VR::GetEyeToHeadTransform causes segfault

[LordOfDragons]

On Windows 10. OpenVR connects to SteamVR and can retrieve parameters and VR_Init works.

[Dragengine] [2021-08-08 20:12:20] Starting VR module OpenVR
[OpenVR] [2021-08-08 20:12:20] Runtime Installed: Yes
[OpenVR] [2021-08-08 20:12:20] Runtime Path: C:\Program Files (x86)\Steam\steamapps\common\SteamVR
[OpenVR] [2021-08-08 20:12:20] HMD Present: Yes

Interaction with the runtime works outside rendering.

[DragonScript] [2021-08-08 20:12:28] [Console] Start VR Runtime...
[OpenVR] [2021-08-08 20:12:28] Start Runtime
warning: Thu Sep 09 2021 20:12:28.571 - //==============================================================================================
warning: Thu Sep 09 2021 20:12:28.582 - ================================================================================================
warning: Thu Sep 09 2021 20:12:28.592 - ================================================================================================
warning: Thu Sep 09 2021 20:12:28.603 - delauncher-console.exe 1.19.7 startup with PID=12152, config=c:\program files (x86)\steam\config, runtime=C:\Program Files (x86)\Steam\steamapps\common\SteamVR
warning: Thu Sep 09 2021 20:12:28.617 - vrclient type=VRApplication_Scene
warning: Thu Sep 09 2021 20:12:28.643 - [Settings] Load Default Json Settings from C:\Program Files (x86)\Steam\steamapps\common\SteamVR\drivers\htc\resources\settings\default.vrsettings
warning: Thu Sep 09 2021 20:12:28.656 - [Settings] Load Default Json Settings from C:\Program Files (x86)\Steam\steamapps\common\SteamVR\drivers\lighthouse\resources\settings\default.vrsettings
warning: Thu Sep 09 2021 20:12:28.669 - [Settings] Load Default Json Settings from C:\Program Files (x86)\Steam\steamapps\common\SteamVR\drivers\null\resources\settings\default.vrsettings
warning: Thu Sep 09 2021 20:12:28.682 - [Settings] Load Default Json Settings from C:\ProgramData\HTC\Viveport\SteamVR\htc_rr\resources\settings\default.vrsettings
warning: Thu Sep 09 2021 20:12:28.711 - [Settings] Load Default Json Settings from C:\Program Files (x86)\Steam\steamapps\common\SteamVR\resources\settings\default.vrsettings
warning: Thu Sep 09 2021 20:12:28.745 - [Settings] Load Json Settings from c:\program files (x86)\steam\config\steamvr.vrsettings
warning: Thu Sep 09 2021 20:12:28.764 - Client (SteamVR_Namespace) app container state: 1
warning: Thu Sep 09 2021 20:12:28.771 - CSharedResourceNamespaceClient::Init(): received namespace data 10880
warning: Thu Sep 09 2021 20:12:28.780 - Client (VR_ServerPipe_10880) app container state: 1
warning: Thu Sep 09 2021 20:12:28.801 - Received success response from vrserver connect
warning: Thu Sep 09 2021 20:12:28.815 - Not looking for a good app key because Steam didn't start this app
warning: Thu Sep 09 2021 20:12:28.828 - App key after connect message:system.generated.delauncher-console.exe
warning: Thu Sep 09 2021 20:12:28.854 - Client (VR_CompositorPipe_10880) app container state: 1
warning: Thu Sep 09 2021 20:12:28.861 - Received success response from vrcompositor connect
warning: Thu Sep 09 2021 20:12:28.867 - Initializing the limited version of CVRCompositorClient
warning: Thu Sep 09 2021 20:12:28.876 - Attempting to load initial input config
warning: Thu Sep 09 2021 20:12:29.124 - After initial config load, app appears to be using legacy input
warning: Thu Sep 09 2021 20:12:29.133 - /user/hand/left is FFFFFFFF
warning: Thu Sep 09 2021 20:12:29.139 - /user/hand/right is FFFFFFFF
warning: Thu Sep 09 2021 20:12:29.144 - TrackedControllerRole_LeftHand (FFFFFFFF)->
warning: Thu Sep 09 2021 20:12:29.149 - Skipping role TrackedControllerRole_LeftHand because the device is invalid
warning: Thu Sep 09 2021 20:12:29.159 - TrackedControllerRole_RightHand (FFFFFFFF)->
warning: Thu Sep 09 2021 20:12:29.168 - Skipping role TrackedControllerRole_RightHand because the device is invalid
warning: Thu Sep 09 2021 20:12:29.180 - TrackedControllerRole_Invalid (0)->
[OpenVR] [2021-08-08 20:12:29] Runtime Version: 1.19.7
[OpenVR] [2021-08-08 20:12:29] Render Size: 1852 2056
warning: Thu Sep 09 2021 20:12:29.212 - Action Manifest Path set to C:\Program Files\Dragengine\Share\modules\vr\openvr\1.6\input\actions.json
[OpenVR] [2021-08-08 20:12:29] Loading render model 'generic_hmd'
[New Thread 12152.0x328c]
[OpenVR] [2021-08-08 20:12:32] Loading render model 'generic_hmd' finished in 3092.0ms
[OpenVR] [2021-08-08 20:12:32] Loading texture map 0
[OpenVR] [2021-08-08 20:12:32] Loading texture map 0 finished in 311.0ms
[OpenVR] [2021-08-08 20:12:32] Loading render model 'lh_basestation_vive'
[OpenVR] [2021-08-08 20:12:33] Loading render model 'lh_basestation_vive' finished in 677.0ms
[OpenVR] [2021-08-08 20:12:33] Loading texture map 1
[OpenVR] [2021-08-08 20:12:33] Loading texture map 1 finished in 219.0ms
[OpenVR] [2021-08-08 20:12:33] Loading render model 'generic_controller'
[OpenVR] [2021-08-08 20:12:34] Loading render model 'generic_controller' finished in 988.0ms
[OpenVR] [2021-08-08 20:12:34] Loading texture map 2
[OpenVR] [2021-08-08 20:12:34] Loading texture map 2 finished in 102.0ms
[OpenVR] [2021-08-08 20:12:34] Input Devices:
[OpenVR] [2021-08-08 20:12:34] - 'HMD' (OVR_hmd_LHR_A55B1588) 0 [8]
[OpenVR] [2021-08-08 20:12:34] - 'Base Station 1' (OVR_bs_LHB_22A3750C) 1 [15]
[OpenVR] [2021-08-08 20:12:34] - 'Base Station 2' (OVR_bs_LHB_F531DB5C) 2 [15]
[OpenVR] [2021-08-08 20:12:34] - 'Controller 1' (OVR_cg_030000008f0e00000300000000000000) 16 [13]
[OpenVR] [2021-08-08 20:12:34] Runtime Ready

Intestingly OpenVR needs over 3s to load a device visualization model but at last it manages to do so. But then OpenVR crashes when I try to retrieve the eye matrix for rendering:

Thread 1 "MainThrd" received signal SIGSEGV, Segmentation fault.
0x00007fff35447c1b in vrclient_x64!VRClientCoreFactory ()
   from C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\vrclient_x64.dll
(gdb) bt
#0  0x00007fff35447c1b in vrclient_x64!VRClientCoreFactory ()
   from C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\vrclient_x64.dll
#1  0x00007fff35447929 in vrclient_x64!VRClientCoreFactory ()
   from C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\vrclient_x64.dll
#2  0x00007fff35212069 in xrNegotiateLoaderRuntimeInterface ()
   from C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\vrclient_x64.dll
#3  0x0000000015c940eb in deVROpenVR::GetMatrixViewEye (this=0x6aa3b0, eye=6549504)
    at src/modules/vr/openvr/src/deVROpenVR.cpp:585
#4  0x00000000045a1d17 in deoglVR::pGetParameters (this=0x2c030a90, renderThread=...)
(...)

The relevant function call is this:

pVRSystem->GetEyeToHeadTransform(eye)   // vr::IVRSystem* pVRSystem

Hence GetEyeToHeadTransform() somehow trashes the stack causing the crash. More I can not figure out since the crash happens inside OpenVR/StreamVR where I have no debug symbols.

[LordOfDragons]

I've managed to create a sanitizer enabled clang build to get a closer look. It's definitely SteamVR crashing here:

=================================================================
==2632==ERROR: AddressSanitizer: access-violation on unknown address 0x000000000108 (pc 0x7ffdf5d67c17 bp 0x006d794fdc90 sp 0x006d794fda90 T0)
==2632==The signal is caused by a READ memory access.
==2632==Hint: address points to the zero page.
    #0 0x7ffdf5d67c16 in HmdSystemFactory+0x1c2e36 (C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\vrclient_x64.dll+0x180287c16)
    #1 0x7ffdf5d67928 in HmdSystemFactory+0x1c2b48 (C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\vrclient_x64.dll+0x180287928)
    #2 0x7ffdf5b32068 in xrNegotiateLoaderRuntimeInterface+0x23778 (C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\vrclient_x64.dll+0x180052068)
    #3 0x7ffdf95b8a4e in deVROpenVR::GetMatrixViewEye /sources/src/modules/vr/openvr/src/deVROpenVR.cpp:585
    #4 0x7ffdf7694ea1 in ZN7deoglVR14pGetParametersER17deoglRenderThread+0x441 (C:\Program Files\Dragengine\Data\modules\graphic\opengl\1.5\graopengl.dll+0x180264ea1)
(...)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: access-violation (C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\vrclient_x64.dll+0x180287c16) in HmdSystemFactory+0x1c2e36
==2632==ABORTING

Here also the steam report file: http://rptd.ch/misc/debug/SteamVR-2021-09-10-PM_11_52_01.txt

The crash happens always when GetEyeToHeadTransform() function is called. Before this point a bunch of other functions are called on IVRSystem and other interfaces so it is a problem specific to the GetEyeToHeadTransform() call.

Also this crash happens only on Windows. On Linux there is no such crash and the application runs.

What can potentially cause this function call to crash on Window?

[LordOfDragons]

What can I do to help solve this bug? It's a show-stopper.

[LordOfDragons]

Can a responsible person please state what's going to happen with this bug? It's still present after a couple of steam updates and it simply makes using VR on steam impossible under Windows.

[LordOfDragons]

Is there an alternate function one can call to work around GetEyeToHeadTransform() crashing Steam?

[JoeLudwig]

That call stack is confusing. The reference to GetEyeToHeadTransform is actually inside DragEngine, not SteamVR. In SteamVR it's in xrNegotiateLoaderRuntimeInterface. And one of those doesn't call the other.

(The relevant DragEngine source is here: https://github.com/LordOfDragons/dragengine/blob/e7b31fe26ea1e2c21c25a9da035f64731976e4fa/src/modules/vr/openvr/src/deVROpenVR.cpp )

Can you provide a .dmp file of the crash? I can probably tell more if I can see the SteamVR part of the callstack in a debugger.

Even better would be a repro case that I can run to debug this on my end.