[Bug] - [CMANGOS-TBC] Event OnPlayerKilledByCreature Hook Sometimes Got Core Crash

[betayi]

Here is part of the coredumpctl gdb output:

Core was generated by `./mangosd'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 Unit::Kill (killer=0x0, victim=0x7fd6841ddb00, damagetype=<error reading variable: Cannot access memory at address 0x7fd6e9b818ec>,
spellInfo=<error reading variable: Cannot access memory at address 0x7fd6e9b818f8>, durabilityLoss=,
duel_hasEnded=) at /data/C-TBC/src/game/Entities/Object.h:484
484 Creature* ToCreature() { if (GetTypeId() == TYPEID_UNIT) return reinterpret_cast<Creature*>(this); else return NULL; }
[Current thread is 1 (LWP 477840)]

in Unit.cpp the only place invoke ToCreature() is:

#ifdef BUILD_ELUNA
if (Creature* killerCre = killer->ToCreature())
{
// used by eluna
if (Player* killed = victim->ToPlayer())
sEluna->OnPlayerKilledByCreature(killerCre, killed);
}
#endif

So, is this the core crash reason ? @Niam5

[Niam5]

Can you provide the script you are using and the conditions that cause the crash please.

…

On Fri, Nov 10, 2023, 9:16 AM Beta.Yi ***@***.***> wrote: Here is part of the coredumpctl gdb output: Core was generated by `./mangosd'. Program terminated with signal SIGSEGV, Segmentation fault. #0 Unit::Kill (killer=0x0, victim=0x7fd6841ddb00, damagetype=<error reading variable: Cannot access memory at address 0x7fd6e9b818ec>, spellInfo=<error reading variable: Cannot access memory at address 0x7fd6e9b818f8>, durabilityLoss=, duel_hasEnded=) at /data/C-TBC/src/game/Entities/Object.h:484 484 Creature* ToCreature() { if (GetTypeId() == TYPEID_UNIT) return reinterpret_cast<Creature*>(this); else return NULL; } [Current thread is 1 (LWP 477840)] in Unit.cpp the only place invoke ToCreature() is: #ifdef BUILD_ELUNA if (Creature* killerCre = killer->ToCreature()) { // used by eluna if (Player* killed = victim->ToPlayer()) sEluna->OnPlayerKilledByCreature(killerCre, killed); } #endif So, is this the core crash reason ? @Niam5 <https://github.com/Niam5> — Reply to this email directly, view it on GitHub <#452>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAD6KBL5ZVK7YFSSMSFN3UTYDZAL7AVCNFSM6AAAAAA7GJQ7Y2VHI2DSMVQWIX3LMV43ASLTON2WKOZRHE4DONZYHA4TKMI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[betayi]

in dumplog , the crash was triggered before hook function, so lua scripts defined registerplayerevent can not be execute here,

the condition is hard to say , cuz it should be a special killer , must not a creature.

[Rochet2]

@Niam5 Looks like killer can be nullptr as seen here, but its not checked if it is null here.

I think the killer might be nullptr if player dies from a spell casted by a gameobject that has no owner. In this case the caster cannot be the gameobject or any other entity as it must be Unit and gameobject is not an Unit.
I guess maybe a fireplace that damages player could cause this?
Looks like some AOE or DOT spells call GetAffectiveCasterOrOwner which might result in nullptr as caster, so spell damage to player will be done by nullptr which then crashes the code as killer is nullptr.

[Niam5]

So it sounds like a null check is needed before calling the check to see if the killer is a creature. I'll write up something here in a bit I'm picking up someone from the airport so I'm away from a computer to work on.

…

On Fri, Nov 10, 2023, 3:54 PM Rochet2 ***@***.***> wrote: @Niam5 <https://github.com/Niam5> Looks like killer can be nullptr as seen here <https://github.com/Eluna-Ports/Eluna-CMaNGOS-TBC/blob/280ba788313381618fcd0e0bb833a3ec0042d6d7/src/game/Entities/Unit.cpp#L1159>, but its not checked if it is null here <https://github.com/Eluna-Ports/Eluna-CMaNGOS-TBC/blob/280ba788313381618fcd0e0bb833a3ec0042d6d7/src/game/Entities/Unit.cpp#L1243> . I think the killer might be nullptr if player dies from a spell casted by a gameobject that has no owner. In this case the caster cannot be the gameobject or any other entity as it must be Unit and gameobject is not an Unit. I guess maybe a fireplace that damages player could cause this? Looks like some AOE or DOT spells call this <https://github.com/Eluna-Ports/Eluna-CMaNGOS-TBC/blob/280ba788313381618fcd0e0bb833a3ec0042d6d7/src/game/Spells/Spell.cpp#L7738-L7741> which might result in nullptr as caster, so spell damage to player will be done by nullptr which then crashes the code as killer is nullptr. — Reply to this email directly, view it on GitHub <#452 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAD6KBPVIQMDPSSEUCQR3UTYD2PDHAVCNFSM6AAAAAA7GJQ7Y2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMBWGQ4DKMRTGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[Niam5]

Update your core to c5eb05a0e04d6638121def394e5d1b7bf1641ac5 and see if it still crashes please.

[betayi]

works. no more crash with this info.