I've learned about the watch command in gdb which has helped me to find where the location of disbanded squad members gets set to -1. It happens in line 1404 of daily.cpp.
Commenting out that line fixes the issue, but probably causes other bugs.
Reproducing bug 2 is now easier, just disband your squad and hold enter for a while.
More info on bug 2: something is setting LocalCreature to a number larger than 0x1a00000000
edit:
The cause of bug 2 is TVRecord_InputSleeperView's liblist is overflowing badly.
(gdb) dow
#0 TVRecord_InputSleeperView (viewnumber=viewnumber@entry=10, creaturetype=creaturetype@entry=61) at monthly/tvrecord.cpp:176
(gdb) print liblist
$40 = {30, 15, 12, 57, 88, 69, 91, 74, 87, 57, 69, 91, 74, 87, 57, 69, 74, 87, 13, 57, 91, 88, 77, 69, 91, 13, 74, 77, 87, 57, 88, 23, 33, 69, 91, 74, 87}
(gdb) print listlength
$41 = 118
(gdb) info watchpoint
Num Type Disp Enb Address What
8 hw watchpoint keep y *0x100c3a1d8
breakpoint already hit 1 time
0x100c3a1d8 is LocalCreature's address
(gdb) print liblist[listlength]
$42 = 28
(gdb) print &(liblist[listlength])
$43 = (int *) 0x100c3a1d8 <namecreaturetype(int)::LocalCreature>
I have no clue what the code is supposed to do, but simply insuring that listlength is never >= VIEWNUM solves this issue therefore I changed this code:
void TVRecord_InputSleeperView(int viewnumber, int creaturetype)
{
static int listlength = 0;
static int liblist[VIEWNUM], stalist[VIEWNUM];
int i, libcount, stacount, localview, numsleepers;
to this code:
void TVRecord_InputSleeperView(int viewnumber, int creaturetype)
{
static int listlength = 0;
static int liblist[VIEWNUM], stalist[VIEWNUM];
int i, libcount, stacount, localview, numsleepers;
if (listlength >= VIEWNUM)
{
listlength = 0;
}
Fixing that exposes a fourth bug! Sometimes a movieactor has lover equal to -1 (they have none maybe? dunno, your code not mine). That can get passed down to Kill_Movie_Character which then tries to access movieactors[-1] which gives a SEGV...
(gdb) down
#5 0x0000000100047b13 in mode_title () at title/titlescreen.cpp:618
#4 0x00000001000762e3 in mode_base () at basemode/basemode.cpp:565
#3 0x0000000100145ef2 in passmonth (clearformess=@0x7fffffffd17b: 1 '\001', canseethings=canseethings@entry=0 '\000') at monthly/monthly.cpp:777
#2 0x0000000100070c84 in Advance_Movie (Film=0x1011c3d60, canseethings=canseethings@entry=0 '\000') at monthly/tvrecord.cpp:1199
#1 0x000000010006ca95 in Narrate_Movie_Events (genre=<optimized out>, protagonistview=<optimized out>, antagonistview=<optimized out>, alignment=3,
canseethings=canseethings@entry=0 '\000') at monthly/tvrecord.cpp:3260
#0 0x0000000100069f04 in Kill_Movie_Character (characterindex=-1, andneeded=0, lovertakeupmysword=lovertakeupmysword@entry=0,
List=List@entry=0x7fffffffccf0 "Raghad Matthews,") at monthly/tvrecord.cpp:2594
This can be fixed by checking that the characters actually exist before you try to kill them. Lines 3121 to 3240 should be doing this but arn't, I'll post a fix when I've got time. (3-4 hours from now)