在iOS中使用CreateFixture在Box2D中使用EXC_BAD_ACCESS

Question

I have had multiple games on the AppStore for 5-6 years that use Cocos2D and Box2D. I've never had a problem with any of them crashing. Apple is making me update them or they'll be taken off of the AppStore. So I started to update them by updating Cocos2d and Box2d. After a few hours dealing with build errors I was ata point where I could test. I tested in the simulator on 6 devices spanning different operating system versions. I also tested on my iPhone6 10.3. I even made screen grabs at different sizes. I uploaded an archive to TestFlight and then tested that on my device.... CRASH. I then went back to test on simulator and CRASH. Now it crashes every time at the same point. I have no idea why it worked for so long and now doesn't without any code changes.

I was getting the crash on CreateBody. I then moved all the code to after world->Step and now it crashes on CreateFixture. I enabled zombies and that doesn't give me any more insight.

The game begins and it creates 2 b2Body objects and 2 b2Fixture objects (a large ring). There is also another b2Body & b2Fixture that you can move up and down (a blimp). The object is to get the blimp to go through the rings. The rings move from right to left. Once you pass or fail that ring, the ring parts are destroyed and and new ring (2 b2Bodies & 2 b2Fixtures) is created. This SECOND RING is where the crash happens. (Again, for years this has worked perfectly starting with ios 4.3 -> 10) but now trying to update with XCode 8 it won't work (even though I tested for hours and it worked fine yesterday).

Here is the ring creation code: (written 4-5 years ago when I was learning Box2D)

-(void)addRing{

int r = (arc4random() % 250) + 160;
CGPoint p = ccp(SCREEN_WIDTH+100,r);

ring_bottom = [CCSprite spriteWithFile:@"ring_bottom.png"];
[self addChild:ring_bottom z:BLIMP_BOTTOM tag:bTagRingBottom];
ring_bottom.position = ccp(p.x, p.y);

// Define the dynamic body.
//Set up a 1m squared box in the physics world
b2BodyDef bodyDef;
bodyDef.type = b2_dynamicBody;
bodyDef.position.Set(p.x/PTM_RATIO,p.y/PTM_RATIO);
bodyDef.userData = ring_bottom;
bodyDef.fixedRotation=YES;
bodyDef.gravityScale=0;
//bodyDef.position.Set(0.0, 0.1);
_ringBottom = _world->CreateBody(&bodyDef);

b2PolygonShape dynamicBox;
dynamicBox.SetAsBox(0.25, 10.0, b2Vec2(0.0,13.00), 0.0);

// Define the dynamic body fixture.
b2FixtureDef fixtureDef;
fixtureDef.shape = &dynamicBox;
fixtureDef.density = 10.0f;
fixtureDef.friction = 0.0f;
fixtureDef.isSensor = true;

_ringBottom->CreateFixture(&fixtureDef);

//----------------------------------------------------

ring_top = [CCSprite spriteWithFile:@"ring_top.png"];
[self addChild:ring_top z:GAME_LAYER tag:bTagRingTop];
ring_top.position = ccp(p.x, p.y);

// Define the dynamic body.
//Set up a 1m squared box in the physics world
b2BodyDef bodyDef2;
bodyDef2.type = b2_dynamicBody;
bodyDef2.position.Set(p.x/PTM_RATIO,p.y/PTM_RATIO);
bodyDef2.userData = ring_top;
bodyDef2.fixedRotation=YES;
bodyDef2.gravityScale=0;
_ringTop = _world->CreateBody(&bodyDef2);

b2PolygonShape dynamicBox2;
dynamicBox2.SetAsBox(0.25, 10.0, b2Vec2(0.0,-13.00), 0.0);

// Define the dynamic body fixture.
b2FixtureDef fixtureDef2;
fixtureDef2.shape = &dynamicBox2;
fixtureDef2.density = 10.0f;
fixtureDef2.friction = 0.0f;
fixtureDef2.isSensor = true;

_ringTop->CreateFixture(&fixtureDef2);
}

If I comment out the CreateFixture, It runs perfectly fine. I can't do this.

The crash is in b2Body.cpp:

b2Fixture* b2Body::CreateFixture(const b2FixtureDef* def)
{

...

fixture->Create(allocator, this, def);

...

}

And in b2Fixture.cpp

void b2Fixture::Create(b2BlockAllocator* allocator, b2Body* body, const b2FixtureDef* def)
{

...

m_shape = def->shape->Clone(allocator);

...

}

I have 5-6 apps that use Box2d & Cocos2d and I don't want to have to take them off the AppStore but I also can't start over on them. I have already written a version where the creation happens after world->Step but that didn't change anything, still crashes.

This is the code that is deleting the bodies in the tick method :

std::vector<b2Body *>toDestroy;

...

std::vector<b2Body *>::iterator pos2;
    for(pos2 = toDestroy.begin(); pos2 != toDestroy.end(); ++pos2) {
        b2Body *body = *pos2;
        if (body->GetUserData() != NULL) {
            CCSprite *sprite = (CCSprite *) body->GetUserData();
            [self removeChild:sprite cleanup:YES];
        }
        _world->DestroyBody(body);
    }

Hopefully someone can help me save these games from being removed from the AppStore. Any help is appreciated and keep in mind I haven't used Box2d in years so frankly I don't remember much about it.

EDIT: I reverted back to the older version of Cocos2d and I'm back to crashing on CreateBody. More specifically:

b2BlockAllocator.cpp

void* b2BlockAllocator::Allocate(int32 size){

...

    if (m_freeLists[index]){
        b2Block* block = m_freeLists[index];
        m_freeLists[index] = block->next; <--------------CRASH
         return block;
    } else {

     ...

    }
}

I always crash on index 6

> Printing description of this->m_freeLists:
(b2Block *[14]) m_freeLists = {
  [0] = 0x0000000000000000
  [1] = 0x0000000103ca4060
  [2] = 0x0000000103ca0080
  [3] = 0x0000000100b30120
  [4] = 0x0000000000000000
  [5] = 0x0000000103ca80a0
  [6] = 0x0000000300b2c180
  [7] = 0x0000000104240000
  [8] = 0x0000000000000000
  [9] = 0x000000010423c140
  [10] = 0x0000000000000000
  [11] = 0x0000000000000000
  [12] = 0x0000000000000000
  [13] = 0x0000000000000000
}

So next in block is null so it crashes. Another forum said a person with very similar code was trying to destroy same object multiple times. I don't see that happening.

Answer 1

So the problem, as PaulMcKenzie pointed out, is the way that I am destroying bodies. This was originally written for Xcode 4.3 and now updating for Xcode 8.3 I have a crash problem. I have no knowledge of Box2D anymore so I went for the quick fix of Destroying the fixtures and hiding the sprites and then destroying the bodies after they go off the screen. This seems to work for me for now and since I can't spend time fixing it with (erase(remove_if()), the right way, it will do for now.

I am Answering this because this is the offending code located in the tick method:

std::vector<b2Body *>::iterator pos2;
for(pos2 = toDestroy.begin(); pos2 != toDestroy.end(); ++pos2) {
    b2Body *body = *pos2;
    if (body->GetUserData() != NULL) {
        CCSprite *sprite = (CCSprite *) body->GetUserData();
        [self removeChild:sprite cleanup:YES];
    }
    _world->DestroyBody(body);
}

And it is important to rewrite this in the proper way to destroy a b2Body.

If someone writes the proper way to destroy the body I will mark it as the correct answer.