null pointer dereference - (ParticleSystemParticles::CopyToArrayAOS) after Unity Update

Unity Engine
, ,
5

Hi,
I encountered a similar issue about ParticleSystem before: Unity 2022.2.1f1 iOS Build crash (possibly with ParticleSystemGeometryJob?) .

Based on the callstack of crash and your code, I created a minimal project to reproduce the issue using Unity 2020.3.47.

Here is the code (Full project is in the attachment below):

public class Test : MonoBehaviour
{
    public GameObject Prefab;
    public int MaxCount;
    public int BatchSize;
    public int[] RandomFrameRange;

    private void Start()
    {
        Application.runInBackground = true;

        for (int i = 0; i < MaxCount / BatchSize; ++i)
            StartCoroutine(Execute(BatchSize));
    }

    private IEnumerator Execute(int batchSize)
    {
        var pss = new List<ParticleSystem>(batchSize);

        while (true)
        {
            for (int i = 0; i < batchSize; ++i)
            {
                var go = Instantiate(Prefab);
                var ps = go.GetComponent<ParticleSystem>();
                pss.Add(ps);
            }

            int frames = Random.Range(RandomFrameRange[0], RandomFrameRange[1]);
            while (frames-- > 0)
                yield return null;

            for (int i = 0; i < batchSize; ++i)
            {
                var particles = new ParticleSystem.Particle[pss[i].particleCount];
                pss[i].GetParticles(particles);
            }

            frames = 5;
            while (frames-- > 0)
                yield return null;

            for (int i = 0; i < batchSize; ++i)
            {
                Destroy(pss[i]);
            }

            pss.Clear();

            yield return null;
        }
    }
}

The project can reproduce the issue in minutes on the following devices:

  • Mi 10
  • Redmi 8A
  • iPhone 6s

I think it’s an issue about race condition: some data is being created when ParticleSystem.GetParticles is called, and at the same time, ParticleSystemParticles::CopyToArrayAOS tries to use that data.

The project has been submitted to Unity: IN-40907.

9009394–1241863–ParticleSystemCrash.zip (29.4 KB)