[VERIFIED] UOX3 crash after garbage collection?

[Xuri]

UOX3 crashed! O_o v0.98-4.0b

Right after having performed a worldsave, and collected some garbage (Console shows "World save complete.", and below that, "Performing Garbage Collection... Removed 29 objects")

Dialogue box with okay button: User breakpoint called from code at 0x7c90120e

Callstack:
NTDLL! 7c90120e()
NTDLL! 7c96c63e()
NTDLL! 7c96d826()
NTDLL! 7c949e1c()
NTDLL! 7c927553()
MSVCRT! 77c2c2de()
JS32! 100533c7()
0824448b()
12000a00()
fb00aafb()
abababab()

Output thing:
HEAP[UOX3.exe]: Invalid Address specified to RtlFreeHeap( 00380000, 1A89A1A9 )

Doesn't look like there's much (if anything) to go on.

[Xuri]

Okay, some more details on this one.

I can reproduce it 100% of the time like this:

Testcase:
1. Log in
2. 'ADD 0x100a
or...
2b. 'ADD 0x1070
3. Doubleclick on the archery butte/training dummy a couple of times
4. 'SAVE

So it would appear that it's related to something in archerybutte.js and trainingdummy.js.

Common for both seems to be use of TriggerEvent to run an event in a different scriptfile, where a tag is applied to the character using SetTag. This is then retrieved again using GetTag in the original scriptfile (archerybutte.js/trainingdummy.js in this case) after the event in the other script is done.

This can also be reproduced by pasting the following into any other JavaScript we have (and replacing pUser with what's appropriate in the script you paste it into):

Code: Select all

		TriggerEvent( 2500, "getWeaponType", pUser );
		var weaponType = pUser.GetTag( "weaponType" );

Trigger the script you pasted this code into, then do a worldsave afterwards. Guaranteed crash. To see what happens during the TriggerEvent bit, check js\server\data\weapontypes.js.

We have other scripts that make use of TriggerEvent without crashing the server (the clock-script, for instance, scriptid 5014), and we also have scripts that make use of SetTag and GetTag without crashing.

But the combination of TriggerEvent, SetTag in external script and then GetTag in original script somehow seems to trigger the crash all the time for me.

This bug is probably the same as this one from June 2007.

[Xuri]

Hm. This might be limited to only happening in debug-mode. I've been unable to reproduce it on the release-version of UOX3, at least.