Segmentation fault - void asCScriptEngine::CallObjectMethod(...)

Started by
15 comments, last by Tzarls 11 years, 10 months ago
Hi, I'm getting a segmentation fault here:


void asCScriptEngine::CallObjectMethod(...)
{
.....f(obj, param); // <- line 3373 - causes segmentation fault
}



"f" comes out with some weird value.

This function is being called by the asCScriptEngine::WriteMessage(...). I'm registering my callback function like this:

void scriptInterface::setMessageCallback(asIScriptEngine* compiler)
{
compiler->SetMessageCallback( asMETHOD(scriptInterface,MessageCallback),this,asCALL_THISCALL );
}



virtual void scriptInterface::MessageCallback(const asSMessageInfo *msg)
{
// Implement a simple message callback function
const char *type = "ERR ";
if( msg->type == asMSGTYPE_WARNING )
type = "WARN";
else if( msg->type == asMSGTYPE_INFORMATION )
type = "INFO";

printf("%s (%d, %d) : %s : %s\n", msg->section, msg->row, msg->col, type, msg->message);
}




I have the feeling that the problem is here (file angelscript.h line 1024)


// Template specialization
template <>
struct asSMethodPtr<SINGLE_PTR_SIZE>
{
template<class M>
static asSFuncPtr Convert(M Mthd)
{
asSFuncPtr p;
asMemClear(&p, sizeof(p));
asMemCopy(&p, &Mthd, SINGLE_PTR_SIZE); //<- after this, "f" (inside "p") gets wrong value
// Mark this as a class method
p.flag = 3;
return p;
}
};


To make things even weirder, everything works as expected under Windows XP. I'm getting this error under Linux (Ubuntu) - using Code::Blocks as IDE.

Any ideas?

Carlos
Advertisement
Did you try with non virtual version of MessageCallback method?
Just tried - under Linux it only works with the non-virtual version.... but under Windows it works with the virtual version too.
It might be that when taking the address of a virtual method from within the actual class GNUC is returning the method pointer in a different way.

Can you check what the difference is between the following two ways of doing it:





void global_setMessageCallback(scriptInteface *obj, asIScriptEngine * compiler)
{
compiler->SetMessageCallback( asMETHOD(scriptInterface,MessageCallback),obj,asCALL_THISCALL );
}

void scriptInterface::setMessageCallback(asIScriptEngine* compiler){ // Get the method from within the class compiler->SetMessageCallback( asMETHOD(scriptInterface,MessageCallback),this,asCALL_THISCALL ); // Get the method from a global function global_setMessageCallback(this, compiler);}


If there is a difference between these two ways of doing it, there has to be a way of identifying that difference so the call can be made correctly anyway.

AngelCode.com - game development and more - Reference DB - game developer references
AngelScript - free scripting library - BMFont - free bitmap font generator - Tower - free puzzle game

Just tried. Exactly the same behaviour. Any other idea?
Interesting..... when the callback function is not virtual, the


static asSFuncPtr Convert (M Mthd)


method (angelscript.h line 1029) is getting the Mthd value as :

(void(scriptInterface::*)(scriptInterface *const)) 0x8068370 <scriptInterface::MessageCallback(asSMessageInfo const*)>

But when the callback function is virtual (even if it hasn´t been overridden) is passed as:

&virtual scriptInterface::MessageCallback(asSMessageInfo const*)

(as reported by code::blocks IDE)

Is that ok?
On gnuc a class method pointer has the following structure


struct {
union {
void *funcPtr;
int virtualFunctionIndex;
};
int baseOffset;
};


If the method is a virtual method, then union will have its least significant bit set, i.e. (int(funcPtr) & 1) will be true, otherwise it will be false, meaning that the funcPtr is the absolute address of the function that will be called.

If the class for the method pointer doesn't have multiple base classes, the baseOffset will always be 0, otherwise it will be the offset that must be added to the 'this' pointer to point to the correct base class when calling the method.

When calling a virtual method, the correct address of the function must be looked up in the virtual function table. The pointer to the virtual function table is stored as the first pointer in the class, i.e. you get to it by derefencing the this pointer, then you get the index into this table by dividing the virtualFunctionIndex by 4.

Of course, if the this pointer is corrupt, or if the first pointer in the class has been overwritten, for example by a buffer overflow or other memory invasion, then the function pointer retrieved from the virtual function table will be incorrect and most likely crash the application.

With what you describe it seems your problem is the latter, i.e. the this pointer is either wrong, or the pointer to the virtual function table has been overwritten. As your message callback doesn't really use the object, the crash doesn't happen when the method is not virtual.


I suggest you check the address at the first position in the scriptInterface. If the address is different when you register the message callback, and when the segv happens, then you definitely have a memory issue in your code. If that is so, you should be able to set a memory breakpoint on that address to identify where that memory issue is occurring.

AngelCode.com - game development and more - Reference DB - game developer references
AngelScript - free scripting library - BMFont - free bitmap font generator - Tower - free puzzle game

Apparently this isn´t my fault :D

Here´s a minimal code that exhibits the same behaviour:

main.h :


#ifndef _MAIN_
#define _MAIN_
#include <cstdio>
#include <angelscript.h>
class msgClass
{
public:
/*virtual*/ void MessageCallback(const asSMessageInfo *msg) // uncomment "virtual" and the app fails
{
const char *type = "ERR ";
if( msg->type == asMSGTYPE_WARNING )
type = "WARN";
else if( msg->type == asMSGTYPE_INFORMATION )
type = "INFO";
printf("%s (%d, %d) : %s : %s\n", msg->section, msg->row, msg->col, type, msg->message);
}
};
#endif


main.cpp :


#include "main.h"
int main (int argc, char ** argv)
{
msgClass *msg = new msgClass;
// Create the script engine
asIScriptEngine *engine = asCreateScriptEngine(ANGELSCRIPT_VERSION);
if( engine == 0 )
{
printf("Failed to create script engine.\n");
return -1;
}
engine->SetMessageCallback( asMETHOD(msgClass,MessageCallback),msg,asCALL_THISCALL );
engine->WriteMessage("My Section", 11, 38, asMSGTYPE_INFORMATION, "Testing Message Callback" );
printf ("Done!");
return 0;
}
It's good that you managed to narrow it down to this. Of course, it means there is a problem in AngelScript but I'm sure there is a solution. Hopefully it won't be too difficult to find.

AngelCode.com - game development and more - Reference DB - game developer references
AngelScript - free scripting library - BMFont - free bitmap font generator - Tower - free puzzle game

Nice! If you need any help just let me know.

This topic is closed to new replies.

Advertisement