AnimationPlayer bezier editor crash when using undo

[KoBeWi]

Tested versions

4.3 f8a2a9193662b2e8c1d04d65e647399dee94f31e

System information

Windows 10.0.19045 - Vulkan (Forward+) - dedicated NVIDIA GeForce GTX 1060 (NVIDIA; 30.0.15.1403) - Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz (8 Threads)

Issue description

CrashHandlerException: Program crashed
Engine version: Godot Engine v4.3.dev.custom_build (f8a2a9193662b2e8c1d04d65e647399dee94f31e)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[0] CowData<Animation::Track *>::_get_size (C:\godot_source\core\templates\cowdata.h:81)
[1] CowData<Animation::Track *>::size (C:\godot_source\core\templates\cowdata.h:134)
[2] Vector<Animation::Track *>::size (C:\godot_source\core\templates\vector.h:93)
[3] Animation::get_track_count (C:\godot_source\scene\resources\animation.cpp:972)
[4] AnimationTrackEditor::_key_selected (C:\godot_source\editor\animation_track_editor.cpp:5083)
[5] call_with_variant_args_helper<AnimationTrackEditor,int,bool,int,0,1,2> (C:\godot_source\core\variant\binder_common.h:308)
[6] call_with_variant_args<AnimationTrackEditor,int,bool,int> (C:\godot_source\core\variant\binder_common.h:418)
[7] CallableCustomMethodPointer<AnimationTrackEditor,int,bool,int>::call (C:\godot_source\core\object\callable_method_pointer.h:99)
[8] Callable::callp (C:\godot_source\core\variant\callable.cpp:58)
[9] CallQueue::_call_function (C:\godot_source\core\object\message_queue.cpp:222)
[10] CallQueue::flush (C:\godot_source\core\object\message_queue.cpp:328)
[11] SceneTree::physics_process (C:\godot_source\scene\main\scene_tree.cpp:473)
[12] Main::iteration (C:\godot_source\main\main.cpp:3750)
[13] OS_Windows::run (C:\godot_source\platform\windows\os_windows.cpp:1474)
[14] widechar_main (C:\godot_source\platform\windows\godot_windows.cpp:182)
[15] _main (C:\godot_source\platform\windows\godot_windows.cpp:204)
[16] main (C:\godot_source\platform\windows\godot_windows.cpp:218)
[17] WinMain (C:\godot_source\platform\windows\godot_windows.cpp:232)
[18] __scrt_common_main_seh (D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288)
[19] <couldn't map PC to fn name>
-- END OF BACKTRACE --

Steps to reproduce

1. Add AnimationPlayer
2. Add a bezier track and insert some key
3. Switch to bezier
4. Do something with the key (change it idk)
5. Delete AnimationPlayer
6. Undo

Exact steps are not obvious determine, but it's something like that.

Minimal reproduction project (MRP)

N/A

[CookieBadger]

I was not able to reproduce this in 4.3-beta2

[KoBeWi]

I can still reproduce. Here's a video, in case instructions were unclear:

https://github.com/godotengine/godot/assets/2223172/73544601-40fc-42ba-b7a9-8d3170e08ed4

[CookieBadger]

Thank you, now I have been able to reproduce it, by performing undo TWICE (undoing the "move bezier key" step, without selecting the animation player). Digging a little into it, I found that it stems from the step // 7-reselect in gui_input() in the animation bezier editor. Commenting out the lines to do undo and redo of the selection in the loop, the crash does not happen anymore.

Looking further, it seems that after the deletion the animation field in animation_track_editor.cpp is NULL, so when the _key_selected method is called after a key_selected signal is emitted in the bezier editor, the program tries to access the track count of a null object. Some null checks should do the trick.