[Fixed] Teleport crash

HotWax · Post by **HotWax** » Sat Jan 31, 2004 5:46 am

Okay, let me say right up front that this crash is most likely the result of PEBKAC. That said, the crash still happens, and if it can be avoided, it should be. Let me explain what I'm trying to do.

Basically, I want to use the silent-teleport-while-falling-down-vertical-shaft trick to give the illusion of a room-over-room effect. To this end, I made a tall shaft that the player falls in (Floor: -1024, ceil: 352, player falls from height 0), and then linked it to a control sector to give it a fake floor at -512 units. I then put an Actor Hits Fake Floor activator in the sector, and selected Teleport (Silent) as the action with these args: 2, 0, 0. Finally, I placed a mapspot with a tag of 2 in a similar shaft in the ceiling of the area I want the player to warp into. (Floor: 0, ceil: 736, surrounding ceiling is 224) I gave the mapspot a Z-height of 675. Then I tested the level. Well, the effect worked, except that mapspots apparently don't hold their Z-height (or the teleport ignores it) and so the player would immediately appear on the floor, ruining the effect. This would not do.

Then I remembered to try a teleport destination, and so chose the appropriately named Teleport with Z Height. I placed it at the same height as the mapspot and tagged it 2. Now whenever I fall into the shaft, ZDoom crashes with a fatal error as soon as the player hits the floor. I thought maybe the destination was too high and shifted it down to 650 (should be more than enough room) but got the same result.

So, this post is twofold and stuff. One, the crash should be fixed if at all possible, and two, somebody please tell me what I'm doing wrong. Thanks.

Code: Select all

Code: ACCESS_VIOLATION
Tried to read address 00000000
Flags: 00000000
Address: 0045d7ce

Windows NT 5.1 Build 2600 Service Pack 1

GS=0000  FS=003b  ES=0023  DS=0023
EAX=01765af4  EBX=00000000  ECX=00000000  EDX=00000160
ESI=0176bc58  EDI=02b30000
EBP=00000000  EIP=0045d7ce  ESP=0012fc18  CS=001b  SS=0023
EFlags=00010206
 CF- PF+ AF- ZF- SF- TF- IF+ DF- OF- NT- RF+ VM- AC- VI- VP-

FPU State:
 ControlWord=027f StatusWord=4021 TagWord=ffff
 ErrorOffset=0046127b
 ErrorSelector=0083001b
 DataOffset=0012fbe0
 DataSelector=ffff0023
 Cr0NpxState=00000000

MM0=9b390d0000000000
MM1=97e7b4eea90f7800
MM2=9fddeb8c70fad800
MM3=0000000000000000
MM4=0000000000000000
MM5=0176bc5802b30000
MM6=0000000001765af4
MM7=000000230012fc18

Running threads:
00000570 at 0045d7ce*
00000788
0000052c
000007b8
0000079c
000002c4
00000730
000002c8
000006ac

Loaded modules:
00400000 - 0062efff *zdoom.exe
77f50000 - 77ff6fff  ntdll.dll
77e60000 - 77f45fff  kernel32.dll
71950000 - 71a33fff  COMCTL32.dll
77c10000 - 77c62fff  msvcrt.dll
77c70000 - 77caffff  GDI32.dll
77d40000 - 77dcbfff  USER32.dll
77dd0000 - 77e5cfff  ADVAPI32.dll
78000000 - 78085fff  RPCRT4.dll
70a70000 - 70ad4fff  SHLWAPI.dll
71ad0000 - 71ad7fff  WSOCK32.dll
71ab0000 - 71ac4fff  WS2_32.dll
71aa0000 - 71aa7fff  WS2HELP.dll
76b40000 - 76b6bfff  WINMM.dll
10000000 - 10093fff  fmod.dll
77be0000 - 77bf3fff  MSACM32.dll
771b0000 - 772d0fff  ole32.dll
763b0000 - 763f4fff  comdlg32.dll
773d0000 - 77bc1fff  SHELL32.dll
76390000 - 763abfff  IMM32.DLL
629c0000 - 629c7fff  LPK.DLL
72fa0000 - 72ff9fff  USP10.dll
00c90000 - 00cbafff  msctfime.ime
76f50000 - 76f57fff  wtsapi32.dll
76360000 - 7636efff  WINSTA.dll
76f90000 - 76f9ffff  Secur32.dll
51080000 - 510d5fff  dsound.dll
77c00000 - 77c06fff  VERSION.dll
72d20000 - 72d28fff  wdmaud.drv
72d10000 - 72d17fff  msacm32.drv
77bd0000 - 77bd6fff  midimap.dll
5ef80000 - 5ef83fff  KsUser.dll
76fd0000 - 77047fff  CLBCATQ.DLL
77120000 - 771aafff  OLEAUT32.dll
77050000 - 77114fff  COMRes.dll
6ce10000 - 6ce44fff  dinput8.dll
688f0000 - 688f8fff  HID.DLL
76670000 - 76756fff  SETUPAPI.DLL
51000000 - 51046fff  ddraw.dll
73bc0000 - 73bc5fff  DCIMAN32.dll
01550000 - 01560fff  ctagent.dll
746f0000 - 74715fff  Msimtf.dll
74720000 - 74763fff  MSCTF.dll

Bytes near EIP:
0045d7be: 7f 17 68 00 01 00 00 8b 46 54 8b 88 e0 00 00 00
0045d7ce: 8b 11 56 ff 92 80 00 00 00 5f 5e 83 c4 08 c3 cc
0045d7de: cc cc 57 b9 80 00 00 00 33 c0 bf f8 50 5b 00 f3

ZDoom version 2.0.61

Command line:
 C:\Games\zdoom\zdoom.exe -iwad C:\Games\zdoom\WADs\CONSTR~1\iwad\hdoom2.wad -file C:\Games\zdoom\tempmap.wad -map MAP01 -skill 4
IWAD: hdoom2.wad

Current map: MAP01

viewx = 25168483
viewy = -26448372
viewz = -27717034
viewangle = 2236678144

Possible call trace:
 0045d7ce  BOOM
 00461e73  call 004611b0
 00463e31  call 00463260
 00421fc7  call [edx+0x10]
 0042230d  call 00421f50
 004737e4  call 004222c0
 0042a9cb  call 00473700
 0041b4a2  call 0042a6b0
 0041753c  call 0041b1b0
 0042d6e7  call 00409a10
 0040afd3  call 0040af20
 0040afd3  call 0040af20
 00499a51  call 0040afc0
 00499b53  call 004fdd96
 00496c03  call 00417590
 00496f15  call 00496850
 0050124a  call 00496ea0
 005010de  call 004feb40
 005010c6

Stack Contents:
0012fc18: 00000200 00000000 0176bc58 fe390000  ········X·v···9·
0012fc28: 017659f8 00461e73 00000000 00000001  ·Yv·s·F·········
0012fc38: 00000000 0176bc58 00000000 00000000  ····X·v·········
0012fc48: 00000000 00000000 00000000 00000000  ················
0012fc58: 00463e31 fe100000 00421fc7 005abccc  1>F·······B···Z·
0012fc68: 00000008 00000000 0042230d 00000008  ·········#B·····
0012fc78: 005ae958 00000001 004737e4 00000194  X·Z······7G·····
0012fc88: 00000001 0042a9cb 005ac82e 00000007  ······B·.·Z·····
0012fc98: 6d7109e3 0041b4a2 00000004 00bc2970  ··qm··A·····p)··
0012fca8: 0012fcd8 00000001 0041753c 00000004  ········<uA·····
0012fcb8: 00bc2970 00000001 0042d6e7 00000193  p)········B·····
0012fcc8: 0012fcb4 0012fe04 0050f455 00000000  ········U·P·····
0012fcd8: 00000000 0000026e 000000f8 0012fe6c  ····n·······l···
0012fce8: 0000017e b2372425 00ba0af8 a0ba88d0  ~···%$7·········
0012fcf8: 01de8165 6d6f6f44 7475412e 616f6c6f  e···Doom.Autoloa
0012fd08: 732f0064 736e696b 4fef1e00 02f4be1e  d·/skins···O····
0012fd18: 53d0c69a e90faa04 5d8757ef e19875d5  ···S·····W·]·u··
0012fd28: 32a981e4 3c8e13bb 1f023a8c 79bddcf3  ···2···<·:·····y
0012fd38: e71d6c56 eb1b10eb a5ecdf3a 6efd0239  Vl······:···9··n
0012fd48: 8b225b79 00000002 d9062e0d 0040afd3  y["······.····@·
0012fd58: 0012fd64 00000002 d9062e0d 0040afd3  d········.····@·
0012fd68: 0012fd74 00499a51 0052f378 00499b53  t···Q·I·x·R·S·I·
0012fd78: 00000094 00000005 00000001 00000a28  ············(···
0012fd88: 00000002 76726553 20656369 6b636150  ····Service Pack
0012fd98: 77003120 772bb638 771c453f 00000000   1·w8·+w?E·w····
0012fda8: 8007000e 0015a178 771b449c 00000000  ····x····D·w····
0012fdb8: 00000000 771ce3f3 0015a178 0012fe04  ·······wx·······
0012fdc8: 772bb6ec 00000000 772bb264 0012fdfc  ··+w····d·+w····
0012fdd8: 771c0ee8 00000001 00000000 00000002  ···w············
0012fde8: 00000000 00000000 0000026e 0000017e  ········n···~···
0012fdf8: 00000002 00062e0d d9062e0d 0012fe60  ·····.···.··`···
0012fe08: 0050f478 ffffffff 00496c03 ffffffff  x·P······lI·····
0012fe18: 77e7e6b9 7ffdf000 00000000 00000000  ···w···········
0012fe28: 0000026e 0000017e 00000001 000f4240  n···~·······@B··
0012fe38: 0012fe2c 00000020 00000276 00000000  ,··· ···v·······
0012fe48: 00400000 00400230 00400208 77e60000  ··@·0·@···@····w
0012fe58: 00400000 0012fe14 0012fe88 00510930  ··@·········0·Q·
0012fe68: 00000000 0012fe98 00496f15 77e7ad86  ·········oI····w
0012fe78: 00000000 7ffdf000 0012fe74 0012f840  ·······t···@···
0012fe88: 0012ffb0 00500e88 0052ea20 00000000  ······P· ·R·····
0012fe98: 0012ffc0 0050124a 00400000 00000000  ····J·P···@·····
0012fea8: 0015232b 00000005 00000094 00000005  +#··············
0012feb8: 00000001 00000a28 00000002 76726553  ····(·······Serv
0012fec8: 20656369 6b636150 ee003120 ee222c08  ice Pack 1···,"·
0012fed8: ee222c08 ee222c08 e3079000 e3079000  ·,"··,"·········
0012fee8: e307a000 e307b000 e307c000 e307d000  ················
0012fef8: e307e000 e307f000 e3080000 e3081000  ················
0012ff08: e3082000 e3083000 e3084000 e3085000  · ···0···@···P··
0012ff18: e3086000 e3079000 fee829a0 00000300  ·`·······)······
0012ff28: 00008b01 00000001 0000000e 00000000  ················
0012ff38: 01010001 00002079 005010de 70a9f1ab  ····y ····P····p
0012ff48: 80000002 7ffdf000 00000044 00153510  ·······D····5··
0012ff58: 001533b0 00153570 00000000 00000000  ·3··p5··········
0012ff68: 00000000 00000000 00000000 00000000  ················
0012ff78: 00000000 00000001 00000005 00000000  ················
0012ff88: ffffffff ffffffff ffffffff 00000006  ················
0012ff98: 00000000 805388d7 0015232b 00000000  ······S·+#······
0012ffa8: 0012feb0 e3f78828 0012ffe0 00500e88  ····(·········P·
0012ffb8: 0055c0e0 00000000 0012fff0 77e814c7  ··U············w
0012ffc8: 70a9f1ab 80000002 7ffdf000 00580045  ···p·······E·X·
0012ffd8: 0012ffc8 c03c7e3c ffffffff 77e94809  ····<~<······H·w
0012ffe8: 77e91210 00000000 00000000 00000000  ···w············
0012fff8: 005010c6 00000000                    ··P·····

Post by **Graf Zahl** » Sat Jan 31, 2004 5:54 am

Can you upload the map that crashed so somebody can test it a little? Without it it might be harder to find the cause of it.

HotWax · Post by **HotWax** » Sat Jan 31, 2004 5:55 am

Just to add to this, I thought maybe the action was causing ZDoom to crash because it was expecting a mapspot with a TID of 2 (not a teleport destination), but when I removed the destination entirely it didn't crash; instead nothing happened when I fell. Of course, it might still be expecting a mapspot, but that's what should happen instead of a crash, IMO.

HotWax · Post by **HotWax** » Sat Jan 31, 2004 5:56 am

Graf Zahl wrote:Can you upload the map that crashed so somebody can test it a little? Without it it might be harder to find the cause of it.

And give away my l33t secrets!? *gasp*

Give me a minute to whip up a sample map that crashes.

[EDIT]And here it is. If you replace the Teleport destination with a mapspot (or mapspot with gravity), the action works but the player immediately appears on the floor.[/EDIT]

Post by **Graf Zahl** » Sat Jan 31, 2004 6:21 am

Ok, I'll take a look at it. If I know something more I'll post here immediately.

Post by **Graf Zahl** » Sat Jan 31, 2004 6:36 am

Don't worry. It isn't your fault that this happens. There is a bug in the sector action code of ZDoom. What happens is the following:

You are triggering a sector action which teleports you to a different sector. The problem is that ZDoom tries a few different sector action types after you have been teleported.
These are done for the new sector, not the old one. Unfortunately this sector does not contain any sector actions so ZDoom tries to read through a NULL pointer. If you use a map spot you land directly on the floor so no further sector actions are executed.
For a temporary fix you can put a dummy sector action thing in the destination sector.

(Randy: To fix this read mo->Sector at the beginning of P_CheckFakeFloorTriggers and store it in a local variable and then use that throughout the function instead of mo->Sector which gets changed if a sector action causes a teleport. There may be more changes necessary because as it is now this will execute different sector action types for different sectors and it re-reads the coordinates several times from the actor depending on which sector action type caused an eventual teleport.)

Cutmanmike · Post by **Cutmanmike** » Sat Jan 31, 2004 11:22 am

Hmm, I could use this bug for my next platform wad...

Post by **Xaser** » Sat Jan 31, 2004 12:51 pm

There should be a Crashes forum, as a lot of the bugs here are just fancy crashes.

Post by **Graf Zahl** » Sat Jan 31, 2004 12:58 pm

Xaser wrote:There should be a Crashes forum, as a lot of the bugs here are just fancy crashes.

Why? This one's clearly a bug, with a specific cause and easily fixed. All those strange random crashes end up in 'Vexing bugs' anyway.

Post by **Xaser** » Sat Jan 31, 2004 1:01 pm

Good point, I guess.

HotWax · Post by **HotWax** » Sat Jan 31, 2004 1:20 pm

Thanks for the info, Graf. I assume it's okay to put an activator in the destination sector that has no action, and this won't break when Randy fixes the problem either? Also, do I need to make it the same type of activator (actor hits fake floor), or will any kind do? And finally, what would happen if I had an activator I wanted to use when the player finishes falling into the new sector? (Actor hits floor) Would it execute its special as soon as the player entered, or properly wait until they hit the floor, or something else?

Anyhow, thanks. /me goes to hack at his level some more.

Post by **Graf Zahl** » Sat Jan 31, 2004 3:14 pm

There just has to be a sector action thing in the sector so that the sector's pointer isn't NULL. It can be of any kind and AFAIK it doesn't need to have a real special.

If you want a real sector action in the destination sector you can do so without problems. It just shouldn't be anything that has to do with fake floors (because those are the ones affected by the bug.)

Post by **randi** » Fri Feb 06, 2004 8:54 pm

Fixed.