EXC_BAD_ACCESS from mvkUpdateDescriptorSets on macOS

[rtwomey]

Found in latest vkQuake 564c14d and MoltenVK edbdcf05, compiled with debug enabled, on macOS 14.5 with M3 Max:

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0xf90013e3f81e889a -> 0x000013e3f81e889a (possible pointer authentication failure)
Exception Codes:       0x0000000000000001, 0xf90013e3f81e889a

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xf90013e3f81e889a)
  * frame #0: 0x0000000102da7720 libMoltenVK.dylib`mvkUpdateDescriptorSets(writeCount=8, pDescriptorWrites=0x000000016fd9d2b0, copyCount=0, pDescriptorCopies=0x0000000000000000) at MVKDescriptorSet.mm:1100:66
    frame #1: 0x0000000102dd8d84 libMoltenVK.dylib`vkUpdateDescriptorSets(device=0x0000000124815618, writeCount=8, pDescriptorWrites=0x000000016fd9d2b0, copyCount=0, pDescriptorCopies=0x0000000000000000) at vulkan.mm:1257:2
    frame #2: 0x00000001000ccd80 vkquake`GL_UpdateLightmapDescriptorSets at r_brush.c:1889:3 [opt]
    frame #3: 0x000000010003ba44 vkquake`R_NewMap at gl_rmisc.c:3866:2 [opt]
    frame #4: 0x0000000100010ae0 vkquake`CL_ParseServerMessage [inlined] CL_ParseServerInfo at cl_parse.c:1040:2 [opt]
    frame #5: 0x0000000100010990 vkquake`CL_ParseServerMessage at cl_parse.c:1840:4 [opt]
    frame #6: 0x000000010000d870 vkquake`CL_ReadFromServer at cl_main.c:950:3 [opt]
    frame #7: 0x00000001000552a0 vkquake`_Host_Frame(time=<unavailable>) at host.c:957:3 [opt]
    frame #8: 0x00000001000554c4 vkquake`Host_Frame(time=<unavailable>) at host.c:1003:3 [opt] [artificial]
    frame #9: 0x00000001000797d8 vkquake`main(argc=<unavailable>, argv=<unavailable>) at main_sdl.c:122:4 [opt]
    frame #10: 0x000000018ad920e0 dyld`start + 2360

See also: vkQuake issue.

[alexey-lysiuk]

The same crash happens on Intel Mac as well using MoltenVK 1.2.9 and 1.2.10. I didn't try with older versions though.

[aerofly]

I can confirm this crash as well in another game we developed. It does not happen with MoltenVK 1.2.9.

[richard-lunarg]

FWIW, I just did a build of vkQuake off the master branch on my M1 Mac with 1.2.10 and it seems to run fine here. So, maybe something that came along after M1 in the feature set.

[rtwomey]

FWIW, I just did a build of vkQuake off the master branch on my M1 Mac with 1.2.10 and it seems to run fine here. So, maybe something that came along after M1 in the feature set.

Can you try with the Immortal Lock with vkQuake? I'm able to get this crash using the following command from the linked issue: build/vkquake -basedir ~/Games/Quake -heapsize 6291456 -game immortal +map immortal.

[billhollings]

Can you try with the Immortal Lock with vkQuake? I'm able to get this crash using the following command from the linked issue: build/vkquake -basedir ~/Games/Quake -heapsize 6291456 -game immortal +map immortal.

I'm trying to replicate this locally. I followed the install instructions, grabbed an Id1 from elsewhere, and attempted to run via the command suggested above:

build/vkquake -basedir ~/Documents/Dev/iOSProjects/Molten/Support/2024/MVK_2282 -heapsize 6291456 -game immortal +map immortal

Unfortunately it's not launching correctly. This is as far as it gets, so I'm clearly missing something, and help would be appreciated:

[richard-lunarg]

Press the ~ key. You should get a menu.

[billhollings]

Press the ~ key. You should get a menu.

Got it. Thanks.

I can start the game, walk around, shoot creatures, without faults.

• Is there something further I need to do to trigger the failures?
• Is there a way to validate that I'm in the reported faulty Immortal Lock scene?
• Is this only happening on particular GPUs?

I'm running on:

• Apple Silicon M3
• macOS 14.5
• vkQuake 5c264f0 (HEAD when I cloned)
• MoltenVK 1.2.10

[Perlence]

@billhollings The base game works fine. However, the main map of the mod The Immortal Lock doesn't load. It does load on the Windows builds of vkQuake though.

In your case, it looks like the engine didn't load the mod properly. Is the immortal folder next to id1 as shown in the picture?

[MrGcGamer]

Tried to set this up on:

AMD - RX6600XT
macOS 12.6.1
vkQuake 5c264f0 (HEAD when I cloned)
MoltenVK 1.2.10

got an exception as well.

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000005d50
Exception Codes:       0x0000000000000001, 0x0000000000005d50
Exception Note:        EXC_CORPSE_NOTIFY

Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   libMoltenVK.dylib             	       0x107553458 mvkUpdateDescriptorSets(unsigned int, VkWriteDescriptorSet const*, unsigned int, VkCopyDescriptorSet const*) + 104
1   libMoltenVK.dylib             	       0x107565c98 vkUpdateDescriptorSets + 56
2   vkquake                       	       0x105da1b07 GL_UpdateLightmapDescriptorSets + 231
3   vkquake                       	       0x105ceb946 R_NewMap + 310
4   vkquake                       	       0x105cbadce CL_ParseServerMessage + 12110
5   vkquake                       	       0x105cb728a CL_ReadFromServer + 138
6   vkquake                       	       0x105d0c91e _Host_Frame + 1678
7   vkquake                       	       0x105d412e4 main + 372
8   dyld                          	       0x109edd52e start + 462

[billhollings]

In your case, it looks like the engine didn't load the mod properly. Is the immortal folder next to id1 as shown in the picture?

No. I just cloned the vkQuake repo, per the install instructions, and retrieved Id1 from another install.

How do I acquire and install the required Immortal Lock mod? And once I get into the app, what do I need to do to get it to fail?

Here's my basedir (the .xcodeproj is so I can launch the app from Xcode to debug).

[MrGcGamer]

@billhollings

How do I acquire and install the required Immortal Lock mod? And once I get into the app, what do I need to do to get it to fail?

You can get the mod from the website Perlence linked.
This will lead you to the google drive where it's hosted.

The immortal folder just needs to be in the same dir as the id1 folder (the basedir).
It will just crash instantly upon invoking the command in the terminal.

[billhollings]

It looks like this issue is caused by the app creating a VkDescriptorPool with 32 VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE descriptors, and then attempting to allocate many more (at least 188) descriptors of that type from the pool.

[mvk-warn] VK_ERROR_OUT_OF_POOL_MEMORY: VkDescriptorPool exhausted pool of 32 VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE descriptors. Allocating dynamically.
VkDescriptorPool 0x13640b400 with 4480 descriptor sets, and pooled descriptors:
	VK_DESCRIPTOR_TYPE_UNIFORM_BUFFER:           32  (31 remaining)
	VK_DESCRIPTOR_TYPE_STORAGE_BUFFER:           544  (402 remaining)
	VK_DESCRIPTOR_TYPE_UNIFORM_BUFFER_DYNAMIC:   544  (450 remaining)
	VK_DESCRIPTOR_TYPE_STORAGE_BUFFER_DYNAMIC:   0  (0 remaining)
	VK_DESCRIPTOR_TYPE_INLINE_UNIFORM_BLOCK_EXT: 0  (0 remaining)
	VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE:            32  (0 remaining)
	VK_DESCRIPTOR_TYPE_STORAGE_IMAGE:            4384  (4321 remaining)
	VK_DESCRIPTOR_TYPE_INPUT_ATTACHMENT:         32  (31 remaining)
	VK_DESCRIPTOR_TYPE_SAMPLER:                  0  (0 remaining)
	VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER:   4641  (3208 remaining)
	VK_DESCRIPTOR_TYPE_UNIFORM_TEXEL_BUFFER:     32  (31 remaining)
	VK_DESCRIPTOR_TYPE_STORAGE_TEXEL_BUFFER:     0  (0 remaining)

Once the pool was exhausted, MoltenVK returned VK_ERROR_OUT_OF_POOL_MEMORY, but the app ignores this, and also ignores the VK_NULL_HANDLE returned for the VkDescriptorSet.

The Vulkan spec says:

If a call to vkAllocateDescriptorSets would cause the total number of descriptor sets allocated from the pool to exceed the value of VkDescriptorPoolCreateInfo::maxSets used to create pAllocateInfo->descriptorPool, then the allocation may fail due to lack of space in the descriptor pool. Similarly, the allocation may fail due to lack of space if the call to vkAllocateDescriptorSets would cause the number of any given descriptor type to exceed the sum of all the descriptorCount members of each element of VkDescriptorPoolCreateInfo::pPoolSizes with a type equal to that type.

MoltenVK chose to fail and report in both of these situations. If this is running successfully on Vulkan implementations on other platforms, then those implementations are being more forgiving with the rules, and are choosing not to fail when the pool is exhausted of a particular descriptor type.

However, the app code should not rely on this, as any implementation could choose to be strict. And the spec intention is that apps can use the failure feedback to create additional descriptor pools as necessary.

MoltenVK PR #2291 fixes the issue here by embracing the may spec directive above for descriptor allocation, and allowing descriptors to be dynamically allocated once the descriptors of a particularly type in the pool are exhausted. MoltenVK will still report a failure if the VkDescriptorPoolCreateInfo::maxSets limit is breached.

BTW...the VkDescriptorSetLayout that uses VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE has a curious pattern for that descriptor type, and I would hazard a guess that the additional VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE binding may have been added to the layout, without the descriptor pool being adjusted accordingly?

[mvk-debug] Created VkDescriptorSetLayout 0x600003ddce40 with 8 bindings:
	0: VK_DESCRIPTOR_TYPE_STORAGE_IMAGE              with 1 elements at binding 0
	1: VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE              with 1 elements at binding 1
	2: VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE              with 3 elements at binding 2
	5: VK_DESCRIPTOR_TYPE_STORAGE_BUFFER             with 1 elements at binding 3
	6: VK_DESCRIPTOR_TYPE_STORAGE_BUFFER             with 1 elements at binding 4
	7: VK_DESCRIPTOR_TYPE_UNIFORM_BUFFER_DYNAMIC     with 1 elements at binding 5
	8: VK_DESCRIPTOR_TYPE_UNIFORM_BUFFER_DYNAMIC     with 1 elements at binding 6
	9: VK_DESCRIPTOR_TYPE_STORAGE_BUFFER             with 1 elements at binding 7

[MrGcGamer]

I can confirm: With the MoltenVK build from the PR, the immortal mod doesn't crash anymore, but I am getting a lot of vertex explosions from the enemies on the map.