[crash] SpellAuraHolder

[shinra]

No problem thanks for being here to confirm.

[The_Game_Master]

Cannot reproduce any of the remaining reproduction methods. I'll come back with a new backtrace as soon as possible.

[bosancero]

hi guys, i have the same problem with the random crashs, i read someone find a solution to solve it but i think i dont get it. can someone help me out with this wierd thing thx

[Mr.Grom]

Permanent crash on 10429

Registers:
EAX:DBF62294
EBX:F2DDCB80
ECX:00000000
EDX:D42FCFE0
ESI:00000000
EDI:009737C0
CS:EIP:0023:0041D40F
SS:ESP:002B:0B9C1C44  EBP:0B9C1C50
DS:002B  ES:002B  FS:0053  GS:002B
Flags:00010216

Call stack:
Address   Frame     Function      SourceFile
0041D40F  00000000  std::_Tree<std::_Tmap_traits<unsigned int,SpellAuraHolder *,std::less<unsigned int>,std::allocator<std::Pair<unsigned int const ,SpellAuraHolder *> >,1> >::_Ubound+F
0049776E  00000000  Unit::DelaySpellAuraHolder+2E
007CAB52  00000000  DynamicObject::Delay+92
0077A9C0  00000000  Spell::DelayedChannel+3D0
004898AD  00000000  Unit::DealDamage+252D
0048C1A5  00000000  Unit::DealMeleeDamage+4E5
0048F39D  00000000  Unit::AttackerStateUpdate+1CD
008CE367  00000000  CreatureEventAI::DoMeleeAttackIfReady+E7
008CD917  00000000  CreatureEventAI::UpdateAI+337
004BF420  00000000  Creature::Update+7B0
004F9CAF  00000000  MaNGOS::ObjectUpdater::Visit+6F
004F9C32  00000000  VisitorHelper<MaNGOS::ObjectUpdater,Creature>+12
004F94A0  00000000  VisitorHelper<MaNGOS::ObjectUpdater,Creature,TypeList<DynamicObject,TypeList<Corpse,TypeNull> > >+10
004F8FD3  00000000  VisitorHelper<MaNGOS::ObjectUpdater,GameObject,TypeList<Creature,TypeList<DynamicObject,TypeList<Corpse,TypeNull> > > >+23
004F8860  00000000  VisitorHelper<MaNGOS::ObjectUpdater,TypeList<GameObject,TypeList<Creature,TypeList<DynamicObject,TypeList<Corpse,TypeNull> > > > >+10
004F54EF  00000000  Map::Visit<MaNGOS::ObjectUpdater,TypeMapContainer<TypeList<GameObject,TypeList<Creature,TypeList<DynamicObject,TypeList<Corpse,TypeNull> > > > > >+CF
004EFE47  00000000  Cell::Visit<MaNGOS::ObjectUpdater,TypeMapContainer<TypeList<GameObject,TypeList<Creature,TypeList<DynamicObject,TypeList<Corpse,TypeNull> > > > > >+67
004D9C3B  00000000  Map::Update+33B
006F4EA0  00000000  MapManager::Update+120
00650852  00000000  World::Update+832
004585BE  00000000  WorldRunnable::run+8E
009737D9  00000000  ACE_Based::Thread::ThreadTask+19
733C1864  00000000  ?invoke@ACE_OS_Thread_Adapter@@UAEKXZ+74
73DB3433  00000000  _endthreadex+44
73DB34C7  00000000  _endthreadex+D8
760BE3F3  00000000  BaseThreadInitThunk+E
77E8CFED  00000000  RtlCreateUserProcess+8C
77E8D1FF  00000000  RtlCreateProcessParameters+4E
========================
Local Variables And Parameters

Call stack:
Address   Frame     Function      SourceFile
0041D40F  00000000  std::_Tree<std::_Tmap_traits<unsigned int,SpellAuraHolder *,std::less<unsigned int>,std::allocator<std::Pair<unsigned int const ,SpellAuraHolder *> >,1> >::_Ubound+F
   Local  <user defined> 'this'
   Local  <user defined> '_Keyval'
   Local  <user defined> '_Pnode'
   Local  <user defined> '_Wherenode'

0049776E  00000000  Unit::DelaySpellAuraHolder+2E
   Local  <user defined> 'this'
punting on symbol spellId
punting on symbol delaytime
   Local  <user defined> 'bounds'

007CAB52  00000000  DynamicObject::Delay+92
   Local  <user defined> 'iunit'
   Local  <user defined> 'this'
punting on symbol delaytime

0077A9C0  00000000  Spell::DelayedChannel+3D0
punting on symbol j
   Local  <user defined> 'ihit'
   Local  <user defined> 'this'
punting on symbol delayReduce
punting on symbol delaytime

004898AD  00000000  Unit::DealDamage+252D
punting on symbol channelInterruptFlags
   Local  <user defined> 'spell'
   Local  <user defined> 'next'
   Local  <user defined> 'i'
punting on symbol morphSpell
   Local  <user defined> 'vAuras'
   Local  <user defined> 'this'
   Local  <user defined> 'pVictim'
punting on symbol damage
   Local  <user defined> 'cleanDamage'
   Local  <user defined> 'damagetype'
   Local  <user defined> 'damageSchoolMask'
   Local  <user defined> 'spellProto'
punting on symbol durabilityLoss
punting on symbol duel_hasEnded
punting on symbol health

[False.Genesis]

got the same crash here: http://paste2.org/p/986878 (rev 10408) -- have this one a lot, but yet no idea how to reproduce

[darkstalker]

looks like using invalid iterator (maybe SpellAuraHolderMap is modified during iteration of std::map)

[laise]

hmm..where it can be modified..its not like SetAuraDuration or SendAuraUpdate are messing with map =\\

[False.Genesis]

just managed to reproduce this in VS debugger (casting 47820 at custom boss in heavy spawn phase). the strange thing here is that Unit::m_spellAuraHolders was empty when the crash occured, so an iterator invalidation is unlikely imho. going to experiment further with this.

[Xfurry]

hmm..where it can be modified..its not like SetAuraDuration or SendAuraUpdate are messing with map =\\

So, is there any fix for this?

I think we are all waiting for 2 months to get this crash fixed.

The main problem is that, this crash only occurs often when there are more than 100 players online.

For example if we have about 50 players online, the server will stay online for about 30-60 min without any crash, but if we have 500-700 players online the server will crash in about 10 secs.

And this is not because of a certain spell or test scenario. I think this may be related to some AuraHolder arrays whice become very unstable on a high number of auras / players.

The_Game_Master, Unloading and others provided a lot of crash logs. Aren't these enough to fix it?

In my opinion, fixing this crash should have the highest priority, before doing any other commit or spell fix!!!

[Toinan67]

In my opinion, fixing this crash should have the highest priority, before doing any other commit or spell fix!!!

Who cares about your public server?

Let the devs do the job, you're using a development branch. Devs don't have to permanently fix crashes, they do want they want...you should be constantly thanking them for gaving you the tools to create a public server.

[zergtmn]

Who cares about your public server?

Let the devs do the job, you're using a development branch. Devs don't have to permanently fix crashes, they do want they want...you should be constantly thanking them for gaving you the tools to create a public server.

Some of server owners donate money to keep this forum up and running.

[Schmoozerd]

I think the community needs both happy devs and happy admins, so I can agree that in this case (many problems since longer time) crash fixing should be done "soonish", however asking for it, (or even the will to fix it) doesn't alone solve the problem.

All we can do is try to reproduce the crashes, provide crashlogs - or try to really understand what is happening, to find out which places in the code are bugged..

perhaps laise has a "test-suite" (or could provide one without too much effort), to log the important aura related events, such that you admins could provide a large-scale stability test, that we might get more insight what's wrong in the code at all..

[Xfurry]

Who cares about your public server?

Let the devs do the job, you're using a development branch. Devs don't have to permanently fix crashes, they do want they want...you should be constantly thanking them for gaving you the tools to create a public server.

1. Why would anyone bother developing such a large project as Mangos, if there were no public servers. That's why we keep public servers running, and develop patches ourselfes, which we submit to Mangos for revision. My respect for Mangos dev, but they are not the only ones who keep this project alive. There are a lot of users which provide usefull patches for Mangos.

2. Why wouldn't a developer want to fix a crash? What is the point in developing an application which does great things but crashes each 5 min?

3. The main purpose of a development branch is to provide developers feedback about the known bugs and crashes. If nobody cares about some crashes reported by many users 2 MONTHS AGO then how are they going to release a new stable version in the future?

I don't say it's easy to fix it, but somebody or better said "all of us", must fix this.

[Toinan67]

Some of server owners donate money to keep this forum up and running.

And what do they give? 50$ ? Whereas they probably make 5 times more a week?...

I can agree that in this case (many problems since longer time) crash fixing should be done "soonish", however asking for it, (or even the will to fix it) doesn't alone solve the problem.

I can agree too, there have been many problems related to this, bugs exist for a long time. We all want it to be fixed as soon as possible, we all want MaNGOS to be 100% blizzlike, we all want peace in the world.

But if you can't fix it, you should never be asking others to fix it...

But I think at the moment I find it quite hard to get inside the code without being a good C++ dev, all I can hope for is a documentation (btw, I make my own advertising, if someone wants to help on something -> http://getmangos.eu/wiki/Spell_system).

PS : any chance this commit fixes some crashes?

Edit : didn't see Xfurry's post.

1. You can find it weird, but I'd say MaNGOS is made to be able to be used, but not to be used. But that's my opinion. I see it as a green fast beautiful big car being in a museum.

2. As I said, we all want it to be fixed, laise wants it to be fixed...

3. I agree, this bug exists for a long time, but have you ever been a total volunteer developer of something used by hundreds of people to make money of it ? I've never been, but I can imagine how devs must feel sometimes....tired.

[False.Genesis]

enough offtopic barfing, now trying to reproduce the crashes after 6259b78a82b

will edit this post with results.

EDIT: crashes are still there. however, seems i managed to get rid of them with this commit: http://github.com/fgenesis/mangos/commit/d2787038182733d9bab9a60e0c1988e8e9d267bc -- yes, i DO wonder about this. A LOT.

[Schmoozerd]

I think there is nothing wrong to start a new thrad, as the code has been changed quite a bit since the aura holder system, and now there are many crashes fixed, and (hopefully no) new crashes

[Xfurry]

enough offtopic barfing, now trying to reproduce the crashes after 6259b78a82b

will edit this post with results.

+1

We shall do the same.

[darkstalker]

It could be old crashes that just got exposed with the new aura system..

Anyway, if you want a stable rev use 10155, avg 10 hours uptime for me. No one forces you to use latest rev.

[Mr.Grom]

Tried this fixed a crash (probably a hack ) I have not repeated it

Fixed

[darkstalker]

if you put a return there then the foor loop becomes dead code

[laise]

wrong fix because - casterGUID is never empty and if it is - problem somewhere else, "return" is wrong because bounds contain all holders for same spell on current Unit - so why check only first one when you need to find exact same from caster who called delay?

[Schmoozerd]

perhaps then add a assert there, to catch earlier bugs easier?

[Mr.Grom]

wrong fix because - casterGUID is never empty and if it is - problem somewhere else, "return" is wrong because bounds contain all holders for same spell on current Unit - so why check only first one when you need to find exact same from caster who called delay?

Wrong fix because - casterGUID is never empty - Even creature corpse if ( !caster -> isAlive() || !caster-> IsInWorld()) ?

"return" is wrong - Then put "break" is also wrong fix ?

[laise]

Wrong fix because - casterGUID is never empty - Even if (caster-> corpse || !caster -> isAlive || !caster-> IsInWorld) ?

"return" is wrong - Then put "break" is also wrong fix ?

ok if casterGUID is magically 0 then it will just compare existing guid with 0 and unless some spell's casterGUID is 0, it won't do anything..

[laise]

@False.Genesis, can you please post crash dump for latest rev?