Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash on ios when printing an array containing [deleted object] #38597

Closed
Myran opened this issue May 9, 2020 · 3 comments
Closed

Crash on ios when printing an array containing [deleted object] #38597

Myran opened this issue May 9, 2020 · 3 comments

Comments

@Myran
Copy link

Myran commented May 9, 2020

Godot version:
3.2.1
OS/device including version:
ios 13.3.1
Issue description:

On an ios device, printing an array containing a [deleted object] crashes with the following bt.
Running the same from editor show: [[Deleted Object], [Deleted Object], [ColorRect:3180]] with no errors.

thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x4a8)
  * frame #0: 0x0000000101d63134 gameone`Object::to_string() + 32
    frame #1: 0x0000000101dc88e8 gameone`Variant::stringify(List<void const*, DefaultAllocator>&) const + 328
    frame #2: 0x00000001013f6960 gameone`GDScriptFunctions::call(GDScriptFunctions::Function, Variant const**, int, Variant&, Variant::CallError&) + 4732
    frame #3: 0x00000001013f1924 gameone`GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) + 23756
    frame #4: 0x00000001013eb2e8 gameone`GDScriptFunctionState::resume(Variant const&) + 128
    frame #5: 0x00000001013eb6e8 gameone`GDScriptFunctionState::_signal_callback(Variant const**, int, Variant::CallError&) + 408
    frame #6: 0x0000000101d5d75c gameone`Object::call(StringName const&, Variant const**, int, Variant::CallError&) + 304
    frame #7: 0x0000000101d67bd0 gameone`Object::emit_signal(StringName const&, Variant const**, int) + 756
    frame #8: 0x0000000101d688c8 gameone`Object::emit_signal(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) + 100
    frame #9: 0x00000001016de590 gameone`SceneTree::idle(float) + 164
    frame #10: 0x000000010137bb84 gameone`-[AppDelegate drawView:] + 4008
    frame #11: 0x0000000101378dbc gameone`-[GLView drawView] + 268
    frame #12: 0x0000000103cfd5f8 GPUToolsCore`-[DYDisplayLinkInterposer forwardDisplayLinkCallback:] + 168
    frame #13: 0x00000001c793d130 QuartzCore`CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 632
    frame #14: 0x00000001c7a07000 QuartzCore`display_timer_callback(__CFMachPort*, void*, long, void*) + 264
    frame #15: 0x00000001c0f4d8ac CoreFoundation`__CFMachPortPerform + 172
    frame #16: 0x00000001c0f7707c CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 56
    frame #17: 0x00000001c0f767a8 CoreFoundation`__CFRunLoopDoSource1 + 444
    frame #18: 0x00000001c0f7167c CoreFoundation`__CFRunLoopRun + 2168
    frame #19: 0x00000001c0f70adc CoreFoundation`CFRunLoopRunSpecific + 464
    frame #20: 0x00000001caf11328 GraphicsServices`GSEventRunModal + 104
    frame #21: 0x00000001c507e63c UIKitCore`UIApplicationMain + 1936
    frame #22: 0x000000010137a400 gameone`main + 124
    frame #23: 0x00000001c0dfa360 libdyld.dylib`start + 4

Steps to reproduce:

Minimal reproduction project:

@naithar
Copy link
Contributor

naithar commented Jun 19, 2020

Reproducible with disabled DEBUG_ENABLED compilation flag.

The reason for crash seems to be in condition inside variant.cpp file which return true for already deleted object, which it shouldn't: https://github.com/godotengine/godot/blob/3.2/core/variant.cpp#L1599
With DEBUG_ENABLED flag enabled, once object is already deleted the condition fails and returns [Deleted Object] or [Object:null] in case of iOS.

In gist there are logs for deleted object state right before the deletion and right after. The ok.txt is right before the deletion, and crash.txt is the state right after:
https://gist.github.com/naithar/95c1d375302e2f33f28318976a8025c2

This could probably be reproducible not only on iOS, but only on 3.2 release, as master seems to be handling objects in stringify method differently.

@naithar
Copy link
Contributor

naithar commented Jun 21, 2020

I was able to reproduce this crash on MacOS 10.15.4 and Windows 10 in builds exported with 3.2.1. While sometimes this issue does not happen immediately it still happens on this systems with both debug and release builds.
Minimal project is here at delete_check branch: https://github.com/naithar/gd_richedit_test/tree/delete_check

@akien-mga
Copy link
Member

Fixed by #39736.

huhund pushed a commit to huhund/godot that referenced this issue Nov 10, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants