Map Server crash save_scdata_single & del_scdata_single

#0  0x000000000048b3d4 in chrif_del_scdata_single (account_id=2020381,
    char_id=174015, type=517) at chrif.c:1616
No locals.
#1  0x00000000005ee7f7 in status_change_end_ (bl=0x15da2930,
    type=SC_PUSH_CART, tid=-1, file=0x650760 "status.c", line=9549)
    at status.c:9604
        sd = 0x15da2930
        sc = 0x15da2d58
        sce = 0x1a1e6d3c
        st = <value optimized out>
        vd = <value optimized out>
        opt_flag = 0
        calc_flag = <value optimized out>
        invisible = false
        __FUNCTION__ = "status_change_end_"
#2  0x00000000005e99af in status_change_clear (bl=0x15da2930, type=1)
    at status.c:9549
        sc = 0x15da2d58
        i = <value optimized out>
#3  0x000000000060e6fe in unit_free (bl=0x15da2930,
    clrtype=<value optimized out>) at unit.c:2572
        __FUNCTION__ = "unit_free"
#4  0x0000000000510741 in map_quit (sd=0x15da2930) at map.c:1771
---Type <return> to continue, or q <return> to quit---
        i = <value optimized out>
        __FUNCTION__ = "map_quit"
#5  0x00000000004c26b2 in clif_parse (fd=2256) at clif.c:18266
        parse_cmd_func = <value optimized out>
        cmd = <value optimized out>
        packet_len = <value optimized out>
        sd = 0x15da2930
        pnum = <value optimized out>
#6  0x0000000000621d0e in do_sockets (next=<value optimized out>)
    at socket.c:887
        rfd = {__fds_bits = {0 <repeats 34 times>, 1125899906842624, 65536, 0,
            0, 0, 0, 0, 0, 0, 0, 65536, 0 <repeats 115 times>}}
        timeout = {tv_sec = 0, tv_usec = 0}
        ret = 0
        i = <value optimized out>
#7  0x0000000000000000 in ?? ()
No symbol table info available.
(gdb)

I tried disable both.

//if( sd )
//chrif->save_scdata_single(sd->status.account_id,sd->status.char_id,type,sce);

//if( sd && sce->timer == INVALID_TIMER )
//chrif->del_scdata_single(sd->status.account_id,sd->status.char_id,type);

Later crashed with :

#0  0x0000000000000000 in ?? ()
Missing separate debuginfos, use: debuginfo-install keyutils-libs-1.4-4.el6.x86_64 krb5-libs-1.10.3-10.el6_4.6.x86_64 libcom_err-1.41.12-18.el6.x86_64 libselinux-2.0.94-5.3.el6_4.1.x86_64 mysql-libs-5.1.73-3.el6_5.x86_64 openssl-1.0.1e-16.el6_5.4.x86_64 zlib-1.2.3-29.el6.x86_64
(gdb) bt full
#0  0x0000000000000000 in ?? ()
No symbol table info available.
#1  0x00000000004f1d06 in intif_saveregistry (sd=0x11da3790) at intif.c:288
        iter = <value optimized out>
        key = {i = 0, ui = 0, str = 0x0, i64 = 0, ui64 = 0}
        data = <value optimized out>
        plen = 14
        len = <value optimized out>
#2  0x000000000048c0c3 in chrif_save (sd=0x11da3790, flag=1) at chrif.c:266
No locals.
#3  0x0000000000488821 in chrif_reconnect (key=<value optimized out>,
    data=<value optimized out>, ap=<value optimized out>) at chrif.c:450
        node = 0x28f5c98
#4  0x000000000061750a in db_obj_vforeach (self=0x276cbb8,
    func=0x488770 <chrif_reconnect>, args=0x7fff10173c30) at db.c:2033
        argscopy = {{gp_offset = 16, fp_offset = 48,
            overflow_arg_area = 0x7fff10173d10,
            reg_save_area = 0x7fff10173c50}}
        db = 0x276cbb8
        sum = 0
        node = 0xafca898
        parent = <value optimized out>
#5  0x00000000006162d1 in db_obj_foreach (self=<value optimized out>,
---Type <return> to continue, or q <return> to quit---
    func=<value optimized out>) at db.c:2079
        args = {{gp_offset = 16, fp_offset = 48,
            overflow_arg_area = 0x7fff10173d10,
            reg_save_area = 0x7fff10173c50}}
#6  0x000000000048c42b in chrif_on_ready () at chrif.c:483
        once = true
#7  0x000000000048cc7e in chrif_parse (fd=7) at chrif.c:1439
        packet_len = 27
        cmd = <value optimized out>
        r = <value optimized out>
#8  0x0000000000621c9e in do_sockets (next=<value optimized out>)
    at socket.c:887
        rfd = {__fds_bits = {128, 0 <repeats 159 times>}}
        timeout = {tv_sec = 0, tv_usec = 49794}
        ret = 0
        i = <value optimized out>
#9  0x000000000061e259 in main (argc=<value optimized out>,
    argv=<value optimized out>) at core.c:369
        next = <value optimized out>

Does it related to :
Bug ID #4856: send shortlist corrupts memory

Referenced to eAthena : http://www.eathena.w...er&showbug=4856

Thank you for all the info, fixed in https://github.com/H...bede749b6455129

After apply the patch.

When players back to choose their character. All statuses are cleared except permanent statues.

After apply the patch.

When players back to choose their character. All statuses are cleared except permanent statues.

couldn't reproduce, tried "blessing -> logout -> log back in -> blessing still active", any more information?

Please try bubble gum , battle manual

still can't reproduce, "field manual -> bubble gum -> logout -> log back in -> both status still active", does it happen everytime to you?oo (any more info? e.g. job/map/...)