Skip to content

(removed)#894

Closed
labolado wants to merge 1 commit into
coronalabs:masterfrom
labolado:fix/physics-uaf-upstream
Closed

(removed)#894
labolado wants to merge 1 commit into
coronalabs:masterfrom
labolado:fix/physics-uaf-upstream

Conversation

@labolado

@labolado labolado commented Apr 8, 2026

Copy link
Copy Markdown

No description provided.

~DisplayObjectExtensions previously checked GetParent() before clearing
b2Body userData. GetParent() returns NULL for objects with
IsRenderedOffScreen flag (snapshot.group, canvas texture cache groups),
causing SetUserData(NULL) to be skipped. This leaves dangling pointers
in the Box2D world body list, which StepWorld dereferences on the next
frame, causing SIGSEGV.

The fix removes the parent dependency and unconditionally clears userData.
This is safe because SetUserData(NULL) has no side effects and the body
is lazily destroyed by StepWorld when it finds NULL userData.
@clang-clang-clang

Copy link
Copy Markdown
Contributor

Hi, just curious, is it 6 FPS during testing or just a typo? Thanks.

    ...
    if frame >= 360 then
        print("PASS: 60 seconds without crash")
        os.exit(0)
    end
    ...

@labolado

labolado commented Apr 8, 2026

Copy link
Copy Markdown
Author

Good catch — that was leftover test infrastructure. Updated the PR with a clean minimal reproduction (7 lines for macOS + MallocScribble, full test for iOS).

@labolado labolado changed the title Fix physics use-after-free crash for offscreen display objects (removed) Apr 15, 2026
@labolado labolado closed this Apr 15, 2026
@labolado labolado deleted the fix/physics-uaf-upstream branch June 16, 2026 05:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants