[One] Regular crash from assert

[Oniryck]

Hello,

First, sorry for opening a new thread for what my be just something caused by my ignorance, but since a very long time, I'm have a crash caused by this assert :

        const uint64& GetUInt64Value( uint16 index ) const
{
   MANGOS_ASSERT( index + 1 < m_valuesCount || PrintIndexError( index , false) );
   return *((uint64*)&(m_uint32Values[ index ]));
}

Here what it looks like :

[New Thread 25845]
[New Thread 25846]
[New Thread 25847]
[New Thread 25848]
[New Thread 25828]
[New Thread 25829]
[New Thread 25830]
[New Thread 25822]
[New Thread 25849]
Core was generated by `./mangosd'.
Program terminated with signal 6, Aborted.
#0  0x00007ff0d46caba5 in raise () from /lib/libc.so.6
#0  0x00007ff0d46caba5 in raise () from /lib/libc.so.6
No symbol table info available.
#1  0x00007ff0d46ce6b0 in abort () from /lib/libc.so.6
No symbol table info available.
#2  0x00007ff0d46c3a71 in __assert_fail () from /lib/libc.so.6
No symbol table info available.
#3  0x0000000000827a21 in Object::GetUInt64Value (this=0x7ff0a300e080, index=0) at /mg/src/game/Object.h:182
       __FUNCTION__ = "GetUInt64Value"
       __PRETTY_FUNCTION__ = "const uint64& Object::GetUInt64Value(uint16) const"
#4  0x0000000000827ce8 in Object::GetGuidValue (this=0x7ff0a300e080, index=0) at /mg/src/game/Object.h:206
No locals.
#5  0x0000000000827765 in Object::GetObjectGuid (this=0x7ff0a300e080) at /mg/src/game/Object.h:134
No locals.
#6  0x00000000008277a0 in Object::GetGUIDLow (this=0x7ff0a300e080) at /mg/src/game/Object.h:136
No locals.
#7  0x0000000000816496 in Player::_SaveInventory (this=0x12458000) at /mg/src/game/Player.cpp:16269
       item = 0x7ff0a300e080
       test = 0x7ff0ac87d980
       i = 0
       error = false
       insertInventory = {m_nIndex = 12, m_nArguments = 5, m_bInitialized = true}
       updateInventory = {m_nIndex = 21, m_nArguments = 5, m_bInitialized = true}
       deleteInventory = {m_nIndex = 41, m_nArguments = 1, m_bInitialized = true}
#8  0x00000000008154db in Player::SaveToDB (this=0x12458000) at /mg/src/game/Player.cpp:16067
       delChar = {m_nIndex = 23, m_nArguments = 1, m_bInitialized = true}
       stmt = {m_index = {m_nIndex = 23, m_nArguments = 1, m_bInitialized = true}, m_pDB = 0x10e4560, m_pParams = 0x0}
       ss = <incomplete type>
       insChar = {m_nIndex = 24, m_nArguments = 60, m_bInitialized = true}
       uberInsert = {m_index = {m_nIndex = 24, m_nArguments = 60, m_bInitialized = true}, m_pDB = 0x10e4560, m_pParams = 0x0}
#9  0x00000000007e43d8 in Player::Update (this=0x12458000, update_diff=100, p_time=100) at /mg/src/game/Player.cpp:1377
       now = 1303566626
       pet = 0x7ff0c30acb10
#10 0x00000000008db06f in WorldObject::UpdateHelper::Update (this=0x7ff0c30acbd0, time_diff=100) at /mg/src/game/Object.h:415
No locals.
#11 0x000000000090c066 in Map::Update (this=0x7ff0bc7a8000, t_diff=@0x7ff0c30acd8c) at /mg/src/game/Map.cpp:462
       helper = {m_obj = 0x12458000}
       plr = 0x12458000
       updater = {i_timeDiff = 100}
       grid_object_update = {i_visitor = @0x7ff0c30accc0}
       __FUNCTION__ = "Update"
       __PRETTY_FUNCTION__ = "virtual void Map::Update(const uint32&)"
       world_object_update = {i_visitor = @0x7ff0c30accc0}
#12 0x0000000000910cc3 in DungeonMap::Update (this=0x7ff0bc7a8000, t_diff=@0x7ff0c30acd8c) at /mg/src/game/Map.cpp:1443
No locals.
#13 0x00000000009b7c87 in MapManager::Update (this=0x7ff0c285b200, diff=28) at /mg/src/game/MapManager.cpp:262
       iter = {_M_node = 0x7ff0b2d21930}
       iter = {_M_node = 0xcc46b0}
#14 0x00000000007c4138 in World::Update (this=0x7ff0d6ba3900, diff=28) at /mg/src/game/World.cpp:1901
No locals.
#15 0x00000000007b3f44 in WorldRunnable::run (this=0x7ff0c28756e0) at /mg/src/mangosd/WorldRunnable.cpp:60
       diff = 28
       realCurrTime = 82660059
       realPrevTime = 82660031
       prevSleepTime = 28
#16 0x0000000000c1434d in ACE_Based::Thread::ThreadTask (param=0x7ff0c28756e0) at /mg/src/shared/Threading.cpp:187
       _task = 0x7ff0c28756e0
#17 0x00007ff0d4a21971 in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#18 0x00007ff0d477d92d in clone () from /lib/libc.so.6
No symbol table info available.
#19 0x0000000000000000 in ?? ()
No symbol table info available.

This crash appears approx. once every week, and I can't explain why, but it seems weird, because for instance the above function :

        const uint32& GetUInt32Value( uint16 index ) const
{
   MANGOS_ASSERT( index < m_valuesCount || PrintIndexError( index , false) );
   return m_uint32Values[ index ];
}

uses "index < m_valuesCount" instead of "index + 1 < m_valuesCount".

I guess that's normal, but if someone could explain me why, maybe it would help me find the source of those crashes. Thank you !

[Ambal]

Such issue usually caused by access to already deleted object (in your case it is item).

[Oniryck]

Hmm ok, thanks for your answer. Do you have an idea how this can happen? Cheat ? Other problem ?