Strange access violation crash in GZDoom (version 4.2.4)...

[DoomKrakken]

Not sure how to explain it, but it continues to happen occasionally in a mod I'm developing called "Embers Of Armageddon" (which attempts to faithfully recreate the weapons, items, combat mechanics, and upgrade systems of DOOM to Doom via GZDoom). It typically happens while a Haste powerup is active (doesn't seem to happen with other powerups in the mod, for whatever reason) while firing the Chaingun in certain areas (although sometimes it also happens just by spinning the Chaingun using the Gatling Rotator). It's a very rare bug, and doesn't always happen, so it's hard to find any place to recreate it.

The most recent place this bug occurred was in MAP12: Suburb in "Lost Civilization" by Jaska (joi_lstcv14.wad).

Here are some screenshots (had to upload them to some channel in Discord so that they can be viewed here):

The Haste item:
https://cdn.discordapp.com/attachments/ ... 231327.png

Firing the Chaingun into the alcove where the problem seems to occur:
https://cdn.discordapp.com/attachments/ ... 004252.png

Haste active:
https://cdn.discordapp.com/attachments/ ... 004305.png

I will PM you my mod upon request (please don't distribute).

I've also attached the crash report here.

What seems to be the problem? Will you need anything more from me?

Thank you for your time.

[_mental_]

Maybe with full memory dump it would be possible to figure out something. Minidump is mostly useless here.
In order to fix this, we need a reliable way to reproduce the problem.

---

Code: Select all

GC::Mark(DObject * * obj=0x0000000000000000) Line 235
DObject::PropagateMark() Line 414
GC::Step() Line 413
[Inline Frame] GC::CheckGC() Line 110
FThinkerList::TickThinkers(FThinkerList * dest=0x0000000140d10db8) Line 583
FThinkerCollection::RunThinkers(FLevelLocals * Level=0x0000000140d0f680) Line 123
P_Ticker() Line 174
G_Ticker() Line 1201
TryRunTics() Line 1994
D_DoomLoop() Line 1046

[DoomKrakken]

I can PM you my mod, would you like that?

Also, you'll need to get joi_lstcv14.wad from here: https://www.doomworld.com/forum/topic/1 ... load-link/

[_mental_]

It depends on how much time I need to play in order to trigger the crash. Actually, you can PM me anyway, as I can try to change garbage collection setting in order to reproduce it faster.

[DoomKrakken]

Alright, I will.

Shouldn't take long to play, if I also give you my save file. You'll spawn right in front of the Haste item, and you'll turn around and find that alcove past the Spider Mastermind and some permanent homing items.

[_mental_]

EOA Code.pk3:ZScript/EOA/Base.txt

Code: Select all

Class EOA_BaseWeapon : DoomWeapon
{
	// ...
	Int SpeedCounter;
	// ...
	Void SetSpeedCounter(Int Amount)
	{
		SpeedCounter = Amount;
	}
	// ...

EOA Code.pk3:Decorate/Weapons/Chaingun.txt

Code: Select all

ACTOR EOA_Chaingun : EOA_Weapon 20008
{
	// ...
	States
	{
		// ...
	SpinAnim1:
		// ...
		"####" ABC 1
		{
			// ...
			SetSpeedCounter(0);
			// ...

The thing is self inside SetSpeedCounter() function will point to a player object and not to a weapon one.
Your mod is so lucky that the given member overwrites the lower half of dynamic array's internal pointer (for 64-bit version).
No surprise that this will crash the game sooner or later.

Engine should reject such code, and it does so for ZScript classes. A mix of Decorate and ZScript lacks such checks at the moment.

[_mental_]

Missing checks are fixed in cf8c05c. This means that code with such issues will fail to compile.

---

Code: Select all

Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 498:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 507:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 541:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 550:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 583:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 592:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 630:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 639:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 672:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 681:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 714:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 723:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 761:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 770:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 803:
Call to member function GetSpeedCounter with incompatible self pointer.
Script error, "EOA Code.pk3:decorate/weapons/chaingun.txt" line 812:
Call to member function GetSpeedCounter with incompatible self pointer.

[DoomKrakken]

AWESOME!

Ah, so it had to do with the porting of speed counters over to ZScript, with an improper pointer.

Well, this will certainly help! Just fixed it, and now there are no crashes (thus far, but I'm confident I fixed it well).

I wonder why it happened in so few places, and didn't crash that often.

Thanks so much for your help!

[_mental_]

I wonder why it happened in so few places, and didn't crash that often.

That’s the nature of a random memory overwrite. Depending on particular situation, it can be very easy to trigger a visible bug or may go unnoticed for years.