It seems there's a memory management issue in SimGear that may cause a
crash under certain conditions. (Actually I'm not totally sure why it
ever works at all, but that's another matter.)

In the routine sgLoad3DModel_internal
(scene/model/SGReaderWriterXML.cxx) there's a prop_root variable of type
SGSharedPtr<SGPropertyNode>. At some point, it may be passed to
Particles::appendParticles.

appendParticles (scene/model/particles.cxx) implicitly copies the value
into a newly allocated GlobalParticleCallback's field modelRoot, of type
SGPropertyNode*. So, when appendParticles return, there's a persistent
non-reference-counted pointer to this structure.

If there are no other references, the prop_root is automatically
destroyed when sgLoad3DModel_internal returns, causing the memory to be
freed. So, later on, when OSG wants to do something with these
particles, the freed memory is referenced and causes a crash.

I didn't see a fix for this in your git, so I've attached a quickfix,
but perhaps you prefer other solutions. And perhaps it's not the only
issue of this kind (especially since I see fgfs still crashes at exit),
but this is all I have time for right now.

Ove
Index: simgear/scene/model/particles.hxx
===================================================================
--- simgear/scene/model/particles.hxx	(revisjon 138)
+++ simgear/scene/model/particles.hxx	(revisjon 148)
@@ -99,7 +99,7 @@
 private:
     static osg::Vec3 gravity;
     static osg::Vec3 wind;
-    const SGPropertyNode* modelRoot;
+    SGSharedPtr<const SGPropertyNode> modelRoot;
     static SGConstPropertyNode_ptr enabledNode;
     static bool enabled;
 };
------------------------------------------------------------------------------
Got Input?   Slashdot Needs You.
Take our quick survey online.  Come on, we don't ask for help often.
Plus, you'll get a chance to win $100 to spend on ThinkGeek.
http://p.sf.net/sfu/slashdot-survey
_______________________________________________
Flightgear-devel mailing list
Flightgear-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/flightgear-devel

Reply via email to