Bug / Crash 100% reproducible crash in Oni::RawPinConstraintBatch::EvaluateConstraint

[josemendez]

Wow, just wrote a reply and lost it because zip file was attached.


So, thanks for a quick reply. I'm not using the experimental "Configurable Enter Play Mode" feature (even though I tired to  ). I'm on macOS Mojave 10.14.6 + Unity 2019.3.0f6 + Obi5.1. Here is a minimal repro project - https://www.dropbox.com/s/7o441ajp3rhncn...t.zip?dl=0
Steps to repro:
1. open HarpoonTest scene
2. Play
3. click anywhere
4. 100% reproducible crash
I believe I'm doing something bad in HarpoonBehaviour.LaunchHook() (it is a modified version of an example). Please let me know how to fix it or if you need more info on the issue.

Hi,

You've added just one pin constraint, but immediately after that you declare that the amount of active constraints is 2:

batch.AddConstraint(blueprint.activeParticleCount - 1, target.GetComponent<Collider>().GetComponent<ObiColliderBase>(),
                                                         target.GetComponent<Collider>().transform.InverseTransformPoint(target.transform.position), Quaternion.identity);
       batch.activeConstraintCount = 2;

This will of course cause an out of bounds access and possibly an immediate crash (if you're lucky). Note that constraint data is not checked for bounds or null accesses in Oni (the internal physics engine) for performance reasons, so by doing this the engine is accessing memory past the end of the constraints array. Working with constraints is similar to working with Unity DOTS with safety checks disabled. From the docs:

As mentioned above, the size you pass must not be larger than the actual length of the array. Behavior is undefined (including the possibility of a crash) if you pass an array length that is larger than the actual length.

Solution - just change it to:

batch.activeConstraintCount = 1;