Why does this map crash WinMBF 2.0.3?

[VGA]

http://www.megafileupload.com/mxc0/keyFUN.wad

It works in anything else I tried, I just thought it was weird. I get this:

$ WinMBF.exe -file keyFUN.wad
Looking in .
Looking in .
Looking in C:/STUFF/Doom Stuff/WADS
IWAD found: C:/STUFF/Doom Stuff/WADS/doom2.wad
DOOM II version
DOOM 2: Hell on Earth v2.03
Built on Jan 19 2005
M_LoadDefaults: Load system defaults.
V_Init: allocate screens.
W_Init: Init WADfiles.
adding C:/STUFF/Doom Stuff/WADS/doom2.wad
adding keyFUN.wad

M_Init: Init miscellaneous info.
R_Init: Init DOOM refresh daemon - [ ........................ ]
R_InitData
R_InitPlanes
R_InitLightTables
R_InitSkyMap
R_InitTranslationsTables

P_Init: Init Playloop state.
I_Init: Setting up machine state.
I_InitSound:
Configured audio device with 512 samples/slice.
I_InitMusic: Using SDL_mixer.
D_CheckNetGame: Checking network game status.
startskill 2 deathmatch: 0 startmap: 1 startepisode: 1
player 1 of 1 (1 nodes)
S_Init: Setting up sound.
S_Init: default sfx volume 8
HU_Init: Setting up heads up display.
ST_Init: Init status bar.
Fatal signal: Segmentation Fault (SDL Parachute Deployed)

WinMBF exiting.

Press any key to continue



EDIT: Wait, is that good ol' crashiness when there's only one sector?

[Maes]

I recall that even shit-old DEU would issue a warning/refuse to save maps with just one sector. Then again the crash was after ST_Init...I'm not sure if that's the last of the various _Init functions...

[Quasar]

Maes said:

I recall that even shit-old DEU would issue a warning/refuse to save maps with just one sector. Then again the crash was after ST_Init...I'm not sure if that's the last of the various _Init functions...

Lee Killough made a mistake while refactoring some code in MBF and created a problem with maps that only have a single subsector, by forgetting to treat numnodes == 0 as a special case. This causes an access to nodes[-1] while doing a traversal. I'd suggest this is the most likely cause.

[RjY]

Quasar said:

Lee Killough made a mistake while refactoring some code in MBF and created a problem with maps that only have a single subsector, by forgetting to treat numnodes == 0 as a special case. This causes an access to nodes[-1] while doing a traversal. I'd suggest this is the most likely cause.

I think you're right but the special case for trivial (zero-nodes, single-subsector) maps actually was removed from R_PointInSubsector in Boom. (I remember looking into this for a bug report a long time ago. VGA's map will likely crash any version of PrBoom before 2.5.0.)