-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Unity] Bug: 2.x IL2CPP模式,iOS平台随机闪退 #1563
Comments
这个栈看上去像是哪里写坏内存了,越界或者free后写,把内存分配器的数据写坏了。后续分配内存的时候访问到坏的数据崩溃了。这也和你描述的问题随机比较吻合:搞坏的内存是随机的,malloc只是其中一个地方。 |
有什么工具能方便得定位到写坏内存的地方吗? |
-> applicationWillResignActive() TypeError: Cannot read properties of undefined (reading 'audioPlayer') -> applicationDidBecomeActive()==5282==ERROR: AddressSanitizer: heap-use-after-free on address 0x0002ae4a1da0 at pc 0x0001756912ac bp 0x00016ee53ae0 sp 0x00016ee53ad8 0x0002ae4a1da0 is located 0 bytes inside of 12-byte region [0x0002ae4a1da0,0x0002ae4a1dac) previously allocated by thread T0 here: SUMMARY: AddressSanitizer: heap-use-after-free (/private/var/containers/Bundle/Application/AF36B216-2599-4010-8E6F-18BB8BD9DF41/ProductName.app/Frameworks/UnityFramework.framework/UnityFramework:arm64+0x68392a8) in Vector3_Set_m1C7E543216734FB513F9CEBA44C50E6FC2AFD49D+0x84 |
看你发的栈上十分可能是这样的场景: ue中也有业务碰到类似的情况,ue的puerts提供了一个LinkOuter功能(默认关闭),打开后访问一个对象的字段,如果是复杂类型(对应的是c#的值类型),会设置返回的js字段的对象的0号字段指向外层,这样字段不释放,其外层对象也不会释放。 |
这个类的实例我是通过c#访问js的函数创建的,然后再将这个实例赋值到c#的一个属性上来持有。这样的方式是否有问题? |
由于github只能上传25M文件,无法在这里发送demo,我已经把可重现的demo发给僵尸杨了,能否提供一下邮箱或qq或微信,我把demo发你一份 |
看代码好像处理有问题。 值类型而且没有参数的话,不抛异常 if (!(isValueType && pesapi_get_args_len(info) == 0))
pesapi_throw_by_string(info, "invalid arguments"); 但往下走,发现值类型就delete了。 if(Class::IsValuetype(classInfo->Class))
{
ValueTypeFree(Ptr);
} ps:还有个小问题,前面都有isValueType,这就不用重新判断了 @zombieyang 确认下 |
* [unreal]添加UE、CPP全局变量,见: Tencent#1526 * [unity] fix Tencent#1520 * [unreal]继承ue类支持esm(*.mts) * [unreal]去掉多余逻辑 * [unreal]5.3下兼容性更好的写法 * [unreal]解决Linux平台因为文件名大小写而导致编译错误并且修改uplugin版本描述 (Tencent#1524) * [unreal]防止toManualReleaseDelegate传给多个不同签名的回调,导致后面的参数处理错误 * [unreal]静态绑定添加从Function数据获取this的选项:GetSelfFromData * [unreal]简化逻辑 * [unreal]js分配的容器,在关闭JsEnv时可能会有内存泄露,fix Tencent#1530 * [unreal]上个提交漏了一个文件 * [unity] fix Tencent#1532 * Revert "[unity] fix Tencent#1532" This reverts commit 3fc1e0d. * [unreal]默认打开UE绕行优化 fix Tencent#1537 * [unreal]SparseDelegate通过Add(Object, string)不生效,fix Tencent#1538 * low unity compat * [unreal]UStruct 析构可能发生在后台线程 fix Tencent#1539 * [unity] fix Tencent#1541 * [unity] fix Tencent#1540 * [unity] fixes for previous commit * Revert "[unity] fixes for previous commit" This reverts commit a56fbcd. * Revert "[unity] fix Tencent#1540" This reverts commit c6a62dc. * [unity] fix Tencent#1540 * [unreal]新方案中,clear delegate时应该用Delete * [unreal]更新backend链接 * [unreal]属性的meta在ts删除了,生成蓝图要同步删除,fix Tencent#1551 * [unreal]静态绑定添加MethodProxy,PropertyProxy fix Tencent#1553 * [unreal]puerts::Object尝试添加SetWeakAndOwnBy方法 * [unreal]update qjs backend link * [unreal]重构,移除多余的头文件 * [unreal]重构:删除多余的TypeScriptObject类 * [unreal]重构,添加必要的头文件 * [unreal]容器添加[Symbol.iterator]支持 (Tencent#1555) * container support iterator * fix indent * add type stub * dummy call to inject iterators into prototype * [unreal]支持quickjs backend自定义v8名字空间 * [unreal]支持quickjs backend自定义v8名字空间(补充上个提交) * [unreal]名字空间后缀功能的重构 * [unreal]支持在puerts名字空间加个_qjs后缀,fix Tencent#1557 * [unity]修复名字空间后缀功能导致unity build失败 * [unreal]属性获取GetArg改为API::GetArg,之前的遗漏 * [unreal]Fix the link of UsingMixin.ts (Tencent#1561) * [pesapi]发现第三方实现pesapi对几个api产生误解,审视名字确实不太恰当,改下名字 * [pesapi]修改api名字以及参数名,改进可读性 * [pesapi]添加可选的pesapi_holder_set_weak_set_owner,用于手动解决循环引用问题 * Update Utils.cs fix Tencent#1565 * [pesapi]修改几个api的名字,让可读性更强些 * [pesapi]新增的api拆成两个 * [pesapi]注释调整 * [pesapi]自动化生成puerts_libs的脚本 * [pesapi]api重命名后,宏没有修改 * [unreal]Free POD UStruct on Worker Thread. Fix Tencent#1539 (Tencent#1576) * arraybuffer for pod struct * make clang-format happy * [unreal]add v8 9.4 link * [unreal]ClearDelegate可能留下undefined元素,GenListApply时会出错 (Tencent#1578) * Update README.md * [unreal]Fix the children ptr in UJsGeneratedClass::Restore (Tencent#1579) * [unreal]解决pesapi addon间引用有可能出现同一类type_id不一致的情况,fix Tencent#1581 * [unreal]FJsObject析构时加入JsEnv生命周期的判断,fix Tencent#1582 * [unity] add warning * [unity] invoke GenericDelegate.Close when JsEnv is disposing * [unreal]支持在被绑定的C++代码中抛js异常(默认关闭,需要通过定义WITH_JS_THROW_IN_CPP打开) * [unreal]优化上个commit * [unity] fix Tencent#1563 * [unreal]c++抛js异常添加std::exception方式(默认方式) * [unity] always generate System.Type in dts * Update README.md * [unreal]支C++构造函数中抛js异常 * [unity] fix bug in 91185ba * [unity] move generate menu into Tools/ to follow the rules of AssetsStore * [unity] reuse variable * [unity] changelog for 2.0.3 * [unity] update GenerateMenu command's path in doc * [unreal]声明生成排除PropertyMetaRoot * [unreal]文档补充 * [unreal]FobjectCacheNode的operator=漏了UserData (Tencent#1590) * [unreal] require先赋值module,异常后才清理 fix: Tencent#1571 (Tencent#1583) * Try to fix: Tencent#1571 If a require recursion it self, may into infinite loop. * re-throw the exception when require met an error~ --------- Co-authored-by: songfeiyu.1986 <songfeiyu.1986@bytedance.com> * [unreal]V8Object.hpp加上线程安全支持 * [unreal]v8 11版本api的兼容,该版本的SetAccessorProperty要求如果FunctionTemplate不为空,函数指针就不能nullptr * [unreal]puerts::ThrowException在使用std::exception方式也能使用 * [unreal]静态绑定不仅限于js,所以异常打开相关宏去掉JS单词 * [unreal]解决开启异常特性后,mac下的编译错误 * [unreal]fix compile error on macOS arm64 with QuickJS (Tencent#1595) Co-authored-by: admin <admin@macos.com> * [unreal]添加能避免不同模块引用同一个类typeid不同的问题,fix Tencent#1596 * [unreal]replace bare v8 string conversion call with wrapper functions (Tencent#1597) * replace bare v8 string conversion call with wrapper functions * clang-format * [unity]解决xil2cpp下,值类型无参构造字段为随机值的问题 --------- Co-authored-by: johnche <johnche@tencent.com> Co-authored-by: zombieyang(杨浩) <zombieyang@tencent.com> Co-authored-by: bluerose <378100977@qq.com> Co-authored-by: unknown <348063288@qq.com> Co-authored-by: BlurryLight <14940338+BlurryLight@users.noreply.github.com> Co-authored-by: eranfu <1119369173@qq.com> Co-authored-by: 森雨Plus <morirain@outlook.com> Co-authored-by: WatsonSong <watsonsong@foxmail.com> Co-authored-by: songfeiyu.1986 <songfeiyu.1986@bytedance.com> Co-authored-by: meilaopo <59859171+meilaopo@users.noreply.github.com> Co-authored-by: admin <admin@macos.com>
前置阅读 | Pre-reading
Puer的版本 | Puer Version
2.x
Unity的版本 | Unity Version
2021.3.8f1
发生在哪个平台 | Platform
Editor(mac)
错误信息 | Error Message
2.x IL2CPP模式,iOS平台随机闪退
进入游戏加载,操作等都有可能闪退。
闪退的堆栈有时候在主线程,有时候在其它线程,完全随机。
每次闪退时,主线程都有 puerts 和 v8 相关调用堆栈。
崩溃的线程都崩溃在malloc操作。
另外,android IL2CPP模式 和 iOS 普通模式,都是正常的。
thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
frame #0: 0x00000001dea79158 libsystem_kernel.dylib
__pthread_kill + 8 frame #1: 0x00000001edeff5f8 libsystem_pthread.dylib
pthread_kill + 208frame #2: 0x00000001aae904b8 libsystem_c.dylib
abort + 124 frame #3: 0x00000001b17980b8 libsystem_malloc.dylib
malloc_vreport + 904frame #4: 0x00000001b1798330 libsystem_malloc.dylib
malloc_zone_error + 100 frame #5: 0x00000001b178c26c libsystem_malloc.dylib
nanov2_guard_corruption_detected + 40frame #6: 0x00000001b178b7b0 libsystem_malloc.dylib
nanov2_allocate_outlined + 344 frame #7: 0x00000001b1782a54 libsystem_malloc.dylib
_malloc_zone_memalign + 228frame #8: 0x00000001b1783f58 libsystem_malloc.dylib
posix_memalign + 36 frame #9: 0x000000010f38bff4 UnityFramework
IphoneNewLabelAllocator::Allocate(unsigned long, int) + 60frame #10: 0x000000010f384204 UnityFramework
MemoryManager::Allocate(unsigned long, unsigned long, MemLabelId const&, AllocateOptions, char const*, int) + 404 frame #11: 0x000000011115cad8 UnityFramework
puerts::w_S_r4r4r4_tr4r4r4(void*, void ()(), v8::FunctionCallbackInfov8::Value const&, bool, puerts::WrapData) + 628frame #12: 0x000000010f1a65a4 UnityFramework
puerts::MethodCallback(pesapi_callback_info__*) + 68 frame #13: 0x0000000110604450 UnityFramework
v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo) + 336frame #14: 0x0000000110603a14 UnityFramework
v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) + 480 frame #15: 0x00000001106031b0 UnityFramework
v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) + 260frame #16: 0x00000001104e742c UnityFramework
Builtins_RecordWriteEmitRememberedSetSaveFP + 494636 frame #17: 0x000000011047a618 UnityFramework
Builtins_RecordWriteEmitRememberedSetSaveFP + 48664frame #18: 0x000000011047a618 UnityFramework
Builtins_RecordWriteEmitRememberedSetSaveFP + 48664 frame #19: 0x000000011047a618 UnityFramework
Builtins_RecordWriteEmitRememberedSetSaveFP + 48664frame #20: 0x000000011047840c UnityFramework
Builtins_RecordWriteEmitRememberedSetSaveFP + 39948 frame #21: 0x00000001104780a4 UnityFramework
Builtins_RecordWriteEmitRememberedSetSaveFP + 39076frame #22: 0x00000001106a49c8 UnityFramework
v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) + 2564 frame #23: 0x00000001106a3f90 UnityFramework
v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handlev8::internal::Object, v8::internal::Handlev8::internal::Object, int, v8::internal::Handlev8::internal::Object) + 212frame #24: 0x00000001105bf740 UnityFramework
v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) + 868 frame #25: 0x0000000110f3d078 UnityFramework
puerts::b_v(void, void*) + 216frame #26: 0x0000000111aaf058 UnityFramework
GameManager_Update_m16DD408C53DB26CB8EED50A60449BB030630872E + 540 frame #27: 0x00000001104397c0 UnityFramework
il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**) + 100frame #28: 0x0000000110439620 UnityFramework
il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**) + 84 frame #29: 0x000000010f65bba4 UnityFramework
scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool) + 112frame #30: 0x000000010f66ac94 UnityFramework
ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool) + 140 frame #31: 0x000000010f67bb44 UnityFramework
MonoBehaviour::CallUpdateMethod(int) + 272frame #32: 0x000000010f3cc5a4 UnityFramework
void BaseBehaviourManager::CommonUpdate<BehaviourManager>() + 228 frame #33: 0x000000010f3cc46c UnityFramework
BehaviourManager::Update() + 36frame #34: 0x000000010f4bec6c UnityFramework
InitPlayerLoopCallbacks()::UpdateScriptRunBehaviourUpdateRegistrator::Forward() + 80 frame #35: 0x000000010f4bf890 UnityFramework
ExecutePlayerLoop(NativePlayerLoopSystem*) + 100frame #36: 0x000000010f4bf8d0 UnityFramework
ExecutePlayerLoop(NativePlayerLoopSystem*) + 164 frame #37: 0x000000010f4bfbbc UnityFramework
PlayerLoop() + 316frame #38: 0x000000010fe4f954 UnityFramework
UnityPlayerLoopImpl(bool) + 116 frame #39: 0x000000010ef78710 UnityFramework
-[UnityAppController(Rendering) repaint] + 84frame #40: 0x00000001a54eacb0 QuartzCore
CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 832 frame #41: 0x00000001a54fa44c QuartzCore
display_timer_callback(__CFMachPort*, void*, long, void*) + 368frame #42: 0x00000001a4098e64 CoreFoundation
__CFMachPortPerform + 172 frame #43: 0x00000001a40b4020 CoreFoundation
CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION + 56frame #44: 0x00000001a40b5c34 CoreFoundation
__CFRunLoopDoSource1 + 512 frame #45: 0x00000001a40997c4 CoreFoundation
__CFRunLoopRun + 2332frame #46: 0x00000001a409dda0 CoreFoundation
CFRunLoopRunSpecific + 584 frame #47: 0x00000001db39b998 GraphicsServices
GSEventRunModal + 160frame #48: 0x00000001a6332fd8 UIKitCore
-[UIApplication _run] + 868 frame #49: 0x00000001a6332c50 UIKitCore
UIApplicationMain + 312frame #50: 0x000000010ef78370 UnityFramework`-[UnityFramework runUIApplicationMainWithArgc:argv:] + 92
main(argc=<unavailable>, argv=<unavailable>) at main.mm:26:9 [opt] frame #52: 0x00000001c17f3344 dyld
start + 1860问题重现 | Bug reproduce
项目复杂度越高越容易出现,大概率出现在操作C#对象时。
iPhone X 出现的概率是明显低于iPhone 13pro 和14pro。
在高频操作下,快时候30秒就能出现,慢的时5分钟肯定能复现。
The text was updated successfully, but these errors were encountered: