[nowakpl]

Originally Posted by Powerlord Is this on Linux or Windows? I've heard reports of this, but I haven't had a chance to set up a server to test it.

Linux, below is gdb backtrace, after running sm_umc_mapvote 2 and sm_map ctf_turbine.

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0xebe45c9f in BuiltinVoteHandler::EndVoting() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/extensions/builtinvotes.ext.2.ep2v.so
#2  0xee777b01 in TimerSystem::KillTimer(SourceMod::ITimer*) () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so
#3  0xee77741b in TimerSystem::RemoveMapChangeTimers() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so
#4  0xee75c96c in SourceModBase::LevelShutdown() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so
#5  0xeec145c6 in __SourceHook_MFHCls_SGD_LevelShutdown::Func() () from /data/home/nowak/tf2/orangebox/tf/../tf/addons/metamod/bin/metamod.2.ep2v.so
#6  0xf6c10afe in CServerPlugin::LevelShutdown() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#7  0xf6b7038d in CHostState::State_ChangeLevelMP() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#8  0xf6b70c8e in CHostState::FrameUpdate(float) () from /data/home/nowak/tf2/orangebox/bin/engine.so
#9  0xf6b70f78 in HostState_Frame(float) () from /data/home/nowak/tf2/orangebox/bin/engine.so
#10 0xf6c28580 in CEngine::Frame() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#11 0xf6c2453a in CDedicatedServerAPI::RunFrame() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#12 0xf6fe019e in ?? ()
#13 0xf6fdfea8 in ?? ()
#14 0xf6c24e36 in CModAppSystemGroup::Main() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#15 0xf6c40128 in CAppSystemGroup::Run() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#16 0xf6c25c3a in CDedicatedServerAPI::ModInit(ModInfo_t&) () from /data/home/nowak/tf2/orangebox/bin/engine.so
#17 0xf6fe0376 in ?? ()
#18 0xf6fe3ea8 in ?? ()
#19 0xf6fe5b8c in ?? ()
#20 0xf6fe3ea8 in ?? ()
#21 0xf6fe07dd in ?? ()
#22 0xf6fe1cc5 in ?? ()
#23 0x080488ad in main ()

[Powerlord]

Originally Posted by nowakpl Linux, below is gdb backtrace, after running sm_umc_mapvote 2 and sm_map ctf_turbine. Program received signal SIGSEGV, Segmentation fault. 0x00000000 in ?? () (gdb) bt #0 0x00000000 in ?? () #1 0xebe45c9f in BuiltinVoteHandler::EndVoting() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/extensions/builtinvotes.ext.2.ep2v.so #2 0xee777b01 in TimerSystem::KillTimer(SourceMod::ITimer*) () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so #3 0xee77741b in TimerSystem::RemoveMapChangeTimers() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so #4 0xee75c96c in SourceModBase::LevelShutdown() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so #5 0xeec145c6 in __SourceHook_MFHCls_SGD_LevelShutdown::Func() () from /data/home/nowak/tf2/orangebox/tf/../tf/addons/metamod/bin/metamod.2.ep2v.so #6 0xf6c10afe in CServerPlugin::LevelShutdown() () from /data/home/nowak/tf2/orangebox/bin/engine.so #7 0xf6b7038d in CHostState::State_ChangeLevelMP() () from /data/home/nowak/tf2/orangebox/bin/engine.so #8 0xf6b70c8e in CHostState::FrameUpdate(float) () from /data/home/nowak/tf2/orangebox/bin/engine.so #9 0xf6b70f78 in HostState_Frame(float) () from /data/home/nowak/tf2/orangebox/bin/engine.so #10 0xf6c28580 in CEngine::Frame() () from /data/home/nowak/tf2/orangebox/bin/engine.so #11 0xf6c2453a in CDedicatedServerAPI::RunFrame() () from /data/home/nowak/tf2/orangebox/bin/engine.so #12 0xf6fe019e in ?? () #13 0xf6fdfea8 in ?? () #14 0xf6c24e36 in CModAppSystemGroup::Main() () from /data/home/nowak/tf2/orangebox/bin/engine.so #15 0xf6c40128 in CAppSystemGroup::Run() () from /data/home/nowak/tf2/orangebox/bin/engine.so #16 0xf6c25c3a in CDedicatedServerAPI::ModInit(ModInfo_t&) () from /data/home/nowak/tf2/orangebox/bin/engine.so #17 0xf6fe0376 in ?? () #18 0xf6fe3ea8 in ?? () #19 0xf6fe5b8c in ?? () #20 0xf6fe3ea8 in ?? () #21 0xf6fe07dd in ?? () #22 0xf6fe1cc5 in ?? () #23 0x080488ad in main ()

As soon as I saw #3 I knew what the problem was. However, I don't know if this fix has any side effects (haven't had a chance to test it).

Basically, the EndTimer action was running (and calling EndVoting) if the map changed... which I wasn't expecting it to. The actions in EndTimer have now been moved to OnTimer where it returns PluginStop (to naturally stop the timer) instead.

[nowakpl]

Originally Posted by Powerlord As soon as I saw #3 I knew what the problem was. However, I don't know if this fix has any side effects (haven't had a chance to test it). Basically, the EndTimer action was running (and calling EndVoting) if the map changed... which I wasn't expecting it to. The actions in EndTimer have now been moved to OnTimer where it returns PluginStop (to naturally stop the timer) instead.

Doesn't crash now but blocks votes after the map change:
L 02/19/2012 - 09:46:11: [SM] Native "DisplayBuiltinVote" reported: A vote is already in progress
L 02/19/2012 - 09:46:11: [SM] Displaying call stack trace for plugin "umc-builtinvotes.smx":
L 02/19/2012 - 09:46:11: [SM] [0] Line 141, umc-builtinvotes.sp::VM_MapVote()

[Powerlord]

Originally Posted by nowakpl Doesn't crash now but blocks votes after the map change: L 02/19/2012 - 09:46:11: [SM] Native "DisplayBuiltinVote" reported: A vote is already in progress L 02/19/2012 - 09:46:11: [SM] Displaying call stack trace for plugin "umc-builtinvotes.smx": L 02/19/2012 - 09:46:11: [SM] [0] Line 141, umc-builtinvotes.sp::VM_MapVote()

Well, at least it's no longer crashing.

Here's a new version (0.5.3), which I think will fix the issue with it thinking a vote is still in progress... basically, it resets the vote parameters when a new map starts.

This is a workaround, I'll come up with a better solution later, but it looks like I'll have to rewrite the vote cancel routine to do so. The reason I call it a workaround is that the vote object is likely going to have an inconsistent state following a map change and wasn't canceled.

Edit: The last version is going to cause handle leaks in the calling plugin, so I'm working on another version to address this issue.

[Powerlord]

Sorry to push out versions so quickly, but the last version would cause handle leaks in the calling plugin, so here's yet another new version.

This time, it will trigger the BuiltinVoteAction_Cancel and BuiltinVoteAction_End callbacks if a vote is auto-canceled on map end.

Edit: While AlliedModders was down, I tested this version on my Linux server and it appears to work without any side-effect. This is likely because the DisplayBuiltinVotesFail message is sent when no users are actually connected.

[lucasdidur]

Originally Posted by Powerlord Sorry to push out versions so quickly, but the last version would cause handle leaks in the calling plugin, so here's yet another new version. This time, it will trigger the BuiltinVoteAction_Cancel and BuiltinVoteAction_End callbacks if a vote is auto-canceled on map end. Edit: While AlliedModders was down, I tested this version on my Linux server and it appears to work without any side-effect. This is likely because the DisplayBuiltinVotesFail message is sent when no users are actually connected.

In this update, I can watch the live vote ?

[nowakpl]

Originally Posted by Powerlord Sorry to push out versions so quickly, but the last version would cause handle leaks in the calling plugin, so here's yet another new version. This time, it will trigger the BuiltinVoteAction_Cancel and BuiltinVoteAction_End callbacks if a vote is auto-canceled on map end. Edit: While AlliedModders was down, I tested this version on my Linux server and it appears to work without any side-effect. This is likely because the DisplayBuiltinVotesFail message is sent when no users are actually connected.

Vote, map change:

Program received signal SIGSEGV, Segmentation fault.
0xebe5e360 in BuiltinVoteHandler::OnMapStart() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/extensions/builtinvotes.ext.2.ep2v.so
(gdb) bt
#0  0xebe5e360 in BuiltinVoteHandler::OnMapStart() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/extensions/builtinvotes.ext.2.ep2v.so
#1  0xee759789 in CExtensionManager::CallOnCoreMapStart(edict_t*, int, int) () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so
#2  0xee79298d in PlayerManager::OnServerActivate(edict_t*, int, int) () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so
#3  0xee796494 in __SourceHook_FHCls_IServerGameDLLServerActivate0::Func(edict_t*, int, int) () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so
#4  0xf6c30c78 in CServerPlugin::ServerActivate(edict_t*, int, int) () from /data/home/nowak/tf2/orangebox/bin/engine.so
#5  0xf6c2acfa in SV_ActivateServer() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#6  0xf6b7fcf5 in Host_Changelevel(bool, char const*, char const*) () from /data/home/nowak/tf2/orangebox/bin/engine.so
#7  0xf6b903fa in CHostState::State_ChangeLevelMP() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#8  0xf6b90c8e in CHostState::FrameUpdate(float) () from /data/home/nowak/tf2/orangebox/bin/engine.so
#9  0xf6b90f78 in HostState_Frame(float) () from /data/home/nowak/tf2/orangebox/bin/engine.so
#10 0xf6c48580 in CEngine::Frame() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#11 0xf6c4453a in CDedicatedServerAPI::RunFrame() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#12 0xf700019e in ?? ()
#13 0xf6fffea8 in ?? ()
#14 0xf6c44e36 in CModAppSystemGroup::Main() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#15 0xf6c60128 in CAppSystemGroup::Run() () from /data/home/nowak/tf2/orangebox/bin/engine.so
#16 0xf6c45c3a in CDedicatedServerAPI::ModInit(ModInfo_t&) () from /data/home/nowak/tf2/orangebox/bin/engine.so
#17 0xf7000376 in ?? ()
#18 0xf7003ea8 in ?? ()
#19 0xf7005b8c in ?? ()
#20 0xf7003ea8 in ?? ()
#21 0xf70007dd in ?? ()
#22 0xf7001cc5 in ?? ()
#23 0x080488ad in main ()

It's crashing on m_pCurVote->Cancel(), m_pCurVote appears to be a valid pointer but the object certainly isn't - has a vtable pointer = 0x10000.
It would be useful if your builds had debug info in (-g).

[snelvuur]

I think i have one similar too, http://crash.limetech.org/stack.php?pubid=27210 dont know if it is the case, still need to update to latest though but might be helpfull.

[Powerlord]

Originally Posted by nowakpl Vote, map change: Program received signal SIGSEGV, Segmentation fault. 0xebe5e360 in BuiltinVoteHandler::OnMapStart() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/extensions/builtinvotes.ext.2.ep2v.so (gdb) bt #0 0xebe5e360 in BuiltinVoteHandler::OnMapStart() () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/extensions/builtinvotes.ext.2.ep2v.so #1 0xee759789 in CExtensionManager::CallOnCoreMapStart(edict_t*, int, int) () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so #2 0xee79298d in PlayerManager::OnServerActivate(edict_t*, int, int) () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so #3 0xee796494 in __SourceHook_FHCls_IServerGameDLLServerActivate0::Func(edict_t*, int, int) () from /data/home/nowak/tf2/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so #4 0xf6c30c78 in CServerPlugin::ServerActivate(edict_t*, int, int) () from /data/home/nowak/tf2/orangebox/bin/engine.so #5 0xf6c2acfa in SV_ActivateServer() () from /data/home/nowak/tf2/orangebox/bin/engine.so #6 0xf6b7fcf5 in Host_Changelevel(bool, char const*, char const*) () from /data/home/nowak/tf2/orangebox/bin/engine.so #7 0xf6b903fa in CHostState::State_ChangeLevelMP() () from /data/home/nowak/tf2/orangebox/bin/engine.so #8 0xf6b90c8e in CHostState::FrameUpdate(float) () from /data/home/nowak/tf2/orangebox/bin/engine.so #9 0xf6b90f78 in HostState_Frame(float) () from /data/home/nowak/tf2/orangebox/bin/engine.so #10 0xf6c48580 in CEngine::Frame() () from /data/home/nowak/tf2/orangebox/bin/engine.so #11 0xf6c4453a in CDedicatedServerAPI::RunFrame() () from /data/home/nowak/tf2/orangebox/bin/engine.so #12 0xf700019e in ?? () #13 0xf6fffea8 in ?? () #14 0xf6c44e36 in CModAppSystemGroup::Main() () from /data/home/nowak/tf2/orangebox/bin/engine.so #15 0xf6c60128 in CAppSystemGroup::Run() () from /data/home/nowak/tf2/orangebox/bin/engine.so #16 0xf6c45c3a in CDedicatedServerAPI::ModInit(ModInfo_t&) () from /data/home/nowak/tf2/orangebox/bin/engine.so #17 0xf7000376 in ?? () #18 0xf7003ea8 in ?? () #19 0xf7005b8c in ?? () #20 0xf7003ea8 in ?? () #21 0xf70007dd in ?? () #22 0xf7001cc5 in ?? () #23 0x080488ad in main () It's crashing on m_pCurVote->Cancel(), m_pCurVote appears to be a valid pointer but the object certainly isn't - has a vtable pointer = 0x10000. It would be useful if your builds had debug info in (-g).

I have no idea how the pointer could be valid there but the object isn't. InternalReset() kills the pointer whenever the vote is ended. The *only* reason I can think of that this might happen is that the plugin is disposing of the vote handle without it ending.

Now that AlliedModders is back up, I can finally post the builds I created before it went down.

Here's 0.5.5, with a few minor changes. Basically, instead of calling Cancel directly, it now calls the CancelVoting function that already exists, which *may* fix the problem if the vote was actually canceled before the map change. Also, I rolled back the DecrementPlayerCount change from 0.5.4 until I can study the problem in more detail.

I normally don't create Debug builds unless people ask because of how large the Linux Debug builds are.

[nowakpl]

Originally Posted by Powerlord I have no idea how the pointer could be valid there but the object isn't. InternalReset() kills the pointer whenever the vote is ended. The *only* reason I can think of that this might happen is that the plugin is disposing of the vote handle without it ending. Now that AlliedModders is back up, I can finally post the builds I created before it went down. Here's 0.5.5, with a few minor changes. Basically, instead of calling Cancel directly, it now calls the CancelVoting function that already exists, which *may* fix the problem if the vote was actually canceled before the map change. Also, I rolled back the DecrementPlayerCount change from 0.5.4 until I can study the problem in more detail. I normally don't create Debug builds unless people ask because of how large the Linux Debug builds are.

Changing map during vote no longer seems to crash but I found another valid pointer, invalid object instance - happens after starting and stopping a vote repeately, every few seconds.

Program received signal SIGSEGV, Segmentation fault.
0xebeb48c7 in CBuiltinVoteHandler::DoAction (this=0xeb25f90, vote=0xcb2fda8, action=BuiltinVoteAction_Cancel, param1=0, param2=0, def_res=0) at natives.cpp:139
139             m_pBasic->PushCell(vote->GetHandle());
(gdb) bt
#0  0xebeb48c7 in CBuiltinVoteHandler::DoAction (this=0xeb25f90, vote=0xcb2fda8, action=BuiltinVoteAction_Cancel, param1=0, param2=0, def_res=0) at natives.cpp:139
#1  0xebeb48a5 in CBuiltinVoteHandler::OnVoteCancel (this=0xeb25f90, vote=0xcb2fda8, reason=SourceMod::BuiltinVoteFail_Generic) at natives.cpp:133
#2  0xebeb1b87 in BuiltinVoteHandler::EndVoting (this=0xebed1240) at BuiltinVoteHandler.cpp:457
#3  0xebeb277e in BuiltinVoteHandler::OnTimer (this=0xebed1240, pTimer=0x92779a0, pData=0x0) at BuiltinVoteHandler.cpp:746
#4  0xee7eb7eb in TimerSystem::RunFrame() () from /data/home/nowak/tf2mesh/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so
#5  0xee7eba63 in TimerSystem::GameFrame(bool) () from /data/home/nowak/tf2mesh/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so
#6  0xee7d2179 in __SourceHook_FHCls_IServerGameDLLGameFramefalse::Func(bool) () from /data/home/nowak/tf2mesh/orangebox/tf/addons/sourcemod/bin/sourcemod.2.ep2v.so
#7  0xf6c84bac in CServerPlugin::GameFrame(bool) () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#8  0xf6c7f890 in SV_Think(bool) () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#9  0xf6c80aa0 in SV_Frame(bool) () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#10 0xf6bd7dac in _Host_RunFrame_Server(bool) () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#11 0xf6bd8b2a in _Host_RunFrame(float) () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#12 0xf6bd946f in Host_RunFrame(float) () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#13 0xf6be4c32 in CHostState::FrameUpdate(float) () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#14 0xf6be4f78 in HostState_Frame(float) () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#15 0xf6c9c580 in CEngine::Frame() () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#16 0xf6c9853a in CDedicatedServerAPI::RunFrame() () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#17 0xf705419e in ?? ()
#18 0xf7053ea8 in ?? ()
#19 0xf6c98e36 in CModAppSystemGroup::Main() () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#20 0xf6cb4128 in CAppSystemGroup::Run() () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#21 0xf6c99c3a in CDedicatedServerAPI::ModInit(ModInfo_t&) () from /data/home/nowak/tf2mesh/orangebox/bin/engine.so
#22 0xf7054376 in ?? ()
#23 0xf7057ea8 in ?? ()
#24 0xf7059b8c in ?? ()
#25 0xf7057ea8 in ?? ()
#26 0xf70547dd in ?? ()
#27 0xf7055cc5 in ?? ()
#28 0x080488ad in main ()
(gdb) print vote->GetHandle()
Cannot access memory at address 0x22d1054
(gdb) print vote
$1 = (class SourceMod::IBaseBuiltinVote *) 0xcb2fda8
(gdb) print *vote
$2 = {_vptr.IBaseBuiltinVote = 0x22d1008}
(gdb) x 0x22d1008
0x22d1008:      Cannot access memory at address 0x22d1008
(gdb) print *this
$3 = {<SourceMod::IBuiltinVoteHandler> = {_vptr.IBuiltinVoteHandler = 0xebecc788}, m_pBasic = 0xcb487c8, m_Flags = 10, m_pVoteResults = 0xcb4b008, m_fnVoteResult = 5}
(gdb) f 2
#2  0xebeb1b87 in BuiltinVoteHandler::EndVoting (this=0xebed1240) at BuiltinVoteHandler.cpp:457
457                     handler->OnVoteCancel(vote, BuiltinVoteFail_Generic);
(gdb) print *this
$6 = {<SourceMod::IBuiltinVoteHandler> = {_vptr.IBuiltinVoteHandler = 0xebecba68}, <SourceMod::IClientListener> = {_vptr.IClientListener = 0xebecba9c}, <SourceMod::ITimedEvent> = {
    _vptr.ITimedEvent = 0xebecbad4}, m_pHandler = 0x0, m_Clients = 0, m_TotalClients = 0, m_Items = 0, m_Votes = {m_Data = 0xeb270e8, m_Size = 5, m_CurrentUsedSize = 5}, m_pCurVote = 0x0,
  m_bStarted = false, m_bCancelled = false, m_NumVotes = 0, m_VoteTime = 20, m_VoteFlags = 0, m_fStartTime = 20.6549988, m_nVoteTime = 20, m_TimeLeft = 0, m_ClientVotes = {0, -1 <repeats 23 times>, -2, -2,
    -2, -2, -2, -2, -2, -2, -2, 0 <repeats 224 times>}, m_Revoting = {false <repeats 257 times>}, m_leaderList = '\000' <repeats 1023 times>, m_displayTimer = 0x0}