Client crash exiting while rejoining

[elexis]

When you Alt+F4 the game while rejoining, the game might crash instead of exit properly.

Notice the signal to end the process must occur right after

TIMER| common/global.xml: 445.017 us

Killing the process after the next message doesn't crash. The next logmessage would be:

TIMER| ParseTerrain: 7.1027 ms

and happens when the loading bar reaches maybe 90%.

This crash occurs reliably everytime when meeting this criteria.

The server usually isn't affected by this.

[elexis]

Here a backtrace:

#0  length (this=<optimized out>) at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/vm/String.h:255
#1  range (this=<optimized out>) at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/vm/String.h:525
#2  IdToTypeId (id=...) at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/jsinferinlines.h:190
#3  MarkTypePropertyNonData (id=..., obj=<optimized out>, cx=<optimized out>)
    at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/jsinferinlines.h:483
#4  JSObject::changeProperty<(js::ExecutionMode)0> (cx=0x7f3188116250, obj=..., shape=..., attrs=68, mask=68, 
    getter=0x7f31f3d6aef0 <array_length_getter(JSContext*, JS::HandleObject, JS::HandleId, JS::MutableHandleValue)>, 
    setter=0x7f31f3d7ab80 <array_length_setter(JSContext*, JS::HandleObject, JS::HandleId, bool, JS::MutableHandleValue)>)
    at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/vm/Shape.cpp:975
#5  0x00007f31f3d809fe in js::ArraySetLength<(js::ExecutionMode)0> (cxArg=0x7f3188116250, arr=..., id=..., attrs=68, value=..., 
    value@entry=..., setterIsStrict=240, setterIsStrict@entry=true)
    at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/jsarray.cpp:674
#6  0x00007f31f40d9d03 in js::baseops::SetPropertyHelper<(js::ExecutionMode)0> (cxArg=0x7f3188116250, obj=..., receiver=..., id=..., 
    qualified=<optimized out>, vp=..., strict=true)
    at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/jsobj.cpp:5022
#7  0x00007f31f3d6c98a in setGeneric (strict=<optimized out>, vp=..., id=..., receiver=..., obj=..., cx=<optimized out>)
    at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/jsobj.h:1024
#8  setProperty (strict=<optimized out>, vp=..., name=<optimized out>, receiver=..., obj=..., cx=<optimized out>)
    at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/jsobj.h:1032
#9  js::SetLengthProperty (cx=0x7f3188116250, obj=..., length=6,9095536994409878e-310)
    at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/jsarray.cpp:367
#10 0x00007f31f3d74264 in js::array_splice_impl (cx=0x7f3188116250, argc=2512370112, vp=0x7f318ee82d00, returnValueIsUsed=68)
    at /path/to/0ad/dev/trunk/libraries/source/spidermonkey/mozjs31/js/src/jsarray.cpp:2565

[elexis]

Sounds a lot like #4154 before the last SpiderMonkey update.