fix(opl): refuse property list invalidation raised from inside GetProperties (#2555)
## The bug
Any property getter reached from `GetProperties` that calls `InvalidateProperties` takes the tooltip build down with it:
```
System.ArgumentNullException: Value cannot be null. (Parameter 'array')
at Server.ObjectPropertyList.AppendStringDirect(String value)
at Server.Mobiles.PlayerMobile.GetProperties(IPropertyList list)
```
`InvalidateProperties` rebuilds **in place** — `Reset()`, then `GetProperties()` again on the same instance — and `Reset()` does two destructive things to a build already in flight:
1. **It returns the pooled interpolation buffer.** The compiler rents it in the handler ctor and returns it in the closing `Add`, so *every hole is evaluated while it is live*:
```csharp
var handler = new InterpolatedStringHandler(1, 2, list); // InitializeInterpolation() RENTS
handler.AppendFormatted(pl.Rank.Title); // <-- getter runs HERE
handler.AppendLiteral("\t");
handler.AppendFormatted(faction.Definition.PropName);
list.Add(1060776, ref handler); // consumes span, RETURNS
```
```
GetProperties(list)
├─ InitializeInterpolation() -> _arrayToReturnToPool = Rent(256) buffer LIVE
├─ « hole 1: pl.Rank.Title »
│ └─ PlayerState.Rank.get (lazy recompute)
│ └─ Invalidate() -> InvalidateProperties() -> m_PropertyList.Reset()
│ └─ Dispose(): Return(buf); _arrayToReturnToPool = null buffer GONE
└─ handler.AppendFormatted("Knight")
└─ _arrayToReturnToPool.AsSpan(_pos..)
└─ ArgumentNullException (Parameter 'array')
```
It surfaces as `ArgumentNullException` rather than `NullReferenceException` because the `Range` overload of `AsSpan` must read `array.Length`, so the BCL null-checks and names the parameter `array`.
2. **It rewinds the packet cursor**, so properties already written are overwritten by the nested pass — a silently corrupted tooltip even where the buffer survives.
## The fix: refuse, don't recover
There is no correct recovery, and retrying the build would only hide the defect. A nested invalidation now logs an error with a stack trace, **throws in `DEBUG`** so it gets found and fixed, and in `RELEASE` returns without touching the list — a possibly stale tooltip, but no crash, no corrupted packet, and nothing leaked back to the pool. Getters that genuinely must invalidate should defer:
```csharp
Timer.DelayCall(InvalidateProperties);
```
The guard flag lives on the `ObjectPropertyList`, not the entity: it is that list's own lifecycle, it costs nothing (both `Item` and `ObjectPropertyList` absorb it in existing padding, and the list is allocated lazily), and it stays correct when builds for different entities nest.
Base instance sizes are unchanged from `main`: Item 128 B, Mobile 792 B, ObjectPropertyList 72 B, PlayerMobile 1216 B.
`PropertyList` also publishes the list into `m_PropertyList` **before** building it rather than assigning through `??=` afterwards, so a nested `InvalidateProperties` sees the build in progress instead of recursing into a second throwaway list whose work is discarded.
`ObjectPropertyList` re-rents its scratch buffer instead of spanning a null array, so a stray `Reset()` from any other caller degrades rather than aborting `GetProperties`.
## Factions `PlayerState`: maintained, not lazily computed
The getter that surfaced this is now a plain field read — the whole `if (m_InvalidateRank)` block and the flag itself are gone:
```csharp
public RankDefinition Rank => m_Rank;
```
`UpdateRank()` recomputes at each point an input actually changes:
| Site | Why |
|---|---|
| `RankIndex` setter | this player's index changed |
| end of `KillPoints` setter | two paths write `m_RankIndex` directly, bypassing the setter; runs once the swap bookkeeping and `ZeroRankOffset` have settled |
| `Faction.AddMember` | *after* the insert — the member count is not settled during the ctor |
| `FactionState` load | once ordering and `ZeroRankOffset` are final |
Supporting fixes this forced out:
- **Both ctors seed the lowest rank.** Nothing recomputes on read any more, so `Rank` has to be usable immediately — including for members that never get a `RankIndex` assigned, which is *every member with no kill points*. Without this, `Rank.Title` NREs.
- **`Rank` always resolves.** Ranks are ordered by `Required` descending ending at `0`, so a *negative* percent (`RankIndex` out of sync with `ZeroRankOffset`) matched nothing and left `m_Rank` null. It no longer divides by a zero `ZeroRankOffset` either.
- **A pre-existing staleness bug.** The `KillPoints` setter writes `m_RankIndex` directly in two places, so the cached rank was never refreshed when a player crossed zero kill points.
All six readers of `Rank` were checked; none relied on the old side effect.
One behaviour change worth flagging: rank refreshes are now **eager** where they used to be lazy, so a `KillPoints` change invalidates each swapped player as it happens. The swap loops break as soon as ordering is satisfied — typically 0–2 swaps — but it is on the path that runs on every faction kill.
## Documentation
The rule is written down so it is enforceable rather than folklore:
- **CLAUDE.md** audit rule 19
- **`dev-docs/property-lists.md`** — new "Never Invalidate From Inside `GetProperties`" section with the failing/passing pattern
- **`dev-docs/claude-skills/modernuo-property-lists.md`** — key rule + anti-pattern
- **`dev-docs/claude-skills/modernuo-code-audit.md`** — rule 19, ERROR severity
## Tests
- `ObjectPropertyListReentrancyTests` — `Reset()` and `Dispose()` re-entered mid-hole (both red against `main` with the exact exception above), nesting behaviour, and the new contract: `DEBUG` throws, `RELEASE` survives, and the build is never retried into a loop.
- `FactionRankTests` — `Rank` is populated before anything reads it, tracks `RankIndex` without a read, is stable across reads, and still resolves when `RankIndex` is out of sync with `ZeroRankOffset`. Red-verified: removing the ctor seed fails the first one.
793/793 `Server.Tests` and 608/608 `UOContent.Tests` pass.
## Noted, not addressed here
`~ObjectPropertyList()` returns the rented array to `STArrayPool<char>.Shared` from the **finalizer thread**, and that pool is single-threaded by design. Left alone as a separate concern.
This commit is contained in:
Kamron Batman
GitHub
parent
967ddf48fa
commit
b8d3fec59a
12 changed files with 530 additions and 45 deletions
|
|
@ -14,6 +14,7 @@
|
|||
*************************************************************************/
|
||||
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Collections.Generic;
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
|
@ -798,7 +799,22 @@ public partial class Item : IHued, IComparable<Item>, ISpawnable, IObjectPropert
|
|||
|
||||
public virtual int HuedItemID => m_ItemID;
|
||||
|
||||
public ObjectPropertyList PropertyList => m_PropertyList ??= InitializePropertyList(new ObjectPropertyList(this));
|
||||
public ObjectPropertyList PropertyList
|
||||
{
|
||||
get
|
||||
{
|
||||
if (m_PropertyList == null)
|
||||
{
|
||||
// Publish the list before building it so a nested InvalidateProperties can see the
|
||||
// build in progress and defer instead of recursing into a second throwaway list.
|
||||
var list = new ObjectPropertyList(this);
|
||||
m_PropertyList = list;
|
||||
InitializePropertyList(list);
|
||||
}
|
||||
|
||||
return m_PropertyList;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Overridable. Fills an <see cref="ObjectPropertyList" /> with everything applicable. By default, this invokes
|
||||
|
|
@ -2429,9 +2445,19 @@ public partial class Item : IHued, IComparable<Item>, ISpawnable, IObjectPropert
|
|||
|
||||
private ObjectPropertyList InitializePropertyList(ObjectPropertyList list)
|
||||
{
|
||||
GetProperties(list);
|
||||
AppendChildProperties(list);
|
||||
list.Terminate();
|
||||
list.IsBuilding = true;
|
||||
|
||||
try
|
||||
{
|
||||
GetProperties(list);
|
||||
AppendChildProperties(list);
|
||||
list.Terminate();
|
||||
}
|
||||
finally
|
||||
{
|
||||
list.IsBuilding = false;
|
||||
}
|
||||
|
||||
return list;
|
||||
}
|
||||
|
||||
|
|
@ -2448,6 +2474,26 @@ public partial class Item : IHued, IComparable<Item>, ISpawnable, IObjectPropert
|
|||
return;
|
||||
}
|
||||
|
||||
// Always a bug in the property getter, and there is no correct recovery: refuse rather than
|
||||
// hide it. RELEASE keeps a possibly stale tooltip, DEBUG throws.
|
||||
// See dev-docs/property-lists.md "Never Invalidate From Inside GetProperties".
|
||||
if (m_PropertyList?.IsBuilding == true)
|
||||
{
|
||||
logger.Error(
|
||||
"{Entity} called InvalidateProperties() while its property list was being built. Remove the side effect from the property getter, or defer it with Timer.DelayCall.\n{StackTrace}",
|
||||
this,
|
||||
new StackTrace()
|
||||
);
|
||||
|
||||
#if DEBUG
|
||||
throw new InvalidOperationException(
|
||||
$"{this} invalidated its property list from inside GetProperties. Remove the side effect from the property getter."
|
||||
);
|
||||
#else
|
||||
return;
|
||||
#endif
|
||||
}
|
||||
|
||||
if (m_Map != null && m_Map != Map.Internal && !World.Loading)
|
||||
{
|
||||
int? oldHash;
|
||||
|
|
|
|||
|
|
@ -26,6 +26,7 @@ using Server.Network;
|
|||
using Server.Prompts;
|
||||
using Server.Targeting;
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Collections.Generic;
|
||||
using System.Runtime.CompilerServices;
|
||||
using Server.Buffers;
|
||||
|
|
@ -2291,7 +2292,22 @@ public partial class Mobile : IHued, IComparable<Mobile>, ISpawnable, IObjectPro
|
|||
public int CompareTo(Mobile other) => other == null ? -1 : Serial.CompareTo(other.Serial);
|
||||
|
||||
public virtual int HuedItemID => m_Female ? 0x2107 : 0x2106;
|
||||
public ObjectPropertyList PropertyList => m_PropertyList ??= InitializePropertyList(new ObjectPropertyList(this));
|
||||
public ObjectPropertyList PropertyList
|
||||
{
|
||||
get
|
||||
{
|
||||
if (m_PropertyList == null)
|
||||
{
|
||||
// Publish the list before building it so a nested InvalidateProperties can see the
|
||||
// build in progress and defer instead of recursing into a second throwaway list.
|
||||
var list = new ObjectPropertyList(this);
|
||||
m_PropertyList = list;
|
||||
InitializePropertyList(list);
|
||||
}
|
||||
|
||||
return m_PropertyList;
|
||||
}
|
||||
}
|
||||
|
||||
public virtual void GetProperties(IPropertyList list)
|
||||
{
|
||||
|
|
@ -7225,8 +7241,18 @@ public partial class Mobile : IHued, IComparable<Mobile>, ISpawnable, IObjectPro
|
|||
|
||||
private ObjectPropertyList InitializePropertyList(ObjectPropertyList list)
|
||||
{
|
||||
GetProperties(list);
|
||||
list.Terminate();
|
||||
list.IsBuilding = true;
|
||||
|
||||
try
|
||||
{
|
||||
GetProperties(list);
|
||||
list.Terminate();
|
||||
}
|
||||
finally
|
||||
{
|
||||
list.IsBuilding = false;
|
||||
}
|
||||
|
||||
return list;
|
||||
}
|
||||
|
||||
|
|
@ -7243,6 +7269,26 @@ public partial class Mobile : IHued, IComparable<Mobile>, ISpawnable, IObjectPro
|
|||
return;
|
||||
}
|
||||
|
||||
// Always a bug in the property getter, and there is no correct recovery: refuse rather than
|
||||
// hide it. RELEASE keeps a possibly stale tooltip, DEBUG throws.
|
||||
// See dev-docs/property-lists.md "Never Invalidate From Inside GetProperties".
|
||||
if (m_PropertyList?.IsBuilding == true)
|
||||
{
|
||||
logger.Error(
|
||||
"{Entity} called InvalidateProperties() while its property list was being built. Remove the side effect from the property getter, or defer it with Timer.DelayCall.\n{StackTrace}",
|
||||
this,
|
||||
new StackTrace()
|
||||
);
|
||||
|
||||
#if DEBUG
|
||||
throw new InvalidOperationException(
|
||||
$"{this} invalidated its property list from inside GetProperties. Remove the side effect from the property getter."
|
||||
);
|
||||
#else
|
||||
return;
|
||||
#endif
|
||||
}
|
||||
|
||||
if (m_Map != null && m_Map != Map.Internal && !World.Loading)
|
||||
{
|
||||
int? oldHash;
|
||||
|
|
|
|||
|
|
@ -55,6 +55,12 @@ public sealed class ObjectPropertyList : IPropertyList, IDisposable
|
|||
private int _pos;
|
||||
private char[]? _arrayToReturnToPool;
|
||||
|
||||
/// <summary>
|
||||
/// True while GetProperties is populating this list. Set by the owning entity so a nested
|
||||
/// InvalidateProperties can be refused instead of Reset()ing a build already in flight.
|
||||
/// </summary>
|
||||
internal bool IsBuilding { get; set; }
|
||||
|
||||
public ObjectPropertyList(IEntity? e)
|
||||
{
|
||||
Entity = e;
|
||||
|
|
@ -319,8 +325,23 @@ public sealed class ObjectPropertyList : IPropertyList, IDisposable
|
|||
private static int GetDefaultLength(int literalLength, int formattedCount) =>
|
||||
Math.Max(256, literalLength + formattedCount * 11);
|
||||
|
||||
// Reset()/Dispose() return the scratch buffer to the pool. If either lands while a `$"..."`
|
||||
// handler is still appending, re-rent rather than spanning a null array and throwing out of
|
||||
// GetProperties. Mobile/Item hold the primary guard; this covers any other caller.
|
||||
[MethodImpl(MethodImplOptions.AggressiveInlining)]
|
||||
private void EnsureInterpolationBuffer()
|
||||
{
|
||||
if (_arrayToReturnToPool == null)
|
||||
{
|
||||
_arrayToReturnToPool = STArrayPool<char>.Shared.Rent(256);
|
||||
_pos = 0;
|
||||
}
|
||||
}
|
||||
|
||||
public void AppendLiteral(string value)
|
||||
{
|
||||
EnsureInterpolationBuffer();
|
||||
|
||||
if (value.Length == 1)
|
||||
{
|
||||
var chars = _arrayToReturnToPool.AsSpan();
|
||||
|
|
@ -354,6 +375,8 @@ public sealed class ObjectPropertyList : IPropertyList, IDisposable
|
|||
|
||||
public void AppendFormatted<T>(T value)
|
||||
{
|
||||
EnsureInterpolationBuffer();
|
||||
|
||||
string? s;
|
||||
if (value is IFormattable)
|
||||
{
|
||||
|
|
@ -384,6 +407,8 @@ public sealed class ObjectPropertyList : IPropertyList, IDisposable
|
|||
|
||||
public void AppendFormatted<T>(T value, string? format)
|
||||
{
|
||||
EnsureInterpolationBuffer();
|
||||
|
||||
// '#' marks an integer argument as a cliloc ("#<value>"). Integers only -- a float/double/decimal
|
||||
// '#' is the standard numeric format, not a cliloc marker.
|
||||
if (format == "#" && value is int or uint or long or ulong or short or ushort or byte or sbyte)
|
||||
|
|
@ -442,6 +467,8 @@ public sealed class ObjectPropertyList : IPropertyList, IDisposable
|
|||
|
||||
public void AppendFormatted(ReadOnlySpan<char> value)
|
||||
{
|
||||
EnsureInterpolationBuffer();
|
||||
|
||||
if (value.TryCopyTo(_arrayToReturnToPool.AsSpan(_pos..)))
|
||||
{
|
||||
_pos += value.Length;
|
||||
|
|
@ -454,6 +481,8 @@ public sealed class ObjectPropertyList : IPropertyList, IDisposable
|
|||
|
||||
public void AppendFormatted(ReadOnlySpan<char> value, int alignment = 0, string? format = null)
|
||||
{
|
||||
EnsureInterpolationBuffer();
|
||||
|
||||
var leftAlign = false;
|
||||
if (alignment < 0)
|
||||
{
|
||||
|
|
@ -488,6 +517,8 @@ public sealed class ObjectPropertyList : IPropertyList, IDisposable
|
|||
|
||||
public void AppendFormatted(string? value)
|
||||
{
|
||||
EnsureInterpolationBuffer();
|
||||
|
||||
if (value?.TryCopyTo(_arrayToReturnToPool.AsSpan(_pos..)) == true)
|
||||
{
|
||||
_pos += value.Length;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue