[1.1.49] Crash inside Commandable::runBehavior dereferencing NULL pointer

[DBotThePony]

Code: Select all

1060.650 Error CrashHandler.cpp:492: Exception Code: c0000005, Address: 0x00007ff6672ceb6e
ModuleBase: 0x00007ff667160000, ImageSize: 01d9e000, RelativeAddress: 0016eb6e
1060.650 Error CrashHandler.cpp:498: Access Violation: Read at address 0000000000000000
1060.650 Error CrashHandler.cpp:512: Exception Context:
rax=000002135d2ea8e0, rbx=000002135d2ea8e0, rcx=0000000000000000,
rdx=00000213711d0000, rsi=0000000000000000, rdi=0000021337210b30,
rip=00007ff6672ceb6e, rsp=0000006be36fe560, rbp=0000006be36fe660,
 r8=00000213713a6780,  r9=0000000000000001, r10=0000000000008000,
r11=0000006be36fe490, r12=0000021342f37490, r13=000002130d489f48,
r14=0000021337210bf8, r15=0000006be36fe7c0
1060.650 Crashed in J:\SteamLibrary\steamapps\common\Factorio\bin\x64\Factorio.exe (0x00007ff667160000 - 0x00007ff668efe000)
Factorio crashed. Generating symbolized stacktrace, please wait ...
c:\cygwin64\tmp\factorio-build-iin7zm\libraries\stackwalker\stackwalker.cpp (924): StackWalker::ShowCallstack
c:\cygwin64\tmp\factorio-build-iin7zm\src\util\logger.cpp (545): Logger::writeStacktrace
c:\cygwin64\tmp\factorio-build-iin7zm\src\util\logger.cpp (552): Logger::logStacktrace
c:\cygwin64\tmp\factorio-build-iin7zm\src\util\crashhandler.cpp (184): CrashHandler::writeStackTrace
c:\cygwin64\tmp\factorio-build-iin7zm\src\util\crashhandler.cpp (541): CrashHandler::SehHandler
ERROR: SymGetLineFromAddr64, GetLastError: 487 (Address: 00007FFE77DFB7F7)
00007FFE77DFB7F7 (KERNELBASE): (filename not available): UnhandledExceptionFilter
ERROR: SymGetLineFromAddr64, GetLastError: 487 (Address: 00007FFE7A0151B0)
00007FFE7A0151B0 (ntdll): (filename not available): memset
ERROR: SymGetLineFromAddr64, GetLastError: 487 (Address: 00007FFE79FFC766)
00007FFE79FFC766 (ntdll): (filename not available): _C_specific_handler
ERROR: SymGetLineFromAddr64, GetLastError: 487 (Address: 00007FFE7A0120CF)
00007FFE7A0120CF (ntdll): (filename not available): _chkstk
ERROR: SymGetLineFromAddr64, GetLastError: 487 (Address: 00007FFE79FC1454)
00007FFE79FC1454 (ntdll): (filename not available): RtlRaiseException
ERROR: SymGetLineFromAddr64, GetLastError: 487 (Address: 00007FFE7A010BFE)
00007FFE7A010BFE (ntdll): (filename not available): KiUserExceptionDispatcher
c:\cygwin64\tmp\factorio-build-iin7zm\src\ai\commandable.cpp (197): Commandable::runBehavior
c:\cygwin64\tmp\factorio-build-iin7zm\src\entity\unit.cpp (332): Unit::update
c:\cygwin64\tmp\factorio-build-iin7zm\src\surface\activeentitiesorder.hpp (135): EntityOrderHelpers::EntityOrderList<LogisticRobot,ConstructionRobot,Inserter,Roboport,HeatPipe,Loader,AssemblingMachine,Furnace,MiningDrill,FluidWagon,ArtilleryWagon,CargoWagon,Locomotive,Character,Boiler,Generator,BurnerGenerator,Reactor,Lab,LandMine,ArithmeticCombinator,ArtilleryFlare,ArtilleryProjectile,ArtilleryTurret,Beam,Car,SpiderVehicle,CharacterCorpse,CombatRobot,Corpse,DeciderCombinator,ElectricEnergyInterface,EnemySpawner,Explosion,FireFlame,FlameThrowerExplosion,FluidStream,FluidTurret,FlyingText,Gate,HeatInterface,HighlightBoxEntity,InfinityContainer,InfinityPipe,ItemRequestProxy,OffshorePump,ParticleSource,PowerSwitch,Projectile,Pump,Radar,ProgrammableSpeaker,RocketSilo,RocketSiloRocket,SimpleSmoke,SmokeWithTrigger,SpeechBubble,Sticker,Turret,Unit>::update
c:\cygwin64\tmp\factorio-build-iin7zm\src\surface\surface.cpp (1633): Surface::update
c:\cygwin64\tmp\factorio-build-iin7zm\src\map\map.cpp (1610): Map::updateEntities
c:\cygwin64\tmp\factorio-build-iin7zm\src\game.cpp (210): Game::update
c:\cygwin64\tmp\factorio-build-iin7zm\src\scenario\scenario.cpp (1279): Scenario::update
c:\cygwin64\tmp\factorio-build-iin7zm\src\scenario\scenario.cpp (1168): Scenario::updateStep
c:\cygwin64\tmp\factorio-build-iin7zm\src\mainloop.cpp (1252): MainLoop::gameUpdateStep
c:\cygwin64\tmp\factorio-build-iin7zm\src\mainloop.cpp (1108): MainLoop::gameUpdateLoop
c:\program files (x86)\microsoft visual studio\2017\buildtools\vc\tools\msvc\14.15.26726\include\functional (15732480): std::_Func_impl_no_alloc<<lambda_a0b28d3cbd8fee115c5615cf40d73b61>,void>::_Do_call
c:\cygwin64\tmp\factorio-build-iin7zm\src\util\workerthread.cpp (49): WorkerThread::loop
c:\program files (x86)\microsoft visual studio\2017\buildtools\vc\tools\msvc\14.15.26726\include\thr\xthread (230): std::_LaunchPad<std::unique_ptr<std::tuple<void (__cdecl LogitechLEDController::*)(void),LogitechLEDController *>,std::default_delete<std::tuple<void (__cdecl LogitechLEDController::*)(void),LogitechLEDController *> > > >::_Go
c:\program files (x86)\microsoft visual studio\2017\buildtools\vc\tools\msvc\14.15.26726\include\thr\xthread (209): std::_Pad::_Call_func
minkernel\crts\ucrt\src\appcrt\startup\thread.cpp (115): thread_start<unsigned int (__cdecl*)(void * __ptr64)>
ERROR: SymGetLineFromAddr64, GetLastError: 487 (Address: 00007FFE787F7034)
00007FFE787F7034 (KERNEL32): (filename not available): BaseThreadInitThunk
ERROR: SymGetLineFromAddr64, GetLastError: 487 (Address: 00007FFE79FC2651)
00007FFE79FC2651 (ntdll): (filename not available): RtlUserThreadStart

First of all, prior to this crash, i've experienced several strange mod crashes, one of them is my mod crashing with this weird traceback:



... despite code being encased inside if condition which explicitly check for unit's validity before doing any actions over it:

(exact line in traceback)

(it appears i can not add unit to a group right after creating the unit, so i delay these actions by 1 tick)

It forced me to put pcall around it, so crashing stopped... for a moment. After i resolved this weird crash inside my own mod, Rampant started to strangely crash as well:



Why strangely? Because this tells us that Rampant had on_build_base_arrived event fired with invalid group, which ended up in unfinished piece of code: It appears because of reckless order setup in my mod on line 399 as of commit 2eb69e0d5ec840a7582d37f67dedb8ba3f342f20, and Rampant just having it's logic missing for such case (despite being documented on Lua API docs).

Code: Select all

local function onBuilderArrived(event)
    local builder = event.group
    if not (builder and builder.valid) then
        builder = event.unit
        if not (builder and builder.valid and builder.force.name == "enemy") then
            return
        end
    elseif (builder.force.name ~= "enemy") then
        ...
    end
    ...
    local squad = universe.groupNumberToSquad[builder.group_number]

So, after we decided (multiplayer game) to get rid of Rampant, it was fine for some time, until we encountered this hard game crash dereferencing NULL pointer (judging by Access Violation: Read at address 0000000000000000), again related to units.

At this point, I have completely no idea what is going on. But I do have an idea that crash is induced by my mod (involving order issuing?), I just don't know exactcause of the crash.

[Rseding91]

Your original "strange mod crashes" is due to set_command potentially firing a lua event which means any other mod (your own included) could then delete/destroy any entities in the entire game. So you need to re-check for valid after every call to set_command. The same applies to the add_member function: it can also fire a lua event and anything can be invalidated after that call. pcalling the function isn't the answer

As for the game crash: do you have some step(s) to reproduce it? I tried loading the save you provided with the mod you provided but it hasn't crashed yet.

[Rseding91]

Actually looking into it more; it's the same issue - a mod listening to events invalidating things and our code not handling it. So the null pointer dereference issue is now fixed.

[DBotThePony]

My own mod listen only for three events: entity damaged, tick and unit added to group. Both have safeguards to avoid recursion or reuse of already-seen structures, so only these strange invalidations can be intermod interactions. Anyway thanks for crash fix.