[Bug] UActorChannel::CleanUp Causing Crash

Development Programming & Scripting
1

I’ve no idea what is causing this crash, but here’s a brief description…

I’m got an actor which has been added in the editor. At runtime, a new component is added to it via with line:

	cGravityMover = NewObject<UBCGravityMovementComponent>( aMoon );
	cGravityMover->RegisterComponentWithWorld( GetWorld() );

It is then added to a TArray UPROPERTY.

When the actor is destroyed, because it has collided with another actor, the following code, in UActorComponent::CleanUp( const bool bForDestroy ), causes the editor to crash:

				for ( int32 i = 0; i < CreateSubObjects.Num(); i++ )
				{
					if ( CreateSubObjects[i].IsValid() )
					{
						Actor->OnSubobjectDestroyFromReplication( CreateSubObjects[i].Get() );

						//CreateSubObjects[i]->MarkPendingKill(); // this line right here
					}
				}

When going through the code, I find that the previous line, a call to OnSubobjectDestroyFromReplication, actually marks the component pending for kill anyway. I commented out this (perhaps) unnecessary line and the game stops crashing.

This crash was in PIE with the dedicated server flag checked.

The crash log is:

[2015.05.07-19.07.52:866][ 70]LogBarrage: S: \Private\Actor\Space\BCSpaceBody.cpp:1019[ABCSpaceBody::DestroyDecorations]: BCStandardMoon_1: Destroying decorations

[2015.05.07-19.07.52:867][ 70]LogBarrage: S: \Private\Actor\Space\BCSpaceBody.cpp:679[ABCSpaceBody::DestroyAttachPoints]: BCStandardMoon_1: Destroying surface attach points (12)

[2015.05.07-19.07.52:876][ 70]LogNetPackageMap:Warning: FNetGUIDCache::SupportsObject: ParticleSystemComponent /Game/Maps/MP/UEDPIE_1_BasicStarSystem.BasicStarSystem:PersistentLevel.BCMoonDestabilizerBuildingActor_22.Projectile Trail NOT Supported.

[2015.05.07-19.07.52:876][ 70]LogNetPackageMap:Warning: FNetGUIDCache::SupportsObject: ParticleSystemComponent /Game/Maps/MP/UEDPIE_1_BasicStarSystem.BasicStarSystem:PersistentLevel.BCMoonDestabilizerBuildingActor_10.Projectile Trail NOT Supported.

[2015.05.07-19.07.52:877][ 70]LogNetPackageMap:Warning: FNetGUIDCache::SupportsObject: ParticleSystemComponent /Game/Maps/MP/UEDPIE_1_BasicStarSystem.BasicStarSystem:PersistentLevel.BCMoonDestabilizerBuildingActor_4.Projectile Trail NOT Supported.

[2015.05.07-19.07.52:877][ 70]LogNetPackageMap:Warning: FNetGUIDCache::SupportsObject: ParticleSystemComponent /Game/Maps/MP/UEDPIE_1_BasicStarSystem.BasicStarSystem:PersistentLevel.BCMoonDestabilizerBuildingActor_20.Projectile Trail NOT Supported.

First-chance exception at 0x000007FEDEA76EAC (UE4Editor-Engine-Win64-Debug.dll) in UE4Editor-Win64-Debug.exe: 0xC0000005: Access violation reading location 0x0000000000000008.

Unhandled exception at 0x000007FEDEA76EAC (UE4Editor-Engine-Win64-Debug.dll) in UE4Editor-Win64-Debug.exe: 0xC0000005: Access violation reading location 0x0000000000000008.

If I add a breakpoint to the code for this line, pressing F11 to step into it immediately causes a crash. I assume because the function is inlined.

The object pointed to by CreateSubObjects[i] (i=0) is a valid object of the correct type whose address is not either of the ones listed above. This is the only element in the array.

This is on the latest 4.7 code from the 4.7 branch of the repo.

Oh, and the call stack:

>	UE4Editor-Engine-Win64-Debug.dll!UActorChannel::CleanUp(const bool bForDestroy) Line 1443	C++
 	UE4Editor-Engine-Win64-Debug.dll!UChannel::ConditionalCleanUp(const bool bForDestroy) Line 99	C++
 	UE4Editor-Engine-Win64-Debug.dll!UChannel::ReceivedSequencedBunch(FInBunch & Bunch) Line 280	C++
 	UE4Editor-Engine-Win64-Debug.dll!UChannel::ReceivedNextBunch(FInBunch & Bunch, bool & bOutSkipAck) Line 588	C++
 	UE4Editor-Engine-Win64-Debug.dll!UChannel::ReceivedRawBunch(FInBunch & Bunch, bool & bOutSkipAck) Line 342	C++
 	UE4Editor-Engine-Win64-Debug.dll!UNetConnection::ReceivedPacket(FBitReader & Reader) Line 979	C++
 	UE4Editor-Engine-Win64-Debug.dll!UNetConnection::ReceivedRawPacket(void * InData, int Count) Line 457	C++
 	UE4Editor-OnlineSubsystemUtils-Win64-Debug.dll!UIpNetDriver::TickDispatch(float DeltaTime) Line 279	C++
 	UE4Editor-Engine-Win64-Debug.dll!TBaseUObjectMethodDelegateInstance<0,UNetDriver,TTypeWrapper<void> __cdecl(float)>::Execute(float <Params_0>) Line 682	C++
 	UE4Editor-Engine-Win64-Debug.dll!TBaseUObjectMethodDelegateInstance<0,UNetDriver,void __cdecl(float)>::ExecuteIfSafe(float <Params_0>) Line 772	C++
 	UE4Editor-Engine-Win64-Debug.dll!TBaseMulticastDelegate<void,float>::Broadcast(float <Params_0>) Line 1030	C++
 	UE4Editor-Engine-Win64-Debug.dll!UWorld::Tick(ELevelTick TickType, float DeltaSeconds) Line 1027	C++
 	UE4Editor-UnrealEd-Win64-Debug.dll!UEditorEngine::Tick(float DeltaSeconds, bool bIdleMode) Line 1329	C++
 	UE4Editor-UnrealEd-Win64-Debug.dll!UUnrealEdEngine::Tick(float DeltaSeconds, bool bIdleMode) Line 347	C++
 	UE4Editor-Win64-Debug.exe!FEngineLoop::Tick() Line 2257	C++
 	UE4Editor-Win64-Debug.exe!EngineTick() Line 52	C++
 	UE4Editor-Win64-Debug.exe!GuardedMain(const wchar_t * CmdLine, HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, int nCmdShow) Line 145	C++
 	UE4Editor-Win64-Debug.exe!WinMain(HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, char * __formal, int nCmdShow) Line 191	C++
 	[External Code]
2

Adding the component as a default subobject, but deactivating it until it is required, stopped the crash. This is still a bug, though?

3

Hey -

What is cGravityMover defined as? When you say that the new component is added at runtime, are the functions being called inside BeginPlay()? Could you post the class where the calls you reference are being made? Looking at hte for loop that you added it seems you’re destroying the component rather than the entire actor. Is this intention? Please provide any additional information you can think of regarding how the actor is setup, created, and destroyed. If possible could you send us a small sample project where the crash is occuring? Additionally, posting the log files from the crash will give us more information into the crash as well.

Cheers

4

I have several types of movement component. Only 1 should be present at any one time. This particular function is intended to remove all other types of movement component, sum their current velocities and initialise a new gravity-based movement component with that initial velocity. It basically enables “free fall” for given actor, with multiple gravity sources.

The event that causes the components to be swapped out is triggered once and once only for this given actor. It is triggered by user input on the client which is forwarded to the server via an rpc, not during begin play. The server swaps out the components and should replicate this change to the client. After it has done this, if the actor containing the components is destroyed, the client crashes at the point indicated in the loop.

The loop I posted is part of the UE4 engine source. It is called on the client when the server has told it that the actor has been destroyed. I assume it goes through deleting all the components before removing the actor. I, however, did not write this code.

This can happen on 1 of 2 actors. The first is placed in the map in the editor and the second, another type of moon, can be spawned by the game during play.

Relevant files: BCGravityMovementComponent.cpp · GitHub

5

Hi ,

Are you still experiencing this issue or have you found a solution? Is it still giving you this crash in 4.8? I may not be understanding you correctly but in your original post, it seems as though the line:

//CreateSubObjects[i]->MarkPendingKill();

is causing you to crash but you also mention that it is redundant as the line before it is already marking the component for ‘PendingKill’. The fact of trying to set this state twice could be the reason for the crash and I’m not quite sure why the line wouldn’t simply be removed.

If I am wrong or if you have any information to provide, please let me know so that I can better assist you.

Have a nice day,