Crash On DynamicHeapAllocator::Allocate or Deallocate everytimes

I use Unity 2019.4.17f1, OS: win10.
I also test 2019.4.18f1 version, it still crash.

I encounter the crash issue. DynamicHeapAllocator::Allocate or Deallocate
When I run the build game , the game sometmes crashs on Loadscene、LoadShader、PlayTimeline.
Although there are three situation on crash, but they all crash on unityPlayer.dll DynamicHeapAllocator.

I don't know what this crash happen.
Is anyone encounter the same problem?
Maybe someone can tell me what DynamicHeapAllocator crash meaning?


simple crash stack Log:
0x00007FFD6D92CF8B (UnityPlayer) tlsf_free
0x00007FFD6C7014C1 (UnityPlayer) DynamicHeapAllocator:: Deallocate
0x00007FFD6C6FE3CA (UnityPlayer) DualThreadAllocator<DynamicHeapAllocator>::TryDeallocate
0x00007FFD6C6E46DA (UnityPlayer) MemoryManager:: Deallocate
0x00007FFD6C6F4B8A (UnityPlayer) free_alloc_internal

 

DynamicHeapAllocator is related to the native Unity code which is responsible for memory management. Usually callstack like this indicates a memory corruption (allocation headers overwrite which happens prior to freeing memory) or potential race condition (double deallocation). Given that callstacks your provided correspond to different areas I would suggest a memory overwrite.
Is it possible to launch win64 player with

-debugallocator

cmdline option? Tt might help to identify the issue in case of memory overwrite.

 

Thanks alexeyzakharov for reply, I will try -debugallocator cmdline with win64.

 

Hello alexeyzakharov,
When I use -debugallocator cmdline, my game will crash very soon.
Can you analysis the crash dumps?(attach 7-zip file)

I am not sure this crash log that associate with DynamicHeapAllocatorCrash.
Thank you read this thread.
Waiting for your reply.

Now crash log:

 

Thank you for taking time and capturing the crash details!

I think this is in fact the location where the bad memory is accessed and corruption happens.

Code (CSharp):

1. 0x00007FFC857A47D0 (UnityPlayer) Camera::GetFar
2. 0x00007FFC857882EA (UnityPlayer) CalculateLightShadowFade
3. 0x00007FFC857F7646 (UnityPlayer) ForwardShaderRenderLoop::SetLightShadowProps
4. 0x00007FFC857F2B72 (UnityPlayer) ForwardRenderLoopJob
5. 0x00007FFC8560BE25 (UnityPlayer) ExecuteAsyncSetup
6. 0x00007FFC85C98E99 (UnityPlayer) JobQueue::Exec
7. 0x00007FFC85C9FB3A (UnityPlayer) JobQueue::WaitForJobGroupID
8. 0x00007FFC85C8FF6C (UnityPlayer) CompleteFenceInternal
9. 0

It is not completely clear to me why Camera object is invalid, but I hope Graphics team has ideas on why and how to fix it. Similarly the second crash is related to invalid PlayableGraph object.
In both cases more likely objects were deleted, but some code was still using those for computational work - perhaps this could give you some ideas about if workaround is possible (keep objects alive).

Would you be happy to file a bug and drop a number here, so that I can ensure it gets prioritized correctly?

 

I already file a bug to FogBugz : Case 1307600. tiket:1307600_ihjdj05q9vhqgucf

But I am not update the -debugallocator crash log on Case 1307600.
Now I want to reproduce the crash with simple project.
When I done the simple project , I will update Case 1307600 and this thread.

Happy to see you reply.
Thanks.

 

Thanks for filing the bug - I've added information about this thread and detailed callstacks to there.

 

Hi @tssai !

Did you have a chance yet to upload a repro project? It would be really appreciated so that we can move the case forward - issues like this are highly dependent on project/scripts setup and are not reproducible in other projects unfortunately

 

alexeyzakharov , VERY SORRY.
So late to reply you.
I have no time to make simple repro project ,now.
Because the project have many Manager script that do assetbundle (load/unload)、loadscene(async/sync).
I want to remove these script for simple project.
I think my project too complicated.
I can give you the simple project on end of april. Sorry I am busy now.

The Crashs :
All use -debugallocator

1. CalculateLightShadowFade Crash:
I have two A,B scene.
All scenes have camera.
And B scene have a mesh that need to receive shadow.

1. In A scene, switch to B scene.
2. load B scene Assetbundle.
3. Use loadsceneAsync to load B scene. Add B scene on A scene.
4. When B scene load already, unload A scene from assetbundle.unload(true).
5. Set B scene activityscene.
6. SceneManager.UnloadSceneAsync A scene .
7. Crash. CalculateLightShadowFade

When I start to load B scene. I disable A scene camera first.
This is a aoivd crash way.
Or
Disable shadow from QualitySetting to avoid crash.

2. PlayableGraph crash:

1. Use Playable Director and timeline signal.
2. Play this playable director.
3. Invoke the signal receiver.
4. In signal receiver callback to do the same playable director STOP.
5. Crash PlayableGraph ispatchOutputNotifications

I avoid signal receiver to stop same playableDirector.

Above, this is my fix ways.
Sorry I can not give you simple project right now.

 

Hey @alexeyzakharov the crash we experience by using particle system simulate method is also crashing in

DynamicHeapAllocator::Deallocate

function. Maybe it would help in solving the bug.

https://forum.unity.com/threads/and...ith-ring-buffer-mode-loop-and-trails.1192972/