16 replies to this topic

[Tzarls]

Hi, I'm getting a segmentation fault here:

void asCScriptEngine::CallObjectMethod(...)
{
.....f(obj, param);			  // <- line 3373 - causes segmentation fault
}

"f" comes out with some weird value.

This function is being called by the asCScriptEngine::WriteMessage(...). I'm registering my callback function like this:

void scriptInterface::setMessageCallback(asIScriptEngine* compiler)
{
compiler->SetMessageCallback( asMETHOD(scriptInterface,MessageCallback),this,asCALL_THISCALL );
}



virtual void scriptInterface::MessageCallback(const asSMessageInfo *msg)
{
// Implement a simple message callback function
const char *type = "ERR ";
if( msg->type == asMSGTYPE_WARNING )
type = "WARN";
else if( msg->type == asMSGTYPE_INFORMATION )
type = "INFO";

printf("%s (%d, %d) : %s : %s\n", msg->section, msg->row, msg->col, type, msg->message);
}

I have the feeling that the problem is here (file angelscript.h line 1024)

// Template specialization
template <>
struct asSMethodPtr<SINGLE_PTR_SIZE>
{
template<class M>
static asSFuncPtr Convert(M Mthd)
{
  asSFuncPtr p;
  asMemClear(&p, sizeof(p));
  asMemCopy(&p, &Mthd, SINGLE_PTR_SIZE); //<- after this, "f" (inside "p") gets wrong value
  // Mark this as a class method
  p.flag = 3;
  return p;
}
};

To make things even weirder, everything works as expected under Windows XP. I'm getting this error under Linux (Ubuntu) - using Code::Blocks as IDE.

Any ideas?

Carlos

[behc]

Did you try with non virtual version of MessageCallback method?

[Tzarls]

Just tried - under Linux it only works with the non-virtual version.... but under Windows it works with the virtual version too.

[Andreas Jonsson]

It might be that when taking the address of a virtual method from within the actual class GNUC is returning the method pointer in a different way.

Can you check what the difference is between the following two ways of doing it:

void global_setMessageCallback(scriptInteface *obj, asIScriptEngine * compiler)
{
  compiler->SetMessageCallback( asMETHOD(scriptInterface,MessageCallback),obj,asCALL_THISCALL );
}

void scriptInterface::setMessageCallback(asIScriptEngine* compiler){  // Get the method from within the class  compiler->SetMessageCallback( asMETHOD(scriptInterface,MessageCallback),this,asCALL_THISCALL );  // Get the method from a global function  global_setMessageCallback(this, compiler);}

If there is a difference between these two ways of doing it, there has to be a way of identifying that difference so the call can be made correctly anyway.

[Tzarls]

Just tried. Exactly the same behaviour. Any other idea?

[Tzarls]

Interesting..... when the callback function is not virtual, the

static asSFuncPtr Convert (M Mthd)

method (angelscript.h line 1029) is getting the Mthd value as :

(void(scriptInterface::*)(scriptInterface *const)) 0x8068370 <scriptInterface::MessageCallback(asSMessageInfo const*)>

But when the callback function is virtual (even if it hasn´t been overridden) is passed as:

&virtual scriptInterface::MessageCallback(asSMessageInfo const*)

(as reported by code::blocks IDE)

Is that ok?

Edited by Tzarls, 01 June 2012 - 11:42 AM.

[Andreas Jonsson]

On gnuc a class method pointer has the following structure

struct {
    union {
        void *funcPtr;
        int  virtualFunctionIndex;
    };
    int baseOffset;
};

If the method is a virtual method, then union will have its least significant bit set, i.e. (int(funcPtr) & 1) will be true, otherwise it will be false, meaning that the funcPtr is the absolute address of the function that will be called.

If the class for the method pointer doesn't have multiple base classes, the baseOffset will always be 0, otherwise it will be the offset that must be added to the 'this' pointer to point to the correct base class when calling the method.

When calling a virtual method, the correct address of the function must be looked up in the virtual function table. The pointer to the virtual function table is stored as the first pointer in the class, i.e. you get to it by derefencing the this pointer, then you get the index into this table by dividing the virtualFunctionIndex by 4.

Of course, if the this pointer is corrupt, or if the first pointer in the class has been overwritten, for example by a buffer overflow or other memory invasion, then the function pointer retrieved from the virtual function table will be incorrect and most likely crash the application.

With what you describe it seems your problem is the latter, i.e. the this pointer is either wrong, or the pointer to the virtual function table has been overwritten. As your message callback doesn't really use the object, the crash doesn't happen when the method is not virtual.


I suggest you check the address at the first position in the scriptInterface. If the address is different when you register the message callback, and when the segv happens, then you definitely have a memory issue in your code. If that is so, you should be able to set a memory breakpoint on that address to identify where that memory issue is occurring.

[Tzarls]

Apparently this isn´t my fault

Here´s a minimal code that exhibits the same behaviour:

main.h :

#ifndef _MAIN_
#define _MAIN_
#include <cstdio>
#include <angelscript.h>
class msgClass
{
    public:
    /*virtual*/ void MessageCallback(const asSMessageInfo *msg)  // uncomment "virtual" and the app fails
    {
const char *type = "ERR ";
if( msg->type == asMSGTYPE_WARNING )
  type = "WARN";
else if( msg->type == asMSGTYPE_INFORMATION )
  type = "INFO";
printf("%s (%d, %d) : %s : %s\n", msg->section, msg->row, msg->col, type, msg->message);
}
};
#endif

main.cpp :

#include "main.h"
int main (int argc, char ** argv)
{
    msgClass *msg = new msgClass;
// Create the script engine
asIScriptEngine *engine = asCreateScriptEngine(ANGELSCRIPT_VERSION);
if( engine == 0 )
{
  printf("Failed to create script engine.\n");
  return -1;
}
engine->SetMessageCallback( asMETHOD(msgClass,MessageCallback),msg,asCALL_THISCALL );
engine->WriteMessage("My Section", 11, 38, asMSGTYPE_INFORMATION, "Testing Message Callback" );
printf ("Done!");
return 0;
}

[Andreas Jonsson]

It's good that you managed to narrow it down to this. Of course, it means there is a problem in AngelScript but I'm sure there is a solution. Hopefully it won't be too difficult to find.

[Tzarls]

Nice! If you need any help just let me know.

[Andreas Jonsson]

Thanks for the offer. I'll try to reproduce it on my mac first. If I don't succeed I'll definitely need help in figuring out how to make this work.

[Tzarls]

Hi Andreas. Any success in finding the cause of the problem?

[Andreas Jonsson]

Unfortunately I haven't had the time to look into this problem yet. I'll let you know when I do.

[Andreas Jonsson]

I've fixed this in revision 1338.

Thanks,
Andreas

[Tzarls]

Nice, thanks! Can I ask what the problem was?

[Andreas Jonsson]

One of the internal functions for calling class methods didn't have the implementation to support virtual class methods. Somehow this had gone unnoticed for many years.

Here's the diff showing what was changed.

Regards,
Andreas

[Tzarls]

FWIW, I´ve just tested this fix in my original project and it works as expected. Thanks again!