sol2: Crash when call protected_function

In my PingPong test, will crash, when C++ call protected_function on timer timeout.

[irons@localhost Joynet]$ valgrind lua examples/PingpongClient-PB.lua ==6034== Memcheck, a memory error detector ==6034== Copyright © 2002-2013, and GNU GPL’d, by Julian Seward et al. ==6034== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info ==6034== Command: lua examples/PingpongClient-PB.lua ==6034== ==6034== Invalid read of size 8 ==6034== at 0x404C52: index2addr (in /usr/local/bin/lua) ==6034== by 0x405BCE: lua_rawgeti (in /usr/local/bin/lua) ==6034== by 0x5F98588: std::_Function_handler<void (), std::_Bind<CoreDD::startLuaTimer(int, sol::basic_protected_functionsol::reference)::{lambda()#1} ()> >::_M_invoke(std::Any_data const&) (in /home/irons/Joynet/Joynet.so) ==6034== by 0x5FB9C8A: TimerMgr::Schedule() (in /home/irons/Joynet/Joynet.so) ==6034== by 0x5F9E4D0: int sol::detail::static_trampoline<&(int sol::usertype_metatable<CoreDD, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul, 10ul, 11ul, 12ul, 13ul, 14ul>, char const (&) [13], void (CoreDD::)(), char const (&) [15], long (CoreDD::)(), char const (&) [5], void (CoreDD::)(), char const (&) [17], int (CoreDD::)(), char const (&) [7], void (CoreDD::)(int, char const, int), char const (&) [11], long (CoreDD::)(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&), char const (&) [14], long (CoreDD::)(int, sol::basic_protected_functionsol::reference), char const (&) [12], void (CoreDD::)(long), char const (&) [19], void (CoreDD::)(int, long), char const (&) [16], void (CoreDD::)(int, long), char const (&) [17], void (CoreDD::)(int, long, char const*, int), char const (&) [20], bool (CoreDD::)(int, int, long, bool), char const (&) [13], long (CoreDD::)(char const*, int, int), char const (&) [4], sol::constructor_list<sol::types<> >&, char const (&) [5], sol::destructor_wrapper<void> const&>::real_call<5ul, true, false>(lua_State*))>(lua_State*) (in /home/irons/Joynet/Joynet.so) ==6034== by 0x4085CE: luaD_precall (in /usr/local/bin/lua) ==6034== by 0x413384: luaV_execute (in /usr/local/bin/lua) ==6034== by 0x4089AE: luaD_call (in /usr/local/bin/lua) ==6034== by 0x408A00: luaD_callnoyield (in /usr/local/bin/lua) ==6034== by 0x407E1B: luaD_rawrunprotected (in /usr/local/bin/lua) ==6034== by 0x408C4C: luaD_pcall (in /usr/local/bin/lua) ==6034== by 0x40630B: lua_pcallk (in /usr/local/bin/lua) ==6034== Address 0x5c81a18 is 40 bytes inside a block of size 216 free’d ==6034== at 0x4C2AD17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==6034== by 0x4155B8: l_alloc (in /usr/local/bin/lua) ==6034== by 0x40B5FD: luaM_realloc (in /usr/local/bin/lua) ==6034== by 0x40AC22: sweeplist (in /usr/local/bin/lua) ==6034== by 0x40AD39: sweepstep (in /usr/local/bin/lua) ==6034== by 0x40B43D: luaC_step (in /usr/local/bin/lua) ==6034== by 0x405726: lua_pushlstring (in /usr/local/bin/lua) ==6034== by 0x4213D3: str_sub (in /usr/local/bin/lua) ==6034== by 0x4085CE: luaD_precall (in /usr/local/bin/lua) ==6034== by 0x413384: luaV_execute (in /usr/local/bin/lua) ==6034== by 0x40885F: unroll (in /usr/local/bin/lua) ==6034== by 0x407E1B: luaD_rawrunprotected (in /usr/local/bin/lua) ==6034== ==6034== Invalid read of size 8 ==6034== at 0x404CD0: index2addr (in /usr/local/bin/lua) ==6034== by 0x405BCE: lua_rawgeti (in /usr/local/bin/lua) ==6034== by 0x5F98588: std::_Function_handler<void (), std::_Bind<CoreDD::startLuaTimer(int, sol::basic_protected_functionsol::reference)::{lambda()#1} ()> >::_M_invoke(std::Any_data const&) (in /home/irons/Joynet/Joynet.so) ==6034== by 0x5FB9C8A: TimerMgr::Schedule() (in /home/irons/Joynet/Joynet.so) ==6034== by 0x5F9E4D0: int sol::detail::static_trampoline<&(int sol::usertype_metatable<CoreDD, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul, 10ul, 11ul, 12ul, 13ul, 14ul>, char const (&) [13], void (CoreDD::)(), char const (&) [15], long (CoreDD::)(), char const (&) [5], void (CoreDD::)(), char const (&) [17], int (CoreDD::)(), char const (&) [7], void (CoreDD::)(int, char const, int), char const (&) [11], long (CoreDD::)(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&), char const (&) [14], long (CoreDD::)(int, sol::basic_protected_functionsol::reference), char const (&) [12], void (CoreDD::)(long), char const (&) [19], void (CoreDD::)(int, long), char const (&) [16], void (CoreDD::)(int, long), char const (&) [17], void (CoreDD::)(int, long, char const*, int), char const (&) [20], bool (CoreDD::)(int, int, long, bool), char const (&) [13], long (CoreDD::)(char const*, int, int), char const (&) [4], sol::constructor_list<sol::types<> >&, char const (&) [5], sol::destructor_wrapper<void> const&>::real_call<5ul, true, false>(lua_State*))>(lua_State*) (in /home/irons/Joynet/Joynet.so) ==6034== by 0x4085CE: luaD_precall (in /usr/local/bin/lua) ==6034== by 0x413384: luaV_execute (in /usr/local/bin/lua) ==6034== by 0x4089AE: luaD_call (in /usr/local/bin/lua) ==6034== by 0x408A00: luaD_callnoyield (in /usr/local/bin/lua) ==6034== by 0x407E1B: luaD_rawrunprotected (in /usr/local/bin/lua) ==6034== by 0x408C4C: luaD_pcall (in /usr/local/bin/lua) ==6034== by 0x40630B: lua_pcallk (in /usr/local/bin/lua) ==6034== Address 0x5c81a10 is 32 bytes inside a block of size 216 free’d ==6034== at 0x4C2AD17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==6034== by 0x4155B8: l_alloc (in /usr/local/bin/lua) ==6034== by 0x40B5FD: luaM_realloc (in /usr/local/bin/lua) ==6034== by 0x40AC22: sweeplist (in /usr/local/bin/lua) ==6034== by 0x40AD39: sweepstep (in /usr/local/bin/lua) ==6034== by 0x40B43D: luaC_step (in /usr/local/bin/lua) ==6034== by 0x405726: lua_pushlstring (in /usr/local/bin/lua) ==6034== by 0x4213D3: str_sub (in /usr/local/bin/lua) ==6034== by 0x4085CE: luaD_precall (in /usr/local/bin/lua) ==6034== by 0x413384: luaV_execute (in /usr/local/bin/lua) ==6034== by 0x40885F: unroll (in /usr/local/bin/lua) ==6034== by 0x407E1B: luaD_rawrunprotected (in /usr/local/bin/lua) ==6034== ==6034== Invalid read of size 8 ==6034== at 0x405BD5: lua_rawgeti (in /usr/local/bin/lua) ==6034== by 0x5F98588: std::_Function_handler<void (), std::_Bind<CoreDD::startLuaTimer(int, sol::basic_protected_functionsol::reference)::{lambda()#1} ()> >::_M_invoke(std::Any_data const&) (in /home/irons/Joynet/Joynet.so) ==6034== by 0x5FB9C8A: TimerMgr::Schedule() (in /home/irons/Joynet/Joynet.so) ==6034== by 0x5F9E4D0: int sol::detail::static_trampoline<&(int sol::usertype_metatable<CoreDD, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul, 10ul, 11ul, 12ul, 13ul, 14ul>, char const (&) [13], void (CoreDD::)(), char const (&) [15], long (CoreDD::)(), char const (&) [5], void (CoreDD::)(), char const (&) [17], int (CoreDD::)(), char const (&) [7], void (CoreDD::)(int, char const, int), char const (&) [11], long (CoreDD::)(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&), char const (&) [14], long (CoreDD::)(int, sol::basic_protected_functionsol::reference), char const (&) [12], void (CoreDD::)(long), char const (&) [19], void (CoreDD::)(int, long), char const (&) [16], void (CoreDD::)(int, long), char const (&) [17], void (CoreDD::)(int, long, char const*, int), char const (&) [20], bool (CoreDD::)(int, int, long, bool), char const (&) [13], long (CoreDD::)(char const*, int, int), char const (&) [4], sol::constructor_list<sol::types<> >&, char const (&) [5], sol::destructor_wrapper<void> const&>::real_call<5ul, true, false>(lua_State*))>(lua_State*) (in /home/irons/Joynet/Joynet.so) ==6034== by 0x4085CE: luaD_precall (in /usr/local/bin/lua) ==6034== by 0x413384: luaV_execute (in /usr/local/bin/lua) ==6034== by 0x4089AE: luaD_call (in /usr/local/bin/lua) ==6034== by 0x408A00: luaD_callnoyield (in /usr/local/bin/lua) ==6034== by 0x407E1B: luaD_rawrunprotected (in /usr/local/bin/lua) ==6034== by 0x408C4C: luaD_pcall (in /usr/local/bin/lua) ==6034== by 0x40630B: lua_pcallk (in /usr/local/bin/lua) ==6034== by 0x403FC6: docall (in /usr/local/bin/lua) ==6034== Address 0x5c81a08 is 24 bytes inside a block of size 216 free’d ==6034== at 0x4C2AD17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==6034== by 0x4155B8: l_alloc (in /usr/local/bin/lua) ==6034== by 0x40B5FD: luaM_realloc (in /usr/local/bin/lua) ==6034== by 0x40AC22: sweeplist (in /usr/local/bin/lua) ==6034== by 0x40AD39: sweepstep (in /usr/local/bin/lua) ==6034== by 0x40B43D: luaC_step (in /usr/local/bin/lua) ==6034== by 0x405726: lua_pushlstring (in /usr/local/bin/lua) ==6034== by 0x4213D3: str_sub (in /usr/local/bin/lua) ==6034== by 0x4085CE: luaD_precall (in /usr/local/bin/lua) ==6034== by 0x413384: luaV_execute (in /usr/local/bin/lua) ==6034== by 0x40885F: unroll (in /usr/local/bin/lua) ==6034== by 0x407E1B: luaD_rawrunprotected (in /usr/local/bin/lua) ==6034== ==6034== Invalid write of size 8 ==6034== at 0x405BE5: lua_rawgeti (in /usr/local/bin/lua) ==6034== by 0x5F98588: std::_Function_handler<void (), std::_Bind<CoreDD::startLuaTimer(int, sol::basic_protected_functionsol::reference)::{lambda()#1} ()> >::_M_invoke(std::Any_data const&) (in /home/irons/Joynet/Joynet.so) ==6034== by 0x5FB9C8A: TimerMgr::Schedule() (in /home/irons/Joynet/Joynet.so) ==6034== by 0x5F9E4D0: int sol::detail::static_trampoline<&(int sol::usertype_metatable<CoreDD, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul, 10ul, 11ul, 12ul, 13ul, 14ul>, char const (&) [13], void (CoreDD::)(), char const (&) [15], long (CoreDD::)(), char const (&) [5], void (CoreDD::)(), char const (&) [17], int (CoreDD::)(), char const (&) [7], void (CoreDD::)(int, char const, int), char const (&) [11], long (CoreDD::)(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&), char const (&) [14], long (CoreDD::)(int, sol::basic_protected_functionsol::reference), char const (&) [12], void (CoreDD::)(long), char const (&) [19], void (CoreDD::)(int, long), char const (&) [16], void (CoreDD::)(int, long), char const (&) [17], void (CoreDD::)(int, long, char const*, int), char const (&) [20], bool (CoreDD::)(int, int, long, bool), char const (&) [13], long (CoreDD::)(char const*, int, int), char const (&) [4], sol::constructor_list<sol::types<> >&, char const (&) [5], sol::destructor_wrapper<void> const&>::real_call<5ul, true, false>(lua_State*))>(lua_State*) (in /home/irons/Joynet/Joynet.so) ==6034== by 0x4085CE: luaD_precall (in /usr/local/bin/lua) ==6034== by 0x413384: luaV_execute (in /usr/local/bin/lua) ==6034== by 0x4089AE: luaD_call (in /usr/local/bin/lua) ==6034== by 0x408A00: luaD_callnoyield (in /usr/local/bin/lua) ==6034== by 0x407E1B: luaD_rawrunprotected (in /usr/local/bin/lua) ==6034== by 0x408C4C: luaD_pcall (in /usr/local/bin/lua) ==6034== by 0x40630B: lua_pcallk (in /usr/local/bin/lua) ==6034== by 0x403FC6: docall (in /usr/local/bin/lua) ==6034== Address 0x5c911d0 is 16 bytes inside a block of size 1,280 free’d ==6034== at 0x4C2AD17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==6034== by 0x4155B8: l_alloc (in /usr/local/bin/lua) ==6034== by 0x40B5FD: luaM_realloc (in /usr/local/bin/lua) ==6034== by 0x40FC1F: luaE_freethread (in /usr/local/bin/lua) ==6034== by 0x40AC22: sweeplist (in /usr/local/bin/lua) ==6034== by 0x40AD39: sweepstep (in /usr/local/bin/lua) ==6034== by 0x40B43D: luaC_step (in /usr/local/bin/lua) ==6034== by 0x405726: lua_pushlstring (in /usr/local/bin/lua) ==6034== by 0x4213D3: str_sub (in /usr/local/bin/lua) ==6034== by 0x4085CE: luaD_precall (in /usr/local/bin/lua) ==6034== by 0x413384: luaV_execute (in /usr/local/bin/lua) ==6034== by 0x40885F: unroll (in /usr/local/bin/lua)

I use CentOS Linux release 7.2.1511 (Core) 64-bit (Host in VMWare 12 of Win10), and Lua 5.3.

But when I only test timer https://github.com/IronsDu/Joynet/blob/dev/examples/TestLuaTimer.lua, none crash.

If you want test, you will compiler Joynet https://github.com/IronsDu/Joynet/tree/dev , and compiler lua protobuf binding https://github.com/cloudwu/pbc/tree/master/binding/lua53. (I push my protobuf.so, maybe you can’t use).

For test, enter Joynet dir, run:

1: lua examples/PingpongServer-PB.lua 2: lua examples/PingpongClient-PB.lua

Thanks.