{"action":"created","issue":{"url":"https://api.github.com/repos/recastnavigation/recastnavigation/issues/138","labels_url":"https://api.github.com/repos/recastnavigation/recastnavigation/issues/138/labels{/name}","comments_url":"https://api.github.com/repos/recastnavigation/recastnavigation/issues/138/comments","events_url":"https://api.github.com/repos/recastnavigation/recastnavigation/issues/138/events","html_url":"https://github.com/recastnavigation/recastnavigation/issues/138","id":123076500,"number":138,"title":"Segfault in dtNavMeshQuery::findPath","user":{"login":"ACB1337","id":11277588,"avatar_url":"https://avatars.githubusercontent.com/u/11277588?v=3","gravatar_id":"","url":"https://api.github.com/users/ACB1337","html_url":"https://github.com/ACB1337","followers_url":"https://api.github.com/users/ACB1337/followers","following_url":"https://api.github.com/users/ACB1337/following{/other_user}","gists_url":"https://api.github.com/users/ACB1337/gists{/gist_id}","starred_url":"https://api.github.com/users/ACB1337/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ACB1337/subscriptions","organizations_url":"https://api.github.com/users/ACB1337/orgs","repos_url":"https://api.github.com/users/ACB1337/repos","events_url":"https://api.github.com/users/ACB1337/events{/privacy}","received_events_url":"https://api.github.com/users/ACB1337/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/recastnavigation/recastnavigation/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-12-19T10:12:26Z","updated_at":"2016-01-03T10:26:10Z","closed_at":null,"body":"In our server we get a segfault in dtNavMeshQuery::findPath after some time (most of the time multiple hours). The segfault occours when trying to dereference an invalid link. The first link of the parentTile points to a polygon that is out of bounds of the polygon array of the tile pointed to. It is always parentTile->links[parentPoly->firstLink] that causes this error. Most of the time the parents link will point to the correct tile but sometimes the salt of the link does not match the salt of the tile eg the links salt was 11 but that of the tile was 2. \r\n\r\nOur server regulary swaps tiles in and out of the navigation mesh to account for destructible geometry. Some of the tiles are built at runtime.\r\n\r\nAll attempts to reproduce the bug failed thus far. Setting the mesh to the state it was in when segfaulting and calculating the same path will work fine. Randomly swapping in Tiles and calculating the path with multiple threads also works fine so it doesnt seem to be an issue with our multithreading code.\r\n\r\nBelow is some information of a coredump from such a crash:\r\n\r\n    (gdb) p parentPoly->firstLink\r\n    $1 = 11\r\n    (gdb) p parentTile->links[11]\r\n    $2 = {ref = 2295592910861, next = 15, edge = 3 '\\003', side = 4 '\\004', bmin = 0 '\\000', bmax = 255 '\\377'}\r\n    (gdb) p *bestPoly\r\n    $3 = {firstLink = 2013265920, verts = {278, 0, 65535, 65535, 1027, 65280}, neis = {1, 30720, 278, 0, 9, 0}, flags = 1025, vertCount = 0 '\\000',\r\n      areaAndtype = 255 '\\377'}\r\n    (gdb) p *bestTile\r\n    $4 = {salt = 1, linksFreeList = 18, header = 0x9147cc00, polys = 0x9147cd58, verts = 0x9147cc74, links = 0x9147ce58, detailMeshes = 0x9147d128,\r\n      detailVerts = 0x9147d188, detailTris = 0x9147d3f8 \"\\021\\003$\\001\\003\\004\\\"\\001\\004\\005&\\001\\005\\006\\030\\001\\006\", bvTree = 0x9147d594, offMeshCons = 0x9147\r\n      offMeshSeg = 0x9147d694, data = 0x9147cc00 \"VAND\\a\", dataSize = 2724, flags = 0, next = 0x0, clusters = 0x9147d694, polyClusters = 0x0, dynamicLinksO = {\r\n        m_data = 0x0, m_size = 0, m_cap = 0}, dynamicFreeListO = 4294967295, dynamicLinksC = {m_data = 0x0, m_size = 0, m_cap = 0}, dynamicFreeListC = 4294967295\r\n    (gdb) p *bestTile->header\r\n    $5 = {magic = 1145979222, version = 7, x = 23, y = 27, layer = 0, userId = 0, polyCount = 8, vertCount = 19, maxLinkCount = 45, detailMeshCount = 8,\r\n      detailVertCount = 52, detailTriCount = 103, bvNodeCount = 16, offMeshConCount = 0, offMeshSegConCount = 0, offMeshBase = 8, offMeshSegPolyBase = 8,\r\n      offMeshSegVertBase = 19, walkableHeight = 55, walkableRadius = 18, walkableClimb = 18, bmin = {-11523.2969, -10357.3135, 1860.67969}, bmax = {-10123.2969,\r\n    7801.13477, 3260.67969}, bvQuantFactor = 0.142857149, clusterCount = 0}\r\n    (gdb) p i\r\n    $6 = 2013265920\r\n\r\n\r\ntileMask = 16383\r\npolyMask = 67108863\r\nsaltMask = 16777215\r\n \r\nsaltBits = 24\r\ntileBits = 14\r\npolyBits = 26\r\n\r\nIf you need more i will try to provide it."},"comment":{"url":"https://api.github.com/repos/recastnavigation/recastnavigation/issues/comments/168485435","html_url":"https://github.com/recastnavigation/recastnavigation/issues/138#issuecomment-168485435","issue_url":"https://api.github.com/repos/recastnavigation/recastnavigation/issues/138","id":168485435,"user":{"login":"Janiels","id":7887810,"avatar_url":"https://avatars.githubusercontent.com/u/7887810?v=3","gravatar_id":"","url":"https://api.github.com/users/Janiels","html_url":"https://github.com/Janiels","followers_url":"https://api.github.com/users/Janiels/followers","following_url":"https://api.github.com/users/Janiels/following{/other_user}","gists_url":"https://api.github.com/users/Janiels/gists{/gist_id}","starred_url":"https://api.github.com/users/Janiels/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Janiels/subscriptions","organizations_url":"https://api.github.com/users/Janiels/orgs","repos_url":"https://api.github.com/users/Janiels/repos","events_url":"https://api.github.com/users/Janiels/events{/privacy}","received_events_url":"https://api.github.com/users/Janiels/received_events","type":"User","site_admin":false},"created_at":"2016-01-03T10:26:10Z","updated_at":"2016-01-03T10:26:10Z","body":"Yes, that should at least avoid the crashes.\r\nCan you try recording a sort of \"replay log\" of the modifications being made to the navmesh up until the invalid link appears? Tiles being removed/readded, changes made to polygons (if you make any), that sort of thing.\r\nAlso, are you using the tile cache?"}}