Debugger RayCast Reference Crash segfault in ::_get_property_listv

[robert-wallis]

Godot version:

• 3.2.2.stable.official
• 3.2.3.rc3.official

OS/device including version:
GLES3
macOS 10.15.6 (produces log)
Windows 10 (no logs, but still crashes)

Issue description:

Godot crashes after saving the results of get_collider() into an exported array.

But only if:

• a breakpoint is set anywhere after saving into the array
• there are multiple raycasts
• the raycasts are in a physics body, and the body is in a sub-scene

(minimal project included)

# Root.gd
extends Spatial

onready var _neighbors = [
	$Neighbors1,
	$Neighbors2,
]

func _ready():
	var updated = []
	for n in _neighbors:
		n.update_neighbors()
		updated.append(n)

	print("put a breakpoint on this line, it will crash")

# Neighbors.gd
extends StaticBody

export var neighbors = []

onready var _ray_e = $RayCast_E
onready var _ray_w = $RayCast_W

# checks all the raycasts for colliders along their path
func update_neighbors():
	_ray_e.force_raycast_update()
	_ray_w.force_raycast_update()
	var e = _ray_e.get_collider()
	var w = _ray_w.get_collider()
	# return [ e, w ]  # UNCOMMENT TO FIX CRASh
	neighbors = [ e, w ] # Crashes here the second time
	return neighbors

Godot crashes with the following crash dump (macOS crash dump window)

Process:               Godot [55571]
Path:                  /private/var/folders/*/Godot 3.2.3rc3.app/Contents/MacOS/Godot
Identifier:            org.godotengine.godot
Version:               3.2.3 (3.2.3)
Code Type:             X86-64 (Native)
Parent Process:        Godot [55484]
User ID:               501

Date/Time:             2020-08-02 00:08:49.208 -0700
OS Version:            Mac OS X 10.15.6 (19G73)
Report Version:        12
Bridge OS Version:     4.6 (17P6065)
Anonymous UUID:        852FD9D5-9495-F193-51D5-745F9A1A65B0

Sleep/Wake UUID:       1BD77278-B242-4A27-8DF0-DD750D1688BE

Time Awake Since Boot: 460000 seconds
Time Since Wake:       38000 seconds

System Integrity Protection: enabled

Notes:                 Translocated Process

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_PROTECTION_FAILURE at 0x00007ffee2fd3ff8
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [55571]

VM Regions Near 0x7ffee2fd3ff8:
    MALLOC_MEDIUM (reserve 00007f85b8800000-00007f85c0000000 [120.0M] rw-/rwx SM=NUL  reserved VM address space (unallocated)
--> STACK GUARD            00007ffedf7d4000-00007ffee2fd4000 [ 56.0M] ---/rwx SM=NUL  stack guard for thread 0
    Stack                  00007ffee2fd4000-00007ffee37d4000 [ 8192K] rw-/rwx SM=SHM  thread 0

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_malloc.dylib        	0x00007fff6a1a28ee tiny_free_list_add_ptr + 4
1   libsystem_malloc.dylib        	0x00007fff6a19fe76 tiny_malloc_from_free_list + 1636
2   libsystem_malloc.dylib        	0x00007fff6a19f297 tiny_malloc_should_clear + 288
3   libsystem_malloc.dylib        	0x00007fff6a19e0c6 szone_malloc_should_clear + 66
4   libsystem_malloc.dylib        	0x00007fff6a19cd7a malloc_zone_malloc + 104
5   libsystem_malloc.dylib        	0x00007fff6a19ccf5 malloc + 21
6   org.godotengine.godot         	0x000000010ec92347 Memory::alloc_static(unsigned long, bool) + 23
7   org.godotengine.godot         	0x000000010eb9dce0 CowData<wchar_t>::resize(int) + 368
8   org.godotengine.godot         	0x000000010eb7f19a String::copy_from(char const*) + 74
9   org.godotengine.godot         	0x000000010eb82bb6 String::String(char const*) + 22
10  org.godotengine.godot         	0x000000010daa27c3 Node::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 35
11  org.godotengine.godot         	0x000000010c6a9e39 Spatial::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 41
12  org.godotengine.godot         	0x000000010dec6629 CollisionObject::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 41
13  org.godotengine.godot         	0x000000010dec4929 PhysicsBody::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 41
14  org.godotengine.godot         	0x000000010dec4e39 StaticBody::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 41
15  org.godotengine.godot         	0x000000010eaf46cc Object::get_property_list(List<PropertyInfo, DefaultAllocator>*, bool) const + 284
16  org.godotengine.godot         	0x000000010ed29c5d encode_variant(Variant const&, unsigned char*, int&, bool) + 1357
17  org.godotengine.godot         	0x000000010ed2a07e encode_variant(Variant const&, unsigned char*, int&, bool) + 2414
18  org.godotengine.godot         	0x000000010ed29d22 encode_variant(Variant const&, unsigned char*, int&, bool) + 1554
19  org.godotengine.godot         	0x000000010ed2a07e encode_variant(Variant const&, unsigned char*, int&, bool) + 2414
20  org.godotengine.godot         	0x000000010ed29d22 encode_variant(Variant const&, unsigned char*, int&, bool) + 1554

[same two addresses repeated from 20 to 510]

510 org.godotengine.godot         	0x000000010ed29d22 encode_variant(Variant const&, unsigned char*, int&, bool) + 1554
511 org.godotengine.godot         	0x000000010ed2a07e encode_variant(Variant const&, unsigned char*, int&, bool) + 2414

Steps to reproduce:

• Open attached project
• Place breakpoint on print() line in Root.gd
• Press Play
• Crash

Crashes on macOS and Windows

Minimal reproduction project:

Crasher.zip

[robert-wallis]

3.2.3 rc4 still happening
(just updating that I tested, I don't know of any commits that would address this)

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_malloc.dylib        	0x00007fff68b1a19c tiny_malloc_should_clear + 37
1   libsystem_malloc.dylib        	0x00007fff68b190c6 szone_malloc_should_clear + 66
2   libsystem_malloc.dylib        	0x00007fff68b17d7a malloc_zone_malloc + 104
3   libsystem_malloc.dylib        	0x00007fff68b17cf5 malloc + 21
4   org.godotengine.godot         	0x00000001074b0777 Memory::alloc_static(unsigned long, bool) + 23
5   org.godotengine.godot         	0x00000001073bc110 CowData<wchar_t>::resize(int) + 368
6   org.godotengine.godot         	0x000000010739d49a String::copy_from(char const*) + 74
7   org.godotengine.godot         	0x00000001073a0eb6 String::String(char const*) + 22
8   org.godotengine.godot         	0x00000001062c00d3 Node::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 35
9   org.godotengine.godot         	0x0000000104ec65a9 Spatial::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 41
10  org.godotengine.godot         	0x00000001066e4699 CollisionObject::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 41
11  org.godotengine.godot         	0x00000001066e2999 PhysicsBody::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 41
12  org.godotengine.godot         	0x00000001066e2ea9 StaticBody::_get_property_listv(List<PropertyInfo, DefaultAllocator>*, bool) const + 41
13  org.godotengine.godot         	0x000000010731297c Object::get_property_list(List<PropertyInfo, DefaultAllocator>*, bool) const + 284
14  org.godotengine.godot         	0x000000010754808d encode_variant(Variant const&, unsigned char*, int&, bool) + 1357
15  org.godotengine.godot         	0x00000001075484ae encode_variant(Variant const&, unsigned char*, int&, bool) + 2414
16  org.godotengine.godot         	0x0000000107548152 encode_variant(Variant const&, unsigned char*, int&, bool) + 1554
17  org.godotengine.godot         	0x00000001075484ae encode_variant(Variant const&, unsigned char*, int&, bool) + 2414

[qarmin]

Looks that it is fixed(this was probably problem with recursion)
With 3.4.beta.custom_build. f285b88, only this errors are shown

ERROR: Condition "err" is true. Returned: err
   at: encode_variant (core/io/marshalls.cpp:1162)
ERROR: Failed to encode variant.
   at: _put_variable (scene/debugger/script_debugger_remote.cpp:111)

[robert-wallis]

Thank you, confirmed no longer segfaults. (3.x branch, 5ac3a85)