Double free crash on b2Array_Grow

[onehundredfeet]

Make sure these boxes are checked before submitting your issue - thank you!

I'm getting a crash on b2Array_Grow. The capacity of the array coming in is 0 and I'm getting a double free error. I'm going to continue debugging and see if I can figure it out. But in case it's obvious to anyone here I wanted to put this up.

• [X ] Ask for help on discord and/or reddit
• [X] Consider providing a dump file using b2World::Dump

[onehundredfeet]

It seems to be when it's pushing an event. The array that gets passed in has already been freed on the second push.

[onehundredfeet]

found the bug. Preparing a PR. It was

if (hit == true)
                {
                    event.normal = contactSim->manifold.normal;

                    b2CheckId(world->shapeArray, contactSim->shapeIdA);
                    b2CheckId(world->shapeArray, contactSim->shapeIdB);
                    b2Shape* shapeA = world->shapeArray + contactSim->shapeIdA;
                    b2Shape* shapeB = world->shapeArray + contactSim->shapeIdB;

                    event.shapeIdA = (b2ShapeId){shapeA->id + 1, world->worldId, shapeA->revision};
                    event.shapeIdB = (b2ShapeId){shapeB->id + 1, world->worldId, shapeB->revision};

                    b2Array_Push(events, event);
                }

Events is a temporary variable. it needs to be:

if (hit == true)
                {
                    event.normal = contactSim->manifold.normal;

                    b2CheckId(world->shapeArray, contactSim->shapeIdA);
                    b2CheckId(world->shapeArray, contactSim->shapeIdB);
                    b2Shape* shapeA = world->shapeArray + contactSim->shapeIdA;
                    b2Shape* shapeB = world->shapeArray + contactSim->shapeIdB;

                    event.shapeIdA = (b2ShapeId){shapeA->id + 1, world->worldId, shapeA->revision};
                    event.shapeIdB = (b2ShapeId){shapeB->id + 1, world->worldId, shapeB->revision};

                    b2Array_Push(world->contactHitArray, event);
                }

[onehundredfeet]

https://github.com/erincatto/box2c/pull/166

[erincatto]

This was fixed. Thanks for the report!