Re: [Pyode-user] bug: read from free'd memory when joint in jointgroup

[Matthias B. <ba...@ir...>]

Chris Bainbridge wrote:
> Argh, I spoke too soon. It fixed the problem, mostly, but I am still
> getting double frees. I think the problem now is that dWorldDestroy is
> destroying all of the joints that aren't part of a joint group, and
> then the destructors again get called by pyode when the joint object
> is freed. From your fix it looks like every python Joint object that
> isn't in a group will have to be notified about the destruction of the
> underlying object in World.__dealloc__

Well, unfortunately, the ownership rules in ODE (if there are any) are 
rather vague. Who is the owner of a joint object who is responsible for 
the destruction of the object? In PyODE it's basically the Python Joint 
object that takes care of destroying the ODE joint (i.e. dJointDestroy() 
is always called inside __dealloc__()). If other objects take over 
ownership (such as the joint group or the world) and destroy the ODE 
joint they have to notify the corresponding Python Joint object about 
this by calling the _destroyed() method. Then the Python Joint object 
will not destroy the ODE joint again.

Now the situation you describe above (i.e. dWorldDestroy() is called 
before the Python joints are deallocated) shouldn't occur because the 
Python joints keep a reference to the World object they are in. I did 
this so that the World object is deallocated after the joints. But I'm 
not sure if Python really cares about the reference counts when the 
interpreter is actually shut down.

Does the crash in your program occur at the time the program is being 
terminated or does it also happen while the program is running?

- Matthias -