Crash in MyContactDestroyedCallback

[Oogst]

I am getting a crash deep inside Bullet code. The crash happens in the function bool MyContactDestroyedCallback(void* userPersistentData). This is the error I am getting: "Unhandled exception at 0x78160f82 in IceMagnet.exe: 0xC0000005: Access violation reading location 0xfffffff8."

The weird thing is that I can get rid of this crash by removing raycasts at a certain point, but the place of the crash seems totally unrelated to raycasting and the stack does not trace back to a point even near to where the raycast happens. Because of this unrelatedness, I am quite at a loss as to how to solve this issue and am hoping someone knows in what direction I should be looking for the solution.

I made some screenshots of the stack information in Visual Studio, I hope this helps to see what is going wrong:







Thanks in advance!

[Oogst]

Does no one have a clue what is causing this crash?

[AlexSilverman]

Hi,

My advice would be to see if you can alter one of the Bullet Demos to create a reproduction that everyone else can see. Since it appears to be crashing in btAlignedFree, my thought would be maybe you're stepping on memory you don't own somewhere along the line. That said, a test case in the Bullet Demo suite is usually a good first step when turning to the forums for help.

Hope this helps.

- Alex

[Oogst]

Doing that would cost a lot of time, as the whole thing is already quite complex. Also, I depend on graphics libraries to create triangle meshes for collision detection. Can you not give me some pointers what might be going wrong here? Is the problem really in this code, or might some other part of Bullet be filling something with bad values at some other point? Might the cache or stack or something be too small?

I did find out now that if I either remove the triangle mesh or decrease the number of physics boxes, then the crashes are gone. Odd thing is that those are two different things, seems quite independent to me.

[AlexSilverman]

It seems to me to be a memory issue, like you're changing memory that you shouldn't be or something. I've never seen this happen myself, and haven't read reports of it happening on the forums. I don't know what Bullet does in the case that the contact point pool runs out, but I doubt this could potentially be a cause. The default value for the maximum number of contact pairs (as defined in btDefaultCollisionConfiguration.cpp, line 38) is quite large, and if you didn't change them, then it's probably not running out.

If there's no way to create a simple reproduction inside Bullet, then I'd examine your memory usage. If you're using a btBvhTriangleMeshShape for your mesh, be careful that you're creating and filling the buffers properly. Otherwise, be sure you're not altering memory outside what you've allocated.

Hope this helps.

- Alex

[Oogst]

Hmm, memory problems with the bvh sounds like a logical cause for the problem. However, I am not aware of what I am doing wrong there and debug mode does not tell me that something is wrong there. Could you have a look at my code for filling the bvh? This is the code (it copies vertices from the graphics mesh to the Bullet mesh):

Code: Select all

int vertexStride = sizeof(btVector3);
int indexStride = 3 * sizeof(int);

int vertexCount = geometry->vertexCount();
int triangleCount = geometry->triangleCount();

btVertices = new btVector3[vertexCount];
int* btIndices = new int[triangleCount * 3];

const Vector3* vertices = geometry->getVertexArray();

for (int i = 0; i < vertexCount; ++i)
{
	btVertices[i] = Casters::makeBtVector3(vertices[i]);
}

for (int i = 0; i < triangleCount; ++i)
{
	unsigned short i0, i1, i2;
	geometry->getIndicesForTriangle(i, i0, i1, i2);
	btIndices[i * 3    ] = i0;
	btIndices[i * 3 + 1] = i1;
	btIndices[i * 3 + 2] = i2;
}

btTriangleIndexVertexArray* indexVertexArrays = new btTriangleIndexVertexArray(
	triangleCount,
	btIndices,
	indexStride,
	vertexCount,
	reinterpret_cast<btScalar*>(btVertices),
	vertexStride);

terrainCollisionMesh = new btBvhTriangleMeshShape(indexVertexArrays, true, true);

terrainBody = new btRigidBody(0.0f, NULL, terrainCollisionMesh);

dynamicsWorld->addRigidBody(
	terrainBody,
	CG_ENVIRONMENT,
	CG_PLAYERS | CG_DOGS | CG_ENEMIES | CG_PHYSICS);

[Oogst]

Might someone have time to check whether the BVH code is correct?

[Erwin Coumans]

Try to use btTriangleMesh instead of btTriangleIndexVertexArray, and use addTriangle to copy triangles.

btTriangleIndexVertexArray is more error-prone, it re-uses the index/vertex arrays.

Hope this helps,
Erwin

[Oogst]

Hmm, I gave the use of addTriangle a try, but that did not change anything: still the exact same crash. I think I am going to try to add code to the Bullet source to see what kind of data is being added to the list that crashes. I am still not sure whether the bug is in my code or in Bullet code (although things like this are usually in my own code).