Crash when saving in 0.H RC

[guijan]

Describe the bug

The game rarely (twice in 3 real life days of gameplay) crashes when saving.

Attach save file

Mill Creek-trimmed.tar.gz

Right after crashing while saving, I opened the game again, loaded the save, and generated this archive. This won't help you reproduce, but it's the closest I have.

Steps to reproduce

Can't reproduce.

Expected behavior

Doesn't crash.

Screenshots

No response

Versions and configuration

• OS:
  OpenBSD 7.5 amd64.
• Graphics version:
  Terminal.
• Ingame language:
  English.
• Commit:
  14edf5b
• Compilation command:

FLAGS="-O3 -march=native -flto=thin" && export CFLAGS="$FLAGS" CXXFLAGS="$FLAGS" LDFLAGS="$FLAGS" && cmake -DCURSES_INCLUDE_PATH=/usr/include/ -DLANGUAGES=es_AR -DBACKTRACE=off -DUSE_PREFIX_DATA_DIR=off -DCMAKE_BUILD_TYPE=Release -DCURSES=on -DTILES=off -G Ninja -B build && cmake --build build -- -j4 

Additional context

debug.zip
There was no crash.log.

Backtrace in GDB:

(gdb) bt
#0  operator+ () at /home/jan/Work/contrib/Cataclysm-DDA/src/point.h:142
#1  global_part_pos3 () at /home/jan/Work/contrib/Cataclysm-DDA/src/vehicle.cpp:3349
#2  global_part_pos3 () at /home/jan/Work/contrib/Cataclysm-DDA/src/vehicle.cpp:3344
#3  position () at /home/jan/Work/contrib/Cataclysm-DDA/src/item_location.cpp:485
#4  0x000001e4fe6c740a in serialize () at /home/jan/Work/contrib/Cataclysm-DDA/src/item_location.cpp:468
#5  0x000001e4fe4d035b in serialize () at /home/jan/Work/contrib/Cataclysm-DDA/src/item_location.cpp:806
#6  write<item_location> () at /home/jan/Work/contrib/Cataclysm-DDA/src/json.h:793
#7  member<item_location> () at /home/jan/Work/contrib/Cataclysm-DDA/src/json.h:950
#8  serialize () at /home/jan/Work/contrib/Cataclysm-DDA/src/uistate.h:36
#9  0x000001e4fe48d8f6 in serialize () at /home/jan/Work/contrib/Cataclysm-DDA/src/uistate.h:75
#10 serialize () at /home/jan/Work/contrib/Cataclysm-DDA/src/inventory_ui.cpp:338
#11 0x000001e4fe2bd45a in operator() () at /home/jan/Work/contrib/Cataclysm-DDA/src/game.cpp:3410
#12 __invoke<(lambda at /home/jan/Work/contrib/Cataclysm-DDA/src/game.cpp:3408:78) &, std::__1::basic_ostream<char, std::__1::char_traits<char> > &> () at /usr/include/c++/v1/__functional/invoke.h:394
#13 __call<(lambda at /home/jan/Work/contrib/Cataclysm-DDA/src/game.cpp:3408:78) &, std::__1::basic_ostream<char, std::__1::char_traits<char> > &> () at /usr/include/c++/v1/__functional/invoke.h:487
#14 operator() () at /usr/include/c++/v1/__functional/function.h:185
#15 operator() () at /usr/include/c++/v1/__functional/function.h:356
#16 0x000001e4fdb55ef1 in operator() () at /usr/include/c++/v1/__functional/function.h:510
#17 operator() () at /usr/include/c++/v1/__functional/function.h:1156
#18 write_to_file () at /home/jan/Work/contrib/Cataclysm-DDA/src/cata_utility.cpp:287
#19 write_to_file () at /home/jan/Work/contrib/Cataclysm-DDA/src/cata_utility.cpp:295
#20 0x000001e4fe24690e in save () at /home/jan/Work/contrib/Cataclysm-DDA/src/game.cpp:3408
#21 0x000001e4fe2a85b5 in quicksave () at /home/jan/Work/contrib/Cataclysm-DDA/src/game.cpp:12886
#22 0x000001e4fe360e28 in do_regular_action () at /home/jan/Work/contrib/Cataclysm-DDA/src/handle_action.cpp:2663
#23 0x000001e4fe37b641 in handle_action () at /home/jan/Work/contrib/Cataclysm-DDA/src/handle_action.cpp:3122
#24 0x000001e4fe040f38 in do_turn () at /home/jan/Work/contrib/Cataclysm-DDA/src/do_turn.cpp:536
#25 0x000001e4ff9d7068 in main () at /home/jan/Work/contrib/Cataclysm-DDA/src/main.cpp:851

[mqrause]

This seems to be related to the AIM uistate. I can't reproduce this on windows, but probable reproduction steps could look like this:
Figured out the necessary reproduction steps

1. Open AIM and look at vehicle storage with a container
2. open that container inside AIM
3. Close AIM
4. Move away from the car until it's no longer inside the reality bubble
5. Save
6. Crash

The issue here is that the item_location that is saved in the AIM pane uistate is based on a vehicle_cursor, but the vehicle reference inside that becomes invalid when the vehicle is not loaded as far as I can tell. So when it's trying to access the vehicle position to serialize the item_location, it crashes on dereferencing a nullpointer.

[mqrause]

/confirmed