Bug#714483: wesnoth-1.10-core: segfault when moving in planning mode

[Ben Longbons]

Package: wesnoth-1.10-core
Version: 1:1.10.6-2
Severity: normal

Dear Maintainer,

I managed to get wesnoth to crash wesnoth. The crash occurred after
entering Planning mode and attempting to move a unit into attack position.
I don't think I saw the red arrow as I moved the mouse, but I can't
reproduce the issue when reloading the save.

I have the coredump (250 MB) and am comfortable with gdb.

(gdb) bt
#0  std::local_Rb_tree_rotate_right (__x=__x at entry=0x65df3f0,
    __root=@0x14b8f70: 0x3914a90)
    at ../../../../../src/libstdc++-v3/src/c++98/tree.cc:169
#1  0x00007fa333393cf4 in std::_Rb_tree_insert_and_rebalance (
    __insert_left=<optimized out>, __x=0x6a2bb70, __p=<optimized out>,
    __header=...) at ../../../../../src/libstdc++-v3/src/c++98/tree.cc:256
#2  0x0000000000d980b4 in std::_Rb_tree<unsigned long, std::pair<unsigned long const, std::map<image::locator::value, int, std::less<image::locator::value>, std::allocator<std::pair<image::locator::value const, int> > > >, std::_Select1st<std::pair<unsigned long const, std::map<image::locator::value, int, std::less<image::locator::value>, std::allocator<std::pair<image::locator::value const, int> > > > >, std::less<unsigned long>, std::allocator<std::pair<unsigned long const, std::map<image::locator::value, int, std::less<image::locator::value>, std::allocator<std::pair<image::locator::value const, int> > > > > >::_M_insert_(std::_Rb_tree_node_base const*, std::_Rb_tree_node_base const*, std::pair<unsigned long const, std::map<image::locator::value, int, std::less<image::locator::value>, std::allocator<std::pair<image::locator::value const, int> > > > const&) ()
#3  0x0000000000d9832d in std::_Rb_tree<unsigned long, std::pair<unsigned long const, std::map<image::locator::value, int, std::less<image::locator::value>, std::allocator<std::pair<image::locator::value const, int> > > >, std::_Select1st<std::pair<unsigned long const, std::map<image::locator::value, int, std::less<image::locator::value>, std::allocator<std::pair<image::locator::value const, int> > > > >, std::less<unsigned long>, std::allocator<std::pair<unsigned long const, std::map<image::locator::value, int, std::less<image::locator::value>, std::allocator<std::pair<image::locator::value const, int> > > > > >::_M_insert_unique_(std::_Rb_tree_const_iterator<std::pair<unsigned long const, std::map<image::locator::value, int, std::less<image::locator::value>, std::allocator<std::pair<image::locator::value const, int> > > > >, std::pair<unsigned long const, std::map<image::locator::value, int, std::less<image::locator::value>, std::allocator<std::pair<image::locator::value const, int> > > > const&) ()
#4  0x0000000000d93073 in image::locator::init_index() ()
#5  0x0000000000d934bb in image::locator::locator(image::locator const&, std::string const&) ()
#6  0x0000000000c8bcbc in unit_frame::get_overlaped_hex(int, map_location const&, map_location const&, frame_parameters const&, frame_parameters const&) const
    ()
#7  0x0000000000c6dedd in unit_animation::particule::get_overlaped_hex(frame_parameters const&, map_location const&, map_location const&) ()
#8  0x0000000000c6e6ce in unit_animation::invalidate(frame_parameters&) ()
#9  0x0000000000c43c62 in unit::invalidate(map_location const&) ()
#10 0x0000000000957bed in ?? ()
#11 0x00007fa332e16c1a in gomp_thread_start (xdata=<optimized out>)
    at ../../../src/libgomp/team.c:115
#12 0x00007fa3364e5e0e in start_thread (arg=0x7fa326e42700)
    at pthread_create.c:311
#13 0x00007fa33293395d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
(gdb) disassemble
Dump of assembler code for function std::local_Rb_tree_rotate_right(std::_Rb_tree_node_base*, std::_Rb_tree_node_base*&):
   0x00007fa333393a30 <+0>:     mov    rax,QWORD PTR [rdi+0x10]
=> 0x00007fa333393a34 <+4>:     mov    rdx,QWORD PTR [rax+0x18]
(gdb) print $rax
$1 = 0
(gdb) print *__x
$2 = {
  _M_color = std::_S_red,
  _M_parent = 0xb1ef330,
  _M_left = 0x0,
  _M_right = 0x0
}

-- System Information:
Debian Release: jessie/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages wesnoth-1.10-core depends on:
ii  libboost-iostreams1.49.0        1.49.0-4
ii  libboost-program-options1.49.0  1.49.0-4
ii  libboost-regex1.49.0            1.49.0-4
ii  libboost-system1.49.0           1.49.0-4
ii  libc6                           2.17-3
ii  libcairo2                       1.12.14-4
ii  libdbus-1-3                     1.6.12-1
ii  libfontconfig1                  2.9.0-7.1
ii  libfribidi0                     0.19.5-2
ii  libgcc1                         1:4.8.1-2
ii  libglib2.0-0                    2.36.1-2build1
ii  libgomp1                        4.8.1-2
ii  libice6                         2:1.0.8-2
ii  libpango1.0-0                   1.32.5-5+b1
ii  libsdl-image1.2                 1.2.12-3
ii  libsdl-mixer1.2                 1.2.12-5
ii  libsdl-net1.2                   1.2.8-3
ii  libsdl-ttf2.0-0                 2.0.11-2
ii  libsdl1.2debian                 1.2.15-5
ii  libsm6                          2:1.2.1-2
ii  libstdc++6                      4.8.1-2
ii  libx11-6                        2:1.5.0-1+deb7u1
ii  libxext6                        2:1.3.1-2+deb7u1
ii  wesnoth-1.10-data               1:1.10.6-2

wesnoth-1.10-core recommends no packages.

Versions of packages wesnoth-1.10-core suggests:
ii  wesnoth  1:1.10.6-2

-- no debconf information