Rollo62

Thanks, but that was already clear. The problem is, that simulators are not behaving exactly like devices, especially with sensors and hardware stuff, this is why I rarely use them.

Python seems most natual to me, since all 3 libraries may support it or have wrapper for that. Moreover is Python maybe also a natural way to use these kind of libraries ( but I'm not a Chemist ), so to put a Delphi UI on top would have a lot of benefits IMHO, while still keeping the full force of Python to C++ underneath. The additional burden to install and requiring Python-Libs for such project seems minor to me. Esspeciall when you think of combining Chemistry with AI features, I think you are already right in the Python world.

This topic has nothing to do with Macos, FMX, Spring4D, Kastri or whatsever. This error was caused by a region, which was a leftover from Copy-Paste code from Windows, which I shouldn't do in the first place. The Region {$REGION 'Windows helper functions'} function SetThreadExecutionState(esFlags: EXECUTION_STATE): EXECUTION_STATE; stdcall; external 'kernel32.dll'; was hiding this Windows-Kernel related kernel reference, which was never used anywhere, but this one line never showed up as an error at this point. This tells me, that using regions to hide code, may also hide code to spot obvious failures sometimes.

Yes, but not because its irrelevant. But that's because even the last snoozer has realised that by now.

@Kas Ob. Yes, I have read about CloudFlare a lot of positive things, but I'm not yet an active user. Your proposal will add additional cost, I think minimum 5$ per month, right? My question would be, how far do I get with their free tier service? As far as I understand, this will be an unlimited, somehwhat protected DNS server, perhaps thats already solving such issues. Is the free tier usable for a commercial server, with not too wild traffic?

Hard to say. One effective approach could be behavior-based rate limiting rather than relying solely on IP tracking. Since these hackers are making two requests at a time from each IP and cycling through thousands of addresses, you could analyze request patterns to flag suspicious behavior. For example: - Track request timing and frequency per IP: Legitimate users rarely hit your site with precise, repetitive timing (e.g., two requests exactly every 24 hours). You could set a threshold where IPs making requests in a tight, unnatural cadence (say, under a second apart) get temporarily soft-blocked (e.g., delayed responses or a 429 Too Many Requests status) without affecting users with more organic patterns. - Fingerprinting beyond IP: Use a lightweight client-side fingerprinting technique (e.g., based on HTTP headers like User-Agent, Accept-Language, or even subtle timing differences in TCP handshakes). If the same fingerprint appears across multiple IPs in a short window, it’s a strong signal of VPN rotation from a single source. You could then throttle or block those requests without needing a CAPTCHA. - Perhaps you need only a few countries, so you could block most of all other country requests - or something like Fail2Ban https://github.com/fail2ban/fail2ban

@Anders Melander I found an older case of yours, here at DevExpress. https://supportcenter.devexpress.com/ticket/details/t812550/an-av-occurs-if-the-spell-checker-whose-usethreadedload-property-is-set-to-true-reloads Which speaks against FreeAndNil too.

Thanks, that sounds like I would never consider this in the first place. This is why I am asking for a simple, generic example to better understand why this would probably make sense. Do you know a specific place in the VCL/FMX code, where it is used like that?

Ok, you both are right, but I still wonder why its used in so many places, if its that unnecessary. The "reduce" was intended as fast fix, if you have no other choice to complete rework or repair anything in time, but you have to ship an update fast, used more or less like as a debugging tool. There must be at least one real use-case, where FAN makes perfectly sense. Yes, I already mentioned this use-case, so is this the only one? Why are there so many places using FAN during Create/Destroy, without any lazy injection? I only can think of critical timing or race-condition protection somehow.

Thanks, its clear then, how the capture of anonymous methods work. We came from the question how FreeAndNil might be helpful here, in this kind of situations, right? Aren't there any situations where FAN can be useful, perhaps with an Assigned( FVar ) guard, were everybody can agree on? I can see much use of FAN in Delphi RTL, Spring4D and all many places all around, but at the same time everybody disagrees on its usefulness & better to avoid it, thats strange ... Where and why is it useful then, if not in situations where I want to check and mark the validity of a lazy Field or the like, for example by Assigned()? I cannot think of much use-cases, where I would ever need this. - If I use it in the case where I inject an object to a class, not by DI, but by method or property, then this would make sense to protect a Field by FAN, IMHO. - In a use case where I purely manage a Field myself by Create/Destroy, it doesn't make much sense if there is no possibility of delayed access to it. So maybe somebody has a clean example, to show where it makes sense?

Sorry, if this was misunderstanding as an advice. It was searching for use cases of FreeAndNil, to help debugging such issues. And sometimes I have to solve problems which comes unexpected, by external influences, where I have little information and influence about. Ok, maybe there are ways to identify and encapsule these issues better, but most of the time they came a little out of the blue.

I just find some time to present an alternative solution, without FreeAndNil, as example with an cancellation token, it could probably look like this, which is more work to do. But the basic problem stays the same, that the cause of the blocking cannot be cancelled. It cannot be allowed to wait forever, after free, so the destroy must compromise somehow. I am not sure, if touching the cancellation token variable on a freed object causes the same issues, I would guess. Perhaps the interfaced token variable preserves the handle accessible, so that it will be safe to touch it within the freed class, but I won't bet on this. So in which places a FreeAndNil should be used then, only in global variables ( don't shoot the messenger ) 🙂 There must be good use cases for FreeAndNil anywhere. type ICancellationToken = interface ['{8C3A7E13-7C12-4F4F-92F5-DA1111111111}'] function GetCancelled: Boolean; procedure Cancel; property Cancelled: Boolean read GetCancelled; end; TCancellationToken = class(TInterfacedObject, ICancellationToken) private FCancelled: Boolean; public function GetCancelled: Boolean; procedure Cancel; end; function TCancellationToken.GetCancelled: Boolean; begin Result := FCancelled; end; procedure TCancellationToken.Cancel; begin FCancelled := True; end; ... type TMyClass = class private FCancellationToken: ICancellationToken; public constructor Create; destructor Destroy; override; procedure StartAsyncTask; end; constructor TMyClass.Create; begin inherited Create; FCancellationToken := TCancellationToken.Create; end; destructor TMyClass.Destroy; begin // Signal the cancellation FCancellationToken.Cancel; // Perhaps a wait mechanism implementation here, if needed, but exactly this is not always possible ??? inherited Destroy; end; procedure TMyClass.StartAsyncTask; begin TTask.Run( procedure begin // Example: Loop until cancellation while not FCancellationToken.Cancelled do begin // Simulation of blocking, regularily checking for cancellation. Exactly this might not alwys be possible. Sleep(100); end; if FCancellationToken.Cancelled then begin // Task is cancelled Exit; end; TThread.Synchronize(nil, procedure begin // Callback-Code Writeln('Task finished gracefully.'); end); end); end;

Ok, I'm open for your proposals If you got very sporadic AV on some customers devices and you are not able to reproduce that or to find any hints .... Sometimes a fast solution is needed, when a complete rewrite is currently not possible in time and you're unsure about the root cause. Of course I like to solve things once and forever too, and I only try to find possible use cases for the FreeandNil, which I have seen before.

Yes, but from my experience, this helps to REDUCE the risk of AV's, in case of async processes, where you cannot safely cancel such async operation, because its not directly under your control. Another example could be a call inside from an anonymous method, how can you canel that, if the class it freed?

To make this discussion less academic: I like to use FreeAndNil in places, where Async callbacks may occur. For example like this (roughly hacked example, excuse typos): type TMyClass = class private FMyVar : TStringList; // The problematic object FMyCallback : TProc; public constructor Create; destructor Destroy; override; procedure Conf_Callback(const AProc: TProc); procedure DoOnCallback; end; constructor TMyClass.Create; begin inherited Create; FMyVar := TStringList.Create; FMyCallback := nil; end; destructor TMyClass.Destroy; begin FreeAndNil( FMyVar ); // Free the object and prevent further calling it FMyCallback := nil; inherited Destroy; end; procedure TMyClass.Conf_Callback(const AProc: TProc); begin FMyCallback := AProc; end; procedure TMyClass.DoOnCallback; begin if not Assigned(FMyVar) then begin DoLogThisIssue; // Logging the rare problem Exit; //<== GUARD end; FMyVar.Add( 'Hello'); // Using an existing object, which is protected by FreeAndNil end; In cases where TMyClass is already freed, but pending async functions might still call the DoOnCallback function. If this happens, the guard may REDUCE THE RISK of an sporadic AV, probably. I know, the arguments against this are, that this should never happen and I should rewrite the code calling DoOnCallback in the first place. But in reality, I see these things might happen, especially in highly async, undetermined, not well testable situations, which will result in unwanted AV's, but where this situation only happens very rarely of system dependent. In that case I prefer to have at least an AV prevention, over having some kind of other issues in the app ( this is of course not a banking app ). At least I'm able to debug or log these rare situations in the guard. I would think of like these two categories: # High critical apps: Either you need a perfect stable, reliable and high-security app ( like banking, high security authentication, database, airplane control, etc. ) # Uncritical apps : Or you have an relative uncritical app, where its more important to not annoy customers by rare crashes, where you can try to catch such issues by logging.