Segfault hr::shmup::pushmonsters after shooting orb of dragon a lot

[l29ah]

(gdb) bt
#0  0x000055cc824666ac in hr::shmup::pushmonsters () at shmup.cpp:317
#1  0x000055cc8217e052 in hr::targetRangedOrb (c=0x55ccadc98760, a=hr::roCheck) at orbs.cpp:1568
#2  0x000055cc825943a3 in hr::drawMarkers () at graph.cpp:1118
#3  0x000055cc825988cb in hr::drawthemap () at graph.cpp:1474
#4  0x000055cc82599de9 in hr::drawfullmap () at graph.cpp:1663
#5  0x000055cc81c8ee1f in hr::function_state<void (*)(), void>::call (this=0x55cc8a64b880) at /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper_function.h:27
#6  0x000055cc81c79131 in hr::function<void()>::operator() (this=0x55cc84ef63d8 <hr::wrap_drawfullmap>) at /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper_function.h:64
#7  0x000055cc8259a657 in hr::gamescreen () at graph.cpp:1769
#8  0x000055cc8259b067 in hr::normalscreen () at graph.cpp:1854
#9  0x000055cc81c8ee1f in hr::function_state<void (*)(), void>::call (this=0x55cc8a64b8e0) at /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper_function.h:27
#10 0x000055cc81c79131 in hr::function<void()>::operator() (this=0x55cc955bee70) at /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper_function.h:64
#11 0x000055cc8259b6a8 in hr::drawscreen () at graph.cpp:1973
#12 0x000055cc82515ae1 in hr::mainloopiter () at control.cpp:1051
#13 0x000055cc8251808e in hr::mainloop () at control.cpp:1633
#14 0x000055cc826d2140 in hr::hyper_main (argc=1, argv=0x7fffa86119b8) at hyper-main.cpp:91
#15 0x000055cc826d223f in main (argc=1, argv=0x7fffa86119b8) at hyper-main.cpp:103

[josephcsible]

Looking at the backtrace, it looks like this was actually related to the Orb of Phasing. But I can't reproduce it either. If it happens again, in addition to the backtrace, can you run these gdb commands too?

print(m)
print(*m)
print(m->base)
print(*m->base)

[l29ah]

I have a core dump:

(gdb) print(m)
$1 = (hr::shmup::monster *) 0x55ccaf3f76b0
(gdb) print(*m)
$2 = {type = 1719614414, base = 0x3ca4000000000000, torigin = 0x55cc8248bb3a <__gnu_cxx::__aligned_membuf<std::pair<hr::cell* const, hr::shmup::monster*> >::_M_ptr()+28>, at = {tab = {{2.6367796834847468e-16, 1.9428902930940239e-16, 1, 4.6608595479296783e-310}, {0, 
        4.6608754586975051e-310, 6.9532831783178928e-310, -1.6912436372644388e-28}, {0, 4.660866360450574e-310, 1.7612565523109427e-312, 2.1219912099886041e-314}, {0, 1, 8.0947715414629834e-320, 0}}}, pat = {T = {tab = {{-0.016492468399740633, 1.7002313818273672e-05, 
          1.0001359916546326, 0}, {0, 0.80781042493442268, 1.3487992131466031e-321, 4.6608599670000128e-310}, {-1.99393796741522e+81, 0, 0.71589327727880214, -0.7155261809234893}, {0.022923107686995417, 0, 0.7158932772788017, 0.71552618092348963}}}, 
    shift = 0.022923107686995459}, ori = {tab = {{1, 0.032418169782688015, 1.9660239561528532e-16, 1.0124259819394046}, {0.41469637989741415, 6.9532831781392386e-310, 4.6608591424031159e-310, 0.03203123647374511}, {6.9532831781716493e-310, 0, 4.660866360450574e-310, 
        1.9097966007972215e-313}, {2.1219919016805083e-314, 1.2598673968951787e-321, 1, 1.0118464426828729e-319}}}, stk = hr::moNone, dead = false, notpushed = false, inBoat = false, no_targetting = false, parent = 0xbfaba1e99d43febc, nextshot = -1264404697, pid = 1068403898, 
  hitpoints = 876618252, stunoff = 1072696636, blowoff = 0, fragoff = 0, swordangle = 0, vel = 0.002, footphase = 3.2114266979681025e-322, isVirtual = 16, inertia = {<std::array<double, 4>> = {_M_elems = {4.6608968182367857e-310, 0, 0, 0}}, <No data fields>}, refs = 0, 
  split_owner = -1, split_tick = 64}
(gdb) print(m->base)
$3 = (hr::cell *) 0x3ca4000000000000
(gdb) print(*m->base)
❌️ Cannot access memory at address 0x3ca4000000000000

[l29ah]

Another crash with the same backtrace, now i was going into a monster:

(gdb) p *m
$2 = {type = hr::moNone, base = 0xbca8000000000000, torigin = 0x5562d8f8eb3a <__gnu_cxx::__aligned_membuf<std::pair<hr::cell* const, hr::shmup::monster*> >::_M_ptr()+28>, at = {tab = {{-9.7144514654701197e-17, 5.5511151231257827e-17, 0.99999999999999989, 
        4.6384382488205735e-310}, {0, 4.6384748815126451e-310, 6.95300730722077e-310, -2.3326372027419587e-253}, {0, 4.63843876223966e-310, 1.8036964252404094e-312, 0}, {2.1168274053227879e-314, 1, 2.590366418519822e-318, 0}}}, pat = {T = {tab = {{0, 0, 1, 0}, {0, 
          1.0082424472615428, 1.3487992131466031e-321, 4.638438667890908e-310}, {5.6860734528741589e-270, 0, 4.2153780466236412e-16, 1}, {2.7755575615628914e-16, 6.9530073072373706e-310, -1, 1.8041124150158794e-16}}}, shift = -1.6653345369377348e-16}, ori = {tab = {{
        4.6384382492632563e-310, -9.7144514654701197e-17, 5.5511151231257827e-17, 0.99999999999999989}, {4.6384382488205735e-310, 0, 4.6384748815126451e-310, 6.95300730722077e-310}, {-2.3326372027419587e-253, 0, 4.63843876223966e-310, 1.8036964256603652e-312}, {0, 
        2.1168274053227879e-314, 1, 2.590366418519822e-318}}}, stk = hr::moNone, dead = false, notpushed = false, inBoat = false, no_targetting = false, parent = 0x0, nextshot = 0, pid = 0, hitpoints = 0, stunoff = 1072693248, blowoff = 0, fragoff = 0, swordangle = 0, vel = 0, 
  footphase = 3.2114266979681025e-322, isVirtual = 240, inertia = {<std::array<double, 4>> = {_M_elems = {4.6384854019069846e-310, 0, 0, 0}}, <No data fields>}, refs = 0, split_owner = -1, split_tick = 64}
(gdb) print(m->base)
$3 = (hr::cell *) 0xbca8000000000000

[josephcsible]

Some kind of memory corruption is going on. Those structs are full of complete garbage, e.g., base isn't even a canonical pointer, type = 1719614414 isn't a valid eMonster, and isVirtual = 240 is supposed to be a bool.

[l29ah]

032630 addMessage: You have found the Orb of Phasing!
033543 1265 -> 10290
=================================================================
==12696==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cc0a4767580 at pc 0x557281dc187e bp 0x7ffdfafe8c50 sp 0x7ffdfafe8c40
READ of size 4 at 0x7cc0a4767580 thread T0
    #0 0x557281dc187d in hr::shmup::isPlayer(hr::shmup::monster*) /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/shmup.cpp:255
    #1 0x557281dc1d2e in hr::shmup::pushmonsters() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/shmup.cpp:317
    #2 0x55728183cb3f in hr::targetRangedOrb(hr::cell*, hr::orbAction) /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/orbs.cpp:1568
    #3 0x557281fd526d in hr::drawMarkers() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/graph.cpp:1118
    #4 0x557281fdf0ff in hr::drawthemap() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/graph.cpp:1474
    #5 0x557281fe0b02 in hr::drawfullmap() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/graph.cpp:1663
    #6 0x557280f9d380 in hr::function_state<void (*)(), void>::call() const /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper_function.h:27
    #7 0x557281fdb456 in hr::function<void ()>::operator()() const /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper_function.h:64
    #8 0x557281fdb456 in hr::gamescreen() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/graph.cpp:1769
    #9 0x557281fdbb55 in hr::normalscreen() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/graph.cpp:1854
    #10 0x557280f9d380 in hr::function_state<void (*)(), void>::call() const /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper_function.h:27
    #11 0x557281fc958b in hr::function<void ()>::operator()() const /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper_function.h:64
    #12 0x557281fc958b in hr::drawscreen() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/graph.cpp:1973
    #13 0x557281ef9861 in hr::mainloopiter() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/control.cpp:1065
    #14 0x557281efc311 in hr::mainloop() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/control.cpp:1631
    #15 0x55728221673f in hr::hyper_main(int, char**) /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper-main.cpp:91
    #16 0x5572822168d8 in main /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/hyper-main.cpp:103
    #17 0x7f60a5e3443a in __libc_start_call_main (/lib64/libc.so.6+0x2743a)
    #18 0x7f60a5e344ea in __libc_start_main (/lib64/libc.so.6+0x274ea)
    #19 0x557280f23ee4 in _start (/usr/bin/hyperrogue+0x87eee4)

0x7cc0a4767580 is located 0 bytes inside of 536-byte region [0x7cc0a4767580,0x7cc0a4767798)
freed by thread T0 here:
    #0 0x7f60a6724a5b in operator delete(void*) /var/tmp/portage/sys-devel/gcc-15.2.1_p20251122/work/gcc-15-20251122/libsanitizer/asan/asan_new_delete.cpp:143
    #1 0x557281e02d3e in hr::shmup::monster::remove_reference() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/shmup.cpp:90
    #2 0x557281ef8ff9 in hr::mainloopiter() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/control.cpp:996
    #3 0x557281efc311 in hr::mainloop() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/control.cpp:1631

previously allocated by thread T0 here:
    #0 0x7f60a6723ebb in operator new(unsigned long) /var/tmp/portage/sys-devel/gcc-15.2.1_p20251122/work/gcc-15-20251122/libsanitizer/asan/asan_new_delete.cpp:86
    #1 0x557281dd47e0 in hr::shmup::activateMonstersAt(hr::cell*) /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/shmup.cpp:2579
    #2 0x557281dfff9b in hr::shmup::turn(int) /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/shmup.cpp:2687
    #3 0x557281ef8ff9 in hr::mainloopiter() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/control.cpp:996
    #4 0x557281efc311 in hr::mainloop() /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/control.cpp:1631

SUMMARY: AddressSanitizer: heap-use-after-free /var/tmp/portage/games-roguelike/hyperrogue-9999/work/hyperrogue-9999/shmup.cpp:255 in hr::shmup::isPlayer(hr::shmup::monster*)
Shadow bytes around the buggy address:
  0x7cc0a4767300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cc0a4767380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cc0a4767400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cc0a4767480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cc0a4767500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x7cc0a4767580:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cc0a4767600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cc0a4767680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cc0a4767700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cc0a4767780: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7cc0a4767800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==12696==ABORTING

[josephcsible]

See if #492 fixes the crashes.

[l29ah]

It does: now the orb of phasing just seemingly does nothing instead of crashing the game.

[josephcsible]

Do you have other orbs too? For me, it works when it's the only orb I have, but not when I also have Orb of the Dragon.

[l29ah]

I don't remember, i had a few, but probably not the dragon. TBH the orbs start to become really annoying when you have several, as you can't choose which one to use.