BUG: munmap_chunk(): invalid pointer

My TBC server crashed under following conditions:

• log on as a warrior
• add two bots (won't crash if I don't add bots)
  • one priest, one mage
• charge into 2+ creatures, and enter batlle
• server will crash in a second or two.

My build is based on:

commit ffcd98e4d8bfb565c72e03c724fa99bc88a0eb5a (HEAD -> master, tag: v22.03.45, origin/master, origin/HEAD)
Author: Antz <billy1arm@users.noreply.github.com>
Date:   Wed Nov 8 22:37:51 2023 +0000

    Fix Gentoo build of openSSL3.x. Thanks to @Shaorin for pointing

I can reproduce the crash very consistently/easily.

Console:

Setting lesser delay 0 -> 100
Correct --- AI Tick ---
Correct T:aoe
Correct T:enemy too close for spell
Correct T:shadow word: pain on attacker
Correct PUSH:say::aoe - 99.000000 (trigger)
Correct PUSH:fade - 50.000000 (trigger)
Correct PUSH:flee - 49.000000 (trigger)
Correct PUSH:shadow word: pain on attacker - 11.000000 (trigger)
Correct A:say::aoe - PREREQ
munmap_chunk(): invalid pointer
Aborted (core dumped)

world-server.log doesn't print anything after startup.

For weird reasons, the coredump was not generated. I will try my best to get the coredump, but no guarantee.(any advise?)

Got the core dump now 

But I have the crash log.

_home_mangos_mangos_one_bin_mangosd.1002.crash

The crashing thread is :

Core was generated by `./mangosd'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=22407811872320) at ./nptl/pthread_kill.c:44
44      ./nptl/pthread_kill.c: No such file or directory.
[Current thread is 1 (Thread 0x146139aab640 (LWP 13664))]
(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=22407811872320) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=22407811872320) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=22407811872320, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x000014613c3b1476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x000014613c3977f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x000014613c3f8676 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x14613c54ab77 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#6  0x000014613c40fcfc in malloc_printerr (str=str@entry=0x14613c54d210 "munmap_chunk(): invalid pointer") at ./malloc/malloc.c:5664
#7  0x000014613c40ffdc in munmap_chunk (p=<optimized out>) at ./malloc/malloc.c:3060
#8  0x000014613c41449a in __GI___libc_free (mem=<optimized out>) at ./malloc/malloc.c:3381
#9  0x0000557ea2c14b7a in ai::SayAction::Execute(ai::Event) ()
#10 0x0000557ea2baeceb in ai::Engine::ListenAndExecute(ai::Action*, ai::Event) ()
#11 0x0000557ea2bb2e37 in ai::Engine::DoNextAction(Unit*, int) ()
#12 0x0000557ea2b21e39 in PlayerbotAI::DoNextAction() ()
#13 0x0000557ea2b29e08 in PlayerbotAIBase::UpdateAI(unsigned int) ()
#14 0x0000557ea289ed69 in Player::Update(unsigned int, unsigned int) ()
#15 0x0000557ea29d13d7 in Map::Update(unsigned int const&) ()
#16 0x0000557ea2d03759 in MapUpdateRequest::call() ()
#17 0x0000557ea309f2a1 in DelayExecutor::svc() ()
#18 0x0000557ea30eeb55 in ACE_Task_Base::svc_run(void*) ()
#19 0x0000557ea310a07d in ACE_Thread_Adapter::invoke() ()
#20 0x000014613c403ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#21 0x000014613c495660 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Workaround:

bool SayAction::Execute(Event event)
{
+   return true;

I will dump more logs within SayAction::Execute and narrow down the issue tmr. 

core.13650.tgz