#20 Segfault during race

[David Bears]

I'm getting a random crash during races. Here is a stack trace:

Thread 1 "torcs-bin" received signal SIGSEGV, Segmentation fault.
0x00007ffff7637036 in ssgBranch::cull(sgFrustum*, float (*) [4], int) ()
   from /usr/lib/torcs/lib/libclient.so
(gdb) bt
#0  0x00007ffff7637036 in ssgBranch::cull(sgFrustum*, float (*) [4], int) ()
   from /usr/lib/torcs/lib/libclient.so
#1  0x00007ffff7637055 in ssgBranch::cull(sgFrustum*, float (*) [4], int) ()
   from /usr/lib/torcs/lib/libclient.so
#2  0x00007ffff76395d0 in ssgContext::cull(ssgBranch*) ()
   from /usr/lib/torcs/lib/libclient.so
#3  0x00007ffff7633492 in ssgCullAndDraw(ssgBranch*) ()
   from /usr/lib/torcs/lib/libclient.so
#4  0x00007fffcf25db32 in grDrawScene ()
    at /usr/src/debug/torcs/torcs-1.3.8/src/modules/graphic/ssggraph/grscene.cpp:247
#5  0x00007fffcf2668a9 in cGrScreen::camDraw (this=<optimized out>,
    s=<optimized out>)
    at /usr/src/debug/torcs/torcs-1.3.8/src/modules/graphic/ssggraph/grscreen.cpp:297
#6  0x00007fffcf266ae5 in cGrScreen::update (this=0x555555eb9960,
    s=0x555555b14560, Fps=45.9768715)
    at /usr/src/debug/torcs/torcs-1.3.8/src/modules/graphic/ssggraph/grscreen.cpp:360
#7  0x00007fffcf253122 in refresh (s=0x555555b14560)
    at /usr/src/debug/torcs/torcs-1.3.8/src/modules/graphic/ssggraph/grmain.cpp:337
#8  0x00007ffff7eee1e4 in ReUpdate ()
    at /usr/src/debug/torcs/torcs-1.3.8/src/libs/raceengineclient/raceengine.cpp:738
#9  0x00007ffff7eee776 in ReStateManage ()
    at /usr/src/debug/torcs/torcs-1.3.8/src/libs/raceengineclient/racestate.cpp:97
#10 0x00007ffff7b60ebe in fghRedrawWindow () from /usr/lib/libglut.so.3
#11 0x00007ffff7b6db46 in ?? () from /usr/lib/libglut.so.3
#12 0x00007ffff7b6d029 in fgEnumWindows () from /usr/lib/libglut.so.3
#13 0x00007ffff7b6d2cc in glutMainLoopEvent () from /usr/lib/libglut.so.3
#14 0x00007ffff7b6d361 in glutMainLoop () from /usr/lib/libglut.so.3
#15 0x0000555555556299 in main (argc=7, argv=0x7fffffffd6f8)
    at /usr/src/debug/torcs/torcs-1.3.8/src/linux/main.cpp:134

[Bernhard Wymann]

Hmm, never seen that before, which plib version are you using? Is it really random, or is it reproducible somehow (e.g just on certain tracks with certain cars)? Does it happen always?

Did you compile plib with -fPIC, and -O2, or did you go higher?

Just thinking loud, I think it cannot be a GPU driver problem, because the frustum culling is probably completely done in plib using bounding spheres or so.

[David Bears]

It seems random to me as it happens on maybe one out of five races. I always do the same race with car4-trb1 in a non-championship race on CG Track 3 with all trb1 opponents, so I wouldn't really be able to say whether it is dependent on the car or track. (Sorry for the lack of diversity.) But it doesn't seem to matter how far into the race I am or where on the track I am.

Though IIRC, I also got a crash from a SIGABRT, but I wasn't able to get the stack trace at that time, so potentially there are two different issues causing "random" crashes.

I am using plib 1.8.5-10 from the AUR, which compiles and links with -fPIC. The optimization level for plib comes from the makepgk default, which looks to be -O2.

If it would help, I can run some gdb commands for you to get more information next time I encounter this crash?

[David Bears]

This might be related: I got this assertion error, which was followed by a segfault in openal.

torcs-bin: ssg.h:309: void ssgBase::deRef(): Assertion `refc > 0' failed.
double free or corruption (out)

[David Bears]

Here is another crash:

torcs-bin: CarSoundData.cpp:103: void CarSoundData::update(tCarElt*): Assertion `car->index == eng_pri.id' failed.

Thread 1 "torcs-bin" received signal SIGABRT, Aborted.
0x00007ffff6c9894c in ?? () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007ffff6c9894c in ?? () from /usr/lib/libc.so.6
#1  0x00007ffff6c3e410 in raise () from /usr/lib/libc.so.6
#2  0x00007ffff6c2557a in abort () from /usr/lib/libc.so.6
#3  0x00007ffff6c254e3 in ?? () from /usr/lib/libc.so.6
#4  0x00007fffdb84c062 in CarSoundData::update (this=<optimized out>, car=<optimized out>) at /usr/src/debug/torcs/torcs-1.3.8/src/modules/graphic/ssggraph/CarSoundData.cpp:103
#5  0x00007fffdb878d54 in grRefreshSound (s=0x555555578830, camera=0x555556606a20) at /usr/src/debug/torcs/torcs-1.3.8/src/modules/graphic/ssggraph/grsound.cpp:239
#6  grRefreshSound (s=0x555555578830, camera=0x555556606a20) at /usr/src/debug/torcs/torcs-1.3.8/src/modules/graphic/ssggraph/grsound.cpp:204
#7  0x00007fffdb8530f6 in refresh (s=0x555555578830) at /usr/src/debug/torcs/torcs-1.3.8/src/modules/graphic/ssggraph/grmain.cpp:328
#8  0x00007ffff7eea1e4 in ReUpdate () at /usr/src/debug/torcs/torcs-1.3.8/src/libs/raceengineclient/raceengine.cpp:738
#9  0x00007ffff7eea776 in ReStateManage () at /usr/src/debug/torcs/torcs-1.3.8/src/libs/raceengineclient/racestate.cpp:97
#10 0x00007ffff7b60ebe in fghRedrawWindow () from /usr/lib/libglut.so.3
#11 0x00007ffff7b6db46 in ?? () from /usr/lib/libglut.so.3
#12 0x00007ffff7b6d029 in fgEnumWindows () from /usr/lib/libglut.so.3
#13 0x00007ffff7b6d2cc in glutMainLoopEvent () from /usr/lib/libglut.so.3
#14 0x00007ffff7b6d361 in glutMainLoop () from /usr/lib/libglut.so.3
#15 0x0000555555556299 in main (argc=7, argv=0x7fffffffd6f8) at /usr/src/debug/torcs/torcs-1.3.8/src/linux/main.cpp:134

I think there must be a use-after-free somewhere that is corrupting the heap.