Access violation (bad reference counting, irrlicht)

Started by
12 comments, last by Khatharr 10 years, 12 months ago

Hi

My prog "crashes" (when i close it!, still works fine during running) with:

Unhandled exception at 0x1014d7af in game.exe: 0xC0000005: Access violation reading location 0xfeeefef2.

It happens when i send a string to a function. If i leave that param empty its ok. If i use a simple string like ("test") it crashes. But its only that instance of that function. I use that function with strings everywhere with no problem. Where can the problem lie?

Maybe you can answer generally, but when i close and get the error the compiler directs me to some irrlicht code, namely:

from ireferencecounter, this is what happens when i close my program:


bool drop() const
{
// someone is doing bad reference counting.
_IRR_DEBUG_BREAK_IF(ReferenceCounter <= 0)


--ReferenceCounter;
if (!ReferenceCounter)
{
delete this;
return true;
}


return false;
}
 
Advertisement

Are you sure that you don't call delete explicitly on the object?

Cheers!

Drop isnt a member function and your calling delete this? Delete what?

Just out of curiosity, does this class have a destructor? If you call Foo::drop(), and it deletes the this pointer, then at the end of the scope, it calls Foo::~Foo(), this would be undefined behavior.

Also, the 0xfeeefef2 looks suspect. I hear that Microsoft's heap allocator implementation writes 0xFEEEFEEE in the freed memory, so it seems like you are trying to access something through an offset from a pointer that had its storage freed.

Of course it's a member function, it is const (EDIT: and delete this; wouldn't compile if it was a free function). A stack trace would be nice...

"Most people think, great God will come from the sky, take away everything, and make everybody feel high" - Bob Marley

0xFEEEFEEE is indeed value to mark freed heap memory. That's why I asked if the object has been freed already elsewhere.

Can you show the calling function where you send a string a bit more? Also the function receiving the string might be useful.

Cheers!

i dont have to code now from work but it draws the string to screen. What makes it hard to understand is the function is used on other places to draw strings and works fine.
Its prob some messup with string lenght somewhere else right? I overwrite some memory and this gives that error message (mind: the program doesnt show any sign of corruption during runtime even if i provoce this error, i only see it when i close the program).

I never manually deal with the ireferencecounter its just an engine thing which i dont know what it does actually... But maybe it can hint on what im messing up.

You're dropping the object too many times or else there's a bug in your version of irrlicht which is causing the object to be released too many times.

I know irrklang has a ridiculous and invasive memory management model. It looks like that extends into the realm of irrlicht in general, since the code you posted is one of the guilty parties. When I used irrklang there were constant bugs surrounding the poorly designed memory management and when I asked the author why he was doing things so bass-ackwards he blew me off, so I ended up just switching to FMOD, which is fantastic and far easier to work with.

Basically when you create the object it has one reference. When you do certain things to it that number increases, and when you call its drop() method the number decreases. The refcounter keeps track of how many things are referring to an object and deletes the object when that number reaches zero. If you try to drop or otherwise dispose of the object after that you'll get that segfault you're getting. Read the documentation carefully to see what all changes the refcount on the stuff you're using. When you shut down irrlicht it drops a lot of stuff, so it can segfault if some of that is already released.

Or just switch to FMOD. If your sound handling is properly abstracted it should only take a small amount of effort to make the switch.

void hurrrrrrrr() {__asm sub [ebp+4],5;}

There are ten kinds of people in this world: those who understand binary and those who don't.

Im not using irrklang (already using FMOD by the way:))

This is the function that in the end causes the error (see below). If i comment out the last line (the drop) the error doesnt come up when i close the program.

But dont i need to drop it? Will they add up each time i call the function and use resources?

Thanks

Erik


void gameGFX_irr::writeWrap(int flags, float x, float y, int align, float width, const char * fmt, ...){

	x+=offsetX;
	y+=offsetY;

	bool centered=false;
	if(flags==TEXT_CENTER)
		centered=true;

	const int maxLetters=2048;

	//prep string
	char txt[maxLetters];
	va_list va;
	va_start( va, fmt );
	vsprintf( txt, fmt, va );
	va_end( va );
	core::stringw str = txt;  

	const core::stringw strw(txt);
	const wchar_t* w_str = strw.c_str(); 
	irr::gui::IGUIStaticText * myText;
	myText=myDevice->getGUIEnvironment()->addStaticText(w_str,rect2d(x,y,x+width,screenY),0,true);
	myText->enableOverrideColor(true);
	myText->setOverrideColor(TEXTCOLOR);
	myText->setOverrideFont(font);
	myText->draw();
	//myText->drop();
}

I can't quite see why you would be releasing the resource without a little more context. Do any of those function calls increment its reference counter? I can assume so, likely the addStaticText() method, which seems to return a pointer to an IGUIStaticText object with a reference count of one.

Again, does the class have a destructor?

This topic is closed to new replies.

Advertisement