What happens
The game crashes with an access violation during the turret update. It has happened 5 times in the last two weeks, every few hours of play while the base is under attack. The two crashes I still have logs for (both attached) have an identical stack:
Code: Select all
Error CrashHandler.cpp:503: Exception Code: c0000005, Address: 0x00007ff7391e3221
ModuleBase: 0x00007ff7382b0000, ImageSize: 02a17000, RelativeAddress: 00f33221
Error CrashHandler.cpp:509: Access Violation: Read at address 000000000BADC216
... r8=000000000badc0de ...
src\Trigger\Shooter.cpp(735): Shooter::refreshBeams
src\Trigger\ShootingLogic.cpp(188): BeamShootingLogic::shootInternal
src\Trigger\ShootingLogic.cpp(267): ShootingLogic::shoot
src\Trigger\ShootingLogic.cpp(262): ShootingLogic::execute
src\Trigger\Shooter.cpp(561): Shooter::shootInternal
src\Entity\ElectricTurret.cpp(68): ElectricTurret::shootAt
src\Entity\Turret.cpp(814): Turret::finishUpdate
src\Entity\TurretTargetManager.cpp(31): TurretTargetManager::finish
src\Map\Map.cpp(1329): Map::updateEntities
src\Game.cpp(191): Game::update
The faulting read is at 0xBADC0DE + 0x138, so it looks like refreshBeams is touching something that has already been destroyed.
Suspected cause (inferred from the stack and the mod code, not confirmed in a debugger)
HeroTurretRedux 1.0.38 "ranks up" turrets by replacing them. In its on_entity_died handler it takes event.cause (the turret that made the kill) and immediately calls entity.destroy({raise_destroy = true}) on it, then surface.create_entity{...} for the ranked version at the same position (prototypes/scripts/turrets.lua, local_replace_turret, called from local_turret_removed). When the killer is a laser turret (electric-turret with a beam attack), I believe the turret gets destroyed by the script while its own ElectricTurret::shootAt -> BeamShootingLogic::shootInternal -> Shooter::refreshBeams is still on the stack.
As a workaround I patched the mod locally so that the replacement is queued and done on the next tick instead of inside on_entity_died. I will report back here whether the crashes stop.
Reproduction
Unfortunately not deterministic. The attached save is an autosave made 270 seconds (about 16,200 ticks) before the second crash. Running it with --benchmark for 20,000 ticks did NOT crash, with 13 turret rank-ups happening during that run, so it seems to depend on exact timing (probably the kill has to come from a specific point of the beam turret's shooting update).
One of the mods in the save is a small local mod of mine (rampant-turret-targeting, attached) that only calls set_priority_target on turrets when they are built, including on script_raised_built; it is not on the mod portal.
Expected
A script destroying event.cause inside on_entity_died should not be able to crash the engine.
Side note
With force-opengl=true and full-screen=true (NVIDIA GTX 1080, driver 581.80) the "Unexpected error occurred" message box opens behind the frozen fullscreen window and is not visible, so the crash looks like a hang: the game shows its last frame, Windows reports "not responding" (AppHangB1) and the only way out is to kill the process. It took me a while to realize the game was actually crashing.
Attachments: two crash logs, the autosave from before the second crash, my local mod.
