ReactorRunnable::svc() checks the status of WorldSockets while WorldRunnable::run() updates them, causing a race condition.
Helgrind log:
Possible data race during write of size 8 at 0x49961810 by thread #9
Locks held: 1, at address 0x4367A620
at 0x51781F7: ACE_Message_Block::copy(char const*, unsigned long) (Message_Block.inl:372)
by 0x15D048F: WorldSocket::SendPacket(WorldPacket const&) (WorldSocket.cpp:180)
by 0x141C45E: WorldSession::SendPacket(WorldPacket const*) (WorldSession.cpp:223)
by 0x15C49C4: WorldSession::SendAuthResponse(unsigned char, bool, unsigned int) (AuthHandler.cpp:37)
by 0x14DA71C: World::AddSession_(WorldSession*) (World.cpp:278)
by 0x14E601E: World::UpdateSessions(unsigned int) (World.cpp:2617)
by 0x14E3E67: World::Update(unsigned int) (World.cpp:1986)
by 0x100EAFA: WorldRunnable::run() (WorldRunnable.cpp:60)
by 0x163A626: ACE_Based::Thread::ThreadTask(void*) (Threading.cpp:186)
by 0x518F555: ACE_OS_Thread_Adapter::invoke() (OS_Thread_Adapter.cpp:103)
by 0x4C2B5AD: mythread_wrapper (hg_intercepts.c:219)
by 0x61DAB4F: start_thread (pthread_create.c:304)
This conflicts with a previous read of size 8 by thread #14
Locks held: none
at 0x1008414: ACE_Message_Block::length() const (Message_Block.inl:131)
by 0x15D1207: WorldSocket::Update() (WorldSocket.cpp:448)
by 0x1427CA3: ReactorRunnable::svc() (WorldSocketMgr.cpp:177)
by 0x51CBB16: ACE_Task_Base::svc_run(void*) (Task.cpp:271)
by 0x51CD3BC: ACE_Thread_Adapter::invoke_i() (Thread_Adapter.cpp:161)
by 0x51CD4D4: ACE_Thread_Adapter::invoke() (Thread_Adapter.cpp:96)
by 0x4C2B5AD: mythread_wrapper (hg_intercepts.c:219)
by 0x61DAB4F: start_thread (pthread_create.c:304)
Address 0x49961810 is 16 bytes inside a block of size 80 alloc'd
at 0x4C286BB: operator new(unsigned long, std::nothrow_t const&) (vg_replace_malloc.c:316)
by 0x15D0818: WorldSocket::open(void*) (WorldSocket.cpp:237)
by 0x1429560: ACE_Acceptor<WorldSocket, ACE_SOCK_Acceptor>::activate_svc_handler(WorldSocket*) (Acceptor.cpp:347)
by 0x142916D: ACE_Acceptor<WorldSocket, ACE_SOCK_Acceptor>::handle_input(int) (Acceptor.cpp:429)
by 0x515F48D: ACE_Dev_Poll_Reactor::dispatch_io_event(ACE_Dev_Poll_Reactor::Token_Guard&) (Dev_Poll_Reactor.inl:86)
by 0x5161653: ACE_Dev_Poll_Reactor::handle_events(ACE_Time_Value*) (Dev_Poll_Reactor.cpp:1015)
by 0x51ACCFC: ACE_Reactor::run_reactor_event_loop(ACE_Time_Value&, int (*)(ACE_Reactor*)) (Reactor.cpp:267)
by 0x1427C57: ReactorRunnable::svc() (WorldSocketMgr.cpp:170)
by 0x51CBB16: ACE_Task_Base::svc_run(void*) (Task.cpp:271)
by 0x51CD3BC: ACE_Thread_Adapter::invoke_i() (Thread_Adapter.cpp:161)
by 0x51CD4D4: ACE_Thread_Adapter::invoke() (Thread_Adapter.cpp:96)
by 0x4C2B5AD: mythread_wrapper (hg_intercepts.c:219)
Fix race condition by replacing a static volatile uint32 with proper atomic thread-safe ACE_Atomic_Op<ACE_Thread_Mutex, uint32>, incremented in WorldRunnable::run() at each world loop and read in FreezeDetectorRunnable::run().
Helgrind log:
Possible data race during read of size 4 at 0x2400D54 by thread #12
Locks held: none
at 0x100FEA6: FreezeDetectorRunnable::run() (Master.cpp:106)
by 0x1637892: ACE_Based::Thread::ThreadTask(void*) (Threading.cpp:186)
by 0x518F555: ACE_OS_Thread_Adapter::invoke() (OS_Thread_Adapter.cpp:103)
by 0x4C2B5AD: mythread_wrapper (hg_intercepts.c:219)
by 0x61DAB4F: start_thread (pthread_create.c:304)
by 0x6C69A7C: clone (clone.S:112)
This conflicts with a previous write of size 4 by thread #9
Locks held: none
at 0x100C23E: WorldRunnable::run() (WorldRunnable.cpp:55)
by 0x1637892: ACE_Based::Thread::ThreadTask(void*) (Threading.cpp:186)
by 0x518F555: ACE_OS_Thread_Adapter::invoke() (OS_Thread_Adapter.cpp:103)
by 0x4C2B5AD: mythread_wrapper (hg_intercepts.c:219)
by 0x61DAB4F: start_thread (pthread_create.c:304)
by 0x6C69A7C: clone (clone.S:112)
Fix an assert triggered by float to int32 cast overflowing to -1, now it replaces -1 with max int32 value.
Fix another assert triggered by Vector3 magnitude float overflow to max/infinity in StaticMapTree::isInLineOfSight(), in this case return false.
Both asserts can be reproduced by casting Mind Control to a NPC, tele to z: 1.0e+38 using client hack tools, move to allow the server to register the new position and stop Mind Control.
Closes#8970Closes#10578Closes#10355Closes#10673
- Remove EAI's ACTION_T_CAST_EVENT and ACTION_T_CAST_EVENT_ALL
- Remove SAI's SMART_ACTION_CALL_CASTEDCREATUREORGO
- Split QUEST_TRINITY_FLAGS_KILL_OR_CAST into QUEST_TRINITY_FLAGS_KILL and QUEST_TRINITY_FLAGS_CAST
- Assign QUEST_TRINITY_FLAGS_CAST to all the quests that were using RequiredSpellCastX
- (unrelated) Fix a warning in Player.cpp
- Replace CastedCreatureOrGO usage in scripts by KilledMonsterCredit
TODO: Convert the two EAI scripts commented out in the .sql to proper SAI
Closes#10667
jackpoz