The editor crash when I load scene from the asset bundle.

I am using the Ferr2D Terrain Tool to build my scene:

And I met a problem, when I load a scene contains the Ferr2D object from asset bundle, the editor and player will crash. But when I load it using the EditorApplicaition to load the scene, everything is OK.

I am using the latest version of the Unity2018.2b10 with the .Net 4.x Equivalent and .Net Standard2.0. And the crash report is like below:

0x00007FFBC88B2375 (mono-2.0-bdwgc) [f:\dd\vctools\crt\vcruntime\src\string\amd64\memset.asm:129] memset
0x00007FFBC86B4FEB (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\boehm-gc.c:738] mono_gc_alloc_obj
0x00007FFBC8658B75 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:5506] mono_object_new_alloc_specific_checked
0x00007FFBC86590AA (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:5447] mono_object_new_specific_checked
0x00007FFBC865E4B3 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:5454] ves_icall_object_new_specific
0x00000000174717C8 (Mono JIT Code) (wrapper managed-to-native) object:__icall_wrapper_ves_icall_object_new_specific (intptr)
0x00000000174749AB (Mono JIT Code) [F:\Repositories\wind_game\Assets\Ferr\Common\2DT\Ferr2DT_Material.cs:34] Ferr2DT_Material:.ctor ()
0x0000000017474C18 (Mono JIT Code) (wrapper runtime-invoke) object:runtime_invoke_void__this__ (object,intptr,intptr,intptr)
0x00007FFBC86CA4BB (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\mini\mini-runtime.c:2809] mono_jit_runtime_invoke
0x00007FFBC8651AE2 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:2915] do_runtime_invoke
0x00007FFBC865AACF (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:2962] mono_runtime_invoke

Is this a bug for the mono? I upload the crash dump file and submit a bug.

3547255–285031–Crash_2018-06-28_112103576.zip (264 KB)

I test when I comment the constructor for the ferr2D, I met another crash:

0x00007FFBC862EAB1 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\metadata.c:5256] mono_metadata_class_equal
0x00007FFBC862C514 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\metadata.c:5091] _mono_metadata_generic_class_equal
0x00007FFBC864B80A (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\mono-hash.c:119] mono_g_hash_table_find_slot
0x00007FFBC864BC45 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\mono-hash.c:266] mono_g_hash_table_lookup
0x00007FFBC86982B9 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\reflection.c:476] mono_type_get_object_checked
0x00007FFBC86547A9 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:2135] mono_class_create_runtime_vtable
0x00007FFBC86553BD (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:1830] mono_class_vtable_full
0x00007FFBC8655303 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:1797] mono_class_vtable
0x00007FFBC8712066 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\mini\method-to-ir.c:9986] mono_method_to_ir
0x00007FFBC86C0989 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\mini\mini.c:3441] mini_method_compile
0x00007FFBC86C5541 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\mini\mini.c:4177] mono_jit_compile_method_inner
0x00007FFBC86C9962 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\mini\mini-runtime.c:2133] mono_jit_compile_method_with_opt
0x00007FFBC87A3BD6 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\mini\mini-trampolines.c:716] common_call_trampoline
0x00007FFBC87A5BF4 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\mini\mini-trampolines.c:848] mono_magic_trampoline
0x000000000E7803A3 (Mono JIT Code) <unknown class>.<unknown method>()
0x000000005946CE9B (Assembly-CSharp) Spine.Unity.SkeletonRenderer..ctor()
0x000000005946CAFB (Assembly-CSharp) Spine.Unity.SkeletonAnimation..ctor()
0x0000000059462578 (mscorlib) System.Object.runtime_invoke_void__this__()
0x00007FFBC86CA4BB (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\mini\mini-runtime.c:2809] mono_jit_runtime_invoke
0x00007FFBC8651AE2 (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:2915] do_runtime_invoke
0x00007FFBC865AACF (mono-2.0-bdwgc) [c:\buildslave\mono\build\mono\metadata\object.c:2962] mono_runtime_invoke

This time it is the Spine.Unity.SkeletonRenderer, which is a useful 2D animation tool:

The problem seems like any constructor will crash when using the asset bundle mode.

I find the crash is because I use the AssetBundle.LoadFromStream from a custom stream, with a very simple crypt process.
I load the asset bundle like this:

var file = File.OpenRead(path);
var stream = new CryptStream(file, this.Keyt);
return AssetBundle.LoadFromStream(stream, 0, this.ReadBufferSize);

And the CryptStream is like this:

    /// <summary>
    /// The crypt stream used to crypt a stream.
    /// </summary>
    public sealed class CryptStream : Stream, IDisposable
    {
        private Stream source;
        private byte[] keyt;

        /// <summary>
        /// Initializes a new instance of the <see cref="CryptStream"/> class.
        /// </summary>
        public CryptStream(Stream source, byte[] keyt)
        {
            this.source = source;
            this.keyt = keyt;
        }

        /// <inheritdoc/>
        public override long Position
        {
            get { return this.source.Position; }
            set { this.source.Position = value; }
        }

        /// <inheritdoc/>
        public override long Length
        {
            get { return this.source.Length; }
        }

        /// <inheritdoc/>
        public override bool CanWrite
        {
            get { return this.source.CanWrite; }
        }

        /// <inheritdoc/>
        public override bool CanSeek
        {
            get { return this.source.CanSeek; }
        }

        /// <inheritdoc/>
        public override bool CanRead
        {
            get { return this.source.CanRead; }
        }

        /// <inheritdoc/>
        public new void Dispose()
        {
            base.Dispose();
            this.source.Dispose();
        }

        /// <inheritdoc/>
        public override void Close()
        {
            base.Close();
            this.source.Close();
        }

        /// <inheritdoc/>
        public override void Flush()
        {
            this.source.Flush();
        }

        /// <inheritdoc/>
        public override long Seek(long offset, SeekOrigin origin)
        {
            return this.source.Seek(offset, origin);
        }

        /// <inheritdoc/>
        public override void SetLength(long value)
        {
            this.source.SetLength(value);
        }

        /// <inheritdoc/>
        public override void Write(byte[] buffer, int offset, int count)
        {
            var keptLen = this.keyt.Length;
            var keptStart = this.source.Position % keptLen;
            for (int i = 0; i < count; ++i)
            {
                var keptPos = (keptStart + i) % keptLen;
                var bufPos = offset + i;
                buffer[bufPos] = (byte)(buffer[bufPos] ^ this.keyt[keptPos]);
            }

            this.source.Write(buffer, offset, count);
        }

        /// <inheritdoc/>
        public override int Read(byte[] buffer, int offset, int count)
        {
            var keptLen = this.keyt.Length;
            var keptStart = this.source.Position % keptLen;

            var readCount = this.source.Read(buffer, offset, count);
            for (int i = 0; i < readCount; ++i)
            {
                var keptPos = (keptStart + i) % keptLen;
                var bufPos = offset + i;
                buffer[bufPos] = (byte)(buffer[bufPos] ^ this.keyt[keptPos]);
            }

            return readCount;
        }
    }

I test the encrypt and decrypt with my own code with this stream is OK. And I read the document really carefully from here:

Especially the section:
The following are restrictions on a Stream object to optimize AssetBundle data loading:

Where am I missing?

In fact I met the same problem some month ago and ask for help, but there is no repsonse:

It seems not the error from the custom Stream, but the bug for the AssetBundle.LoadFromStreamAsync

The more reliable approach is to submit a bug-report following these guidelines:

Using the official way makes sure the report is in Unity’s bug-tracking pipeline and gets processed at one point.

Yes, I submit this bug a month ago. Finally I found I met the same problem.
The most correct bug ID is 1026629