glTF importer crashes in _parse_meshes on specific glTF sample (crash in RasterizerStorageRD::mesh_add_surface)

[akien-mga]

Godot version:
master (3556bc4)
The crash is not reproducible in the 3.2 branch.

OS/device including version:
Mageia 8 Linux x86_64
GCC 10.2.0

Issue description:
The glTF 2.0 sample "BrainStem" (from https://github.com/KhronosGroup/glTF-Sample-Models) included in the attached project triggers a crash in the master branch with the following stacktrace:

glTF: Importing file res://BrainStem/glTF/BrainStem.gltf as scene.
glTF: Total buffers: 1
glTF: Total buffer views: 8
glTF: Total accessors: 372
glTF: Total materials: 59
glTF: type mat4 component type: Float stride: 64 amount 18
glTF: accessor offset0 view offset: 0 total buffer len: 3105104 view len 1152
glTF: Total skins: 1
glTF: Parsing mesh: 0
glTF: type vec3 component type: Float stride: 12 amount 538
glTF: accessor offset6456 view offset: 1542536 total buffer len: 3105104 view len 819816
glTF: type vec3 component type: Float stride: 12 amount 538
glTF: accessor offset0 view offset: 1542536 total buffer len: 3105104 view len 819816
glTF: type vec4 component type: UShort stride: 8 amount 538
glTF: accessor offset0 view offset: 2362352 total buffer len: 3105104 view len 273272
glTF: type vec4 component type: Float stride: 16 amount 538
glTF: accessor offset0 view offset: 399088 total buffer len: 3105104 view len 546544
glTF: type float component type: UShort stride: 2 amount 2778
glTF: accessor offset0 view offset: 2735108 total buffer len: 3105104 view len 369996
glTF: type vec3 component type: Float stride: 12 amount 1019
glTF: accessor offset25140 view offset: 1542536 total buffer len: 3105104 view len 819816
glTF: type vec3 component type: Float stride: 12 amount 1019
glTF: accessor offset12912 view offset: 1542536 total buffer len: 3105104 view len 819816
glTF: type vec4 component type: UShort stride: 8 amount 1019
glTF: accessor offset4304 view offset: 2362352 total buffer len: 3105104 view len 273272
glTF: type vec4 component type: Float stride: 16 amount 1019
glTF: accessor offset8608 view offset: 399088 total buffer len: 3105104 view len 546544
glTF: type float component type: UShort stride: 2 amount 5928
glTF: accessor offset5556 view offset: 2735108 total buffer len: 3105104 view len 369996
ERROR: FATAL: Index p_index = 2 is out of bounds (((Vector<T> *)(this))->_cowdata.size() = 2).
   at: operator[] (./core/vector.h:50)
--Type <RET> for more, q to quit, c to continue without paging--

Thread 1 "godot-git" received signal SIGILL, Illegal instruction.
0x0000000003fcbbd9 in VectorWriteProxy<AABB>::operator[] (this=0x900bec8, p_index=2) at ./core/vector.h:50
50                      CRASH_BAD_INDEX(p_index, ((Vector<T> *)(this))->_cowdata.size());
(gdb) bt
#0  0x0000000003fcbbd9 in VectorWriteProxy<AABB>::operator[] (this=0x900bec8, p_index=2) at ./core/vector.h:50
#1  0x00000000045aa8b6 in RasterizerStorageRD::mesh_add_surface (this=0x80f99b0, p_mesh=..., p_surface=...) at servers/rendering/rasterizer_rd/rasterizer_storage_rd.cpp:2348
#2  0x000000000446e092 in RenderingServerRaster::mesh_add_surface (this=0x7af0e40, arg1=..., arg2=...) at servers/rendering/rendering_server_raster.h:245
#3  0x00000000044a4712 in RenderingServerWrapMT::mesh_add_surface (this=0x84f86d0, p1=..., p2=...) at servers/rendering/rendering_server_wrap_mt.h:152
#4  0x0000000003fc2c8f in ArrayMesh::add_surface (this=0x16dcc960, p_format=32195, p_primitive=Mesh::PRIMITIVE_TRIANGLES, p_array=..., p_vertex_count=1019, p_index_array=..., p_index_count=5928, p_aabb=..., 
    p_blend_shapes=..., p_bone_aabb=..., p_lods=...) at scene/resources/mesh.cpp:1104
#5  0x0000000003fc2ec2 in ArrayMesh::add_surface_from_arrays (this=0x16dcc960, p_primitive=Mesh::PRIMITIVE_TRIANGLES, p_arrays=..., p_blend_shapes=..., p_lods=..., p_flags=31744)
    at scene/resources/mesh.cpp:1127
#6  0x000000000305b5fb in EditorSceneImporterGLTF::_parse_meshes (this=0xa8a0d40, state=...) at editor/import/editor_scene_importer_gltf.cpp:1225
#7  0x000000000306a0da in EditorSceneImporterGLTF::import_scene (this=0xa8a0d40, p_path=..., p_flags=6406, p_bake_fps=15, r_missing_deps=0x7fffffffb750, r_err=0x7fffffffb75c)
    at editor/import/editor_scene_importer_gltf.cpp:3204
#8  0x000000000309ff22 in ResourceImporterScene::import (this=0x91e3700, p_source_file=..., p_save_path=..., p_options=..., r_platform_variants=0x7fffffffbf58, r_gen_files=0x7fffffffbf50, 
    r_metadata=0x7fffffffbf30) at editor/import/resource_importer_scene.cpp:1274
#9  0x0000000002c831a0 in EditorFileSystem::_reimport_file (this=0x9feaa70, p_file=...) at editor/editor_file_system.cpp:1729
#10 0x0000000002c85eae in EditorFileSystem::reimport_files (this=0x9feaa70, p_files=...) at editor/editor_file_system.cpp:1918
#11 0x0000000002c7863e in EditorFileSystem::_update_scan_actions (this=0x9feaa70) at editor/editor_file_system.cpp:558
#12 0x0000000002c7c863 in EditorFileSystem::_notification (this=0x9feaa70, p_what=17) at editor/editor_file_system.cpp:1122
#13 0x0000000002c89088 in EditorFileSystem::_notificationv (this=0x9feaa70, p_notification=17, p_reversed=false) at editor/editor_file_system.h:106
#14 0x000000000480b3f5 in Object::notification (this=0x9feaa70, p_notification=17, p_reversed=false) at core/object.cpp:806
#15 0x000000000384b718 in SceneTree::_notify_group_pause (this=0x7a0b770, p_group=..., p_notification=17) at scene/main/scene_tree.cpp:818
#16 0x00000000038499d6 in SceneTree::idle (this=0x7a0b770, p_time=0.143625021) at scene/main/scene_tree.cpp:447
#17 0x0000000001ad732b in Main::iteration () at main/main.cpp:2426
#18 0x0000000001aa00e2 in OS_LinuxBSD::run (this=0x7fffffffd190) at platform/linuxbsd/os_linuxbsd.cpp:240
#19 0x0000000001a9dd47 in main (argc=3, argv=0x7fffffffd698) at platform/linuxbsd/godot_linuxbsd.cpp:58

Steps to reproduce:

• Download MRP
• Run in editor (use -v for importer logs)

Minimal reproduction project:
gltf-crash-parse_meshes.zip

[akien-mga]

Interestingly, the same crash happens with the Collada version of this mesh, so the issue doesn't seem to be on the import side but further down the stacktrace in the rasterizer (which explains why it crashes on master and not 3.2).

[1] /lib64/libc.so.6(+0x3a4e0) [0x7f533e3d24e0] (??:0)
[2] VectorWriteProxy<AABB>::operator[](int) (/home/akien/Projects/godot/godot.git/./core/vector.h:50 (discriminator 7))
[3] RasterizerStorageRD::mesh_add_surface(RID, RenderingServer::SurfaceData const&) (/home/akien/Projects/godot/godot.git/servers/rendering/rasterizer_rd/rasterizer_storage_rd.cpp:2348 (discriminator 2))
[4] RenderingServerRaster::mesh_add_surface(RID, RenderingServer::SurfaceData const&) (/home/akien/Projects/godot/godot.git/servers/rendering/rendering_server_raster.h:245)
[5] RenderingServerWrapMT::mesh_add_surface(RID, RenderingServer::SurfaceData const&) (/home/akien/Projects/godot/godot.git/servers/rendering/rendering_server_wrap_mt.h:152 (discriminator 2))
[6] ArrayMesh::add_surface(unsigned int, Mesh::PrimitiveType, Vector<unsigned char> const&, int, Vector<unsigned char> const&, int, AABB const&, Vector<Vector<unsigned char> > const&, Vector<AABB> const&, Vector<RenderingServer::SurfaceData::LOD> const&) (/home/akien/Projects/godot/godot.git/scene/resources/mesh.cpp:1106)
[7] ArrayMesh::add_surface_from_arrays(Mesh::PrimitiveType, Array const&, Array const&, Dictionary const&, unsigned int) (/home/akien/Projects/godot/godot.git/scene/resources/mesh.cpp:1127)
[8] ColladaImport::_create_mesh_surfaces(bool, Ref<ArrayMesh>&, Map<String, Collada::NodeGeometry::Material, Comparator<String>, DefaultAllocator> const&, Collada::MeshData const&, Transform const&, Vector<int> const&, Collada::SkinControllerData const*, Collada::MorphControllerData const*, Vector<Ref<ArrayMesh> >, bool, bool) (/home/akien/Projects/godot/godot.git/editor/import/editor_import_collada.cpp:926 (discriminator 7))
[9] ColladaImport::_create_resources(Collada::Node*, bool) (/home/akien/Projects/godot/godot.git/editor/import/editor_import_collada.cpp:1136 (discriminator 3))
[10] ColladaImport::_create_resources(Collada::Node*, bool) (/home/akien/Projects/godot/godot.git/editor/import/editor_import_collada.cpp:1177)
[11] ColladaImport::load(String const&, int, bool, bool) (/home/akien/Projects/godot/godot.git/editor/import/editor_import_collada.cpp:1216)
[12] EditorSceneImporterCollada::import_scene(String const&, unsigned int, int, List<String, DefaultAllocator>*, Error*) (/home/akien/Projects/godot/godot.git/editor/import/editor_import_collada.cpp:1661)
[13] ResourceImporterScene::import(String const&, String const&, Map<StringName, Variant, Comparator<StringName>, DefaultAllocator> const&, List<String, DefaultAllocator>*, List<String, DefaultAllocator>*, Variant*) (/home/akien/Projects/godot/godot.git/editor/import/resource_importer_scene.cpp:1274)
[14] EditorFileSystem::_reimport_file(String const&) (/home/akien/Projects/godot/godot.git/editor/editor_file_system.cpp:1729)
[15] EditorFileSystem::reimport_files(Vector<String> const&) (/home/akien/Projects/godot/godot.git/editor/editor_file_system.cpp:1916 (discriminator 3))
[16] EditorFileSystem::_update_scan_actions() (/home/akien/Projects/godot/godot.git/editor/editor_file_system.cpp:561)
[17] EditorFileSystem::_notification(int) (/home/akien/Projects/godot/godot.git/editor/editor_file_system.cpp:1123)
[18] EditorFileSystem::_notificationv(int, bool) (/home/akien/Projects/godot/godot.git/editor/editor_file_system.h:106 (discriminator 14))
[19] Object::notification(int, bool) (/home/akien/Projects/godot/godot.git/core/object.cpp:808)
[20] SceneTree::_notify_group_pause(StringName const&, int) (/home/akien/Projects/godot/godot.git/scene/main/scene_tree.cpp:818)
[21] SceneTree::idle(float) (/home/akien/Projects/godot/godot.git/scene/main/scene_tree.cpp:447 (discriminator 2))
[22] Main::iteration() (/home/akien/Projects/godot/godot.git/main/main.cpp:2426)
[23] OS_LinuxBSD::run() (/home/akien/Projects/godot/godot.git/platform/linuxbsd/os_linuxbsd.cpp:240)
[24] godot-git(main+0x135) [0x1a9dd47] (/home/akien/Projects/godot/godot.git/platform/linuxbsd/godot_linuxbsd.cpp:60)
[25] /lib64/libc.so.6(__libc_start_main+0xea) [0x7f533e3becda] (??:0)
[26] godot-git(_start+0x2a) [0x1a9db6a] (??:?)
-- END OF BACKTRACE --
Aborted (core dumped)

[akien-mga]

There was a pre-existing report about this in #36802, so we know the issue exists at least since e89754f.

According to @dpalacio, after a successful import of the glTF in Godot 3.2.x, trying to open that inherited scene in master will trigger the same crash.

[akien-mga]

No longer crashing in latest master.