[Fixed] [r3735] A case of state jump causing a crash

[Blue Shadow]

If a code performs a jump to a label through Goto and that label is followed immediately by another Goto, ZDoom crashes.

Example (Note that this's just a simple example to produce the crash. I'm not using the exact same setup you see here):

Code: Select all • Expand view

ACTOR NC_DoomImp : DoomImp replaces DoomImp
{
  States
  {
  Missile:
    TROO EF 8 A_FaceTarget
    TROO G 6 A_TroopAttack
    Goto Missile1
  Missile1:
    Goto Missile2
  Missile2:
    TROO EF 8 A_FaceTarget
    TROO G 6 A_HeadAttack
    Goto See
  }
}


Now, if you were to put a state (i.e., TNT1 A 0) between "Missile1:" and "Goto Missile2", it'll work fine and won't crash. The same if you were to replace "Goto Missile1" with "TNT1 A 0 A_Jump(255, "Missile1")".

Spoiler: Using either of these versions of the code above will not cause a crash

Code: Select all • Expand view

ACTOR NC_DoomImp : DoomImp replaces DoomImp
{
  States
  {
  Missile:
    TROO EF 8 A_FaceTarget
    TROO G 6 A_TroopAttack
    Goto Missile1
  Missile1:
    TNT1 A 0 // <----
    Goto Missile2
  Missile2:
    TROO EF 8 A_FaceTarget
    TROO G 6 A_HeadAttack
    Goto See
  }
}


Code: Select all • Expand view

ACTOR NC_DoomImp : DoomImp replaces DoomImp
{
  States
  {
  Missile:
    TROO EF 8 A_FaceTarget
    TROO G 6 A_TroopAttack
    TNT1 A 0 A_Jump(255, "Missile1") // <----
  Missile1:
    Goto Missile2
  Missile2:
    TROO EF 8 A_FaceTarget
    TROO G 6 A_HeadAttack
    Goto See
  }
}


For your convenience, here is a ready-to-test file that produces the crash (just summon an imp and let it fire at you):

state_jumping.pk3

Also, the crash report:

CrashReport.zip

[MartinHowe]

In both cases, it's a question of "don't do that". However, IMO the engine should surely abort with an error message in the loading console, rather than crash. In the second case, how can one A_Jump to an empty state, since technically empty states do not exist... wonder what the engine actually does there

[FDARI]

What I think it should do, and thought it would do, since zdoom seems to support some kinds of "stateless" label traversal, is to make missile1 the equivalent of missile2 (at load-time). (Any label immediately followed by a goto instruction could transparently be redirected to the destination of that goto.)

[Edward-san]

"simplifyUselessLabel(*insertstatetypehere* *oldstate, *insertstatetypehere* *newstate)", anyone?

[randi]

Fixed in r3784.