Segmentation Fault from player:getStorageValue()

[Shadow_]

Hello,
I really need assistance here as im getting a crash from the function like this case.

Getting SIGSEGV in std::map, when using find function

I am running some small online game and there is server crash at some time. I can't find what is causing the SIGSEGV. The gdb bring me to that function: bool Player::getStorageValue(const uint32_t...

stackoverflow.com

bt without symbols

warning: Section `.reg-xstate/9545' in core file too small.
#0  0x000055fd9209ed8c in std::less<unsigned int>::operator()(unsigned int const&, unsigned int const&) const ()
[Current thread is 1 (Thread 0x7fce02ac0700 (LWP 9545))]
(gdb) bt
#0  0x000055fd9209ed8c in std::less<unsigned int>::operator()(unsigned int const&, unsigned int const&) const ()
#1  0x000055fd91e3cb2a in std::_Rb_tree<unsigned int, std::pair<unsigned int const, int>, std::_Select1st<std::pair<unsigned int const, in             t> >, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, int> > >::_M_lower_bound(std::_Rb_tree_node<std::pair<unsigned              int const, int> > const*, std::_Rb_tree_node_base const*, unsigned int const&) const ()
#2  0x000055fd91e39350 in std::_Rb_tree<unsigned int, std::pair<unsigned int const, int>, std::_Select1st<std::pair<unsigned int const, in             t> >, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, int> > >::find(unsigned int const&) const ()
#3  0x000055fd91e368bb in std::map<unsigned int, int, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, int> > >::find             (unsigned int const&) const ()
#4  0x000055fd91e65702 in Player::getStorageValue(unsigned int, int&) const ()
#5  0x000055fd91ed0f73 in LuaScriptInterface::luaPlayerGetStorageValue(lua_State*) ()
#6  0x00007fce061d0e37 in ?? () from /usr/lib/x86_64-linux-gnu/libluajit-5.1.so.2
#7  0x00007fce0621e27c in lua_pcall () from /usr/lib/x86_64-linux-gnu/libluajit-5.1.so.2
#8  0x000055fd91f5f988 in LuaScriptInterface::protectedCall(lua_State*, int, int) ()
#9  0x000055fd91f60ab5 in LuaScriptInterface::callFunction(int) ()
#10 0x000055fd91edf490 in LuaEnvironment::executeTimerEvent(unsigned int) ()
#11 0x000055fd91eb704b in void std::__invoke_impl<void, void (LuaEnvironment::*&)(unsigned int), LuaEnvironment*&, unsigned int&>(std::__i             nvoke_memfun_deref, void (LuaEnvironment::*&)(unsigned int), LuaEnvironment*&, unsigned int&) ()
#12 0x000055fd91eb49ca in std::__invoke_result<void (LuaEnvironment::*&)(unsigned int), LuaEnvironment*&, unsigned int&>::type std::__invo             ke<void (LuaEnvironment::*&)(unsigned int), LuaEnvironment*&, unsigned int&>(void (LuaEnvironment::*&)(unsigned int), LuaEnvironment*&, un             signed int&) ()
#13 0x000055fd91eb0dae in void std::_Bind<void (LuaEnvironment::*(LuaEnvironment*, unsigned int))(unsigned int)>::__call<void, , 0ul, 1ul>             (std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) ()
#14 0x000055fd91eeaa1b in void std::_Bind<void (LuaEnvironment::*(LuaEnvironment*, unsigned int))(unsigned int)>::operator()<, void>() ()
#15 0x000055fd91ee5f8e in std::_Function_handler<void (), std::_Bind<void (LuaEnvironment::*(LuaEnvironment*, unsigned int))(unsigned int)             > >::_M_invoke(std::_Any_data const&) ()
#16 0x000055fd91d9896a in std::function<void ()>::operator()() const ()
#17 0x000055fd91d98290 in Task::operator()() ()
#18 0x000055fd91d98582 in Dispatcher::threadMain() ()
#19 0x000055fd91e8b213 in void std::__invoke_impl<void, void (Dispatcher::*)(), Dispatcher*>(std::__invoke_memfun_deref, void (Dispatcher:             :*&&)(), Dispatcher*&&) ()
#20 0x000055fd91e89b8e in std::__invoke_result<void (Dispatcher::*)(), Dispatcher*>::type std::__invoke<void (Dispatcher::*)(), Dispatcher             *>(void (Dispatcher::*&&)(), Dispatcher*&&) ()
#21 0x000055fd91e53aa9 in decltype (__invoke((_S_declval<0ul>)(), (_S_declval<1ul>)())) std::thread::_Invoker<std::tuple<void (Dispatcher:             :*)(), Dispatcher*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) ()
#22 0x000055fd91e535c6 in std::thread::_Invoker<std::tuple<void (Dispatcher::*)(), Dispatcher*> >::operator()() ()
#23 0x000055fd91e5307c in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (Dispatcher::*)(), Dispatcher*> > >::_M_run() ()
#24 0x00007fce04eee6df in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#25 0x00007fce053de6db in start_thread (arg=0x7fce02ac0700) at pthread_create.c:463

 

[Gesior.pl]

#0  0x000055fd9209ed8c in std::less<unsigned int>::operator()(unsigned int const&, unsigned int const&) const ()
[Current thread is 1 (Thread 0x7fce02ac0700 (LWP 9545))]
(gdb) bt
#0  0x000055fd9209ed8c in std::less<unsigned int>::operator()(unsigned int const&, unsigned int const&) const ()
#1  0x000055fd91e3cb2a in std::_Rb_tree<unsigned int, std::pair<unsigned int const, int>, std::_Select1st<std::pair<unsigned int const, in             t> >, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, int> > >::_M_lower_bound(std::_Rb_tree_node<std::pair<unsigned              int const, int> > const*, std::_Rb_tree_node_base const*, unsigned int const&) const ()
#2  0x000055fd91e39350 in std::_Rb_tree<unsigned int, std::pair<unsigned int const, int>, std::_Select1st<std::pair<unsigned int const, in             t> >, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, int> > >::find(unsigned int const&) const ()
#3  0x000055fd91e368bb in std::map<unsigned int, int, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, int> > >::find             (unsigned int const&) const ()
#4  0x000055fd91e65702 in Player::getStorageValue(unsigned int, int&) const ()
#5  0x000055fd91ed0f73 in LuaScriptInterface::luaPlayerGetStorageValue(lua_State*) ()

Crash is reported in C++ 'std::map' structure. We may assume that basic C++ structure is not bugged.
There are 3 possibilities:

• that structure does not exist and we are using some old pointer to Player*
• there is second thread that reads/writes data from/to that structure in same time (need thread apply all bt from gdb to verify that)
• some random write to RAM destroyed std::map structure (very rare bug)

There is also this line:

#10 0x000055fd91edf490 in LuaEnvironment::executeTimerEvent(unsigned int) ()

Which means that LUA script was called from addEvent and it's common mistake to pass objects (Player/Creature/Item) to addEvent function. When event is execute, passed object does not exist (player logged out) and calling player:getStorageValue(123) results in server crash.
More about LUA scripts that crash server:

[TFS 1.x+] How to NOT write LUA scripts or how to crash server by LUA script – HALP!