-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Fatal Exception: std::out_of_range vector, Regression in 4.0 beta #11538
Comments
Thanks for the thorough report and reproduction, @parrots — here’s what the crash looks like with a fully-symbolicated debug build of our framework at 7f18b0b:
|
Yeah, thanks for the great report @parrots! The crash is happening because a layer in the tile's
mapbox-gl-native/src/mbgl/tile/geometry_tile.cpp Lines 216 to 223 in 553efa3
It seems like somehow we're ending up in a situation where the mapbox-gl-native/src/mbgl/annotation/annotation_tile.cpp Lines 99 to 101 in d7bc36d
And the default copy constructor will end up copying shared pointers:
So we get in a weird situation where mapbox-gl-native/src/mbgl/tile/geometry_tile_worker.cpp Lines 371 to 375 in d7bc36d
That said, I haven't actually found a bug in the logic yet: it doesn't look like we modify any of the I'll keep investigating tomorrow. |
First half of fix for issue #11538. Testing `if (pendingData)` didn't work if there _was_ a data update, but the update was "the data for this tile is now null". In that case, the tile's FeatureIndex would be updated, but the tile's data member would remain unchanged. In the case of a tile's data being deleted, the matching FeatureIndex would have an empty set of bucketLayerIDs, but the _old_ data would still be in place for querying, and the symbolBuckets might not be updated yet (pending onPlacement). In this case `bucketLayerIDs.at(indexedFeature.bucketName)` could throw an out-of-range exception.
Second half of fix for issue #11538. If a global placement took place between the time a tile's non-symbol layout updated and the time new symbol buckets arrived, the tile's new FeatureIndex would be committed, but the global CollisionIndex would be generated against the old symbolBuckets. The mismatch could cause the CollisionIndex to contain indices that didn't exist in the new FeatureIndex, and attempting to access them would generate an out-of-bounds exception.
I believe I've found the cause and have two proposed fixes in #11551. In the end, the broken logic I found was entirely in the shared |
First half of fix for issue #11538. Testing `if (pendingData)` didn't work if there _was_ a data update, but the update was "the data for this tile is now null". In that case, the tile's FeatureIndex would be updated, but the tile's data member would remain unchanged. In the case of a tile's data being deleted, the matching FeatureIndex would have an empty set of bucketLayerIDs, but the _old_ data would still be in place for querying, and the symbolBuckets might not be updated yet (pending onPlacement). In this case `bucketLayerIDs.at(indexedFeature.bucketName)` could throw an out-of-range exception.
Second half of fix for issue #11538. If a global placement took place between the time a tile's non-symbol layout updated and the time new symbol buckets arrived, the tile's new FeatureIndex would be committed, but the global CollisionIndex would be generated against the old symbolBuckets. The mismatch could cause the CollisionIndex to contain indices that didn't exist in the new FeatureIndex, and attempting to access them would generate an out-of-bounds exception.
This should be fixed in |
@ChrisLoer I’m still able to exactly reproduce #11538 (comment) after #11551. I’ll work on bringing the reproduction into our project and push a branch, so it’s less work to reproduce/iterate. |
Darn. 😞 OK back to the drawing board. |
Interesting wrinkle: this crash appears to require the presence of annotation views — commenting out |
Side note & wrinkle to your wrinkle: If I let @parrots' test run and run (after commenting out Edit: This is with excessive printf logging. Without the logging, I don't see a crash. |
So many wrinkles! @julianrex Can you post a symbolicated call stack from the |
@ChrisLoer check out |
Awesome, I can reproduce pretty easily running this version in the debugger. |
Follow up fix for issue #11538. This closes a hole in the logic where: - Layout result 1 arrived - Symbols arrives for result 1, it was marked ready for commit - Layout result 2 arrived, clearing "ready for commit" state - Global placement ran on symbols for result 1, but layout result 1 data wasn't committed because it had been replaced with layout result 2.
Fixed again with #11575. @parrots we really owe you for the reproduction case you put together -- it turns out to be a great stress-tester for a part of our code with complex timing-dependent logic. The additional problem was a hole in the logic where:
I originally prepared #11570 as a patch for the race condition, but we decided instead to pursue a larger fix that hopefully simplifies the logic in a way that will make it easier to prevent this kind of problem in the future. |
Not fixed. Platform: iOS Still getting error: libc++abi.dylib: terminating with uncaught exception of type std::out_of_range: vector While rapidly removing and adding multiple annotation views. |
@l2comdev That’s a bummer — please post any stack traces and reproduction code that you can provide. |
Just updated to 4.0.1, its rare but I'd say after 5 minutes of map panning/zooming I can generate the crash. libc++abi.dylib: terminating with uncaught exception of type std::out_of_range: vector
0x18e01178c <+236>: mov x0, x20 Thread 1: signal SIGABRT |
Updated to ios-v4.1.0-alpha.1 - No crashes since! |
Platform: iOS
Mapbox SDK version: 4.0.0-beta2
This may be related to #10844, which was included and through to be fixed in the 4.0.0-beta 2 release, however running 4.0.0-beta2 shows it isn't fixed.
Because we can not dynamically hide/show annotations without adding and removing them, I'm left rapidly adding and removing annotations. At the same time I'm also changing the coordinate on some annotations. This all happens as the user interacts with a scrollview to browse their day and the paths they took on a ski hill.
Basically I'm causing a lot of redrawing, and sometimes that leads to crashes, more-so than ever with the 4.0.0 beta 2. This has skyrocketed to be my top crasher since deploying 4.0.0 beta (needed heat maps).
Steps to trigger behavior
Expected behavior
No boom
Actual behavior
libc++abi.dylib: terminating with uncaught exception of type std::out_of_range: vector.
Full crash log from production: CrashLog.txt
MapboxCrasher.zip
The text was updated successfully, but these errors were encountered: