[Unity] Bug: 2.x IL2CPP模式，iOS平台随机闪退 #1563
Comments
|
这个栈看上去像是哪里写坏内存了，越界或者free后写，把内存分配器的数据写坏了。后续分配内存的时候访问到坏的数据崩溃了。这也和你描述的问题随机比较吻合：搞坏的内存是随机的，malloc只是其中一个地方。 |
有什么工具能方便得定位到写坏内存的地方吗？ |
|
-> applicationWillResignActive() TypeError: Cannot read properties of undefined (reading 'audioPlayer') -> applicationDidBecomeActive()==5282==ERROR: AddressSanitizer: heap-use-after-free on address 0x0002ae4a1da0 at pc 0x0001756912ac bp 0x00016ee53ae0 sp 0x00016ee53ad8 0x0002ae4a1da0 is located 0 bytes inside of 12-byte region [0x0002ae4a1da0,0x0002ae4a1dac) previously allocated by thread T0 here: SUMMARY: AddressSanitizer: heap-use-after-free (/private/var/containers/Bundle/Application/AF36B216-2599-4010-8E6F-18BB8BD9DF41/ProductName.app/Frameworks/UnityFramework.framework/UnityFramework:arm64+0x68392a8) in Vector3_Set_m1C7E543216734FB513F9CEBA44C50E6FC2AFD49D+0x84 |
|
看你发的栈上十分可能是这样的场景： ue中也有业务碰到类似的情况，ue的puerts提供了一个LinkOuter功能（默认关闭），打开后访问一个对象的字段，如果是复杂类型（对应的是c#的值类型），会设置返回的js字段的对象的0号字段指向外层，这样字段不释放，其外层对象也不会释放。 |
|
在awake中，我创建了一个js的class，posTemp就会实例化，然后，不知道什么原因，马上就释放了，我看前半段堆栈式一样的，这个地方就是创建完马上释放。然后我在update的时候，访问了已经释放的posTemp |
|
这个类的实例我是通过c#访问js的函数创建的，然后再将这个实例赋值到c#的一个属性上来持有。这样的方式是否有问题？ |
由于github只能上传25M文件，无法在这里发送demo，我已经把可重现的demo发给僵尸杨了，能否提供一下邮箱或qq或微信，我把demo发你一份 |
|
看代码好像处理有问题。 值类型而且没有参数的话，不抛异常 if (!(isValueType && pesapi_get_args_len(info) == 0))
pesapi_throw_by_string(info, "invalid arguments");但往下走，发现值类型就delete了。 if(Class::IsValuetype(classInfo->Class))
{
ValueTypeFree(Ptr);
}ps：还有个小问题，前面都有isValueType，这就不用重新判断了 @zombieyang 确认下 |
* [unreal]添加UE、CPP全局变量，见： Tencent#1526 * [unity] fix Tencent#1520 * [unreal]继承ue类支持esm（*.mts) * [unreal]去掉多余逻辑 * [unreal]5.3下兼容性更好的写法 * [unreal]解决Linux平台因为文件名大小写而导致编译错误并且修改uplugin版本描述 (Tencent#1524) * [unreal]防止toManualReleaseDelegate传给多个不同签名的回调，导致后面的参数处理错误 * [unreal]静态绑定添加从Function数据获取this的选项：GetSelfFromData * [unreal]简化逻辑 * [unreal]js分配的容器，在关闭JsEnv时可能会有内存泄露，fix Tencent#1530 * [unreal]上个提交漏了一个文件 * [unity] fix Tencent#1532 * Revert "[unity] fix Tencent#1532" This reverts commit 3fc1e0d. * [unreal]默认打开UE绕行优化 fix Tencent#1537 * [unreal]SparseDelegate通过Add(Object, string)不生效，fix Tencent#1538 * low unity compat * [unreal]UStruct 析构可能发生在后台线程 fix Tencent#1539 * [unity] fix Tencent#1541 * [unity] fix Tencent#1540 * [unity] fixes for previous commit * Revert "[unity] fixes for previous commit" This reverts commit a56fbcd. * Revert "[unity] fix Tencent#1540" This reverts commit c6a62dc. * [unity] fix Tencent#1540 * [unreal]新方案中，clear delegate时应该用Delete * [unreal]更新backend链接 * [unreal]属性的meta在ts删除了，生成蓝图要同步删除，fix Tencent#1551 * [unreal]静态绑定添加MethodProxy，PropertyProxy fix Tencent#1553 * [unreal]puerts::Object尝试添加SetWeakAndOwnBy方法 * [unreal]update qjs backend link * [unreal]重构，移除多余的头文件 * [unreal]重构：删除多余的TypeScriptObject类 * [unreal]重构，添加必要的头文件 * [unreal]容器添加[Symbol.iterator]支持 (Tencent#1555) * container support iterator * fix indent * add type stub * dummy call to inject iterators into prototype * [unreal]支持quickjs backend自定义v8名字空间 * [unreal]支持quickjs backend自定义v8名字空间(补充上个提交) * [unreal]名字空间后缀功能的重构 * [unreal]支持在puerts名字空间加个_qjs后缀，fix Tencent#1557 * [unity]修复名字空间后缀功能导致unity build失败 * [unreal]属性获取GetArg改为API::GetArg，之前的遗漏 * [unreal]Fix the link of UsingMixin.ts (Tencent#1561) * [pesapi]发现第三方实现pesapi对几个api产生误解，审视名字确实不太恰当，改下名字 * [pesapi]修改api名字以及参数名，改进可读性 * [pesapi]添加可选的pesapi_holder_set_weak_set_owner，用于手动解决循环引用问题 * Update Utils.cs fix Tencent#1565 * [pesapi]修改几个api的名字，让可读性更强些 * [pesapi]新增的api拆成两个 * [pesapi]注释调整 * [pesapi]自动化生成puerts_libs的脚本 * [pesapi]api重命名后，宏没有修改 * [unreal]Free POD UStruct on Worker Thread. Fix Tencent#1539 (Tencent#1576) * arraybuffer for pod struct * make clang-format happy * [unreal]add v8 9.4 link * [unreal]ClearDelegate可能留下undefined元素，GenListApply时会出错 (Tencent#1578) * Update README.md * [unreal]Fix the children ptr in UJsGeneratedClass::Restore (Tencent#1579) * [unreal]解决pesapi addon间引用有可能出现同一类type_id不一致的情况，fix Tencent#1581 * [unreal]FJsObject析构时加入JsEnv生命周期的判断，fix Tencent#1582 * [unity] add warning * [unity] invoke GenericDelegate.Close when JsEnv is disposing * [unreal]支持在被绑定的C++代码中抛js异常（默认关闭，需要通过定义WITH_JS_THROW_IN_CPP打开） * [unreal]优化上个commit * [unity] fix Tencent#1563 * [unreal]c++抛js异常添加std::exception方式(默认方式) * [unity] always generate System.Type in dts * Update README.md * [unreal]支C++构造函数中抛js异常 * [unity] fix bug in 91185ba * [unity] move generate menu into Tools/ to follow the rules of AssetsStore * [unity] reuse variable * [unity] changelog for 2.0.3 * [unity] update GenerateMenu command's path in doc * [unreal]声明生成排除PropertyMetaRoot * [unreal]文档补充 * [unreal]FobjectCacheNode的operator=漏了UserData (Tencent#1590) * [unreal] require先赋值module，异常后才清理 fix: Tencent#1571 (Tencent#1583) * Try to fix: Tencent#1571 If a require recursion it self, may into infinite loop. * re-throw the exception when require met an error~ --------- Co-authored-by: songfeiyu.1986 <songfeiyu.1986@bytedance.com> * [unreal]V8Object.hpp加上线程安全支持 * [unreal]v8 11版本api的兼容，该版本的SetAccessorProperty要求如果FunctionTemplate不为空，函数指针就不能nullptr * [unreal]puerts::ThrowException在使用std::exception方式也能使用 * [unreal]静态绑定不仅限于js，所以异常打开相关宏去掉JS单词 * [unreal]解决开启异常特性后，mac下的编译错误 * [unreal]fix compile error on macOS arm64 with QuickJS (Tencent#1595) Co-authored-by: admin <admin@macos.com> * [unreal]添加能避免不同模块引用同一个类typeid不同的问题，fix Tencent#1596 * [unreal]replace bare v8 string conversion call with wrapper functions (Tencent#1597) * replace bare v8 string conversion call with wrapper functions * clang-format * [unity]解决xil2cpp下，值类型无参构造字段为随机值的问题 --------- Co-authored-by: johnche <johnche@tencent.com> Co-authored-by: zombieyang(杨浩) <zombieyang@tencent.com> Co-authored-by: bluerose <378100977@qq.com> Co-authored-by: unknown <348063288@qq.com> Co-authored-by: BlurryLight <14940338+BlurryLight@users.noreply.github.com> Co-authored-by: eranfu <1119369173@qq.com> Co-authored-by: 森雨Plus <morirain@outlook.com> Co-authored-by: WatsonSong <watsonsong@foxmail.com> Co-authored-by: songfeiyu.1986 <songfeiyu.1986@bytedance.com> Co-authored-by: meilaopo <59859171+meilaopo@users.noreply.github.com> Co-authored-by: admin <admin@macos.com>
前置阅读 | Pre-reading
Puer的版本 | Puer Version
2.x
Unity的版本 | Unity Version
2021.3.8f1
发生在哪个平台 | Platform
Editor(mac)
错误信息 | Error Message
2.x IL2CPP模式，iOS平台随机闪退
进入游戏加载，操作等都有可能闪退。
闪退的堆栈有时候在主线程，有时候在其它线程，完全随机。
每次闪退时，主线程都有 puerts 和 v8 相关调用堆栈。
崩溃的线程都崩溃在malloc操作。
另外，android IL2CPP模式 和 iOS 普通模式，都是正常的。
thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
frame #0: 0x00000001dea79158 libsystem_kernel.dylib
__pthread_kill + 8 frame #1: 0x00000001edeff5f8 libsystem_pthread.dylibpthread_kill + 208frame #2: 0x00000001aae904b8 libsystem_c.dylib
abort + 124 frame #3: 0x00000001b17980b8 libsystem_malloc.dylibmalloc_vreport + 904frame #4: 0x00000001b1798330 libsystem_malloc.dylib
malloc_zone_error + 100 frame #5: 0x00000001b178c26c libsystem_malloc.dylibnanov2_guard_corruption_detected + 40frame #6: 0x00000001b178b7b0 libsystem_malloc.dylib
nanov2_allocate_outlined + 344 frame #7: 0x00000001b1782a54 libsystem_malloc.dylib_malloc_zone_memalign + 228frame #8: 0x00000001b1783f58 libsystem_malloc.dylib
posix_memalign + 36 frame #9: 0x000000010f38bff4 UnityFrameworkIphoneNewLabelAllocator::Allocate(unsigned long, int) + 60frame #10: 0x000000010f384204 UnityFramework
MemoryManager::Allocate(unsigned long, unsigned long, MemLabelId const&, AllocateOptions, char const*, int) + 404 frame #11: 0x000000011115cad8 UnityFrameworkpuerts::w_S_r4r4r4_tr4r4r4(void*, void ()(), v8::FunctionCallbackInfov8::Value const&, bool, puerts::WrapData) + 628frame #12: 0x000000010f1a65a4 UnityFramework
puerts::MethodCallback(pesapi_callback_info__*) + 68 frame #13: 0x0000000110604450 UnityFrameworkv8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo) + 336frame #14: 0x0000000110603a14 UnityFramework
v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) + 480 frame #15: 0x00000001106031b0 UnityFrameworkv8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) + 260frame #16: 0x00000001104e742c UnityFramework
Builtins_RecordWriteEmitRememberedSetSaveFP + 494636 frame #17: 0x000000011047a618 UnityFrameworkBuiltins_RecordWriteEmitRememberedSetSaveFP + 48664frame #18: 0x000000011047a618 UnityFramework
Builtins_RecordWriteEmitRememberedSetSaveFP + 48664 frame #19: 0x000000011047a618 UnityFrameworkBuiltins_RecordWriteEmitRememberedSetSaveFP + 48664frame #20: 0x000000011047840c UnityFramework
Builtins_RecordWriteEmitRememberedSetSaveFP + 39948 frame #21: 0x00000001104780a4 UnityFrameworkBuiltins_RecordWriteEmitRememberedSetSaveFP + 39076frame #22: 0x00000001106a49c8 UnityFramework
v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) + 2564 frame #23: 0x00000001106a3f90 UnityFrameworkv8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handlev8::internal::Object, v8::internal::Handlev8::internal::Object, int, v8::internal::Handlev8::internal::Object) + 212frame #24: 0x00000001105bf740 UnityFramework
v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) + 868 frame #25: 0x0000000110f3d078 UnityFrameworkpuerts::b_v(void, void*) + 216frame #26: 0x0000000111aaf058 UnityFramework
GameManager_Update_m16DD408C53DB26CB8EED50A60449BB030630872E + 540 frame #27: 0x00000001104397c0 UnityFrameworkil2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**) + 100frame #28: 0x0000000110439620 UnityFramework
il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**) + 84 frame #29: 0x000000010f65bba4 UnityFrameworkscripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool) + 112frame #30: 0x000000010f66ac94 UnityFramework
ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool) + 140 frame #31: 0x000000010f67bb44 UnityFrameworkMonoBehaviour::CallUpdateMethod(int) + 272frame #32: 0x000000010f3cc5a4 UnityFramework
void BaseBehaviourManager::CommonUpdate<BehaviourManager>() + 228 frame #33: 0x000000010f3cc46c UnityFrameworkBehaviourManager::Update() + 36frame #34: 0x000000010f4bec6c UnityFramework
InitPlayerLoopCallbacks()::UpdateScriptRunBehaviourUpdateRegistrator::Forward() + 80 frame #35: 0x000000010f4bf890 UnityFrameworkExecutePlayerLoop(NativePlayerLoopSystem*) + 100frame #36: 0x000000010f4bf8d0 UnityFramework
ExecutePlayerLoop(NativePlayerLoopSystem*) + 164 frame #37: 0x000000010f4bfbbc UnityFrameworkPlayerLoop() + 316frame #38: 0x000000010fe4f954 UnityFramework
UnityPlayerLoopImpl(bool) + 116 frame #39: 0x000000010ef78710 UnityFramework-[UnityAppController(Rendering) repaint] + 84frame #40: 0x00000001a54eacb0 QuartzCore
CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 832 frame #41: 0x00000001a54fa44c QuartzCoredisplay_timer_callback(__CFMachPort*, void*, long, void*) + 368frame #42: 0x00000001a4098e64 CoreFoundation
__CFMachPortPerform + 172 frame #43: 0x00000001a40b4020 CoreFoundationCFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION + 56frame #44: 0x00000001a40b5c34 CoreFoundation
__CFRunLoopDoSource1 + 512 frame #45: 0x00000001a40997c4 CoreFoundation__CFRunLoopRun + 2332frame #46: 0x00000001a409dda0 CoreFoundation
CFRunLoopRunSpecific + 584 frame #47: 0x00000001db39b998 GraphicsServicesGSEventRunModal + 160frame #48: 0x00000001a6332fd8 UIKitCore
-[UIApplication _run] + 868 frame #49: 0x00000001a6332c50 UIKitCoreUIApplicationMain + 312frame #50: 0x000000010ef78370 UnityFramework`-[UnityFramework runUIApplicationMainWithArgc:argv:] + 92
main(argc=<unavailable>, argv=<unavailable>) at main.mm:26:9 [opt] frame #52: 0x00000001c17f3344 dyldstart + 1860问题重现 | Bug reproduce
项目复杂度越高越容易出现，大概率出现在操作C#对象时。
iPhone X 出现的概率是明显低于iPhone 13pro 和14pro。
在高频操作下，快时候30秒就能出现，慢的时5分钟肯定能复现。
The text was updated successfully, but these errors were encountered: