Read-only archive of the Armageddon Games Forums Archive (2000–2026) · About this archive

[OSX] Hmm, dropdown menus crash as well.

16 replies · 3,885 views · Started 27 August 2007

Well...

#0  0x00000000 in ?? ()
#1 0x01a905c0 in object_message ()
#2 0x01a910c8 in do_dialog ()
#3 0x01a911e8 in popup_dialog ()
#4 0x0004c398 in droplist(DIALOG*) (d=0x108ec58) at jwin.cpp:3195
#5 0x0004c728 in jwin_droplist_proc (msg=4, d=0x108ec58, c=1) at jwin.cpp:3272

??? is unfortunately not too helpful 😉
Put a breakpoint in _handle_jwin_scrollable_scroll_click and let me know where the null pointer dereference is happening.

Actually, _handle_jwin_scrollable_scroll_click() is never called before the crash. I tried breaking at _handle_jwin_listbox_click() instead, but that also didn't happened.

To be precise: the crash occurs just before the dropdown menu itself is meant to appear. It is still possible to click and select the listbox. Sorry.

Despite my not-entirely-rational reluctance to recompile Allegro in debug mode for "just one bug", it has become the only recourse for this problem!

And now, some actual information:

(gdb) bt
#0 0x00000000 in ?? ()
Cannot access memory at address 0x0
#1 0x01d1b54c in object_message (dialog=0x3dae20, msg=10, c=0) at src/gui.c:353
#2 0x01d1c7cc in do_dialog (dialog=0x3dae20, focus_obj=0) at src/gui.c:809
#3 0x01d1c958 in popup_dialog (dialog=0x3dae20, focus_obj=0) at src/gui.c:850
#4 0x0004c398 in droplist(DIALOG*) (d=0x10a457c) at jwin.cpp:3195
#5 0x0004c728 in jwin_droplist_proc (msg=4, d=0x10a457c, c=1) at jwin.cpp:3272
...
(gdb) up
#1 0x01d1b54c in object_message (dialog=0x3dae20, msg=10, c=0) at src/gui.c:353
353 ret = dialog->proc(msg, dialog, c);

So... what is up with droplist_dlg[0].proc in jwin.cpp?

Very odd; dialog[0].proc is most definitely not null since it is set in jwin.cpp line 3165. Can you get the value of droplist_dlg[0].proc immediately before droplist()? If that's not null, could you make sure that it is null right before the fatal gui.c line 353?

Well, I've figured out something that makes the bug go away... but this merely illustrates that something even less appealing is going wrong somehow. For instance, through no fault of its own, line 3165 fails to work:

Breakpoint 2, droplist(DIALOG*) (d=0x10a457c) at jwin.cpp:3165
3165 droplist_dlg[0].proc = jwin_abclist_proc;
(gdb) print droplist_dlg[0].proc
$1 = 0x15cdb8 [d_dropdmaptypelist_proc(int, DIALOG*, int)]
(gdb) step
3166 droplist_dlg[0].flags = D_EXIT + D_USER;
(gdb) print droplist_dlg[0].proc
$2 = 0
What's more, when I inserted the line "println("%ld\n", (long)jwin_abclist_proc);" just before that line, it outputted "0".

But, through some trial and error I somehow managed to produce a sequence that would function correctly:

  droplist_dlg[0].proc  = jwin_abclist_proc;
droplist_dlg[0].proc = jwin_droplist_proc;
droplist_dlg[0].proc = jwin_abclist_proc;
And here's what happens:
Breakpoint 2, droplist(DIALOG*) (d=0x1095e28) at jwin.cpp:3165
3165 droplist_dlg[0].proc = jwin_abclist_proc;
(gdb) print droplist_dlg[0].proc
$1 = 0x4bf68 [jwin_droplist_proc]
(gdb) step
3166 droplist_dlg[0].proc = jwin_droplist_proc;
(gdb) print droplist_dlg[0].proc
$2 = 0x4c358 [jwin_abclist_proc]
(gdb) step
3167 droplist_dlg[0].proc = jwin_abclist_proc;
(gdb) print droplist_dlg[0].proc
$3 = 0
(gdb) step
3168 droplist_dlg[0].flags = D_EXIT + D_USER;
(gdb) print droplist_dlg[0].proc
$4 = 0x4c358 [jwin_abclist_proc]

I have a hunch that this root cause may be causing my Tile Paste crash as well.

println("%ld\n", (long)jwin_abclist_proc);

What the *fuck*?! "Less appealing" is right.
Does it make a difference if you change jwin_abclist_proc to &jwin_abclist_proc?

Unfortunately not!

Well, this line still fails to work:

  droplist_dlg[1].proc  = jwin_abclist_proc;


But now that droplist_dlg[1].proc's default value is an actual procedure, the failure only occurs in object_message():
(gdb) down
#3 0x01d67958 in popup_dialog (dialog=0x3dbe20, focus_obj=1) at src/gui.c:850
850 ret = do_dialog(dialog, focus_obj);
Current language: auto; currently c
(gdb) print dialog->proc
$7 = 0x4b768 <d_dropcancel_proc(int, DIALOG*, int)>
(gdb) down
#2 0x01d677cc in do_dialog (dialog=0x3dbe20, focus_obj=1) at src/gui.c:809
809 player = init_dialog(dialog, focus_obj);
(gdb) print dialog->proc
$8 = 0x4b768 <d_dropcancel_proc(int, DIALOG*, int)>
(gdb) down
#1 0x01d6654c in object_message (dialog=0x3dbe58, msg=10, c=0) at src/gui.c:353
353 ret = dialog->proc(msg, dialog, c);
(gdb) print dialog->proc
$9 = 0

To clarify, the bugs Takuya is having relate to clear_to_color() and not droplist.

L, I still want you to experiment with ampersands, as I'm 80% sure they will fix your pointer-to-function woes 😉

And you're sure you put ampersands in the right place? I keep harping on the damn &s because we had a similar problem back last summer, and we eventually concluded that your compiler does not correctly handle the (non-compliant) syntax of getting a function pointer without an & 😉

I'm calling this one solved on the basis that the bug itself has been suppressed.