Lock Simulation weak_ptr in all visitors to avoid use after free.
And swap order for weak_ptr locking with locking collision world mutex to avoid
deadlock when underlying object tries to lock the same mutex in the destructor.
Add SimulationImpl type to avoid use of FrameData without locking weak_ptr.
* Avoid inheritance.
* Define equality operators out of the class definition.
* Replace toString with toStringView where it doesn't make sense to create a string.
This prevents actors going back when a new shortest path includes a point
behind them where they were right before. Such situation can happen when path
includes off mesh connection. Resulting cost of such path can be lower than
the real one because off mesh connections are straight lines and walking
surface usually is not a plane but a surface.
Skip to path point where distance from current position to the line between
previous and this point is less than point tolerance. Which means actor is
standing very close to the edge between those points. Additionally check by
navmesh raycasting to make sure there is actually a valid path.
Choose a parent base on which node is used to iterate over children nodes.
This leads to duplicate handing of child nodes. A node will be handled so many
times how many parents it has.
For example:
p1 p2
\ /
c
Will be handled as:
p1 p2
| |
c c
If c has children they will be handled X times c is handled.
> warning: the variable 'key' is copy-constructed from a const reference but is
only used as const reference; consider making it a const reference
[performance-unnecessary-copy-initialization]
Found by clang-tidy.
=================================================================
==20931==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000206030 at pc 0x7fc8b0f3a72b bp 0x7ffcee176860 sp 0x7ffcee176008
READ of size 13 at 0x607000206030 thread T0
#0 0x7fc8b0f3a72a in __interceptor_strlen /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:389
#1 0x562e069a0af7 in QString::fromUtf8(char const*, int) /usr/include/qt/QtCore/qstring.h:706
#2 0x562e069a0af7 in Launcher::AdvancedPage::AdvancedPage(Config::GameSettings&, QWidget*) /home/elsid/dev/openmw/apps/launcher/advancedpage.cpp:29
#3 0x562e06959613 in Launcher::MainDialog::createPages() /home/elsid/dev/openmw/apps/launcher/maindialog.cpp:127
#4 0x562e069691d2 in Launcher::MainDialog::setup() /home/elsid/dev/openmw/apps/launcher/maindialog.cpp:228
#5 0x562e06969d88 in Launcher::MainDialog::showFirstRunDialog() /home/elsid/dev/openmw/apps/launcher/maindialog.cpp:188
#6 0x562e06957025 in main /home/elsid/dev/openmw/apps/launcher/main.cpp:35
#7 0x7fc8ad0d9b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#8 0x562e0690fced in _start (/home/elsid/dev/openmw/build/gcc/asan/openmw-launcher+0x56ced)
0x607000206030 is located 16 bytes inside of 64-byte region [0x607000206020,0x607000206060)
freed by thread T0 here:
#0 0x7fc8b0fb3f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x7fc8b0de3388 (/usr/lib/libopenal.so.1+0x40388)
previously allocated by thread T0 here:
#0 0x7fc8b0fb4fd6 in __interceptor_posix_memalign /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:226
#1 0x7fc8b0e379cb (/usr/lib/libopenal.so.1+0x949cb)
SUMMARY: AddressSanitizer: heap-use-after-free /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:389 in __interceptor_strlen
Shadow bytes around the buggy address:
0x0c0e80038bb0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa 00 00
0x0c0e80038bc0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
0x0c0e80038bd0: 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 00 00
0x0c0e80038be0: 00 00 02 fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c0e80038bf0: 02 fa fa fa fa fa fd fd fd fd fd fd fd fd fa fa
=>0x0c0e80038c00: fa fa fa fa fd fd[fd]fd fd fd fd fd fa fa fa fa
0x0c0e80038c10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e80038c20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e80038c30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e80038c40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e80038c50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==20931==ABORTING
