-
Notifications
You must be signed in to change notification settings - Fork 25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
(use-after-free) Crash when trying to use an exploded bomb/bullet entity in lua on android #83
Comments
Comment the first line and the message changes from 4 to 3 when the bomb explodes. |
(maybe title needs to be updated) |
Discovered this accidentaly in this level: https://principia-web.se/level/676 |
Another more straight forward example: local ref
function init()
ref = world:get_entity_by_id(2)
end
function step(count)
if count > 200 then
ref:highlight()
end
end After the bomb explodes on windows place where it was before the explosion is highlighted, and on android this causes a lua error and not a crash... wtf |
local ref
function init()
ref = world:get_entity_by_id(2)
end
function step(count)
if count == 3 then
game:message(ref:get_name())
end
if count == 240 then
game:message(ref:get_name())
end
end This on frame 3 prints "Bomb" and on frame 240 (after explosion) "Toggle axis rotation"????? |
calling |
After looking at the escript source I think this is actually use-after-free? Game tries to clean up objects from the stack and globals but fails in this case??? |
(way overdue) correction: any form of disowning triggers this too, for example calling absorb |
Weird but this doesn't happen on Windows, where the invalid object reference just keeps "working" (maybe a use-after-free situation or just an invalid object reference?)
I was able to reproduce this like this:
This issue only happens if e is a top-level local, and the object safely gets removed if
e
is a globalThe text was updated successfully, but these errors were encountered: