==72172==ERROR: AddressSanitizer: heap-use-after-free on address 0x631001603810 at pc 0x7f95cc43a2c3 bp 0x7ffd05c74bd0 sp 0x7ffd05c74378
WRITE of size 24 at 0x631001603810 thread T0
#0 0x7f95cc43a2c2 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
#1 0x1f40f524 in CallQueue::flush() core/object/message_queue.cpp:239
#2 0x13bce6d9 in SceneTree::_process_group(SceneTree::ProcessGroup*, bool) scene/main/scene_tree.cpp:950
#3 0x13bd1858 in SceneTree::_process(bool) scene/main/scene_tree.cpp:1022
#4 0x13bbf585 in SceneTree::process(double) scene/main/scene_tree.cpp:504
#5 0x2d04bcc in Main::iteration() main/main.cpp:3334
#6 0x2a46d53 in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:899
#7 0x2a222a8 in main platform/linuxbsd/godot_linuxbsd.cpp:73
#8 0x7f95cb823a8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#9 0x7f95cb823b48 in __libc_start_main_impl ../csu/libc-start.c:360
#10 0x2a21c64 in _start (/usr/bin/godot4s+0x2a21c64)
0x631001603810 is located 61456 bytes inside of 65552-byte region [0x6310015f4800,0x631001604810)
freed by thread T0 here:
#0 0x7f95cc4b4537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x1db7f2f9 in Memory::free_static(void*, bool) core/os/memory.cpp:168
#2 0x2bb29cf in CowData<unsigned char>::_unref(void*) core/templates/cowdata.h:218
#3 0x2b99f16 in CowData<unsigned char>::~CowData() core/templates/cowdata.h:412
#4 0x2b7be19 in Vector<unsigned char>::~Vector() core/templates/vector.h:290
#5 0x4a8df8a in CowData<Vector<unsigned char> >::_unref(void*) core/templates/cowdata.h:213
#6 0x4a8c25c in CowData<Vector<unsigned char> >::~CowData() core/templates/cowdata.h:412
#7 0x4a8978f in Vector<Vector<unsigned char> >::~Vector() core/templates/vector.h:290
#8 0xc25894f in RenderingDeviceVulkan::shader_create_from_bytecode(Vector<unsigned char> const&) drivers/vulkan/rendering_device_vulkan.cpp:4940
#9 0x1b090f3a in ShaderRD::_load_from_cache(ShaderRD::Version*) servers/rendering/renderer_rd/shader_rd.cpp:431
#10 0x1b0937dd in ShaderRD::_compile_version(ShaderRD::Version*) servers/rendering/renderer_rd/shader_rd.cpp:478
#11 0x1b095df5 in ShaderRD::version_set_code(RID, HashMap<String, String, HashMapHasherDefault, HashMapComparatorDefault<String>, DefaultTypedAllocator<HashMapElement<String, String> > > const&, String const&, String const&, String const&, Vector<String> const&) servers/rendering/renderer_rd/shader_rd.cpp:553
#12 0x1d38b7ff in RendererCanvasRenderRD::CanvasShaderData::set_code(String const&) servers/rendering/renderer_rd/renderer_canvas_render_rd.cpp:2085
#13 0x1b76cdfb in RendererRD::MaterialStorage::shader_set_code(RID, String const&) servers/rendering/renderer_rd/storage_rd/material_storage.cpp:2534
#14 0x1aa28ed4 in RenderingServerDefault::shader_set_code(RID, String const&) servers/rendering/rendering_server_default.h:229
#15 0x1832c1eb in Shader::set_code(String const&) scene/resources/shader.cpp:107
#16 0x1424c416 in ColorPicker::init_shaders() scene/gui/color_picker.cpp:179
#17 0x135a546b in register_scene_types() scene/register_scene_types.cpp:1150
#18 0x2ce1001 in Main::setup2() main/main.cpp:2407
#19 0x2cce801 in Main::setup(char const*, int, char**, bool) main/main.cpp:1943
#20 0x2a220c9 in main platform/linuxbsd/godot_linuxbsd.cpp:61
#21 0x7f95cb823a8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
previously allocated by thread T0 here:
#0 0x7f95cc4b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x1db7e21b in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:75
#2 0x46eaf00 in Error CowData<unsigned char>::resize<false>(int) core/templates/cowdata.h:288
#3 0x45beb81 in Vector<unsigned char>::resize(int) core/templates/vector.h:94
#4 0xc254f42 in RenderingDeviceVulkan::shader_create_from_bytecode(Vector<unsigned char> const&) drivers/vulkan/rendering_device_vulkan.cpp:4969
#5 0x1b090f3a in ShaderRD::_load_from_cache(ShaderRD::Version*) servers/rendering/renderer_rd/shader_rd.cpp:431
#6 0x1b0937dd in ShaderRD::_compile_version(ShaderRD::Version*) servers/rendering/renderer_rd/shader_rd.cpp:478
#7 0x1b095df5 in ShaderRD::version_set_code(RID, HashMap<String, String, HashMapHasherDefault, HashMapComparatorDefault<String>, DefaultTypedAllocator<HashMapElement<String, String> > > const&, String const&, String const&, String const&, Vector<String> const&) servers/rendering/renderer_rd/shader_rd.cpp:553
#8 0x1d38b7ff in RendererCanvasRenderRD::CanvasShaderData::set_code(String const&) servers/rendering/renderer_rd/renderer_canvas_render_rd.cpp:2085
#9 0x1b76cdfb in RendererRD::MaterialStorage::shader_set_code(RID, String const&) servers/rendering/renderer_rd/storage_rd/material_storage.cpp:2534
#10 0x1aa28ed4 in RenderingServerDefault::shader_set_code(RID, String const&) servers/rendering/rendering_server_default.h:229
#11 0x1832c1eb in Shader::set_code(String const&) scene/resources/shader.cpp:107
#12 0x1424c416 in ColorPicker::init_shaders() scene/gui/color_picker.cpp:179
#13 0x135a546b in register_scene_types() scene/register_scene_types.cpp:1150
#14 0x2ce1001 in Main::setup2() main/main.cpp:2407
#15 0x2cce801 in Main::setup(char const*, int, char**, bool) main/main.cpp:1943
#16 0x2a220c9 in main platform/linuxbsd/godot_linuxbsd.cpp:61
#17 0x7f95cb823a8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.
Godot version
4.1.dev.custom_build. c64afeb01
System information
Ubuntu 23.04 - AMD RX 470, Gnome shell 43 X11
Issue description
When executing
Godot crashes:
This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.
Memory leaks or asan backtraces are visibe when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)
Steps to reproduce
Above
Minimal reproduction project
Above