Crash when TextureRect is visible and TileMap is scaled down

[duane-r]

Godot version

v4.1.1.stable.official [bd6af8e]

System information

Godot v4.1.1.stable - Gentoo 2.14 - Vulkan (Compatibility) - AMD Radeon Vega 8 Graphics (raven, LLVM 16.0.6, DRM 3.49, 6.1.41-gentoo-x86_64) () - AMD Ryzen 5 3500U with Radeon Vega Mobile Gfx (8 Threads)

Issue description

This minimal project crashes when run with the background TextRect visible, but if you toggle its visibility, no crash occurs. Note that this only started when I scaled down the TileMap to half (either by scaling MapCenter or Dungeon).

handle_crash: Program crashed with signal 11
Engine version: Godot Engine v4.1.1.stable.official (bd6af8e0ea69167dd0627f3bd54
f9105bda0f8b5)
Dumping the backtrace. Please include this when reporting the bug to the project
 developer.
[1] /lib64/libc.so.6(+0x38790) [0x7fd308df7790] (??:0)
[2] /lib64/libc.so.6(+0x14e237) [0x7fd308f0d237] (??:0)
[3] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0x1c66508] (??:0)
[4] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0x1c71f1b] (??:0)
[5] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0x1c9c1d3] (??:0)
[6] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0x1c9ff22] (??:0)
[7] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0x4339a9c] (??:0)
[8] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0x4342037] (??:0)
[9] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0x3dcc902] (??:0)
[10] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0xf16a56] (??:0)
[11] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0xe46444] (??:0)
[12] /lib64/libc.so.6(+0x2364a) [0x7fd308de264a] (??:0)
[13] /lib64/libc.so.6(__libc_start_main+0x85) [0x7fd308de2705] (??:0)
[14] /usr/local/bin/Godot_v4.1.1-stable_linux.x86_64() [0xe777ae] (??:0)
-- END OF BACKTRACE --
================================================================

Steps to reproduce

1. Run the attached project to see the crash.
2. Click the "toggle visibility" button beside Background to see no crash.

Minimal reproduction project

mrp.zip

[KoBeWi]

CrashHandlerException: Program crashed
Engine version: Godot Engine v4.2.dev.custom_build (3f25e51aa88ffe27e5173057136c359fab450125)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[0] memcpy (D:\a\_work\1\s\src\vctools\crt\vcruntime\src\string\amd64\memcpy.asm:433)
[1] RasterizerCanvasGLES3::_add_to_batch (C:\godot_source\drivers\gles3\rasterizer_canvas_gles3.cpp:1464)
[2] RasterizerCanvasGLES3::_record_item_commands (C:\godot_source\drivers\gles3\rasterizer_canvas_gles3.cpp:980)
[3] RasterizerCanvasGLES3::_render_items (C:\godot_source\drivers\gles3\rasterizer_canvas_gles3.cpp:634)
[4] RasterizerCanvasGLES3::canvas_render_items (C:\godot_source\drivers\gles3\rasterizer_canvas_gles3.cpp:493)
[5] RendererCanvasCull::_render_canvas_item_tree (C:\godot_source\servers\rendering\renderer_canvas_cull.cpp:72)
[6] RendererCanvasCull::render_canvas (C:\godot_source\servers\rendering\renderer_canvas_cull.cpp:381)
[7] RendererViewport::_draw_viewport (C:\godot_source\servers\rendering\renderer_viewport.cpp:559)
[8] RendererViewport::draw_viewports (C:\godot_source\servers\rendering\renderer_viewport.cpp:741)
[9] RenderingServerDefault::_draw (C:\godot_source\servers\rendering\rendering_server_default.cpp:92)
[10] RenderingServerDefault::draw (C:\godot_source\servers\rendering\rendering_server_default.cpp:387)
[11] Main::iteration (C:\godot_source\main\main.cpp:3517)
[12] OS_Windows::run (C:\godot_source\platform\windows\os_windows.cpp:1479)
[13] widechar_main (C:\godot_source\platform\windows\godot_windows.cpp:182)
[14] _main (C:\godot_source\platform\windows\godot_windows.cpp:204)
[15] main (C:\godot_source\platform\windows\godot_windows.cpp:218)
[16] WinMain (C:\godot_source\platform\windows\godot_windows.cpp:232)
[17] __scrt_common_main_seh (D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288)
[18] <couldn't map PC to fn name>
-- END OF BACKTRACE --

[jsjtxietian]

The real problem is that the buffer is NULL ( glMapBufferRange failed ) in the following code, using glGetError will tell GL_INVALID_VALUE.

// From RasterizerCanvasGLES3::_add_to_batch
// On Desktop and mobile we map the memory without synchronizing for maximum speed.
void *buffer = glMapBufferRange(GL_ARRAY_BUFFER, state.last_item_index * sizeof(InstanceData), r_index * sizeof(InstanceData), GL_MAP_WRITE_BIT | GL_MAP_UNSYNCHRONIZED_BIT);
memcpy(buffer, state.instance_data_array, r_index * sizeof(InstanceData));

state.last_item_index = 1, sizeof(InstanceData) =128, r_index = data.max_instances_per_buffer = 16384 , buffer length = 2097152. And glMapBufferRange trys to map from offset 128 with length 2097152 from the array buffer which length is 2097152 so it failed, because offset + length > buffer length.

@clayjohn Any thoughts? I change if (r_index >= data.max_instances_per_buffer) to if (r_index + state.last_item_index >= data.max_instances_per_buffer) and it works, I will submit a pr for this and your suggestion is welcomed.