Search Issue Tracker
Fixed in 2022.2.X
Votes
1
Found in
2021.2.0b15
2022.1.0a9
2022.1.0a14
Issue ID
1377416
Regression
Yes
Memory access violation in LightProbesManager when appending LightProbes objects with overlaps twice
Steps to reproduce:
1. Open the attached project (JapanOffice.zip);
2. In the opened popup window for prompting to change Project setting press Cancel button;
3. Ensure that in the Hierarchy there are several scenes loaded additively; if there are none, load those scenes manually;
4. In the Hierarchy select any scene other than the active scene (e.g. NoonB) and double-click on it;
5. Repeat step 4 5-6 times;
6. Enter Play mode.
Expected result: Play mode launches without crashes.
Actual result: Editor crashes
Reproducible with: 2021.2.0b15, 2021.2.4f, 2022.1.0a9, 2022.1.0a16
Not reproducible with: 2019.4.33f1, 2020.3.23f1, 2021.2.0b14, 2022.1.0a8
Notes:
- Reproducible on Windows (by following the repro steps) and macOS (after just opening the repro project);
- The crash might not reproduce every time; if it doesn't try exiting Play mode after step 6 or repeat the initial steps once again with different timings between actions;
- The crash might produce different stack traces on different versions.
- First few lines of a stacktrace:
0x00007ff76b9aed85 (Unity) `anonymous namespace'::CombineMeshFiltersForStaticBatching
0x00007ff76b9ae6f8 (Unity) StaticBatching::CombineAllStaticMeshesInSceneForStaticBatching
0x00007ff76b4174c9 (Unity) StaticBatchingEditorHelper_CUSTOM_CombineAllStaticMeshesForScenePostProcessing
0x000001a845246391 (Mono JIT Code) (wrapper managed-to-native) UnityEditor.StaticBatchingEditorHelper:CombineAllStaticMeshesForScenePostProcessing (ulong)
0x000001a845245983 (Mono JIT Code) UnityEditor.UnityBuildPostprocessor:OnProcessScene
Probable Root Cause:
When reproing this we found what seemed like random callstack at each crash. Further investigation suggests that this is because LightProbesManager#Append() can write beyond the range of its allocated memory (see the memcpy involving m_BakedCoefficients inside Append()). By doing this it effectively caused undefined behaviour (including sometimes crashing the editor).
Comments (1)
Add comment
All about bugs
View bugs we have successfully reproduced, and vote for the bugs you want to see fixed most urgently.
Latest issues
- Build and Run button greyed out for locally invalid architecture, despite remote build is specified
- Graphics Settings: “Use Defaults” checkboxes misaligned in Tier Settings section
- VFX Graph particles are not culled when using URP and Frustum Culling is enabled on VFX Mesh Output
- Texture2D hash changes inside of an AssetBundle when rebuilding a SpriteAtlas bundle with an empty AssetPostprocessor Script enabled
- Aniso Level still applies when Generate MipMap is disabled in Texture Import Settings
ateo-developer
Mar 21, 2022 14:57
We are also encountering this bug in 2020.3 when unloading a scene within a few seconds after it has been fully loaded (Awake, Start and Update have all been called at least once after the load). We are using the Addressable system to load and unload the scenes.