Closed lostminds closed 2 years ago
I just tried this in 4.0beta4 and it didn't crash there, but it caused another buggy behavior: Using the same test project and clicking the theme StyleBox resource in the Inspector in 4.0beta4 seems to break the Theme panel in the inspector, so maybe the root bug is not new, only now it crashes the editor and not just the panel.
4.0.beta4 behavior: https://user-images.githubusercontent.com/17763524/202385450-0510ed1a-0ae5-4ecb-be80-36f6646754d0.mov
This is similar to #68769, seems to be a duplicate of it.
==40959==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e00285d8f8 at pc 0x56544eb4e157 bp 0x7ffc19bbfbb0 sp 0x7ffc19bbf380
READ of size 8 at 0x61e00285d8f8 thread T0
#0 0x56544eb4e156 in __asan_memcpy (/opt/godot/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san+0x19a84156) (BuildId: adc5cf39a196db58)
#1 0x56544f7f1951 in Object::get_instance_id() const /opt/godot/godot/./core/object/object.h:746:59
#2 0x565462494557 in SceneTree::call_group_flagsp(unsigned int, StringName const&, StringName const&, Variant const**, int) /opt/godot/godot/scene/main/scene_tree.cpp:281:48
#3 0x5654624af83a in SceneTree::_call_group(Variant const**, int, Callable::CallError&) /opt/godot/godot/scene/main/scene_tree.cpp:985:2
#4 0x565462527b8c in MethodBindVarArgT::call(Object*, Variant const**, int, Callable::CallError&) /opt/godot/godot/./core/object/method_bind.h:214:3
#5 0x56546edfc609 in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) /opt/godot/godot/core/object/object.cpp:733:17
#6 0x56546da68ecd in Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot/core/variant/callable.cpp:62:25
#7 0x56546edd6dad in MessageQueue::_call_function(Callable const&, Variant const*, int, bool) /opt/godot/godot/core/object/message_queue.cpp:229:13
#8 0x56546edd8241 in MessageQueue::flush() /opt/godot/godot/core/object/message_queue.cpp:275:6
#9 0x56546249a465 in SceneTree::physics_process(double) /opt/godot/godot/scene/main/scene_tree.cpp:433:33
#10 0x56544edc7072 in Main::iteration() /opt/godot/godot/main/main.cpp:3141:45
#11 0x56544ebb38af in OS_LinuxBSD::run() /opt/godot/godot/platform/linuxbsd/os_linuxbsd.cpp:799:7
#12 0x56544eb8caa9 in main /opt/godot/godot/platform/linuxbsd/godot_linuxbsd.cpp:73:6
#13 0x7f346db2dd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#14 0x7f346db2de3f in __libc_start_main csu/../csu/libc-start.c:392:3
#15 0x56544eacbfe4 in _start (/opt/godot/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san+0x19a01fe4) (BuildId: adc5cf39a196db58)
0x61e00285d8f8 is located 120 bytes inside of 2840-byte region [0x61e00285d880,0x61e00285e398)
freed by thread T0 here:
#0 0x56544eb4eb82 in free (/opt/godot/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san+0x19a84b82) (BuildId: adc5cf39a196db58)
#1 0x56546cc7f16f in Memory::free_static(void*, bool) /opt/godot/godot/core/os/memory.cpp:168:3
#2 0x5654515cf018 in void memdelete(Node*) /opt/godot/godot/./core/os/memory.h:112:2
#3 0x565462336ef6 in Node::_notification(int) /opt/godot/godot/scene/main/node.cpp:169:5
#4 0x56544f781a35 in Node::_notificationv(int, bool) /opt/godot/godot/./scene/main/node.h:45:2
#5 0x5654529cf26c in CanvasItem::_notificationv(int, bool) /opt/godot/godot/./scene/main/canvas_item.h:45:2
#6 0x5654529ced2c in Control::_notificationv(int, bool) /opt/godot/godot/./scene/gui/control.h:47:2
#7 0x5654529ce7ec in Container::_notificationv(int, bool) /opt/godot/godot/./scene/gui/container.h:37:2
#8 0x5654529ce24c in BoxContainer::_notificationv(int, bool) /opt/godot/godot/./scene/gui/box_container.h:37:2
#9 0x5654529c1ddb in VBoxContainer::_notificationv(int, bool) /opt/godot/godot/./scene/gui/box_container.h:92:2
#10 0x56546edeae73 in Object::notification(int, bool) /opt/godot/godot/core/object/object.cpp:790:2
#11 0x56546edeaa9d in Object::_predelete() /opt/godot/godot/core/object/object.cpp:196:2
#12 0x56546ee28290 in predelete_handler(Object*) /opt/godot/godot/core/object/object.cpp:1840:19
#13 0x5654515ceed5 in void memdelete(Node*) /opt/godot/godot/./core/os/memory.h:105:7
#14 0x56545bf8df80 in EditorInspector::_clear() /opt/godot/godot/editor/editor_inspector.cpp:3312:3
#15 0x56545bf95249 in EditorInspector::edit(Object*) /opt/godot/godot/editor/editor_inspector.cpp:3331:3
#16 0x56545bfa780c in EditorInspector::_notification(int) /opt/godot/godot/editor/editor_inspector.cpp:3859:4
#17 0x56545c015195 in EditorInspector::_notificationv(int, bool) /opt/godot/godot/./editor/editor_inspector.h:437:2
#18 0x56546edeae73 in Object::notification(int, bool) /opt/godot/godot/core/object/object.cpp:790:2
#19 0x5654623461ea in Node::_propagate_exit_tree() /opt/godot/godot/scene/main/node.cpp:295:2
#20 0x565462345d1e in Node::_propagate_exit_tree() /opt/godot/godot/scene/main/node.cpp:286:21
#21 0x56546236394d in Node::_set_tree(SceneTree*) /opt/godot/godot/scene/main/node.cpp:2523:3
#22 0x56546233eafc in Node::remove_child(Node*) /opt/godot/godot/scene/main/node.cpp:1199:11
#23 0x565462336bc2 in Node::_notification(int) /opt/godot/godot/scene/main/node.cpp:163:18
#24 0x56544f781a35 in Node::_notificationv(int, bool) /opt/godot/godot/./scene/main/node.h:45:2
#25 0x5654529cf26c in CanvasItem::_notificationv(int, bool) /opt/godot/godot/./scene/main/canvas_item.h:45:2
#26 0x5654529ced2c in Control::_notificationv(int, bool) /opt/godot/godot/./scene/gui/control.h:47:2
#27 0x5654529ce7ec in Container::_notificationv(int, bool) /opt/godot/godot/./scene/gui/container.h:37:2
#28 0x5654529ce24c in BoxContainer::_notificationv(int, bool) /opt/godot/godot/./scene/gui/box_container.h:37:2
#29 0x5654529c1ddb in VBoxContainer::_notificationv(int, bool) /opt/godot/godot/./scene/gui/box_container.h:92:2
previously allocated by thread T0 here:
#0 0x56544eb4ee2e in malloc (/opt/godot/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san+0x19a84e2e) (BuildId: adc5cf39a196db58)
#1 0x56546cc7a88d in Memory::alloc_static(unsigned long, bool) /opt/godot/godot/core/os/memory.cpp:75:14
#2 0x56546cc7a6e2 in operator new(unsigned long, char const*) /opt/godot/godot/core/os/memory.cpp:40:9
#3 0x56545c9a258d in EditorInspectorDefaultPlugin::get_editor_for_property(Object*, Variant::Type, String const&, PropertyHint, String const&, unsigned int, bool) /opt/godot/godot/editor/editor_properties.cpp:4607:38
#4 0x56545c99555e in EditorInspectorDefaultPlugin::parse_property(Object*, Variant::Type, String const&, PropertyHint, String const&, unsigned int, bool) /opt/godot/godot/editor/editor_properties.cpp:4200:20
#5 0x56545bf848b9 in EditorInspector::update_tree() /opt/godot/godot/editor/editor_inspector.cpp:3177:26
#6 0x56545bf96422 in EditorInspector::edit(Object*) /opt/godot/godot/editor/editor_inspector.cpp:3344:3
#7 0x56545c99303e in EditorPropertyResource::update_property() /opt/godot/godot/editor/editor_properties.cpp:4126:20
#8 0x56545c97ef3c in EditorPropertyResource::_resource_selected(Ref const&, bool) /opt/godot/godot/editor/editor_properties.cpp:3838:3
#9 0x56545cb5d627 in void call_with_variant_args_helper const&, bool, 0ul, 1ul>(EditorPropertyResource*, void (EditorPropertyResource::*)(Ref const&, bool), Variant const**, Callable::CallError&, IndexSequence<0ul, 1ul>) /opt/godot/godot/./core/variant/binder_common.h:262:2
#10 0x56545cb5d126 in void call_with_variant_args const&, bool>(EditorPropertyResource*, void (EditorPropertyResource::*)(Ref const&, bool), Variant const**, int, Callable::CallError&) /opt/godot/godot/./core/variant/binder_common.h:376:2
#11 0x56545cb5c9b9 in CallableCustomMethodPointer const&, bool>::call(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot/./core/object/callable_method_pointer.h:104:3
#12 0x56546da67d23 in Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot/core/variant/callable.cpp:50:11
#13 0x56546ee04f1d in Object::emit_signalp(StringName const&, Variant const**, int) /opt/godot/godot/core/object/object.cpp:1046:15
#14 0x56545cd4079a in Error Object::emit_signal, bool>(StringName const&, Ref, bool) /opt/godot/godot/./core/object/object.h:865:10
#15 0x56545ccfc07d in EditorResourcePicker::_resource_selected() /opt/godot/godot/editor/editor_resource_picker.cpp:132:2
#16 0x56545cd6a475 in void call_with_variant_args_helper(EditorResourcePicker*, void (EditorResourcePicker::*)(), Variant const**, Callable::CallError&, IndexSequence<>) /opt/godot/godot/./core/variant/binder_common.h:262:2
#17 0x56545cd6a0aa in void call_with_variant_args(EditorResourcePicker*, void (EditorResourcePicker::*)(), Variant const**, int, Callable::CallError&) /opt/godot/godot/./core/variant/binder_common.h:376:2
#18 0x56545cd69959 in CallableCustomMethodPointer::call(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot/./core/object/callable_method_pointer.h:104:3
#19 0x56546da67d23 in Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot/core/variant/callable.cpp:50:11
#20 0x56546ee04f1d in Object::emit_signalp(StringName const&, Variant const**, int) /opt/godot/godot/core/object/object.cpp:1046:15
#21 0x56545337f8ad in Error Object::emit_signal<>(StringName const&) /opt/godot/godot/./core/object/object.h:865:10
#22 0x5654628b9308 in BaseButton::_pressed() /opt/godot/godot/scene/gui/base_button.cpp:138:2
#23 0x5654628b6640 in BaseButton::on_action_event(Ref) /opt/godot/godot/scene/gui/base_button.cpp:172:5
#24 0x5654628b3a5d in BaseButton::gui_input(Ref const&) /opt/godot/godot/scene/gui/base_button.cpp:68:3
#25 0x565462c56c3f in Control::_call_gui_input(Ref const&) /opt/godot/godot/scene/gui/control.cpp:1709:2
#26 0x5654625d0d82 in Viewport::_gui_call_input(Control*, Ref const&) /opt/godot/godot/scene/main/viewport.cpp:1324:14
#27 0x5654625dd8a6 in Viewport::_gui_input_event(Ref) /opt/godot/godot/scene/main/viewport.cpp:1601:15
#28 0x565462614928 in Viewport::push_input(Ref const&, bool) /opt/godot/godot/scene/main/viewport.cpp:2782:3
#29 0x5654627972fb in Window::_window_input(Ref const&) /opt/godot/godot/scene/main/window.cpp:1089:2
SUMMARY: AddressSanitizer: heap-use-after-free (/opt/godot/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san+0x19a84156) (BuildId: adc5cf39a196db58) in __asan_memcpy
Closing in favour of #69159 which reports the same issue, but has more discussion/investigation
Godot version
4.0.beta5
System information
macOS 13.0.1
Issue description
If you have a control (like a Panel) with an assigned Theme you can access the Theme and the Theme styles in the Inspector for the Panel and click to then access the StyleBoxTexture for example. I'm pretty sure this worked as intended in 4.0.beta4, but now the editor consistently crashes if I click this Theme style resource in the inspector.
I can access the same resource fine from the Theme editor panel, or if I apply a stylebox as a Theme override on the Panel directly instead of via a Theme.
https://user-images.githubusercontent.com/17763524/202382786-243a0866-01ad-452a-8849-72b80b29e475.mov
Crash report
``` Process: Godot [1762] Path: /Applications/Godot.app/Contents/MacOS/Godot Identifier: org.godotengine.godot Version: 4.0 (4.0) Code Type: X86-64 (Native) Parent Process: launchd [1] User ID: 501 Date/Time: 2022-11-17 08:12:41.1798 +0100 OS Version: macOS 13.0.1 (22A400) Report Version: 12 Anonymous UUID: FCE8D6FB-F64A-7F5F-1FED-8DB41D0B297B Time Awake Since Boot: 2700 seconds System Integrity Protection: enabled Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGABRT) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000068 Exception Codes: 0x0000000000000001, 0x0000000000000068 VM Region Info: 0x68 is not in any region. Bytes before following region: 140737487749016 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL UNUSED SPACE AT START ---> shared memory 7ffffff6c000-7ffffff6d000 [ 4K] r-x/r-x SM=SHM Application Specific Information: abort() called Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsystem_kernel.dylib 0x7ff817a1330e __pthread_kill + 10 1 libsystem_pthread.dylib 0x7ff817a4af7b pthread_kill + 263 2 libsystem_c.dylib 0x7ff817994ca5 abort + 123 3 Godot 0x10c55354d 0x10c0e4000 + 4650317 4 libsystem_platform.dylib 0x7ff817a75c1d _sigtramp + 29 5 ??? 0x600019cbe890 ??? 6 Godot 0x10e5c8a22 0x10c0e4000 + 38685218 7 Godot 0x10da4536b 0x10c0e4000 + 26612587 8 Godot 0x1106018d0 0x10c0e4000 + 72472784 9 Godot 0x1102ac587 0x10c0e4000 + 68978055 10 Godot 0x1105f9fb6 0x10c0e4000 + 72441782 11 Godot 0x1105fa288 0x10c0e4000 + 72442504 12 Godot 0x10e5c6403 0x10c0e4000 + 38675459 13 Godot 0x10c5a18c7 0x10c0e4000 + 4970695 14 Godot 0x10c5502f3 0x10c0e4000 + 4637427 15 Godot 0x10c57825d 0x10c0e4000 + 4801117 16 dyld 0x7ff81771a310 start + 2432 Thread 1: 0 libsystem_kernel.dylib 0x7ff817a0f1fe __psynch_cvwait + 10 1 libsystem_pthread.dylib 0x7ff817a4b7e1 _pthread_cond_wait + 1243 2 libc++.1.dylib 0x7ff8179a7c32 std::__1::condition_variable::wait(std::__1::unique_lockSteps to reproduce
Minimal reproduction project
Test project (github won't let me attach zip files, so I've put it somewhere else)
(EDIT: Made crash report collapsible for improved readability)