Crash with RPC invoke order

Ekinoxx · February 5, 2023, 3:16am

Hi,

It seems like I finally found a repro for a crash I’ve had for a long time
This is following up a discussion I had with @DaBestServerOwner on the discord you can find here :
https://discord.com/channels/192358910387159041/443079653624643595/1071599856440856698

The crash seems to be happenning here based on the crash informations :

github.com

citizenfx/fivem/blob/cbfe089506155921ae20aae551c1aa5951ff0d43/code/components/gta-net-five/src/ClientRPC.cpp#L513


      
          								}
          								case RpcConfiguration::ArgumentType::Entity:
          								{
          									uint32_t entity = buf->Read<uint32_t>();
          
          
									if (entity & 0x80000000)
          									{
          										entity = g_creationTokenToObjectId[entity & 0x7FFFFFFF];
          									}
          
          
									executionCtx->Push(ObjectToEntity(entity));
          
          
									break;
          								}
          								case RpcConfiguration::ArgumentType::Int:
          								case RpcConfiguration::ArgumentType::Hash:
          									executionCtx->Push(buf->Read<int>());
          									break;
          								case RpcConfiguration::ArgumentType::Float:
          									executionCtx->Push(buf->Read<float>());
          									break;

My first assumption following the creation of my repro is :
An entity is created, the clients delete it while the server is sending an RPC command
The RPC command cannot executes correctly because the entity doesn’t exist anymore

This is very timing related and the repro is based on a random ping request to try reproducing it as much as possible.

You can find the repro here : GitHub - Ekinoxx0/repro
Note: This repro is based on a “server side” object creation, just because I’m blocking any client side creation on my own server. Probably not related to the crash at all, hoping this doesn’t cause any other difficulties in the debug process.

Here is a mini dump : https://cdn.discordapp.com/attachments/443079653624643595/1071602393915068456/6c0c3f64-50fd-42fe-aff7-7a70ed37f6f2.dmp

And a full dump :
FULL DUMP

Screenshot of the crash (just as a reference) : https://i.imgur.com/tyUulcm.png

Thanks for all your work and patience.

nta · February 5, 2023, 11:01pm

Might be fixed by fix(gamestate/client): null gameobject reference in RPC · citizenfx/fivem@49c714d · GitHub, but this wasn’t tested.