Extraction Crash

From: John Evans (evansj@HI-LINE.NET)
Date: 10/19/97


I am having a problem with a crash-bug here. It happens when an object is
extracted via the 'R' zone command for removing an object. I can purge
and junk objects just fine, but as soon as the game tries to remove one,
it crashes... Here is the gdb and code.

GDB OUTPUT:
Core was generated by `bin/spear -q 1066'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libc.so.5...done.
Reading symbols from /lib/ld-linux.so.1...done.
#0  0x807a6ec in extract_obj (obj=0x81338a0) at handler.c:828
828         while (temp && (temp->next != obj))
(gdb) bt
#0  0x807a6ec in extract_obj (obj=0x81338a0) at handler.c:828
#1  0x80748a5 in reset_zone (zone=1) at db.c:1999
#2  0x8063f9f in do_zreset (ch=0x8134270, argument=0xbffff9f8 " .", cmd=456,
    subcmd=0) at act.wizard.c:1980
#3  0x807c265 in command_interpreter (ch=0x8134270,
    argument=0xbffff9f4 "zres .") at interpreter.c:922
#4  0x806d5c4 in game_loop (mother_desc=3) at comm.c:606
#5  0x806cd18 in init_game (port=1066) at comm.c:237
#6  0x806cca7 in main (argc=3, argv=0xbffffe58) at comm.c:207
#7  0x80493fe in _start ()
(gdb) p temp->next
Cannot access memory at address 0x290813d8.
(gdb) p temp
$1 = (struct obj_data *) 0x29081338
(gdb) p temp->name
Cannot access memory at address 0x290813ac.
(gdb) quit

Notice that temp->next is unaccessable for some reason. Look at the code
and tell me if you can spot why...

/* Extract an object from the world */
void extract_obj(struct obj_data * obj)
{
  struct obj_data *temp;

  if (obj->worn_by != NULL)
    if (unequip_char(obj->worn_by, obj->worn_on) != obj)
      log("SYSERR: Inconsistent worn_by and worn_on pointers!!");

  if (obj->in_room != NOWHERE)
    obj_from_room(obj);
  else if (obj->carried_by)
    obj_from_char(obj);
  else if (obj->in_obj)
    obj_from_obj(obj);

  /* Get rid of the contents of the object, as well. */
  while (obj->contains)
    extract_obj(obj->contains);

/* BEGIN REMOVE_FROM_LIST */
  if (obj == object_list)
    object_list = obj->next;
  else {
    temp = object_list;
    while (temp && (temp->next != obj))
      temp = temp->next;
    if (temp)
      temp->next = obj->next;
  }
/* END REMOVE_FROM_LIST */

/*
  REMOVE_FROM_LIST(obj, object_list, next);
*/

  if (GET_OBJ_RNUM(obj) >= 0)
    (obj_index[GET_OBJ_RNUM(obj)].number)--;

  free_obj(obj);
}

I commented out the REMOVE_FROM_LIST macro call because the crash was
happening on one of the lines of that macro and I wanted to be able to
see which one. As you can tell (from gdb), it's the while loop call that
is choking.

Any insight is helpful... Even if it's a stupid mistake. :)

Thanks,
John Evans <evansj@hi-line.net>

May the source be with you.


     +------------------------------------------------------------+
     | Ensure that you have read the CircleMUD Mailing List FAQ:  |
     | http://democracy.queensu.ca/~fletcher/Circle/list-faq.html |
     +------------------------------------------------------------+



This archive was generated by hypermail 2b30 : 12/08/00 PST