the issue happens in Naxxramas it would be really helpful if someone could run the instance in debug mode and post the crashlog (or even with Address Sanitizer)

[ghost]

@jackpoz

full tested instance naxxramas and crash for , boss = Thaddius

https://gist.github.com/Hir0shi/e7eca1dddfe5f7815f0a168552546a27

[jackpoz]

anyone was able to repro the issue in Debug to get a detailed crashlog ? maybe even with Address Sanitizer ?

[TheWinchesters]

I have had people doing Naxxramas and no crashs so far

[ghost]

Player cheat on, going for the last boss , objects It activates and server will to crashed.

[Faq]

@Hir0shi where is new crashlog?

[ghost]

https://gist.github.com/Hir0shi/e7eca1dddfe5f7815f0a168552546a27

[illfated]

That is the crash log from 2018-11-12 (12. November).
You commented as if you had a new crash, so Faq wanted to see the new crash log.

Player cheat on, going for the last boss , objects It activates and server will to crashed.

[jackpoz]

anyone was able to repro the issue in Debug to get a detailed crashlog ?

anyone ?

[jackpoz]

still waiting for a crash log in Debug

[TheWinchesters]

@jackpoz I will recompile in debug mode and I'll give it a try.
If I understand correctyl, Thaddius is the target to test.

[jackpoz]

even clear How To Reproduce steps would be nice, once we have those we can repro it in Debug and get a nice crash report

[TheWinchesters]

I am sorry, I can not try anything with Thaddius because he disappears after killing Feugen & Stalagg, even If I kill all the other bosses in the right order.
What am I missing?

[jackpoz]

Thaddius script looks like a huge hack with setActive() calls (and of course no comments about why those are needed)

[jackpoz]

There are some leftovers from https://github.com/TrinityCore/TrinityCore/commit/184c45cfe0fbe4f3e4fb701f0f99994df98bdc8a too (starting 200 things and not finishing any...), maybe it's the cause of the issue. Thaddius reset for me also

[opiums9]

Hello, I stumbled upon a similar problem:
https://gist.github.com/opiums9/863ba05da78be15257d7d8aded3c00ef
https://gist.github.com/opiums9/5806e361219f3c9620536f56138aa332
https://gist.github.com/opiums9/af3c477bbe9af0d422a3501de0931471

[illfated]

@opiums9 : Even if your logs are fine (debug logs with BACKTRACE), I noticed they are based on ElunaTrinityWotlk source and therefore may contain non-TC material.

I also took a brief look at https://github.com/ElunaLuaEngine/ElunaTrinityWotlk and noticed that https://github.com/ElunaLuaEngine/ElunaTrinityWotlk/blob/master/README.md does not contain any references to the ElunaLuaEngine/ElunaTrinityWotlk source, only pointers to TC, as well as no issue tracker on ElunaLuaEngine/ElunaTrinityWotlk (we can blame @Rochet2 for this) :-P

(They could be disregarded by TC members, even if I would hope there could be something at all useful in them.)

[jackpoz]

was anyone able to reproduce the issue with TC build in debug mode ?

[jackpoz]

same issue as https://github.com/TrinityCore/TrinityCore/issues/21403 most likely

[sirikfoll]

Although I can't reproduce this crash, I'm pretty sure the problem here is that you can't call
DespawnOrUnsummon before setActive(false);
Just swapping the order of those calls in Thadius script is working for me

[jackpoz]

Please meet the Thaddius crash:

[jackpoz]

strangely enough the crashing object doesn't have any of the typical VC++ magic numbers, maybe the memory was reused already before it crashed

There are only 2 objects in the setActive() list, the crashing one and a "Living Poison" TempSummon https://wotlk.evowow.com/npc=16027

[jackpoz]

Fixed in https://github.com/TrinityCore/TrinityCore/commit/1c833f28e471e3787f1d328e44af5f065ad9ca8c