Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Executing AnimationNode.blend_node function crashes Godot #86070

Closed
qarmin opened this issue Dec 12, 2023 · 0 comments · Fixed by #86321
Closed

Executing AnimationNode.blend_node function crashes Godot #86070

qarmin opened this issue Dec 12, 2023 · 0 comments · Fixed by #86321

Comments

@qarmin
Copy link
Contributor

qarmin commented Dec 12, 2023

Tested versions

4.3.dev.custom_build. 15a03ed - not happened 10 days ago

System information

Ubuntu 22.04 CI

Issue description

When executing (this code was automatically minimized, so it is possible, that an even more "minimal" project can be created)

extends Node
func _process(delta):
	var temp_variable6683 = AnimationNode.new()
	temp_variable6683.blend_node(StringName(""), null, -73.458343744278, false, false, -98.5318875871599, -46, false, false)

Godot crashes:

Godot Engine v4.3.dev.custom_build.15a03ed98 - https://godotengine.org
Time set to: 0 seconds.
Loaded settings:
modules/gdscript/gdscript_vm.cpp:698:13: runtime error: store to misaligned address 0x61600014e024 for type '<unknown> *', which requires 8 byte alignment
0x61600014e024: note: pointer points here
  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  0a 00 00 00 02 00 00 00  09 00 00 00 17 00 00 00
              ^ 
modules/gdscript/gdscript_vm.cpp:705:42: runtime error: load of misaligned address 0x61600014e024 for type '<unknown> *', which requires 8 byte alignment
0x61600014e024: note: pointer points here
  01 00 00 00 2e ac 55 fa  13 56 00 00 00 00 00 00  0a 00 00 00 02 00 00 00  09 00 00 00 17 00 00 00
              ^ 
######################## Ending test ########################
scene/animation/animation_tree.cpp:155:21: runtime error: member access within null pointer of type 'struct AnimationNode'
================================================================
handle_crash: Program crashed with signal 11
Engine version: Godot Engine v4.3.dev.custom_build (15a03ed98e63590c85dac62405d785e1b7ca7fed)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] ./godot.linuxbsd.editor.dev.x86_64.san(+0x3a3de0d9) [0x5613dfbfc0d9] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/crash_handler_linuxbsd.cpp:61)
[2] /lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7f8834642520] (??:0)
[3] CowData<StringName>::_get_size() const (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/cowdata.h:81)
[4] CowData<StringName>::size() const (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/cowdata.h:134)
[5] Error CowData<StringName>::resize<false>(int) (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/cowdata.h:267)
[6] Vector<StringName>::resize(int) (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/vector.h:94)
[7] Vector<StringName>::clear() (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/vector.h:87)
[8] AnimationNode::blend_node(Ref<AnimationNode>, StringName const&, AnimationMixer::PlaybackInfo, AnimationNode::FilterAction, bool, bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/animation/animation_tree.cpp:156)
[9] AnimationNode::blend_node_ex(StringName const&, Ref<AnimationNode>, double, bool, bool, float, AnimationNode::FilterAction, bool, bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/animation/animation_tree.cpp:432)
[10] void call_with_variant_args_ret_helper<__UnexistingClass, double, StringName const&, Ref<AnimationNode>, double, bool, bool, float, AnimationNode::FilterAction, bool, bool, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul>(__UnexistingClass*, double (__UnexistingClass::*)(StringName const&, Ref<AnimationNode>, double, bool, bool, float, AnimationNode::FilterAction, bool, bool), Variant const**, Variant&, Callable::CallError&, IndexSequence<0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul>) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:755 (discriminator 4))
[11] void call_with_variant_args_ret_dv<__UnexistingClass, double, StringName const&, Ref<AnimationNode>, double, bool, bool, float, AnimationNode::FilterAction, bool, bool>(__UnexistingClass*, double (__UnexistingClass::*)(StringName const&, Ref<AnimationNode>, double, bool, bool, float, AnimationNode::FilterAction, bool, bool), Variant const**, int, Variant&, Callable::CallError&, Vector<Variant> const&) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:505)
[12] MethodBindTR<double, StringName const&, Ref<AnimationNode>, double, bool, bool, float, AnimationNode::FilterAction, bool, bool>::call(Object*, Variant const**, int, Callable::CallError&) const (/home/runner/work/Qarminer/Qarminer/godot/./core/object/method_bind.h:496)
[13] Object::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:775)
[14] Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/variant/variant_call.cpp:1168)
[15] GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript_vm.cpp:1705)
[16] GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript.cpp:1937)
[17] bool Node::_gdvirtual__process_call<false>(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.h:318 (discriminator 1))
[18] Node::_notification(int) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.cpp:58)
[19] Node::_notificationv(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/./scene/main/node.h:49 (discriminator 14))
[20] Object::notification(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:840)
[21] SceneTree::_process_group(SceneTree::ProcessGroup*, bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:951)
[22] SceneTree::_process(bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:1023 (discriminator 2))
[23] SceneTree::process(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:510)
[24] Main::iteration() (/home/runner/work/Qarminer/Qarminer/godot/main/main.cpp:3739)
[25] OS_LinuxBSD::run() (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/os_linuxbsd.cpp:933)
[26] ./godot.linuxbsd.editor.dev.x86_64.san(main+0x583) [0x5613dfbfbb4c] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/godot_linuxbsd.cpp:76)
[27] /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f8834629d90] (??:0)
[28] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f8834629e40] (??:0)
[29] ./godot.linuxbsd.editor.dev.x86_64.san(_start+0x25) [0x5613dfbfb505] (??:?)
-- END OF BACKTRACE --
================================================================
Aborted (core dumped)

This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visible when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

Steps to reproduce

Above

Minimal reproduction project (MRP)

Above

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants