SmatZ wrote:

Are you able to reproduce it, or it happened just once? I wasn't able to reproduce it (I clicked on Luukland's server 5, then checked missing GRFs online - I got the same list, but it didn't crash, nor I didn't get any valgrind error).

This comment was imported from FlySpray: https://bugs.openttd.org/task/3899#comment8175

wipeout wrote:

it happened 3 times total the log is from the 3rd time first 2 times i figured it was just random but guess it was something that was running in the background as now i was able to get them without trouble

This comment was imported from FlySpray: https://bugs.openttd.org/task/3899#comment8177

glx wrote:

KERNELBASE.dll!_RaiseException@16() + 0x54 octets
openttd.exe!CustomAbort(int signal=0x00000016) Ligne 417 C++
openttd.exe!raise(int signum=0x00000016) Ligne 590 + 0x4 octets C
openttd.exe!abort() Ligne 71 + 0x7 octets C
openttd.exe!error(const char * s=0x006e966c, ...) Ligne 131 C++
openttd.exe!GetStringWithArgs(char * buffr=0x00000000, unsigned int string=0x00000000, __int64 * argv=0x0075e730, const char * last=0x0012e25f) Ligne 141 C++
openttd.exe!FormatString(char * buff=0x00000000, const char * str=0x00000000, int64 * argv=0x0075e728, unsigned int casei=0x00000000, const char * last=0x0012e25f) Ligne 664 C++
openttd.exe!GetStringWithArgs(char * buffr=0x00000000, unsigned int string=0x00000000, int64 * argv=0x0075e728, const char * last=0x0012e25f) Ligne 152 C++
openttd.exe!GetString(char * buffr=0x00000000, unsigned short string=0x0000, const char * last=0x0012e25f) Ligne 157 C++
openttd.exe!DrawStringMultiLine(int left=0x00000144, int right=0x00000268, int top=0x00000000, int bottom=0x0000018d, unsigned short str=0x0000, TextColour colour=TC_FROMSTRING, StringAlignment align=SA_LEFT, bool underline=true) Ligne 813 C++
openttd.exe!NetworkContentListWindow::DrawDetails(const Rect & r={...}) Ligne 536 C++
openttd.exe!NetworkContentListWindow::DrawWidget(const Rect & r={...}, int widget=0x00000008) Ligne 413 + 0xa octets C++
openttd.exe!NWidgetBackground::Draw(const Window * w=0x04d44bc8) Ligne 1584 C++
openttd.exe!NWidgetPIPContainer::Draw(const Window * w=0x04d44bc8) Ligne 1091 + 0xb octets C++
openttd.exe!NWidgetPIPContainer::Draw(const Window * w=0x04d44bc8) Ligne 1091 + 0xb octets C++
openttd.exe!NWidgetPIPContainer::Draw(const Window * w=0x04d44bc8) Ligne 1091 + 0xb octets C++
openttd.exe!NWidgetBackground::Draw(const Window * w=0x04d44bc8) Ligne 1586 C++
openttd.exe!NWidgetPIPContainer::Draw(const Window * w=0x04d44bc8) Ligne 1091 + 0xb octets C++
openttd.exe!Window::DrawWidgets() Ligne 572 C++
openttd.exe!NetworkContentListWindow::OnPaint() Ligne 433 C++
openttd.exe!DrawOverlappedWindow(Window * w=0x00000000, int left=0x00000000, int top=0x0000009a, int right=0x00000340, int bottom=0x00000260) Ligne 481 + 0x7 octets C++
openttd.exe!RedrawScreenRect(int left=0x000000c5, int top=0x0000009a, int right=0x00000000, int bottom=0x00000000) Ligne 1429 + 0x4b octets C++
openttd.exe!DrawDirtyBlocks() Ligne 1515 + 0xa octets C++
openttd.exe!UpdateWindows() Ligne 2297 C++
openttd.exe!VideoDriver_Win32::MainLoop() Ligne 896 C++
openttd.exe!ttd_main(int argc=, char * * argv=) Ligne 761 C++
openttd.exe!WinMain(HINSTANCE * hInstance=0x00400000, HINSTANCE * hPrevInstance=0x00000000, char * lpCmdLine=0x00191f7e, int nCmdShow=0x0000000a) Ligne 429 + 0x9 octets C++
openttd.exe!__tmainCRTStartup() Ligne 263 + 0x1b octets C
kernel32.dll!@BaseThreadInitThunk@12() + 0x12 octets
ntdll.dll!___RtlUserThreadStart@8() + 0x27 octets
ntdll.dll!__RtlUserThreadStart@8() + 0x1b octets

This comment was imported from FlySpray: https://bugs.openttd.org/task/3899#comment8178

Rubidium wrote:

It looks like "this->selected" is not the same as the selected ContentInfo struct. This as the matrix's "Station's name..." NewGRF isn't selected, though it has been drawn that tick as can be seen by the buttons in bottom missing.

Given the unreliable reproduction of the behaviour it seems to be related to how the chunks of memory are (re)allocated and thus that "this->selected" was freed and used somewhere else without properly trashing it or something.

This comment was imported from FlySpray: https://bugs.openttd.org/task/3899#comment8208

Rubidium wrote:

Apply the given patch.

Then open the server list, find a server with missing NewGRFs that are on bananas. Open the content list, select one of the missing NewGRFs that is on bananas and wait 15-20 seconds.

Then you'll get corruption due to "delete ici" in network_content.cpp which can lead to the crash or at least seriously screwed up data in the window, e.g. download size of 104 MB.

Attachments

• reproduce.diff (0.49 KiB)

This comment was imported from FlySpray: https://bugs.openttd.org/task/3899#comment8209

Rubidium closed the ticket.

Reason for closing: Fixed

In r20082

This comment was imported from FlySpray: https://bugs.openttd.org/task/3899