Search Issue Tracker

Third Party Issue

Votes

1

Found in

2021.3.5f1

2022.1.7f1

2022.2.0a19

2023.1.0a2

Issue ID

UUM-9235

Regression

No

Crash when entering or exiting Play mode on Windows

--

-

To reproduce:
1. Open the project “Kalman test”
2. Open the scene “SampleScene” (Assets → Scenes → SampleScene)
3. Enter Play mode
4. Exit Play mode
5. Observe a crash

Reproducible with: 2021.3.5f1, 2022.1.7f1, 2022.2.0b1, 2023.1.0a2
Could not test with: 2020.3.36f1 (Console errors)

Reproduced on: Windows 10
Not reproduced on: macOS Monterey 12.4 (Intel)

First frames of the stack trace:
0x00007FFCB7DC4FD9 (KERNELBASE) RaiseException
0x00007FFC454D064C (mono-2.0-bdwgc) \[C:\\build\\output\\Unity-Technologies\\mono\\mono\\utils\\mono-log-common.c:143] mono_log_write_logfile
0x00007FFC454BC4A2 (mono-2.0-bdwgc) \[C:\\build\\output\\Unity-Technologies\\mono\\mono\\eglib\\goutput.c:172] monoeg_g_logv_nofree
0x00007FFC454BC508 (mono-2.0-bdwgc) \[C:\\build\\output\\Unity-Technologies\\mono\\mono\\eglib\\goutput.c:187] monoeg_g_log
0x00007FFC454BBDC2 (mono-2.0-bdwgc) \[C:\\build\\output\\Unity-Technologies\\mono\\mono\\eglib\\gmem.c:138] monoeg_malloc0
0x00007FFC4562B632 (mono-2.0-bdwgc) \[C:\\build\\output\\Unity-Technologies\\mono\\mono\\metadata\\object.c:7953] mono_utf16_to_utf8len
0x00007FFC4562B413 (mono-2.0-bdwgc) \[C:\\build\\output\\Unity-Technologies\\mono\\mono\\metadata\\object.c:7911] mono_string_to_utf8
0x00007FF786F52175 (Unity) MonoStringToCpp

Notes:
*·* 2023.1.0a2 crashes not every time (three out of eight)
*·* The crash occurs after the 3rd or 4th step. If not, repeat 3 and 4 steps a couple of times

  1. Resolution Note:

    The crash is caused by a memory corruption caused by the EigenCore C wrapper code.

    https://github.com/modios/EigenCore/blob/95a1b30c70549636d7d250486cfbf5476049c4f3/src/native/EigenNative.cpp#L203

    The line must be changed to Map<MatrixXd> result(vout, row1, col1);

    With this particular scenario (prior to the fix), 'result' is constructed as a 9x9 but the input buffer (vout) is only 9x1. 

    If you make this change and rebuild the native dll, the crash is resolved.

Add comment

Log in to post comment

All about bugs

View bugs we have successfully reproduced, and vote for the bugs you want to see fixed most urgently.