Removing of rigid object/motion state - crash [solved]

[mi076]

-- Topic split from solved issue about CharacterFilter and softbodies crash --

I have tried revision 1496 and it still happens. I can reproduce it better now - it happens after removing of rigid object (and it's motion state)... So "wild clicking" was not necessary , just shoot a sphere and wait 10 second were enough.
...
...
btRigidBody * body = robj->get_rigid_body();
if (!body) continue;
if (body->getMotionState())
{
------> delete body->getMotionState();
}
m_broadphase->getOverlappingPairCache()->cleanProxyFromPairs(body->getBroadphaseHandle(),
m_dynamicsWorld->getDispatcher() );
m_dynamicsWorld->removeRigidBody(body);
delete body;
...
...

If comment out "delete body->getMotionState();" line it doesn't happen. All the lines after doesn't matter. Have tried again to link with revision 1458 - no problem...

Trace:

btDiscreteDynamicsWorld.cpp:270

btTransform interpolatedTransform;
btTransformUtil::integrateTransform(body->getInterpolationWorldTransform(),
body->getInterpolationLinearVelocity(),body->getInterpolationAngularVelocity(),m_localTime*body->getHitFraction(),interpolatedTransform);
----------> body->getMotionState()->setWorldTransform(interpolatedTransform);

[Switching to Thread -1234696480 (LWP 11455)]
0x088266af in ?? ()
(gdb) up
#1 0x080974f9 in btDiscreteDynamicsWorld::synchronizeSingleMotionState (this=0x8747740, body=0x8826750) at /usr/local/b_svn/bullet/src/BulletDynamics/Dynamics/btDiscreteDynamicsWorld.cpp:270
(gdb) up
#2 0x08097563 in btDiscreteDynamicsWorld::synchronizeMotionStates (this=0x8747740) at /usr/local/b_svn/bullet/src/BulletDynamics/Dynamics/btDiscreteDynamicsWorld.cpp:287
(gdb) up
#3 0x080973d7 in btDiscreteDynamicsWorld::stepSimulation (this=0x8747740, timeStep=0.000633999996, maxSubSteps=1, fixedTimeStep=0.0166666675) at /usr/local/b_svn/bullet/src/BulletDynamics/Dynamics/btDiscreteDynamicsWorld.cpp:364
(gdb)

Thank you again for looking into it.

[mi076]

if (!body) continue;
if (body->getMotionState())
{
------> delete body->getMotionState();
}

It is better to say it is workaround, the crash itseft doesn't happen at this place, it happens after m_dynamicsWorld->stepSimulation is called...

[sparkprime]

stepSimulation should not be seeing your rigid body if you've removed it, maybe erwin can shed some light on this.

Only thing I can suggest is not destroying the motionstate until you have successfully removed and destroyed the rigid body, that way there are no dead pointers around. However unless you are using threads I can't see how this would help you here.

[mi076]

stepSimulation should not be seeing your rigid body if you've removed it, maybe erwin can shed some light on this.

It also doesn't happen if simulation runs in fixed steps

int numSimSteps = 0;
int maxSimSubSteps = 1;
btScalar internal_rate = btScalar( 1.0 / BULLET_INTERNAL_HZ );
#ifdef USE_FIXED_STEP
btScalar fixed_rate = btScalar( 1.0 / REFRESH_RATE_HZ );
numSimSteps = m_dynamicsWorld->stepSimulation(fixed_rate, 0, internal_rate);
et = fixed_rate;
#else
numSimSteps = m_dynamicsWorld->stepSimulation(et, maxSimSubSteps, internal_rate);
#endif

[mi076]

The rigid body should not be there, have tested with fully empty world, just shoot one sphere, it was deleted and set "=NULL", debugger also shows it as 0x0 after. But crash is exactly the same, no idea where the crashing rigid body does come from... The line 270 found by debugger is correct, then commented out no crash happens... I shall look again little later, thank you for your help.

[mi076]

It seems the body still exists in m_activeObjects array... From this array the synchronizeSingleMotionState gets the pointer...

Here is output directly after remove:

body=143319776
after m_dynamicsWorld->removeRigidBody(body) : body=143319776
after delete body : body=143319776
after body = NULL : body=0
m_dynamicsWorld->getCollisionObjectArray().size() = 0
m_dynamicsWorld->getActiveObjects().size() = 1
m_dynamicsWorld->getActiveObjects()[0] = 143319776

[mi076]

Most likely i have found it, findActiveObjects() rebuilds the m_activeObjects array.
It is called in btDiscreteDynamicsWorld::stepSimulation,
but it is called only in "if (numSimulationSubSteps) {...}" block. If numSimulationSubSteps==0 it is not called. I have just put findActiveObjects() several lines higher and have no more crashes ...

[Erwin Coumans]

For now we remove/disabled 'getActiveObjects', and work on a better island/deactivation solution for Bullet 2.74

Can you check if r1498 works for you?
Thanks for the report,
Erwin

[mi076]

Thank you. It is solved in r1498.

BTW, i run simulation with variable step

maxSimSubSteps = 1;
numSimSteps = m_dynamicsWorld->stepSimulation( dt, maxSimSubSteps, 1.0/60.0 );
and count results:

if (numSimSteps == 0)
{
interpolated_transforms += 1;
}
else
{
if (numSimSteps > maxSimSubSteps)
{
simulated_steps += maxSimSubSteps;
dropped_steps += (numSimSteps - maxSimSubSteps);
}
else
{
simulated_steps += numSimSteps;
}
}

the results are typically (after short time running at several hundreds fps):
interpolated_transforms = 62320
simulated_steps = 7948
dropped_steps = 8

hope, it is O.K.
Also, many things are different if maxSimSubsteps is set 0, have to look closer, it is
probably off-topic here, thank you again..