xboard 4.62 segmentation error with 2nd ICS game

[BrianJB]

Linux Ubutu kernel 3.2.0-29-generic
AMD 64 64 bit build
Timeseal is no longer timeseal_64 as FICS no longer provide it and state that timeseal is sufficient
xboard 4.62 (with zippy code)
./fics: line 2: 3479 Segmentation fault /usr/local/bin/xboard -size Huge -ics -icshost 69.36.243.188 -telnet -telnetProgram timeseal

The segmentation fault occurs immediately an opponent accepts a challenge after a previous game has been completed. I do not know whether the problem is due to an xboard bug or timeseal bug. Any help in diagnosid or solution would be welcome.

[H.G.Muller]

It will be next to impossible to figure out what causes this without having a debug log. The only thing I see that is a bit unusual is that you use the options -telnet and -telnetProgram, while the more usual way is to use -icshelper timeseal. But I don't see how that could cause any problems.

Perhaps you can add the option -debug to the xboard command line, and if this problem happens again, post the last 20 lines or so of the xboard.debug file it will create?

[BrianJB]

Here is a specimen log. Its a little longer than 20 lines as I examined the previous game and that bit of log is uninformative. I can see nothing untoward. Perhaps you can?

GameEnds(26, BrianJB resigns, 0)
<ICS: \012\015Challenge: BABASBABE (1379) BrianJB (1143) rated blitz 6 12.\012\015Your blitz rating will change: Win: +13, Draw: +5, Loss: -3\012\015Your new RD will be 42.9\012\015You can "accept" or "decline", or propose different parameters.\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
>ICS: say no more\012
<ICS: (told BABASBABE)\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
<ICS: \012\015Ignoring (formula): BABASBABE (1379) BrianJB (1143) rated blitz 3 12.\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
BackwardInner(0), current 68, forward 68
<ICS: \012\015BABASBABE tells you: ok\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
<ICS: \012\015BABASBABE, who was challenging you, has departed.\012\015Challenge from BABASBABE removed.\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
ForwardInner(1), current 0, forward 68
ForwardInner(2), current 1, forward 68
ForwardInner(3), current 2, forward 68
ForwardInner(4), current 3, forward 68
ForwardInner(5), current 4, forward 68
ForwardInner(6), current 5, forward 68
ForwardInner(7), current 6, forward 68
ForwardInner(8), current 7, forward 68
ForwardInner(9), current 8, forward 68
ForwardInner(10), current 9, forward 68
ForwardInner(11), current 10, forward 68
ForwardInner(12), current 11, forward 68
ForwardInner(13), current 12, forward 68
ForwardInner(14), current 13, forward 68
ForwardInner(15), current 14, forward 68
ForwardInner(16), current 15, forward 68
ForwardInner(17), current 16, forward 68
ForwardInner(18), current 17, forward 68
ForwardInner(19), current 18, forward 68
ForwardInner(20), current 19, forward 68
ForwardInner(21), current 20, forward 68
ForwardInner(22), current 21, forward 68
ForwardInner(23), current 22, forward 68
ForwardInner(24), current 23, forward 68
ForwardInner(25), current 24, forward 68
ForwardInner(26), current 25, forward 68
ForwardInner(27), current 26, forward 68
ForwardInner(28), current 27, forward 68
ForwardInner(29), current 28, forward 68
ForwardInner(30), current 29, forward 68
ForwardInner(31), current 30, forward 68
ForwardInner(32), current 31, forward 68
ForwardInner(33), current 32, forward 68
ForwardInner(34), current 33, forward 68
ForwardInner(35), current 34, forward 68
ForwardInner(36), current 35, forward 68
ForwardInner(37), current 36, forward 68
ForwardInner(38), current 37, forward 68
ForwardInner(39), current 38, forward 68
ForwardInner(40), current 39, forward 68
ForwardInner(41), current 40, forward 68
ForwardInner(42), current 41, forward 68
ForwardInner(43), current 42, forward 68
ForwardInner(44), current 43, forward 68
ForwardInner(45), current 44, forward 68
ForwardInner(46), current 45, forward 68
ForwardInner(47), current 46, forward 68
ForwardInner(48), current 47, forward 68
ForwardInner(49), current 48, forward 68
ForwardInner(50), current 49, forward 68
ForwardInner(51), current 50, forward 68
>ICS: seek 6 12 f\012
<ICS: Your seek has been posted with index 187.\012\015(61 player(s) saw the seek.)\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
>ICS: seek 30 30 f\012
<ICS: Your seek has been posted with index 72.\012\015(33 player(s) saw the seek.)\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
<ICS: \012\015YukonBob (1557) seeking 15 20 rated standard ("play 1" to respond)\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
>ICS: play 1\012
<ICS: That seek is not available.\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
<ICS: \012\015luckyluchino accepts your seek.\012\015\012\015Creating: luckyluchino (1360) BrianJB (1143) rated blitz 6 12\012\015{Game 415 (luckyluchino vs. BrianJB) Creating rated blitz match.}\012\015\012\015<12> rnbqkbnr pppppppp -------- -------- -------- -------- PPPPPPPP RNBQKBNR W -1 1 1 1 1 0 415 luckyluchino BrianJB -1 6 12 39 39 360000 360000 1 none (0:00.000) none 1 0 0\012\015fics%
ics input 68, castling = 45 45 45 45 45 45
Ratings from 'Creating:' luckyluchino 1360, BrianJB 1143
Parsing board: rnbqkbnr pppppppp -------- -------- -------- -------- PPPPPPPP RNBQKBNR W -1 1 1 1 1 0 415 luckyluchino BrianJB -1 6 12 39 39 360000 360000 1 none (0:00.000) none 1 0 0

Reset(1, 1) from gameMode 11
recognized 'normal' (-1) as variant normal
GameEnds(0, (null), 2)
shuffleOpenings = 0
recognized 'ICS rated blitz match' (-1) as variant normal
ParseBoard says variant = 'ICS rated blitz match'
recognized as normal
Remembered ratings: W 1360, B 1143
load 8x8 board
Display title 'luckyluchino (39) vs. BrianJB (39) {6 12}, gameInfo.variant = 0'

This is the console display>>>>>>>>>>>>>>>>>>
Creating: luckyluchino (1360) BrianJB (1143) rated blitz 6 12
{Game 415 (luckyluchino vs. BrianJB) Creating rated blitz match.}
./fics: line 2: 2263 Segmentation fault /usr/local/bin/xboard -size Huge -ics -icshost 69.36.243.188 -telnet -telnetProgram timeseal -debug -nameOfDebugFile ~/xboarddebug
brian@brian-desktop:~$

[BrianJB]

Apologies for the second posting about the same crash. I just found a line in syslog which helps to locate the problem a little more closely.

Aug 30 19:46:16 brian-desktop kernel: [13810.592278] xboard[2263]: segfault at 21 ip 00007fcf65c38884 sp 00007fffb11eb230 error 4 in libXt.so.6.0.0[7fcf65c0b000+5f000]

[H.G.Muller]

OK, thanks. This helps, but unfortuunately not enough. The debug log suggests that the crash occurs somewhere at the end of the routine that parses the board just received from the ICS (the first board of the started game). The 'Display Title' message is still printed. After that, the only major thing XBoard would be doing is to update auxiliary windows, such as move history, eval graph, edit book. But unfortunately nothing isprinted to the debug file during that.

Did you have the move history (or eval graph window) open or closed, when the crash occurred?

Would it be possible for you to install XBoard from source? If so, I could prepare a special debug version for you, slipping in some extra print statements, which you could then run to narrow it down further. It seems you have no difficulty reproducing the crash.

[BrianJB]

Move history and eval graph windows had not been opened.
I will be pleased to install a debug version from source.
On this occasion I was able to play half a dozen blitz games before the crash occurred. On other occasions it has been the second game.

[H.G.Muller]

OK, I have uploaded a file backend.c to http://hgm.nubati.net/backend.c , which contains a few extra print statements to the debug file. The best way to proceed is to get a source tar ball for XBoard-4.6.2, unpack it, and then replace the backend.c in it by the new one. Then you can build XBoard by the usual

./configure
make
sudo make install

Repeating the test with that new XBoard should tell us more.

[BrianJB]

Same error messages with new backend.c: Second game this time. (I will message HunterRose an apology for using him as a test bed)

<ICS: \012\015HunterRose accepts your seek.\012\015\012\015Creating: HunterRose (1152) BrianJB (1134) rated blitz 6 12\012\015{Game 504 (HunterRose vs. BrianJB) Creating rated blitz match.}\012\015\012\015<12> rnbqkbnr pppppppp -------- -------- -------- -------- PPPPPPPP RNBQKBNR W -1 1 1 1 1 0 504 HunterRose BrianJB -1 6 12 39 39 360000 360000 1 none (0:00.000) none 1 0 0\012\015fics%
ics input 92, castling = 45 45 45 45 45 45
Ratings from 'Creating:' HunterRose 1152, BrianJB 1134
Parsing board: rnbqkbnr pppppppp -------- -------- -------- -------- PPPPPPPP RNBQKBNR W -1 1 1 1 1 0 504 HunterRose BrianJB -1 6 12 39 39 360000 360000 1 none (0:00.000) none 1 0 0

Reset(1, 1) from gameMode 11
recognized 'normal' (-1) as variant normal
GameEnds(0, (null), 2)
shuffleOpenings = 0
HistoryEvalGraphEngineOutdonerecognized 'ICS rated blitz match' (-1) as variant normal
ParseBoard says variant = 'ICS rated blitz match'
recognized as normal
Remembered ratings: W 1152, B 1134
load 8x8 board
Display title 'HunterRose (39) vs. BrianJB (39) {6 12}, gameInfo.variant = 0'
SetHistoryEvalGraphEngineOutdoneSet done

[H.G.Muller]

Well, it seems it gets safely through all the places I suspected (and that I forgot a few linefeeds...).

I uploaded a new backend.c to the same place, with a few additional print statements in places after where the routine that parses the board returns. Strange thing is that the only thing it should do after parsing the board is ignore the 'fics%' prompt that follows it, which does not really seem a crash-prone thing. It did not receive anything else from the ICS yet. But we will see...

[BrianJB]

This time I was able to play 3 games. It may be a coincidence, and I cannot easily confirm, but the crashes may be occurring when my opponent has a longer name string than the previous game.

<ICS: \012\015Konvictes accepts your seek.\012\015\012\015Creating: Konvictes (1064) BrianJB (1147) rated blitz 6 12\012\015{Game 607 (Konvictes vs. BrianJB) Creating rated blitz match.}\012\015\012\015<12> rnbqkbnr pppppppp -------- -------- -------- -------- PPPPPPPP RNBQKBNR W -1 1 1 1 1 0 607 Konvictes BrianJB -1 6 12 39 39 360000 360000 1 none (0:00.000) none 1 0 0\012\015fics%
ics input 99, castling = 45 45 45 45 45 45
next loop 0
next loop 1
next loop 2
next loop 3
next loop 4
next loop 5
next loop 6
next loop 7
next loop 8
next loop 9
next loop 10
next loop 11
next loop 12
next loop 13
next loop 14
next loop 15
next loop 16
next loop 17
next loop 18
next loop 19
next loop 20
next loop 21
next loop 22
next loop 23
next loop 24
next loop 25
next loop 26
next loop 27
next loop 28
next loop 29
next loop 30
next loop 31
Ratings from 'Creating:' Konvictes 1064, BrianJB 1147
next loop 72
next loop 73
next loop 74
next loop 75
next loop 76
next loop 77
next loop 78
next loop 79
next loop 80
next loop 81
next loop 82
next loop 83
next loop 84
next loop 85
next loop 86
next loop 87
next loop 88
next loop 89
next loop 90
next loop 152
next loop 153
next loop 159
next loop 160
next loop 161
next loop 162
next loop 163
next loop 164
next loop 165
next loop 166
next loop 167
next loop 168
next loop 169
next loop 170
next loop 171
next loop 172
next loop 173
next loop 174
next loop 175
next loop 176
next loop 177
next loop 178
next loop 179
next loop 180
next loop 181
next loop 182
next loop 183
next loop 184
next loop 185
next loop 186
next loop 187
next loop 188
next loop 189
next loop 190
next loop 191
next loop 192
next loop 193
next loop 194
next loop 195
next loop 196
next loop 197
next loop 198
next loop 199
next loop 200
next loop 201
next loop 202
next loop 203
next loop 204
next loop 205
next loop 206
next loop 207
next loop 208
next loop 209
next loop 210
next loop 211
next loop 212
next loop 213
next loop 214
next loop 215
next loop 216
next loop 217
next loop 218
next loop 219
next loop 220
next loop 221
next loop 222
next loop 223
next loop 224
next loop 225
next loop 226
next loop 227
next loop 228
next loop 229
next loop 230
next loop 231
next loop 232
next loop 233
next loop 234
next loop 235
next loop 236
next loop 237
next loop 238
next loop 239
next loop 240
next loop 241
next loop 242
next loop 243
next loop 244
next loop 245
next loop 246
next loop 247
next loop 248
next loop 249
next loop 250
next loop 251
next loop 252
next loop 253
next loop 254
next loop 255
next loop 256
next loop 257
next loop 258
next loop 259
next loop 260
next loop 261
next loop 262
next loop 263
next loop 264
next loop 265
next loop 266
next loop 267
next loop 268
next loop 269
next loop 270
next loop 271
next loop 272
next loop 273
next loop 274
next loop 275
next loop 276
next loop 277
next loop 278
next loop 279
next loop 280
next loop 281
next loop 282
next loop 283
next loop 284
next loop 285
next loop 286
next loop 287
next loop 288
next loop 289
next loop 290
next loop 291
next loop 292
next loop 293
next loop 294
next loop 295
next loop 296
next loop 297
next loop 298
next loop 299
next loop 300
next loop 301
next loop 302
next loop 303
next loop 304
next loop 305
next loop 306
next loop 307
next loop 308
next loop 309
next loop 310
next loop 311
next loop 312
next loop 313
next loop 314
next loop 315
next loop 316
next loop 317
next loop 318
next loop 319
next loop 320
next loop 321
next loop 322
next loop 323
next loop 324
Parsing board: rnbqkbnr pppppppp -------- -------- -------- -------- PPPPPPPP RNBQKBNR W -1 1 1 1 1 0 607 Konvictes BrianJB -1 6 12 39 39 360000 360000 1 none (0:00.000) none 1 0 0

Reset(1, 1) from gameMode 11
recognized 'normal' (-1) as variant normal
GameEnds(0, (null), 2)
shuffleOpenings = 0
HistoryEvalGraphEngineOutdonerecognized 'ICS rated blitz match' (-1) as variant normal
ParseBoard says variant = 'ICS rated blitz match'
recognized as normal
Remembered ratings: W 1064, B 1147
load 8x8 board
Display title 'Konvictes (39) vs. BrianJB (39) {6 12}, gameInfo.variant = 0'
Set
HistoryEvalGraphEngineOutdoneSet done
returned
prompt suppress
prompt killed

[H.G.Muller]

Well, this is getting more and more mysterious. The latest debug log shows that it really completely processes all ICS input, upto the prompt, and drops out of the parsing loop after that (no more 'next loop', as expected). After that there still is some code to print output in the ICS console for the user, but it should have been skipped here, as there is nothing to print. And after that XBoard is completely done processing the event triggered by receiving the board from the ICS.

It could be that the crash actually occurs in the next event, which now is not producing any output at all. I added one more print in backend.c, just to be sure, and some prints in xboard.c, in some event-handler routines which could be called asynchronously (e.g. redrawing the board after an expose event). So perhaps you can replace that too (from http://hgm.nubati.net/xboard.c ) before you recompile.

[BrianJB]

Herewith another crash. Please excuse me if the next comment is way of beam as I haven't done any C programming for more than 15 years. As syslog shows the crash to be in libXt.so.6.0.0 doesn't this indicate that the seg error itself is within an asychronous thread in Xwindow.
So possibly invalid data has come from a call which has already been exited.

<ICS: You accept the match offer from yiprokopchuk.\012\015\012\015Creating: yiprokopchuk (1160) BrianJB (1161) rated blitz 6 12\012\015{Game 312 (yiprokopchuk vs. BrianJB) Creating rated blitz match.}\012\015\012\015<12> rnbqkbnr pppppppp -------- -------- -------- -------- PPPPPPPP RNBQKBNR W -1 1 1 1 1 0 312 yiprokopchuk BrianJB -1 6 12 39 39 360000 360000 1 none (0:00.000) none 1 0 0\012\015fics%
ics input 63, castling = 45 45 6 45 45 7
next loop 0
next loop 1
next loop 2
next loop 3
next loop 4
next loop 5
next loop 6
next loop 7
next loop 8
next loop 9
next loop 10
next loop 11
next loop 12
next loop 13
next loop 14
next loop 15
next loop 16
next loop 17
next loop 18
next loop 19
next loop 20
next loop 21
next loop 22
next loop 23
next loop 24
next loop 25
next loop 26
next loop 27
next loop 28
next loop 29
next loop 30
next loop 31
next loop 32
next loop 33
next loop 34
next loop 35
next loop 36
next loop 37
next loop 38
next loop 39
next loop 40
next loop 41
next loop 42
next loop 43
next loop 44
next loop 45
next loop 46
next loop 47
Ratings from 'Creating:' yiprokopchuk 1160, BrianJB 1161
next loop 91
next loop 92
next loop 93
next loop 94
next loop 95
next loop 96
next loop 97
next loop 98
next loop 99
next loop 100
next loop 101
next loop 102
next loop 103
next loop 104
next loop 105
next loop 106
next loop 107
next loop 108
next loop 109
next loop 174
next loop 175
next loop 181
next loop 182
next loop 183
next loop 184
next loop 185
next loop 186
next loop 187
next loop 188
next loop 189
next loop 190
next loop 191
next loop 192
next loop 193
next loop 194
next loop 195
next loop 196
next loop 197
next loop 198
next loop 199
next loop 200
next loop 201
next loop 202
next loop 203
next loop 204
next loop 205
next loop 206
next loop 207
next loop 208
next loop 209
next loop 210
next loop 211
next loop 212
next loop 213
next loop 214
next loop 215
next loop 216
next loop 217
next loop 218
next loop 219
next loop 220
next loop 221
next loop 222
next loop 223
next loop 224
next loop 225
next loop 226
next loop 227
next loop 228
next loop 229
next loop 230
next loop 231
next loop 232
next loop 233
next loop 234
next loop 235
next loop 236
next loop 237
next loop 238
next loop 239
next loop 240
next loop 241
next loop 242
next loop 243
next loop 244
next loop 245
next loop 246
next loop 247
next loop 248
next loop 249
next loop 250
next loop 251
next loop 252
next loop 253
next loop 254
next loop 255
next loop 256
next loop 257
next loop 258
next loop 259
next loop 260
next loop 261
next loop 262
next loop 263
next loop 264
next loop 265
next loop 266
next loop 267
next loop 268
next loop 269
next loop 270
next loop 271
next loop 272
next loop 273
next loop 274
next loop 275
next loop 276
next loop 277
next loop 278
next loop 279
next loop 280
next loop 281
next loop 282
next loop 283
next loop 284
next loop 285
next loop 286
next loop 287
next loop 288
next loop 289
next loop 290
next loop 291
next loop 292
next loop 293
next loop 294
next loop 295
next loop 296
next loop 297
next loop 298
next loop 299
next loop 300
next loop 301
next loop 302
next loop 303
next loop 304
next loop 305
next loop 306
next loop 307
next loop 308
next loop 309
next loop 310
next loop 311
next loop 312
next loop 313
next loop 314
next loop 315
next loop 316
next loop 317
next loop 318
next loop 319
next loop 320
next loop 321
next loop 322
next loop 323
next loop 324
next loop 325
next loop 326
next loop 327
next loop 328
next loop 329
next loop 330
next loop 331
next loop 332
next loop 333
next loop 334
next loop 335
next loop 336
next loop 337
next loop 338
next loop 339
next loop 340
next loop 341
next loop 342
next loop 343
next loop 344
next loop 345
next loop 346
next loop 347
next loop 348
next loop 349
Parsing board: rnbqkbnr pppppppp -------- -------- -------- -------- PPPPPPPP RNBQKBNR W -1 1 1 1 1 0 312 yiprokopchuk BrianJB -1 6 12 39 39 360000 360000 1 none (0:00.000) none 1 0 0

Reset(1, 1) from gameMode 11
recognized 'normal' (-1) as variant normal
GameEnds(0, (null), 2)
shuffleOpenings = 0
HistoryEvalGraphEngineOutdonerecognized 'ICS rated blitz match' (-1) as variant normal
ParseBoard says variant = 'ICS rated blitz match'
recognized as normal
Remembered ratings: W 1160, B 1161
load 8x8 board
Display title 'yiprokopchuk (39) vs. BrianJB (39) {6 12}, gameInfo.variant = 0'
Set
HistoryEvalGraphEngineOutdoneSet done
returned
prompt suppress
prompt killed
exit loop: next_out=356 i=356 started=0 leftover=356
return
block done

[H.G.Muller]

Herewith another crash. Please excuse me if the next comment is way of beam as I haven't done any C programming for more than 15 years. As syslog shows the crash to be in libXt.so.6.0.0 doesn't this indicate that the seg error itself is within an asychronous thread in Xwindow.
So possibly invalid data has come from a call which has already been exited.

...
prompt killed
exit loop: next_out=356 i=356 started=0 leftover=356
return
block done

The crash is indeed in libXt, but my first suspicion was that it would be in an Xt routine called by processing the latest ICS output. Like updating the text in the title bar, updating something in a non-existing move-history window, or something like that. But is seems it is not triggered by anything that is done there; the "block done" message is just before the return of the input handler, which is called from the Xt event loop when input arrives. It could of course be that it crashes after the input callback returns; that would be inside libXt.

I don't know if anything done from earlier Xt calls could lead to an asynchronus Xt call with user-supplied parameters. The board drawing isn't really suspect, since it was done many times before in the same session, and the first board of a game is just a board like any other. Changing the text in the title bar is done only on the start of a new game, and is a more likely candidate. But the title that is passed to it is printed in the debug file, and looks normal. Starting a new game shouldn't do anything else than printing the board and altering the title-bar text.

So I am out of ideas now. It could be a bug in your version of libXt. No one else has complained about crashes like this, while 4.6.2 has been out for quite some time now.