3.5.0 reproducible crash

[Saplaran]

I'm playing a kobold rogue in 3.5.0 (Windows 8.1 with Shockbolt's tiles and subwindows).

Unfortunately the game always crashes at a certain point. I have a savefile where you only need to walk two steps to the west. Since I don't know, if this is a known bug and looking for "game crashes when walking to the west" in bugtracking-lists seems somewhat pointless to me I just post a link to my savefile here. Maybe someone can help me...

http://www.mdiergardt.de/1000.Markus

[fizzix]

Weird, I didn't get a crash on my clean 3.5 version (windows 7). What OS are you playing on?

[Saplaran]

I'm using Windows 8.1...

[fizzix]

Originally Posted by Saplaran

I'm using Windows 8.1...

I'm not sure we have any Windows 8 testers... The absence of comments in this thread seems to support this...

How many squares do you have to move to get a crash? Just one, or more. What happens if you go the other direction first and then backtrack? What about casting a spell?

[Atanvarno]

I can reproduce this on Win7, but it requires that the monster list subwindow is just the right width so that the accented i in Ibun's name is barely visible (or would become barely visible when taking two steps to the west if it weren't for the crash).

I've had a similar problem in the past:
http://angband.oook.cz/forum/showthread.php?t=6618

[MattB]

Originally Posted by Atanvarno

I can reproduce this on Win7, but it requires that the monster list subwindow is just the right width so that the accented i in Ibun's name is barely visible (or would become barely visible when taking two steps to the west if it weren't for the crash).

I've had a similar problem in the past:
http://angband.oook.cz/forum/showthread.php?t=6618

That's just weird (to a non-coder), but an astonishing catch!
And as for win8, I just paid an extra £120 to get win7 for my new laptop...

[Dawnmist]

Originally Posted by Atanvarno

I can reproduce this on Win7, but it requires that the monster list subwindow is just the right width so that the accented i in Ibun's name is barely visible (or would become barely visible when taking two steps to the west if it weren't for the crash).

I've had a similar problem in the past:
http://angband.oook.cz/forum/showthread.php?t=6618

That would explain a consistent crash I was getting last December when identifying an artifact crown on the ground - I sent in the save file with the character standing on the unid'd crown, but while it was 100% consistent for me no-one else seemed to be able to reproduce it (was happening on win7). If I picked up the crown and id'd it, everything was fine (it would no longer have been in the objects subwindow then) - but identifying it before picking it up would crash. Can't remember which crown now, but I do remember it had an accent in the name because I was suspicious that the accent was part of why it was crashing.

[Bogatyr]

Originally Posted by MattB

That's just weird (to a non-coder), but an astonishing catch!
And as for win8, I just paid an extra £120 to get win7 for my new laptop...

Well worth it. windblow$ 8 is a disaster

[fizzix]

Originally Posted by Atanvarno

I can reproduce this on Win7, but it requires that the monster list subwindow is just the right width so that the accented i in Ibun's name is barely visible (or would become barely visible when taking two steps to the west if it weren't for the crash).

I've had a similar problem in the past:
http://angband.oook.cz/forum/showthread.php?t=6618

Very nice work

[PowerWyrm]

Reproduced under Win7:
- move 2 squares left until Ibun gets in LOS
- reduce Term-1 width (monster list window) until the name becomes "[U] Ibun, Son of Mî (asleep) 2 S 6 W"
- game crashes

I compiled the source using my BC++5 environment and launched the exe in debug mode. Result is as follows: project angband.exe crashes with EAccessViolation at address 0051551B, reading address 11111119.

Here's the list of function calls at the moment of the crash:
- update_monlist_subwindow(EVENT_MONSTERLIST)
- monster_list_show_subwindow(16, 39)
- monster_list_format_textblock(list, textblock, 16, 39, ...)
- monster_list_format_section(list, textblock, MONSTER_LIST_SECTION_LOS, 1, 39, ...)
- textblock_append_c(tb, line_attr, "%-*s%s\n", full_width = 57, line_buffer = "[U] Ibun, Son of MÃ (asleep)", location = " 2 S 6 W") [line 419]
- textblock_vappend_c(tb, attr, fmt, vp)

At this point, a malloc-ed string temp_space is created from the va_args: temp_space = "[U] Ibun, Son of MÃ (asleep) 2 S 6 W\n".

Next call is Term_mbstowcs(NULL, temp_space, 0) to get the new length, but this call fails. The hook in Term_mbstowcs calls Term_mbstowcs_win from main-win.c: return (size_t)(MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, src, -1, NULL, 0) - 1);

Here the MultiByteToWideChar function fails (error code = 1113, ERROR_NO_UNICODE_TRANSLATION, "No mapping for the Unicode character exists in the target multi-byte code page") and returns 0. In this case, Term_mbstowcs returns -1, which is used as the new length. The following call tries to resize the textblock to an invalid size (-1 as a u32 value!) and fails with a crash...

Testing a little more in debug mode, it's easy to trace down the problem. Putting a breakpoint in update_monlist_subwindow, I was able to test the faulty code with term width = 40 then term width = 39. And here it is:

		/* Clip the monster name to fit, and append the sleep tag. */
		name_width = MIN(full_width - strlen(asleep), sizeof(line_buffer));
		get_mon_name(line_buffer, name_width + 1, list->entries[entry_index].race, list->entries[entry_index].count[section]);
		my_strcat(line_buffer, asleep, sizeof(line_buffer));

When term width = 40, everything works fine:
- name_width = 20
- line_buffer = "[U] Ibun, Son of Mî"

When term width = 39, the name is truncated!
- name_width = 19
- line_buffer = "[U] Ibun, Son of MÃ"

Then of course, the last character is not a valid unicode character anymore...

Fix: in get_mon_name(), ensure that the last character, if it's an unicode character, is not truncated.