Closed qarmin closed 4 years ago
Address Sanitizer log:
==58829==ERROR: AddressSanitizer: heap-use-after-free on address 0x61a0001fec90 at pc 0x00000e94c2dc bp 0x7fff52875300 sp 0x7fff528752f0
READ of size 8 at 0x61a0001fec90 thread T0
#0 0xe94c2db in Variant::Variant(Object const*) core/variant.cpp:2344
#1 0xa0dfef0 in MethodBind0RC<Popup*>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:593
#2 0xe72ac01 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:922
#3 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#4 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
#5 0x18aa19d in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
#6 0xe72a771 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
#7 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#8 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
#9 0x18aa19d in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
#10 0xe72a771 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
#11 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#12 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
#13 0x18aa6b3 in GDScriptInstance::call_multilevel(StringName const&, Variant const**, int) modules/gdscript/gdscript.cpp:1253
#14 0x94fbcfa in Node::_notification(int) scene/main/node.cpp:69
#15 0x17615e7 in Node::_notificationv(int, bool) scene/main/node.h:46
#16 0x1763a52 in CanvasItem::_notificationv(int, bool) scene/2d/canvas_item.h:166
#17 0x1766132 in Control::_notificationv(int, bool) scene/gui/control.h:48
#18 0x17e49b4 in Container::_notificationv(int, bool) scene/gui/container.h:38
#19 0x9c3eefc in GridContainer::_notificationv(int, bool) scene/gui/grid_container.h:38
#20 0xe72b091 in Object::notification(int, bool) core/object.cpp:932
#21 0x96273f3 in SceneTree::_notify_group_pause(StringName const&, int) scene/main/scene_tree.cpp:985
#22 0x961570d in SceneTree::iteration(float) scene/main/scene_tree.cpp:481
#23 0x15c5a16 in Main::iteration() main/main.cpp:2077
#24 0x14bef6b in OS_X11::run() platform/x11/os_x11.cpp:3265
#25 0x14394e5 in main platform/x11/godot_x11.cpp:56
#26 0x7ffae360c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#27 0x14390ed in _start (/usr/bin/godots+0x14390ed)
0x61a0001fec90 is located 16 bytes inside of 1264-byte region [0x61a0001fec80,0x61a0001ff170)
freed by thread T0 here:
#0 0x7ffae4ab81b7 in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xb01b7)
#1 0xec5abb0 in Memory::free_static(void*, bool) core/os/memory.cpp:178
#2 0x15d188f in void memdelete<Object>(Object*) core/os/memory.h:119
#3 0x962a054 in SceneTree::_flush_delete_queue() scene/main/scene_tree.cpp:1110
#4 0x9616160 in SceneTree::iteration(float) scene/main/scene_tree.cpp:488
#5 0x15c5a16 in Main::iteration() main/main.cpp:2077
#6 0x14bef6b in OS_X11::run() platform/x11/os_x11.cpp:3265
#7 0x14394e5 in main platform/x11/godot_x11.cpp:56
#8 0x7ffae360c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
previously allocated by thread T0 here:
#0 0x7ffae4ab8517 in malloc (/lib/x86_64-linux-gnu/libasan.so.6+0xb0517)
#1 0xec59cbf in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:82
#2 0xec59bbe in operator new(unsigned long, char const*) core/os/memory.cpp:42
#3 0x9467012 in Object* ClassDB::creator<PopupMenu>() core/class_db.h:143
#4 0xe4cc239 in ClassDB::instance(StringName const&) core/class_db.cpp:548
#5 0x1881f2a in GDScriptNativeClass::instance() modules/gdscript/gdscript.cpp:82
#6 0x188191c in GDScriptNativeClass::_new() modules/gdscript/gdscript.cpp:69
#7 0x1960015 in MethodBind0R<Variant>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:237
#8 0xe72ac01 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:922
#9 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#10 0x1a751fa in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1085
#11 0x18aa19d in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
#12 0xe72a771 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
#13 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#14 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
#15 0x18aa19d in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
#16 0xe72a771 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
#17 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#18 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
#19 0x18aa6b3 in GDScriptInstance::call_multilevel(StringName const&, Variant const**, int) modules/gdscript/gdscript.cpp:1253
#20 0x94fbcfa in Node::_notification(int) scene/main/node.cpp:69
#21 0x17615e7 in Node::_notificationv(int, bool) scene/main/node.h:46
#22 0x1763a52 in CanvasItem::_notificationv(int, bool) scene/2d/canvas_item.h:166
#23 0x1766132 in Control::_notificationv(int, bool) scene/gui/control.h:48
#24 0x17e49b4 in Container::_notificationv(int, bool) scene/gui/container.h:38
#25 0x9c3eefc in GridContainer::_notificationv(int, bool) scene/gui/grid_container.h:38
#26 0xe72b091 in Object::notification(int, bool) core/object.cpp:932
#27 0x96273f3 in SceneTree::_notify_group_pause(StringName const&, int) scene/main/scene_tree.cpp:985
#28 0x961570d in SceneTree::iteration(float) scene/main/scene_tree.cpp:481
#29 0x15c5a16 in Main::iteration() main/main.cpp:2077
Probably leak is related to crash
Direct leak of 109840 byte(s) in 2746 object(s) allocated from:
#0 0x7f3cff19a517 in malloc (/lib/x86_64-linux-gnu/libasan.so.6+0xb0517)
#1 0xec59cbf in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:82
#2 0xec59bbe in operator new(unsigned long, char const*) core/os/memory.cpp:42
#3 0xe72cd1b in Object::_use_rc() core/object.cpp:987
#4 0xe94c36a in Variant::Variant(Object const*) core/variant.cpp:2344
#5 0x1881d0b in GDScriptNativeClass::_new() modules/gdscript/gdscript.cpp:76
#6 0x1960015 in MethodBind0R<Variant>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:237
#7 0xe72ac01 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:922
#8 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#9 0x1a751fa in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1085
#10 0x18aa19d in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
#11 0xe72a771 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
#12 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#13 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
#14 0x18aa19d in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
#15 0xe72a771 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
#16 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#17 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
#18 0x18aa19d in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
#19 0xe72a771 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
#20 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#21 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
#22 0x18aa19d in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
#23 0xe72a771 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
#24 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#25 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
#26 0x18aa19d in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
#27 0xe72a771 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
#28 0xe9a0781 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1127
#29 0x1a7527b in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1088
CC @RandomShaper since _use_rc code was touched recently by you
Crash happens also with Godot 4.0 but with different backtrace every time This is regression from 3.2.1
[1] /lib/x86_64-linux-gnu/libc.so.6(+0x46210) [0x7f394b111210] (??:0)
[2] Callable::get_object() const (/mnt/Miecz/godot/core/callable.cpp:60)
[3] Object::~Object() (/mnt/Miecz/godot/core/object.cpp:1901 (discriminator 2))
[4] Node::~Node() (/mnt/Miecz/godot/scene/main/node.cpp:2956 (discriminator 4))
[5] Timer::~Timer() (/mnt/Miecz/godot/scene/main/timer.h:36)
[6] void memdelete<Node>(Node*) (/mnt/Miecz/godot/./core/os/memory.h:118)
[7] Node::_notification(int) (/mnt/Miecz/godot/scene/main/node.cpp:168)
[8] Node::_notificationv(int, bool) (/mnt/Miecz/godot/./scene/main/node.h:46 (discriminator 14))
[9] Viewport::_notificationv(int, bool) (/mnt/Miecz/godot/./scene/main/viewport.h:87)
[10] Window::_notificationv(int, bool) (/mnt/Miecz/godot/./scene/main/window.h:40)
[11] Popup::_notificationv(int, bool) (/mnt/Miecz/godot/./scene/gui/popup.h:37)
[12] PopupMenu::_notificationv(int, bool) (/mnt/Miecz/godot/scene/gui/popup_menu.h:38)
[13] Object::notification(int, bool) (/mnt/Miecz/godot/core/object.cpp:901)
[14] Object::_predelete() (/mnt/Miecz/godot/core/object.cpp:355)
[15] predelete_handler(Object*) (/mnt/Miecz/godot/core/object.cpp:1928)
[16] void memdelete<Object>(Object*) (/mnt/Miecz/godot/./core/os/memory.h:111)
[17] SceneTree::_flush_delete_queue() (/mnt/Miecz/godot/scene/main/scene_tree.cpp:993)
[18] SceneTree::idle(float) (/mnt/Miecz/godot/scene/main/scene_tree.cpp:467 (discriminator 4))
[19] Main::iteration() (/mnt/Miecz/godot/main/main.cpp:2199)
[20] OS_LinuxBSD::run() (/mnt/Miecz/godot/platform/linuxbsd/os_linuxbsd.cpp:241)
[21] /usr/bin/godot4(main+0x125) [0x1990e6b] (/mnt/Miecz/godot/platform/linuxbsd/godot_linuxbsd.cpp:57)
[22] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f394b0f20b3] (??:0)
[23] /usr/bin/godot4(_start+0x2e) [0x1990c8e] (??:?)
-- END OF BACKTRACE --
Running: /usr/bin/godot4 --path /home/rafal/Pobrane/TheWorstGodotTestProject --remote-debug tcp://127.0.0.1:6007 --allow_focus_steal_pid 187600 --position 320,180
handle_crash: Program crashed with signal 11
Dumping the backtrace. Please include this when reporting the bug on https://github.com/godotengine/godot/issues
[1] /lib/x86_64-linux-gnu/libc.so.6(+0x46210) [0x7f1e9ee0a210] (??:0)
[2] Reference::reference() (/mnt/Miecz/godot/core/reference.cpp:63)
[3] Reference::init_ref() (/mnt/Miecz/godot/core/reference.cpp:36)
[4] Variant::Variant(Object const*) (/mnt/Miecz/godot/core/variant.cpp:2536)
[5] MethodBind0RC<Popup*>::call(Object*, Variant const**, int, Callable::CallError&) (/mnt/Miecz/godot/./core/method_bind.gen.inc:594 (discriminator 4))
[6] Object::call(StringName const&, Variant const**, int, Callable::CallError&) (/mnt/Miecz/godot/core/object.cpp:890 (discriminator 1))
[7] Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Callable::CallError&) (/mnt/Miecz/godot/core/variant_call.cpp:1226 (discriminator 1))
[8] GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) (/mnt/Miecz/godot/modules/gdscript/gdscript_function.cpp:1047)
[9] GDScriptInstance::call_multilevel(StringName const&, Variant const**, int) (/mnt/Miecz/godot/modules/gdscript/gdscript.cpp:1306)
[10] Node::_notification(int) (/mnt/Miecz/godot/scene/main/node.cpp:57)
[11] Node::_notificationv(int, bool) (/mnt/Miecz/godot/./scene/main/node.h:46 (discriminator 14))
[12] CanvasItem::_notificationv(int, bool) (/mnt/Miecz/godot/./scene/main/canvas_item.h:162 (discriminator 3))
[13] Control::_notificationv(int, bool) (/mnt/Miecz/godot/./scene/gui/control.h:47 (discriminator 3))
[14] Container::_notificationv(int, bool) (/mnt/Miecz/godot/./scene/gui/container.h:37 (discriminator 3))
[15] TabContainer::_notificationv(int, bool) (/mnt/Miecz/godot/scene/gui/tab_container.h:37 (discriminator 3))
[16] Object::notification(int, bool) (/mnt/Miecz/godot/core/object.cpp:901)
[17] SceneTree::_notify_group_pause(StringName const&, int) (/mnt/Miecz/godot/scene/main/scene_tree.cpp:823)
[18] SceneTree::idle(float) (/mnt/Miecz/godot/scene/main/scene_tree.cpp:454 (discriminator 2))
[19] Main::iteration() (/mnt/Miecz/godot/main/main.cpp:2199)
[20] OS_LinuxBSD::run() (/mnt/Miecz/godot/platform/linuxbsd/os_linuxbsd.cpp:241)
[21] /usr/bin/godot4(main+0x125) [0x1990e6b] (/mnt/Miecz/godot/platform/linuxbsd/godot_linuxbsd.cpp:57)
[22] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f1e9edeb0b3] (??:0)
[23] /usr/bin/godot4(_start+0x2e) [0x1990c8e] (??:?)
-- END OF BACKTRACE --
Running: /usr/bin/godot4 --path /home/rafal/Pobrane/TheWorstGodotTestProject --remote-debug tcp://127.0.0.1:6007 --allow_focus_steal_pid 187600 --position 320,180
handle_crash: Program crashed with signal 11
Dumping the backtrace. Please include this when reporting the bug on https://github.com/godotengine/godot/issues
[1] /lib/x86_64-linux-gnu/libc.so.6(+0x46210) [0x7f3810d17210] (??:0)
[2] Set<CollisionObject2DSW*, Comparator<CollisionObject2DSW*>, DefaultAllocator>::front() const (/mnt/Miecz/godot/./core/set.h:555)
[3] PhysicsServer2DSW::free(RID) (/mnt/Miecz/godot/servers/physics_2d/physics_server_2d_sw.cpp:1194)
[4] PhysicsServer2DWrapMT::free(RID) (/mnt/Miecz/godot/servers/physics_2d/physics_server_2d_wrap_mt.h:297)
[5] World2D::~World2D() (/mnt/Miecz/godot/scene/resources/world_2d.cpp:371)
[6] void memdelete<World2D>(World2D*) (/mnt/Miecz/godot/./core/os/memory.h:118)
[7] Ref<World2D>::unref() (/mnt/Miecz/godot/./core/reference.h:224)
[8] Ref<World2D>::~Ref() (/mnt/Miecz/godot/./core/reference.h:235)
[9] Viewport::~Viewport() (/mnt/Miecz/godot/scene/main/viewport.cpp:3507)
[10] Window::~Window() (/mnt/Miecz/godot/scene/main/window.cpp:1399)
[11] Popup::~Popup() (/mnt/Miecz/godot/scene/gui/popup.cpp:145)
[12] PopupMenu::~PopupMenu() (/mnt/Miecz/godot/scene/gui/popup_menu.cpp:1461)
[13] void memdelete<Object>(Object*) (/mnt/Miecz/godot/./core/os/memory.h:118)
[14] SceneTree::_flush_delete_queue() (/mnt/Miecz/godot/scene/main/scene_tree.cpp:993)
[15] SceneTree::idle(float) (/mnt/Miecz/godot/scene/main/scene_tree.cpp:467 (discriminator 4))
[16] Main::iteration() (/mnt/Miecz/godot/main/main.cpp:2199)
[17] OS_LinuxBSD::run() (/mnt/Miecz/godot/platform/linuxbsd/os_linuxbsd.cpp:241)
[18] /usr/bin/godot4(main+0x125) [0x1990e6b] (/mnt/Miecz/godot/platform/linuxbsd/godot_linuxbsd.cpp:57)
[19] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f3810cf80b3] (??:0)
[20] /usr/bin/godot4(_start+0x2e) [0x1990c8e] (??:?)
-- END OF BACKTRACE -
Godot version:
3.2.2 4.0
Doesn't happens with 3.2.1
OS/device including version:
Ubuntu 20.04
Issue description: When I run project(which contains only TabContainer and GridContainer node) then it almost immediately crash (Probably this is recent regression, I suspect that this may be caused by #38119)
Steps to reproduce:
Minimal reproduction project:
TheWorstGodotTestProject.zip Edit: This is a lot of smaller project: TheWorstGodotTestProject.zip