1 Topic by xHire

  • xHire
  • New member
  • Offline

Topic: Client is crashing with some maps

When I am trying to connect to server with some of these maps, my client always crashes and blocks the mouse so I have to run TW again to unblock it: ctf_sea (239c3b44), waterpirates_v5b (1c067614), pirates2 (3d901a53), Legend.roma (2a5a6d6d), beachfake (a8a3757c), watergarden (0a421ee8) and probably some more.

It doesn't depend neither on server I am connecting to, nor the mod of the server (tested via map rotation).

Here's my crash log (I am running official precompiled version from this web):

[4a251081][engine]: running on unix-linux-ia32
[4a251081][engine]: arch is little endian
[4a251081][binds]: bound f1 (282) = toggle_local_console
---cut---
[4a251081][binds]: bound f4 (285) = vote no
[4a251081][engine/datadir]: paths used:
[4a251081][engine/datadir]:     .
[4a251081][engine/datadir]:     /home/xhire/.teeworlds
[4a251081][engine/datadir]:     data
[4a251081][engine/datadir]: saving files to: /home/xhire/.teeworlds
[4a251081][console]: failed to open 'autoexec.cfg'
[4a251081][console]: executing 'settings.cfg'
[4a251081][]: added fav, (nil)
[4a251081][binds]: bound tab (9) = +scoreboard
---cut---
[4a251081][binds]: bound mousewheeldown (332) = +nextweapon
[4a251081][engine/mastersrv]: refreshing master server addresses
[4a251081][client/sound]: sound init successful
[4a251082][font]: gfx memory used for font textures: 3058288
[4a251082][game]: load skin limekitty
---cut---
[4a251082][game]: load skin warpaint
[4a251083][]: 1796.577024.2ms
[4a251083][client]: version 0.5 b67d1f1a1eea234e
[4a251089][engine/mastersrv]: saving addresses
[4a251090][netclient]: disconnected. reason="(null)"
[4a251090][client]: connecting to '85.131.190.199:8303'
[4a251090][client]: connected, sending info
[4a251090][client]: loading map, map=ctf_sea wanted crc=239c3b44
[4a251090][datafile]: datafile loading. filename='maps/ctf_sea.map'
[4a251090][datafile]: datafile loading. filename='downloadedmaps/ctf_sea_239c3b44.map'
[4a251090][client]: loaded map 'downloadedmaps/ctf_sea_239c3b44.map'
[4a251090][client/network]: loading done
[4a251090][datafile]: loading data index=16 size=1822 uncompressed=128000
[4a251090][datafile]: loading data index=15 size=1137 uncompressed=128000
[4a251090][datafile]: loading data index=17 size=1519 uncompressed=128000
[4a251090][datafile]: loading data index=18 size=1343 uncompressed=128000
[4a251090][datafile]: loading data index=19 size=1876 uncompressed=128000
[4a251090][datafile]: loading data index=20 size=1574 uncompressed=128000
[4a251090][datafile]: loading data index=21 size=569 uncompressed=118720
[4a251090][datafile]: loading data index=23 size=1115 uncompressed=128000
[4a251090][datafile]: loading data index=24 size=2012 uncompressed=128000
[4a251090][datafile]: loading data index=25 size=224 uncompressed=128000
[4a251090][datafile]: loading data index=0 size=12 uncompressed=4
[4a251090][datafile]: loading data index=1 size=19 uncompressed=11
[4a251091][datafile]: loading data index=3 size=3335 uncompressed=2508800
*** glibc detected *** ./teeworlds: free(): invalid pointer: 0xb7b77150 ***
======= Backtrace: =========
/lib/libc.so.6[0xb7ab3b30]
/lib/libc.so.6(__libc_free+0x89)[0xb7ab5609]
/usr/lib/dri/i965_dri.so(intel_miptree_set_level_info+0x6f)[0xb6c7eeaf]
/usr/lib/dri/i965_dri.so(i945_miptree_layout_2d+0x147)[0xb6c95877]
/usr/lib/dri/i965_dri.so(brw_miptree_layout+0x39)[0xb6cb6f49]
/usr/lib/dri/i965_dri.so[0xb6c7f102]
/usr/lib/dri/i965_dri.so(intel_miptree_create+0x61)[0xb6c7f261]
/usr/lib/dri/i965_dri.so[0xb6c94dd6]
/usr/lib/dri/i965_dri.so(intelTexImage2D+0x77)[0xb6c955e7]
/usr/lib/dri/i965_dri.so(_mesa_TexImage2D+0x2be)[0xb6d4cb6e]
/usr/lib/libGLU.so.1[0xb7d2df81]
/usr/lib/libGLU.so.1(gluBuild2DMipmaps+0xbe)[0xb7d34dce]
./teeworlds[0x8088a77]
./teeworlds[0x805b20e]
./teeworlds[0x80705a4]
./teeworlds[0x806ddcc]
./teeworlds[0x808cd44]
./teeworlds[0x808db3f]
./teeworlds[0x808e2a4]
./teeworlds[0x808e6fb]
./teeworlds[0x808ee75]
/lib/libc.so.6(__libc_start_main+0xd8)[0xb7a657c8]
./teeworlds[0x804a951]
======= Memory map: ========
08048000-080b2000 r-xp 00000000 08:02 62018      /home/xhire/games/.full/teeworlds-0.5.1-linux_x86/teeworlds
080b2000-080b6000 rw-p 0006a000 08:02 62018      /home/xhire/games/.full/teeworlds-0.5.1-linux_x86/teeworlds
080b6000-09249000 rw-p 080b6000 00:00 0          [heap]
b0500000-b0521000 rw-p b0500000 00:00 0 
b0521000-b0600000 ---p b0521000 00:00 0 
b0679000-b0b7b000 rw-p b0679000 00:00 0 
b0b7b000-b137b000 rw-s 00000000 00:07 712051     /drm mm object (deleted)
b1518000-b177d000 rw-p b1518000 00:00 0 
b177d000-b17fd000 rw-s 00000000 00:07 712050     /drm mm object (deleted)
b17fd000-b17fe000 rw-p b17fd000 00:00 0 
b17fe000-b183e000 rw-s 00000000 00:07 712016     /drm mm object (deleted)
b183e000-b187e000 rw-s 00000000 00:07 712015     /drm mm object (deleted)
b187e000-b18be000 rw-s 00000000 00:07 712014     /drm mm object (deleted)
b18be000-b18fe000 rw-s 00000000 00:07 712013     /drm mm object (deleted)
b18fe000-b193e000 rw-s 00000000 00:07 712012     /drm mm object (deleted)
b193e000-b197e000 rw-s 00000000 00:07 712011     /drm mm object (deleted)
b197e000-b19be000 rw-s 00000000 00:07 712010     /drm mm object (deleted)
b19be000-b19fe000 rw-s 00000000 00:07 712009     /drm mm object (deleted)
b19fe000-b1a3e000 rw-s 00000000 00:07 712008     /drm mm object (deleted)
b1a3e000-b1a7e000 rw-s 00000000 00:07 712007     /drm mm object (deleted)
b1a7e000-b1abe000 rw-s 00000000 00:07 712006     /drm mm object (deleted)
b1abe000-b1afe000 rw-s 00000000 00:07 712005     /drm mm object (deleted)
b1afe000-b1b3e000 rw-s 00000000 00:07 712004     /drm mm object (deleted)
b1b3e000-b1b7e000 rw-s 00000000 00:07 712003     /drm mm object (deleted)
b1b7e000-b1bbe000 rw-s 00000000 00:07 712002     /drm mm object (deleted)
b1bbe000-b1bfe000 rw-s 00000000 00:07 712001     /drm mm object (deleted)
b1bfe000-b1c3e000 rw-s 00000000 00:07 712000     /drm mm object (deleted)
b1c3e000-b1c7e000 rw-s 00000000 00:07 711999     /drm mm object (deleted)
b1c7e000-b1cbe000 rw-s 00000000 00:07 711998     /drm mm object (deleted)
b1cbe000-b1cfe000 rw-s 00000000 00:07 711997     /drm mm object (deleted)
b1cfe000-b1d3e000 rw-s 00000000 00:07 711996     /drm mm object (deleted)
b1d3e000-b1d7e000 rw-s 00000000 00:07 711995     /drm mm object (deleted)
b1d7e000-b1dbe000 rw-s 00000000 00:07 711994     /drm mm object (deleted)
b1dbe000-b1dfe000 rw-s 00000000 00:07 711993     /drm mm object (deleted)
b1dfe000-b1e3e000 rw-s 00000000 00:07 711992     /drm mm object (deleted)
b1e3e000-b1e7e000 rw-s 00000000 00:07 711991     /drm mm object (deleted)
b1e7e000-b1ebe000 rw-s 00000000 00:07 711990     /drm mm object (deleted)
b1ebe000-b20be000 rw-s 00000000 00:07 711979     /drm mm object (deleted)
b20be000-b22be000 rw-s 00000000 00:07 711978     /drm mm object (deleted)
b22be000-b26be000 rw-s 00000000 00:07 711975     /drm mm object (deleted)
b26bf000-b28bf000 rw-s 00000000 00:07 711976     /drm mm object (deleted)
b28bf000-b2a58000 rw-p b28bf000 00:00 0 
b2a58000-b2c58000 rw-s 00000000 00:07 711928     /drm mm object (deleted)
b2c59000-b2c99000 rw-s 00000000 00:07 711989     /drm mm object (deleted)
b2c99000-b2cd9000 rw-s 00000000 00:07 711988     /drm mm object (deleted)
b2cd9000-b2d19000 rw-s 00000000 00:07 711987     /drm mm object (deleted)
b2d19000-b2d59000 rw-s 00000000 00:07 711986     /drm mm object (deleted)
b2d59000-b2dd9000 rw-s 00000000 00:07 711927     /drm mm object (deleted)
b2dea000-b2e2a000 rw-s 00000000 00:07 711985     /drm mm object (deleted)
b2e2a000-b2e6a000 rw-s 00000000 00:07 711984     /drm mm object (deleted)
b2e6a000-b2eaa000 rw-s 00000000 00:07 711983     /drm mm object (deleted)
b2eaa000-b2eca000 rw-s 00000000 00:07 711982     /drm mm object (deleted)
b2eca000-b2eda000 rw-s 00000000 00:07 711981     /drm mm object (deleted)
b2eda000-b2f1a000 rw-s 00000000 00:07 711925     /drm mm object (deleted)
b2f1a000-b2f1b000 ---p b2f1a000 00:00 0 
b2f1b000-b371b000 rw-p b2f1b000 00:00 0 
b371b000-b3f1b000 rw-s 00000000 00:07 711896     /drm mm object (deleted)
b3f1f000-b3f27000 rw-s 00000000 00:07 711980     /drm mm object (deleted)
b3f27000-b3f67000 rw-s 00000000 00:07 711924     /drm mm object (deleted)
b3f67000-b3fa7000 rw-s 00000000 00:07 711923     /drm mm object (deleted)
b3fa7000-b3fe7000 rw-s 00000000 00:07 711922     /drm mm object (deleted)
b3fe7000-b4027000 rw-s 00000000 00:07 711921     /drm mm object (deleted)
b4027000-b4067000 rw-s 00000000 00:07 711920     /drm mm object (deleted)
b4069000-b40e9000 rw-s 00000000 00:07 711926     /drm mm object (deleted)
b40e9000-b4109000 rw-s 00000000 00:07 711919     /drm mm object (deleted)
b4109000-b4129000 rw-s 00000000 00:07 711918     /drm mm object (deleted)
b4129000-b4149000 rw-s 00000000 00:07 711917     /drm mm object (deleted)
b4149000-b4169000 rw-s 00000000 00:07 711916     /drm mm object (deleted)
b4169000-b4189000 rw-s 00000000 00:07 711915     /drm mm object (deleted)
b4189000-b41a9000 rw-s 00000000 00:07 711914     /drm mm object (deleted)
b41a9000-b41c9000 rw-s 00000000 00:07 711913     /drm mm object (deleted)
b41c9000-b41e9000 rw-s 00000000 00:07 711912     /drm mm object (deleted)
b41e9000-b4209000 rw-s 00000000 00:07 711911     /drm mm object (deleted)
b4209000-b4229000 rw-s 00000000 00:07 711910     /drm mm object (deleted)
b4229000-b4239000 rw-s 00000000 00:07 711909     /drm mm object (deleted)
b4239000-b4249000 rw-s 00000000 00:07 711908     /drm mm object (deleted)
b4249000-b4259000 rw-s 00000000 00:07 711907     /drm mm object (deleted)
b4259000-b4269000 rw-s 00000000 00:07 711906     /drm mm object (deleted)
b4269000-b42e9000 rw-s 00000000 00:07 711899     /drm mm object (deleted)
b42e9000-b4309000 rw-s 00000000 00:07 6357000    /SYSV0056a4d6 (deleted)
b4309000-b4319000 rw-s 00000000 00:0a 4691       /dev/snd/pcmC0D0p
b4319000-b431a000 rw-s 81000000 00:0a 4691       /dev/snd/pcmC0D0p
b431a000-b431b000 r--s 80000000 00:0a 4691       /dev/snd/pcmC0D0p
b431b000-b431c000 rw-s 00000000 00:07 6324231    /SYSV0056a4d5 (deleted)
b431c000-b439c000 rw-s 00000000 00:07 711894     /drm mm object (deleted)
b439c000-b43aa000 r-xp 00000000 08:01 268763     /lib/libresolv-2.5.1.so
b43aa000-b43ac000 rw-p 0000d000 08:01 268763     /lib/libresolv-2.5.1.so
b43ac000-b43ae000 rw-p b43ac000 00:00 0 
b43ae000-b43b2000 r-xp 00000000 08:01 268764     /lib/libnss_dns-2.5.1.so
b43b2000-b43b4000 rw-p 00003000 08:01 268764     /lib/libnss_dns-2.5.1.so
b43ba000-b43c2000 rw-s 00000000 00:07 711977     /drm mm object (deleted)
b43c2000-b43d2000 rw-s 00000000 00:07 711905     /drm mm object (deleted)
b43d2000-b43e2000 rw-s 00000000 00:07 711904     /drm mm object (deleted)
b43e2000-b43f2000 rw-s 00000000 00:07 711903     /drm mm object (deleted)
b43f2000-b4402000 rw-s 00000000 00:07 711902     /drm mm object (deleted)
b4402000-b4412000 rw-s 00000000 00:07 711901     /drm mm object (deleted)
b4412000-b4422000 rw-s 00000000 00:07 711900     /drm mm object (deleted)
b4422000-b4424000 rw-s 00000000 00:07 711890     /drm mm object (deleted)
b4424000-b4425000 rw-s 00000000 00:07 711889     /drm mm object (deleted)
b4425000-b483c000 rw-p b4425000 00:00 0 
16063 Neúsp?šn? ukon?en (SIGABRT)   ./teeworlds

I guess that these maps contain some specific object which makes the game crash. But I don't know neither what the object is, nor why is it crashing. But I know that it should be fixed. wink

P.S.: I can upload these maps somewhere (or here if the forum allows it) if necessary.

2 Reply by Random Tee

  • Random Tee
  • Random Tee
  • Member
  • Offline

Re: Client is crashing with some maps

I think I've got exactly the same problem!
It's very odd, I used to be able to play some of the maps (I think) but now they don't work.

I hope there's a fix as it means I can't play some of the more interesting mods (water mod).

I'm running 64bit Linux, latest version of Tee Worlds.
Looking at the back trace, could it be something to do with hardware acceleration/mesa (my PC has a history of these sorts of problems!)?

===I take pride in my insanity!===    |    Blender3D    |    What do you think of my post? Rate it!
Admin@SuperSiliconux128:~$quantumphysics --help -mtheory -standardmodel
[quantum_physics]: segmentation fault, core dumped

3 Reply by xHire

  • xHire
  • New member
  • Offline

Re: Client is crashing with some maps

I set `ulimit -c unlimited` and TW generated coredump for me so I put it into gdb and ran `bt` on it. Here is the output:

Core was generated by `./teeworlds'.
Program terminated with signal 6, Aborted.
[New process 16995]
[New process 16996]
[New process 16997]
#0  0xb7f17424 in __kernel_vsyscall ()
(gdb) bt
#0  0xb7f17424 in __kernel_vsyscall ()
#1  0xb7a80551 in raise () from /lib/libc.so.6
#2  0xb7a81d38 in abort () from /lib/libc.so.6
#3  0xb7ab5edb in __libc_message () from /lib/libc.so.6
#4  0xb7abbb30 in malloc_printerr () from /lib/libc.so.6
#5  0xb7abd609 in free () from /lib/libc.so.6
#6  0xb6c86eaf in intel_miptree_set_level_info () from /usr/lib/dri/i965_dri.so
#7  0xb6c9d877 in i945_miptree_layout_2d () from /usr/lib/dri/i965_dri.so
#8  0xb6cbef49 in brw_miptree_layout () from /usr/lib/dri/i965_dri.so
#9  0xb6c87102 in intel_miptree_create_internal () from /usr/lib/dri/i965_dri.so
#10 0xb6c87261 in intel_miptree_create () from /usr/lib/dri/i965_dri.so
#11 0xb6c9cdd6 in intelTexImage () from /usr/lib/dri/i965_dri.so
#12 0xb6c9d5e7 in intelTexImage2D () from /usr/lib/dri/i965_dri.so
#13 0xb6d54b6e in _mesa_TexImage2D () from /usr/lib/dri/i965_dri.so
#14 0xb7d35f81 in gluBuild2DMipmapLevelsCore () from /usr/lib/libGLU.so.1
#15 0xb7d3cdce in gluBuild2DMipmaps () from /usr/lib/libGLU.so.1
#16 0x08088a77 in gfx_load_texture_raw ()
#17 0x0805b20e in MAPIMAGES::on_mapload ()
#18 0x080705a4 in GAMECLIENT::on_connected ()
#19 0x0806ddcc in modc_connected ()
#20 0x0808cf99 in client_process_packet ()
#21 0x0808db3f in client_pump_network ()
#22 0x0808e2a4 in client_update ()
#23 0x0808e6fb in client_run ()
#24 0x0808ee75 in main ()

I hope it will help developers to find the bug.

Random Tee: I really don't know what is this actually connected with, but I am sure that the problem is in the game where it could be fixed. By the way, what graphic card (and driver) do you have?

4 Reply by Random Tee

  • Random Tee
  • Random Tee
  • Member
  • Offline

Re: Client is crashing with some maps

I've got a recent Intel graphics card on the motherboard, I'm not sure quite what it is, a GMA something-or-other I think. The driver is what Ubuntu chose to run automatically, but I've had lots of trouble with getting Mesa to work, DRI acceleration won't work correctly so I've had to re-compile Mesa and try to install it, which caused problems.

I'm only guessing that it could be a problem, although I did think I'd got it to work.

Looking at the latest information you got, I still think it could be a bug in drivers.
#5  0xb7abd609 in free () from /lib/libc.so.6
#6  0xb6c86eaf in intel_miptree_set_level_info () from /usr/lib/dri/i965_dri.so
could indicate that the driver ran free() with some bad parameters as free() should be reliable. Most of the functions listed are from mesa and it's related libraries, another thing that might point to the problem being in Mesa.
in intelTexImage ()
could even be similar driver to the problem one I've run into!

===I take pride in my insanity!===    |    Blender3D    |    What do you think of my post? Rate it!
Admin@SuperSiliconux128:~$quantumphysics --help -mtheory -standardmodel
[quantum_physics]: segmentation fault, core dumped

5 Reply by xHire

  • xHire
  • New member
  • Offline

Re: Client is crashing with some maps

Random Tee wrote:

Looking at the latest information you got, I still think it could be a bug in drivers.
#5  0xb7abd609 in free () from /lib/libc.so.6
#6  0xb6c86eaf in intel_miptree_set_level_info () from /usr/lib/dri/i965_dri.so
could indicate that the driver ran free() with some bad parameters as free() should be reliable.

You might be right there! But we don't know what causes the problem. TeeWorlds developers (are there any? big_smile) should first identify why is this crash caused and by what. If they proved that the bug is really in Intel driver, I would report it to the maintainers. But now I don't know anything what I could tell them to do or to fix...

First step could be to find out which exact objects in each case cause the crash (and why are they special). The second if there isn't bug in gfx_load_texture_raw() or if they cat find out some workaround. I am opened to cooperation but no TW dev's appeared here yet... sad

6 Reply by Jamp

  • Jamp
  • Member
  • Offline

Re: Client is crashing with some maps

I had this problem with intel graphics on linux too, never get solved (bought some old secondhand nvidia)
You should also ask some intel driver guys IMO

Drowning dwarves lately

7 Reply by Random Tee

  • Random Tee
  • Random Tee
  • Member
  • Offline

Re: Client is crashing with some maps

From what people have said in other places the devs are quite busy/inactive right now, so we might have to wait a while for them.

I had a quick look at the function, signal 6 by the way is SIGARBT (in case you don't know, I didn't), an abort signal usually from the program. The function, gfx_load_texture_raw is a part of the gfx stuff in TW, it looks like it's one of the older parts too, as it's written in C rather than C++, which (I would think) should mean that it's reliable.
I think that makes the case for it being a driver bug, especially as there is a reference to an abort() function and what Jamp has said.

===I take pride in my insanity!===    |    Blender3D    |    What do you think of my post? Rate it!
Admin@SuperSiliconux128:~$quantumphysics --help -mtheory -standardmodel
[quantum_physics]: segmentation fault, core dumped