Sign in to follow this  
Friggle

Access to NULL-Pointer when releasing engine

Recommended Posts

Hi,

I just dropped in AngelScript 2.23.1 (as replacement for 2.23.0) and now my application crashes when I finally want to release the engine. I'm using VC9 under Win7.

When stepping down starting from the following call
[CODE]
mpEngine->Release();
[/CODE]
the code line
[CODE]
asDELETE(const_cast<asCScriptEngine*>(this),asCScriptEngine);
[/CODE]
calls the destructor of the engine:
[CODE]
asCScriptEngine::~asCScriptEngine()
[/CODE]
The last line of the destructor calls
[CODE]
asCThreadManager::Release();
[/CODE]
which tries to lock a crit section object:
[CODE]
void asCThreadCriticalSection::Enter()
{
#if defined AS_POSIX_THREADS
pthread_mutex_lock(&criticalSection);
#elif defined AS_WINDOWS_THREADS
EnterCriticalSection(&criticalSection);
#endif
}
[/CODE]
The pointer '&criticalSection' is NULL, that's where the code crashes.

Any ideas to this?

Many thanks and regards,
Thomas Edited by Andreas Jonsson

Share this post


Link to post
Share on other sites
Here's some additional info:

When entering the code
[CODE]
void asCThreadManager::Release()
{
// It's necessary to protect this section so no
// other thread attempts to call AddRef or Release
// while clean up is in progress.
ENTERCRITICALSECTION(criticalSection);
if( --threadManager->refCount == 0 )
{
// The last engine has been destroyed, so we
// need to delete the thread manager as well
asDELETE(threadManager,asCThreadManager);
threadManager = 0;
}
LEAVECRITICALSECTION(criticalSection);
}
[/CODE]
The expression threadManager->refCount is 1 which seems to be plausible to me.
When looking at the section where the (static) instance of the csritical section should be created:
[CODE]
#ifndef AS_NO_THREADS
static DECLARECRITICALSECTION(criticalSection)
#endif
[/CODE]
It seems that I do not define 'AS_NO_THREADS', i.e. this should be fine, too.
Still, the static 'criticalSection' can't be resolved by the debugger...

Share this post


Link to post
Share on other sites
Do you use multiple script engines in parallel? Perhaps this is what triggers the problem.

When you debug you need to check in which scope you're looking at the criticalSection. The global static criticalSection is of the type asCThreadCriticalSection. That class in itself as a member also called criticalSection (poorly named, I know). It is possible the debugger is seeing one or the other depending on where you're checking.

Share this post


Link to post
Share on other sites
[quote]Do you use multiple script engines in parallel? Perhaps this is what triggers the problem.[/quote]
No, I'm just using one single script engine instance, created through the following code:
[CODE]
mpEngine = asCreateScriptEngine(ANGELSCRIPT_VERSION);
[/CODE]
I'll check again with the scope of the criticalSection during the debug session and post again.

Regards,
Thomas

Share this post


Link to post
Share on other sites
I checked in a minor change in 1291 where I renamed the criticalSections. The global one is now prefixed with 'g_' and the member is prefixed with 'm_'.

I made a test with multiple engines, but it seems to be working properly too.

Share this post


Link to post
Share on other sites
OK, here's some more information:
I renamed the global criticalSection object (statically allocated in as_Thread.cpp) to 'gCriticalSection'.
In the following code:
[CODE]
void asCThreadCriticalSection::Enter()
{
#if defined AS_POSIX_THREADS
pthread_mutex_lock(&criticalSection);
#elif defined AS_WINDOWS_THREADS
EnterCriticalSection(&criticalSection);
#endif
}
[/CODE]
I have a breakpoint on the 'ENterCriticalSection...' line.
My watch window output is attached.
Does that help?

Thanks so much and regards,
Thomas

Share this post


Link to post
Share on other sites
OK, we had the same idea it seems... Anyway, I guess there's no much use trying your renamed version, too?
Regards,
Thomas

Share this post


Link to post
Share on other sites
One more observation:
The criticalSection member is initialized during the constructor of asCThreadCriticalSection:
[CODE]
#ifndef AS_NO_THREADS
asCThreadCriticalSection::asCThreadCriticalSection()
{
#if defined AS_POSIX_THREADS
pthread_mutex_init(&criticalSection, 0);
#elif defined AS_WINDOWS_THREADS
InitializeCriticalSection(&criticalSection);
#endif
}
[/CODE]
For the global gCriticalSection there is no call to 'InitializeCriticalSection(...)'. Could this be an issue?

Regards,
Thomas

Share this post


Link to post
Share on other sites
Not yet. I haven't done any fixes in the new revision.

But there is definitely something wrong. When I set a breakpoint on EnterCriticalSection in my test bed I get the following values in the member criticalSection:

DebugInfo -> address of an object that holds valid information
LockCount -> -1

The rest of the members are 0.

It looks like the criticalSection in your application has somehow become corrupt. Probably some memory invasion that overwrote the global memory.

I suggest setting a memory break point on the gCriticalSection->criticalSection->DebugInfo to see when the address changes. It should only change once, when the InitializeCriticalSection() is called on start up.

Share this post


Link to post
Share on other sites
[quote name='Friggle' timestamp='1335902440' post='4936504']
One more observation:
The criticalSection member is initialized during the constructor of asCThreadCriticalSection:
[CODE]
#ifndef AS_NO_THREADS
asCThreadCriticalSection::asCThreadCriticalSection()
{
#if defined AS_POSIX_THREADS
pthread_mutex_init(&criticalSection, 0);
#elif defined AS_WINDOWS_THREADS
InitializeCriticalSection(&criticalSection);
#endif
}
[/CODE]
For the global gCriticalSection there is no call to 'InitializeCriticalSection(...)'. Could this be an issue?

Regards,
Thomas
[/quote]

It is the constructor of the global gCriticalSection that calls InitializeCriticalSection() on the member.

Share this post


Link to post
Share on other sites
[quote]It is the constructor of the global gCriticalSection that calls InitializeCriticalSection() on the member.[/quote]
Certainly, I mixed it up again with the struct CRITICAL_SECTION. Seems it's too late today already, I'm getting numb ;-)

I'll post again when I have news from the memory breakpoint.

Share this post


Link to post
Share on other sites
[quote]When I set a breakpoint on EnterCriticalSection in my test bed I get the following values in the member criticalSection:[/quote]
Did you also try to enable the breakpoint only after the last line of the desctructor of asCScriptEngine has been reached:
[CODE]
asCThreadManager::Release();
[/CODE]
Only in this case I got the strange values and the crash. All preceding calls go fine.

Share this post


Link to post
Share on other sites
I think now I know what to look at a bit closer:
I've incorporated the AngelScript engine in a class that is a Singleton and which is itself statically allocated. During this classes' destructor the mpEngine->Release() call is made. I guess at this point the also statically allocated asCThreadCriticalSection object (gCriticalSection) is already dead... Simply a question of the order of destructor calls by the compiler, possibly. I'll look into this some more and probably may decide to call the Release() method somewhere else, i.e. earlier.

Regards,
Thomas

Share this post


Link to post
Share on other sites
ah.

Do you by any chance keep the engine pointer in a singleton, i.e. a global object where the destructor of that object is the one that releases the engine? If that is so, it might be that the destructor of the global critical section has been called before the destructor of your singleton, which would explain why you get the crash.

Share this post


Link to post
Share on other sites
:)

We came to the same conclusion at the same time. I remember seeing this before in an earlier version of AngelScript where I had also allocated the thread manager globally, and the same kind of crashes happened for others who like you stored the engine in a singleton.

I'll have to find a way to avoid storing the critical section in the global memory. It has to be created with the first engine instance and destroyed with the last one. The problem will just be in how to do this in a multithreaded environment where multiple engines might get created at the same time.

Share this post


Link to post
Share on other sites
I've removed the global criticalSection in revision 1293, it is now a member of the thread manager instead. You should no longer face the crash with this version.

For version 2.24.0 I'll add two new global functions to deal with the problem that led me to create the global criticalSection in the first place. These new global functions will only be required for those applications that uses multiple engines in multiple threads, so most projects will probably not even need to know about them.

Share this post


Link to post
Share on other sites
Perfect, just tried out rev 1293 and the crash is gone.

Many thanks again for the great and super fast support!

Regards,
Thomas

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this