Tobi

Spring 0.77b5 infinite loop in real game, possibility to attach debugger

(gdb) bt
#0  ListErase<CObject*> (list=@0xfe545f4, what=@0xbfbe4334) at /usr/include/c++/4.2/bits/stl_list.h:142
#1  0x08518ef8 in ~CObject (this=0x132bed20) at /home/tobi/wd/spring/spring_0.77b5/rts/System/Object.cpp:45
#2  0x0842e7c8 in ~CExploSpikeProjectile (this=0x132bed20) at /home/tobi/wd/spring/spring_0.77b5/rts/Sim/Projectiles/Unsynced/ExploSpikeProjectile.cpp:50
#3  0x083e1f31 in CProjectileHandler::Update (this=0x91fd660) at /home/tobi/wd/spring/spring_0.77b5/rts/Sim/Projectiles/ProjectileHandler.cpp:427
#4  0x080a749d in CGame::SimFrame (this=0x8a2be08) at /home/tobi/wd/spring/spring_0.77b5/rts/Game/Game.cpp:3176
#5  0x080b8d34 in CGame::ClientReadNet (this=0x8a2be08) at /home/tobi/wd/spring/spring_0.77b5/rts/Game/Game.cpp:3574
#6  0x080bc7c9 in CGame::Update (this=0x8a2be08) at /home/tobi/wd/spring/spring_0.77b5/rts/Game/Game.cpp:2469
#7  0x0850336b in SpringApp::Update (this=0xbfbe508c) at /home/tobi/wd/spring/spring_0.77b5/rts/System/SpringApp.cpp:884
#8  0x0850a195 in SpringApp::Run (this=0xbfbe508c, argc=2, argv=0xbfbe5174) at /home/tobi/wd/spring/spring_0.77b5/rts/System/SpringApp.cpp:1125
#9  0x084f2a5a in Run (argc=2, argv=0xbfbe5174) at /home/tobi/wd/spring/spring_0.77b5/rts/System/Main.cpp:60
#10 0x084f2bc2 in main (argc=252574672, argv=0xdec7360) at /home/tobi/wd/spring/spring_0.77b5/rts/System/Main.cpp:111

CObject::~CObject()
{
	std::list<CObject*>::iterator di;
	for(di=listeners.begin();di!=listeners.end();++di){
 		m_setOwner(__FILE__, __LINE__, __FUNCTION__);
		(*di)->DependentDied(this);
		m_setOwner(__FILE__, __LINE__, __FUNCTION__);
		ListErase<CObject*>((*di)->listening, this);
	}
	for(di=listening.begin();di!=listening.end();++di){
		m_setOwner(__FILE__, __LINE__, __FUNCTION__);
		ListErase<CObject*>((*di)->listeners, this); // <-- crash on this line
	}
	m_resetGlobals();
}

So it loops through this->listening, and for each listening item it erases "this" from the listeners.

(gdb) up
#1  0x08518ef8 in ~CObject (this=0x132bed20) at /home/tobi/wd/spring/spring_0.77b5/rts/System/Object.cpp:45
45                      ListErase<CObject*>((*di)->listeners, this);
(gdb) p listening
$81 = {<std::_List_base<CObject*,std::allocator<CObject*> >> = {
    _M_impl = {<std::allocator<std::_List_node<CObject*> >> = {<__gnu_cxx::new_allocator<std::_List_node<CObject*> >> = {<No data fields>}, <No data fields>}, _M_node = {
        _M_next = 0xcf2ac40, _M_prev = 0xcf2ac40}}}, <No data fields>}
(gdb) p listeners
$82 = {<std::_List_base<CObject*,std::allocator<CObject*> >> = {
    _M_impl = {<std::allocator<std::_List_node<CObject*> >> = {<__gnu_cxx::new_allocator<std::_List_node<CObject*> >> = {<No data fields>}, <No data fields>}, _M_node = {
        _M_next = 0x132bed24, _M_prev = 0x132bed24}}}, <No data fields>}

Does this mean no nodes in both of these lists?

(gdb) p *0x132bed24
$83 = 321645860
(gdb) p **0x132bed24
$84 = 321645860
(gdb) p ***0x132bed24
$85 = 321645860
(gdb) p ****0x132bed24
$86 = 321645860

Seems right. (std::list probably uses a special end node. May even be a circular list.)

(gdb) p *0xcf2ac40
$87 = 321645868
(gdb) p **0xcf2ac40
$88 = 217230400
(gdb) p ***0xcf2ac40
$89 = 321645868
(gdb) p ****0xcf2ac40
$90 = 217230400

Or not? (Iterating over two nodes when following next pointers)



The node:

(gdb) pt std::_List_node<CObject*>
type = class std::_List_node<CObject*> : public std::_List_node_base {
  public:
    CObject *_M_data;
}
(gdb) pt std::_List_node_base
type = class std::_List_node_base {
  public:
    std::_List_node_base *_M_next;
    std::_List_node_base *_M_prev;

    static void swap(std::_List_node_base&, std::_List_node_base&);
    void transfer(std::_List_node_base*, std::_List_node_base*);
    void reverse();
    void hook(std::_List_node_base*);
    void unhook();
}

Assumption that next is first memory location of node is right.


The list:

(gdb) pt std::_List_base<CObject*,std::allocator<CObject*> >
type = class std::_List_base<CObject*,std::allocator<CObject*> > {
  protected:
    std::_List_base<CObject*,std::allocator<CObject*> >::_List_impl _M_impl;

    class std::_List_node<CObject*> * _M_get_node();
    void _M_put_node(std::_List_node<CObject*>*);
  public:
    std::allocator<std::_List_node<CObject*> > & _M_get_Node_allocator();
    const std::allocator<std::_List_node<CObject*> > & _M_get_Node_allocator() const;
    std::allocator<CObject*> _M_get_Tp_allocator() const;
    std::allocator<CObject*> get_allocator() const;
    void _List_base(const std::allocator<CObject*> &);
    ~_List_base(int);
    void _M_clear();
    void _M_init();
}
(gdb) pt std::_List_base<CObject*,std::allocator<CObject*> >::_List_impl
type = class std::_List_base<CObject*,std::allocator<CObject*> >::_List_impl : public std::allocator<std::_List_node<CObject*> > {
  public:
    std::_List_node_base _M_node;

    void _List_impl(const std::allocator<std::_List_node<CObject*> > &);
}
(gdb) p sizeof(std::_List_base<CObject*,std::allocator<CObject*> >::_List_impl)
$91 = 8

So a list always has a single _List_node_base and 0..n _List_nodes.


H: would it be possible listening is corrupt because of the extra node found earlier (to which prev doesn't point?)

(gdb) p &listeners._M_impl
$108 = (std::_List_base<CObject*,std::allocator<CObject*> >::_List_impl *) 0x132bed24
(gdb) p listeners._M_impl
$109 = {<std::allocator<std::_List_node<CObject*> >> = {<__gnu_cxx::new_allocator<std::_List_node<CObject*> >> = {<No data fields>}, <No data fields>}, _M_node = {
    _M_next = 0x132bed24, _M_prev = 0x132bed24}}

(gdb) p listening._M_impl
$110 = {<std::allocator<std::_List_node<CObject*> >> = {<__gnu_cxx::new_allocator<std::_List_node<CObject*> >> = {<No data fields>}, <No data fields>}, _M_node = {
    _M_next = 0xcf2ac40, _M_prev = 0xcf2ac40}}
(gdb) p &listening._M_impl
$111 = (std::_List_base<CObject*,std::allocator<CObject*> >::_List_impl *) 0x132bed2c

This makes sense.
listening contains a single node and is not corrupt at all. (special node <-> single value node <-> special node: special node marks begin and end)
listeners is an empty list. (special node -> special node)

H rejected.


Let's examine the CObject that's in there:

(gdb) p {class CObject*} (0xcf2ac40+8)
$99 = (CObject *) 0xfe545f0

(gdb) p {class CObject*} (321645868+8)
$102 = (CObject *) 0x0

(gdb) p*$99
$105 = {_vptr.CObject = 0x860fb68, static binder = {class_ = 0x873de20, base = 0x0, flags = creg::CF_None, memberRegistrator = 0x872a7e0, name = 0x86184b4 "CObject", size = 20,
    constructor = 0x85189a0 <CObject::_ConstructInstance(void*)>, destructor = 0x8518970 <CObject::_DestructInstance(void*)>, nextBinder = 0x872a8e0},
  static memberRegistrator = 0x872a824, listeners = {<std::_List_base<CObject*,std::allocator<CObject*> >> = {
      _M_impl = {<std::allocator<std::_List_node<CObject*> >> = {<__gnu_cxx::new_allocator<std::_List_node<CObject*> >> = {<No data fields>}, <No data fields>}, _M_node = {
          _M_next = 0xf0dfbd0, _M_prev = 0xdec7360}}}, <No data fields>}, listening = {<std::_List_base<CObject*,std::allocator<CObject*> >> = {
      _M_impl = {<std::allocator<std::_List_node<CObject*> >> = {<__gnu_cxx::new_allocator<std::_List_node<CObject*> >> = {<No data fields>}, <No data fields>}, _M_node = {
          _M_next = 0xfe545fc, _M_prev = 0xfe545fc}}}, <No data fields>}}
(gdb) p this
$106 = (CObject * const) 0x132bed20

What is it? Use CREG (reflection for C++, basically, made for Spring) to find out.

(gdb) call $99->GetClass()
$112 = (class creg::Class *) 0x873d560
(gdb) p *$112
$114 = {members = {<std::_Vector_base<creg::Class::Member*,std::allocator<creg::Class::Member*> >> = {
      _M_impl = {<std::allocator<creg::Class::Member*>> = {<__gnu_cxx::new_allocator<creg::Class::Member*>> = {<No data fields>}, <No data fields>}, _M_start = 0x8753558,
        _M_finish = 0x87537fc, _M_end_of_storage = 0x8753958}}, <No data fields>}, derivedClasses = {<std::_Vector_base<creg::Class*,std::allocator<creg::Class*> >> = {
      _M_impl = {<std::allocator<creg::Class*>> = {<__gnu_cxx::new_allocator<creg::Class*>> = {<No data fields>}, <No data fields>}, _M_start = 0x87578d8, _M_finish = 0x87578e4,
        _M_end_of_storage = 0x87578e8}}, <No data fields>}, binder = 0x871a940, name = {static npos = 4294967295,
    _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0x87511fc "CUnit"}}, base = 0x873caa8,
  serializeProc = NULL, postLoadProc = 0x844d860 <CUnit::PostLoad()>}

A CUnit. What is it?

(gdb) p {class CUnit*} $99
$115 = (CUnit *) 0x860fb68
(gdb) p $115->unitDef->humanName
Cannot access memory at address 0x726f7469
(gdb) p $115->unitDef->name
Cannot access memory at address 0x726f7465

Starts to get dodgy... probably not a unit anyway. Check with gdb.

(gdb) p $99
$129 = (CObject *) 0xfe545f0
(gdb) set print object on
(gdb) p $99
$130 = (CUnit *) 0xfe545f0

CUnit after all.

(gdb) p $130->unitDef->humanName
$133 = {_M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0xab249ec "Krogoth"}}

Kroggie. The one which was being built for a long time already in the game, probably.

(gdb) set print pretty on
(gdb) p *$130
$137 = (CUnit) {
  <CSolidObject> = {
    <CWorldObject> = {
      <CObject> = {
        _vptr.CObject = 0x860fb68,
        listeners = {
          <std::_List_base<CObject*,std::allocator<CObject*> >> = {
            _M_impl = {
              <std::allocator<std::_List_node<CObject*> >> = {
                <__gnu_cxx::new_allocator<std::_List_node<CObject*> >> = {<No data fields>}, <No data fields>},
              members of std::_List_base<CObject*,std::allocator<CObject*> >::_List_impl:
              _M_node = {
                _M_next = 0xf0dfbd0,
                _M_prev = 0xdec7360
              }
            }
          }, <No data fields>},
        listening = {
          <std::_List_base<CObject*,std::allocator<CObject*> >> = {
            _M_impl = {
              <std::allocator<std::_List_node<CObject*> >> = {
                <__gnu_cxx::new_allocator<std::_List_node<CObject*> >> = {<No data fields>}, <No data fields>},
              members of std::_List_base<CObject*,std::allocator<CObject*> >::_List_impl:
              _M_node = {
                _M_next = 0xfe545fc,
                _M_prev = 0xfe545fc
              }
            }
          }, <No data fields>}
      },
      members of CWorldObject:
      id = 6988,
      pos = {
        <SFloat3> = {
          x = 324.25,
          y = 141.09375,
          z = 1272
        },
      },
      radius = 69.301239,
      sqRadius = 4802.66162,
      drawRadius = 69.301239,
      useAirLos = false,
      alwaysVisible = false
    },
    members of CSolidObject:
---Type <return> to continue, or q <return> to quit---
    mass = 100000,
    blocking = true,
    floatOnWater = false,
    isUnderWater = false,
    immobile = false,
    blockHeightChanges = false,
    xsize = 6,
    ysize = 6,
    height = 116.674454,
    heading = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<short int>:
      x = 16384
    },
    physicalState = CSolidObject::OnGround,
    midPos = {
      x = {
        <CSyncedPrimitiveBase> = {<No data fields>},
        members of SyncedPrimitive<float>:
        x = 324.25
      },
      y = {
        <CSyncedPrimitiveBase> = {<No data fields>},
        members of SyncedPrimitive<float>:
        x = 199.225067
      },
      z = {
        <CSyncedPrimitiveBase> = {<No data fields>},
        members of SyncedPrimitive<float>:
        x = 1272
      }
    },
    isMoving = false,
    residualImpulse = {
      <SFloat3> = {
        x = 0,
        y = 0,
        z = 0
      },
    },
    mobility = 0xf0a0430,
    mapPos = {
      x = 38,
      y = 156
    },
    yardMap = 0x0,
---Type <return> to continue, or q <return> to quit---
    buildFacing = 1,
    isMarkedOnBlockingMap = true,
    speed = {
      <SFloat3> = {
        x = 0,
        y = 0,
        z = 0
      },
    }
  },
  members of CUnit:
  unitDef = 0x9e79fcc,
  collisionVolume = 0xfeee788,
  unitDefName = {
    _M_dataplus = {
      <std::allocator<char>> = {
        <__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>},
      members of std::basic_string<char,std::char_traits<char>,std::allocator<char> >::_Alloc_hider:
      _M_p = 0x9327ccc "core_krogoth"
    }
  },
  modParams = {
    <std::_Vector_base<float,std::allocator<float> >> = {
      _M_impl = {
        <std::allocator<float>> = {
          <__gnu_cxx::new_allocator<float>> = {<No data fields>}, <No data fields>},
        members of std::_Vector_base<float,std::allocator<float> >::_Vector_impl:
        _M_start = 0x0,
        _M_finish = 0x0,
        _M_end_of_storage = 0x0
      }
    }, <No data fields>},
  modParamsMap = {
    _M_t = {
      _M_impl = {
        <std::allocator<std::_Rb_tree_node<std::pair<const std::basic_string<char, std::char_traits<char>, std::allocator<char> >, int> > >> = {
          <__gnu_cxx::new_allocator<std::_Rb_tree_node<std::pair<const std::basic_string<char, std::char_traits<char>, std::allocator<char> >, int> > >> = {<No data fields>}, <No data fields>},
        members of std::_Rb_tree<std::basic_string<char, std::char_traits<char>, std::allocator<char> >,std::pair<const std::basic_string<char, std::char_traits<char>, std::allocator<char> >, int>,std::_Select1st<std::pair<const std::basic_string<char, std::char_traits<char>, std::allocator<char> >, int> >,std::less<std::basic_string<char, std::char_traits<char>, std::allocator<char> > >,std::allocator<std::pair<const std::basic_string<char, std::char_traits<char>, std::allocator<char> >, int> > >::_Rb_tree_impl<std::less<std::basic_string<char, std::char_traits<char>, std::allocator<char> > >,false>:
        _M_key_compare = {
          <std::binary_function<std::basic_string<char, std::char_traits<char>, std::allocator<char> >,std::basic_string<char, std::char_traits<char>, std::allocator<char> >,bool>> = {<No data fields>}, <No data fields>},
        _M_header = {
---Type <return> to continue, or q <return> to quit---
          _M_color = std::_S_red,
          _M_parent = 0x0,
          _M_left = 0xfe546a0,
          _M_right = 0xfe546a0
        },
        _M_node_count = 0
      }
    }
  },
  team = 4,
  allyteam = 1,
  lineage = 4,
  aihint = 244,
  frontdir = {
    x = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 1
    },
    y = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 0
    },
    z = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = -4.37113883e-08
    }
  },
  rightdir = {
    x = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 4.37113883e-08
    },
    y = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = -0
    },
    z = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 1
    }
---Type <return> to continue, or q <return> to quit---
  },
  updir = {
    x = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 0
    },
    y = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 1
    },
    z = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 0
    }
  },
  upright = true,
  relMidPos = {
    x = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 0
    },
    y = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 58.1313248
    },
    z = {
      <CSyncedPrimitiveBase> = {<No data fields>},
      members of SyncedPrimitive<float>:
      x = 0
    }
  },
  deathSpeed = {
    <SFloat3> = {
      x = 0,
      y = 0,
      z = 0
    },
  },
  travel = 0,
  travelPeriod = 0,
  power = 33321.668,
---Type <return> to continue, or q <return> to quit---
  maxHealth = 105250,
  health = 104253.367,
  paralyzeDamage = 0,
  captureProgress = 0,
  experience = 0,
  limExperience = 0,
  neutral = false,
  soloBuilder = 0x0,
  beingBuilt = true,
  lastNanoAdd = 92484,
  repairAmount = 0,
  transporter = 0x0,
  toBeTransported = false,
  buildProgress = 0.990848303,
  groundLevelled = true,
  terraformLeft = 0,
  realLosRadius = 54,
  realAirLosRadius = 40,
  losStatus = {0, 3855, 0 <repeats 15 times>},
  inBuildStance = false,
  stunned = false,
  useHighTrajectory = false,
  dontUseWeapons = false,
  deathScriptFinished = false,
  deathCountdown = 0,
  delayedWreckLevel = -1,
  restTime = 0,
  weapons = {
    <std::_Vector_base<CWeapon*,std::allocator<CWeapon*> >> = {
      _M_impl = {
        <std::allocator<CWeapon*>> = {
          <__gnu_cxx::new_allocator<CWeapon*>> = {<No data fields>}, <No data fields>},
        members of std::_Vector_base<CWeapon*,std::allocator<CWeapon*> >::_Vector_impl:
        _M_start = 0xf9da300,
        _M_finish = 0xf9da30c,
        _M_end_of_storage = 0xf9da310
      }
    }, <No data fields>},
  shieldWeapon = 0x0,
  stockpileWeapon = 0x0,
  reloadSpeed = 1,
  maxRange = 1000,
  haveTarget = false,
  haveUserTarget = false,
  haveDGunRequest = false,
  lastMuzzleFlameSize = 0,
---Type <return> to continue, or q <return> to quit---
  lastMuzzleFlameDir = {
    <SFloat3> = {
      x = 0,
      y = 1,
      z = 0
    },
  },
  armorType = 0,
  category = 30,
  quads = {
    <std::_Vector_base<int,std::allocator<int> >> = {
      _M_impl = {
        <std::allocator<int>> = {
          <__gnu_cxx::new_allocator<int>> = {<No data fields>}, <No data fields>},
        members of std::_Vector_base<int,std::allocator<int> >::_Vector_impl:
        _M_start = 0x9231798,
        _M_finish = 0x92317a0,
        _M_end_of_storage = 0x92317a0
      }
    }, <No data fields>},
  los = 0xd31ed38,
  tempNum = 7504345,
  lastSlowUpdate = 0,
  mapSquare = 162856,
  controlRadius = 4,
  losRadius = 1,
  airLosRadius = 1,
  losHeight = 92.7819443,
  lastLosUpdate = 81799,
  radarRadius = 0,
  sonarRadius = 0,
  jammerRadius = 0,
  sonarJamRadius = 0,
  seismicRadius = 0,
  seismicSignature = 41.8330002,
  hasRadarCapacity = false,
  radarSquares = {
    <std::_Vector_base<int,std::allocator<int> >> = {
      _M_impl = {
        <std::allocator<int>> = {
          <__gnu_cxx::new_allocator<int>> = {<No data fields>}, <No data fields>},
        members of std::_Vector_base<int,std::allocator<int> >::_Vector_impl:
        _M_start = 0x0,
        _M_finish = 0x0,
        _M_end_of_storage = 0x0
      }
---Type <return> to continue, or q <return> to quit---
    }, <No data fields>},
  oldRadarPos = {
    x = -1,
    y = 1043273744
  },
  stealth = false,
  sonarStealth = false,
  moveType = 0xffaad60,
  prevMoveType = 0x0,
  usingScriptMoveType = false,
  commandAI = 0xd9ddcc0,
  group = 0x0,
  condUseMetal = 0,
  condUseEnergy = 0,
  condMakeMetal = 0,
  condMakeEnergy = 0,
  uncondUseMetal = 0,
  uncondUseEnergy = 0,
  uncondMakeMetal = 0,
  uncondMakeEnergy = 0,
  metalUse = 0,
  energyUse = 0,
  metalMake = 0,
  energyMake = 0,
  metalUseI = 0,
  energyUseI = 0,
  metalMakeI = 0,
  energyMakeI = 0,
  metalUseold = 0,
  energyUseold = 0,
  metalMakeold = 0,
  energyMakeold = 0,
  energyTickMake = 1.10000002,
  metalExtract = 0,
  metalCost = 30950,
  energyCost = 142300,
  buildTime = 462150,
  metalStorage = 0,
  energyStorage = 0,
  lastAttacker = 0x0,
  lastAttack = -200,
  lastDamage = -100,
  lastFireWeapon = 0,
  recentDamage = 0,
  userTarget = 0x0,
  userAttackPos = {
---Type <return> to continue, or q <return> to quit---
    <SFloat3> = {
      x = 0,
      y = 0,
      z = 0
    },
  },
  userAttackGround = false,
  commandShotCount = -1,
  fireState = 2,
  dontFire = false,
  moveState = 1,
  activated = false,
  model = 0xe60e2d8,
  cob = 0x10547f38,
  script = 0x0,
  localmodel = 0xd5dc2b8,
  tooltip = {
    _M_dataplus = {
      <std::allocator<char>> = {
        <__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>},
      members of std::basic_string<char,std::char_traits<char>,std::allocator<char> >::_Alloc_hider:
      _M_p = 0xe7ef1dc "Krogoth - - Experimental Kbot"
    }
  },
  crashing = false,
  isDead = false,
  falling = false,
  fallSpeed = 0.200000003,
  inAir = false,
  inWater = false,
  flankingBonusMode = 1,
  flankingBonusDir = {
    <SFloat3> = {
      x = 0,
      y = 0,
      z = 1
    },
  },
  flankingBonusMobility = 10,
  flankingBonusMobilityAdd = 0.00999999978,
  flankingBonusAvgDamage = 1.39999998,
  flankingBonusDifDamage = 0.5,
  armoredState = true,
  armoredMultiple = 1,
  curArmorMultiple = 1,
  wreckName = {
---Type <return> to continue, or q <return> to quit---
    _M_dataplus = {
      <std::allocator<char>> = {
        <__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>},
      members of std::basic_string<char,std::char_traits<char>,std::allocator<char> >::_Alloc_hider:
      _M_p = 0xab24f3c "core_krogoth_dead"
    }
  },
  posErrorVector = {
    <SFloat3> = {
      x = -0.302853882,
      y = 0.0753254145,
      z = -0.642256141
    },
  },
  posErrorDelta = {
    <SFloat3> = {
      x = 0.00372611522,
      y = -8.71685479e-05,
      z = 0.00033092103
    },
  },
  nextPosErrorUpdate = 13,
  hasUWWeapons = false,
  wantCloak = false,
  scriptCloak = 0,
  cloakTimeout = 128,
  curCloakTimeout = 60154,
  isCloaked = false,
  decloakDistance = 0,
  lastTerrainType = 0,
  curTerrainType = 0,
  selfDCountdown = 0,
  directControl = 0x0,
  myTrack = 0x0,
  incomingMissiles = {
    <std::_List_base<CMissileProjectile*,std::allocator<CMissileProjectile*> >> = {
      _M_impl = {
        <std::allocator<std::_List_node<CMissileProjectile*> >> = {
          <__gnu_cxx::new_allocator<std::_List_node<CMissileProjectile*> >> = {<No data fields>}, <No data fields>},
        members of std::_List_base<CMissileProjectile*,std::allocator<CMissileProjectile*> >::_List_impl:
        _M_node = {
          _M_next = 0xfe5497c,
          _M_prev = 0xfe5497c
        }
      }
    }, <No data fields>},
---Type <return> to continue, or q <return> to quit---
  lastFlareDrop = 0,
  currentFuel = 0,
  luaDraw = false,
  noDraw = false,
  noSelect = false,
  noMinimap = false,
  isIcon = false,
  iconRadius = 0,
  maxSpeed = 1.20000005,
  weaponHitMod = 0.14453125,
  lodCount = 0,
  currentLOD = 0,
  lodLengths = {
    <std::_Vector_base<float,std::allocator<float> >> = {
      _M_impl = {
        <std::allocator<float>> = {
          <__gnu_cxx::new_allocator<float>> = {<No data fields>}, <No data fields>},
        members of std::_Vector_base<float,std::allocator<float> >::_Vector_impl:
        _M_start = 0x0,
        _M_finish = 0x0,
        _M_end_of_storage = 0x0
      }
    }, <No data fields>},
  luaMats = {{
      lodCount = 0,
      lastLOD = 0,
      lodMats = {
        <std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >> = {
          _M_impl = {
            <std::allocator<LuaUnitLODMaterial>> = {
              <__gnu_cxx::new_allocator<LuaUnitLODMaterial>> = {<No data fields>}, <No data fields>},
            members of std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >::_Vector_impl:
            _M_start = 0x0,
            _M_finish = 0x0,
            _M_end_of_storage = 0x0
          }
        }, <No data fields>}
    }, {
      lodCount = 0,
      lastLOD = 0,
      lodMats = {
        <std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >> = {
          _M_impl = {
            <std::allocator<LuaUnitLODMaterial>> = {
              <__gnu_cxx::new_allocator<LuaUnitLODMaterial>> = {<No data fields>}, <No data fields>},
            members of std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >::_Vector_impl:
---Type <return> to continue, or q <return> to quit---
            _M_start = 0x0,
            _M_finish = 0x0,
            _M_end_of_storage = 0x0
          }
        }, <No data fields>}
    }, {
      lodCount = 0,
      lastLOD = 0,
      lodMats = {
        <std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >> = {
          _M_impl = {
            <std::allocator<LuaUnitLODMaterial>> = {
              <__gnu_cxx::new_allocator<LuaUnitLODMaterial>> = {<No data fields>}, <No data fields>},
            members of std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >::_Vector_impl:
            _M_start = 0x0,
            _M_finish = 0x0,
            _M_end_of_storage = 0x0
          }
        }, <No data fields>}
    }, {
      lodCount = 0,
      lastLOD = 0,
      lodMats = {
        <std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >> = {
          _M_impl = {
            <std::allocator<LuaUnitLODMaterial>> = {
              <__gnu_cxx::new_allocator<LuaUnitLODMaterial>> = {<No data fields>}, <No data fields>},
            members of std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >::_Vector_impl:
            _M_start = 0x0,
            _M_finish = 0x0,
            _M_end_of_storage = 0x0
          }
        }, <No data fields>}
    }, {
      lodCount = 0,
      lastLOD = 0,
      lodMats = {
        <std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >> = {
          _M_impl = {
            <std::allocator<LuaUnitLODMaterial>> = {
              <__gnu_cxx::new_allocator<LuaUnitLODMaterial>> = {<No data fields>}, <No data fields>},
            members of std::_Vector_base<LuaUnitLODMaterial,std::allocator<LuaUnitLODMaterial> >::_Vector_impl:
            _M_start = 0x0,
            _M_finish = 0x0,
            _M_end_of_storage = 0x0
          }
---Type <return> to continue, or q <return> to quit---
        }, <No data fields>}
    }},
  alphaThreshold = 0.100000001,
  cegDamage = 1
}


I'd suspect listeners to be corrupted in this unit.

(gdb) p $130->listeners
$138 = {
  <std::_List_base<CObject*,std::allocator<CObject*> >> = {
    _M_impl = {
      <std::allocator<std::_List_node<CObject*> >> = {
        <__gnu_cxx::new_allocator<std::_List_node<CObject*> >> = {<No data fields>}, <No data fields>},
      members of std::_List_base<CObject*,std::allocator<CObject*> >::_List_impl:
      _M_node = {
        _M_next = 0xf0dfbd0,
        _M_prev = 0xdec7360
      }
    }
  }, <No data fields>}


How to check this?

(gdb) set $node = 0xfe545f4
(gdb) p $node
$191 = 266683892
(gdb) p $node = *$node
$192 = 252574672
(gdb)
$193 = 295722248

<hold enter to loop through linked list>

no repeat found at all, seems to through like entire memory...

==========

in replay, at first moment of lag (just after 0:51:00)

  maxParticles = 4000,
  currentParticles = 74783,
  particleSaturation = 15.0202503,

seemingly pretty much all CSimpleParticleSystems...