Multiple crashes when using invalid code #105

qarmin · 2021-07-19T16:36:58Z

Goost and Godot version:
Version from actions 3.4.beta.custom_build. 71e30e303

For now I can't find more(this isn't minimal code, but still should be helpful):

	var temp_variable = ImageFrames.new()
	temp_variable.get_frame_image(-20)
	temp_variable.load(".", 4)
	temp_variable.load_gif_from_buffer(PoolByteArray([]), -31)

	var temp_variable = LinkedList.new()
	temp_variable.swap(ClassDB.instance("ListNode"), null)
	temp_variable.insert_after(null, Array([]))
	temp_variable.erase(Array([]))
	temp_variable.pop_front()
	temp_variable.get_back()
	temp_variable.insert_before(null, Array([]))
	temp_variable.move_to_front(ClassDB.instance("ListNode"))
	temp_variable.invert()
	temp_variable.move_before(null, null)

	var temp_variable = LinkedList.new()
	temp_variable.pop_front()
	temp_variable.invert()
	temp_variable.find(Array([]))
	temp_variable.push_front(Array([]))
	temp_variable.pop_back()
	temp_variable.remove(null)
	temp_variable.clear()
	temp_variable.size()
	temp_variable.erase({"roman" : 22, 22 : 25, BoxShape.new() : BoxShape.new()})
	temp_variable.move_to_front(ClassDB.instance("ListNode"))
	temp_variable.get_front()
	temp_variable.swap(ClassDB.instance("ListNode"), ClassDB.instance("ListNode"))

	var temp_variable = LinkedList.new()
	temp_variable.insert_before(null, Array([]))
	temp_variable.sort()
	temp_variable.insert_after(ClassDB.instance("ListNode"), Array([]))

	var temp_variable = LinkedList.new()
	temp_variable.get_elements()
	temp_variable.empty()
	temp_variable.remove(ClassDB.instance("ListNode"))
	temp_variable.move_to_front(ClassDB.instance("ListNode"))
	temp_variable.size()
	temp_variable.erase(RigidBody.new())
	temp_variable.move_to_back(null)

var temp_variable = ClassDB.instance("Mixin")
temp_variable.free() # cause GDScript bug

	var temp_variable = LinkedList.new()
	temp_variable.sort()
	temp_variable.clear()
	temp_variable.pop_front()
	temp_variable.create_from(Camera.new())
	temp_variable.size()
	temp_variable.empty()
	temp_variable.insert_before(ClassDB.instance("ListNode"), Array([]))

	var temp_variable = LinkedList.new()
	temp_variable.remove(ClassDB.instance("ListNode"))
	temp_variable._iter_init(Array([]))
	temp_variable._iter_next(Array([]))
	temp_variable.erase(GradientTexture2D.new())
	temp_variable.get_nodes()
	temp_variable.move_to_front(null)

	var temp_variable = ClassDB.instance("ListNode")
	temp_variable.get_next()
	temp_variable.erase() # This is probably cause of error from belov
	temp_variable.set_value("1769126663") # GDScript error Attempted to run on null instance

	var temp_variable = ClassDB.instance("_GodotSharp")
	temp_variable.is_runtime_shutting_down()
	temp_variable.detach_thread()
	temp_variable.is_scripts_domain_loaded()
	temp_variable.get_domain_id()

Out of memory(not sure about it)

	var temp_variable = ClassDB.instance("_GoostGeometry2D")
	temp_variable.polygon_to_pixels(PoolVector2Array([Vector2(-0.143121, -4.830118), Vector2(-0.340626, 0.940199), Vector2(-0.657458, -0.753491), Vector2(-0.534295, -0.845298), Vector2(-0.661573, -4.117198), Vector2(-1.052691, 0.895295), Vector2(-1.672537, 1.051412), Vector2(-0.948645, -0.316341), Vector2(-0.757789, -0.392265), Vector2(1.104076, 2.547603)]))
	temp_variable.polyline_to_pixels(PoolVector2Array([Vector2(-0.487021, 0.87339), Vector2(0.888258, 0.459344), Vector2(2.262319, -0.774596), Vector2(-0.463077, 0.886318), Vector2(2.589881, -0.21457), Vector2(-2.274473, -3.251533), Vector2(-0.262697, -0.964878), Vector2(-3.214366, -4.200902), Vector2(-0.603559, -0.797319), Vector2(-0.741167, 0.671321)]))
	temp_variable.smooth_polyline_approx(PoolVector2Array([]), -4, -2.36875)
	temp_variable.smooth_polyline(PoolVector2Array([Vector2(0.937638, 0.347613), Vector2(-0.696513, -0.717544), Vector2(0.86947, 2.836716), Vector2(-0.979038, 0.203677), Vector2(-4.794624, 0.407636), Vector2(-0.822897, 0.56819), Vector2(-4.252971, 0.873511), Vector2(-0.989352, 0.145541), Vector2(-0.664498, 3.515671), Vector2(-0.814789, 0.579758)]), -2.878688, -4.491194)
	temp_variable.merge_polygons(PoolVector2Array([Vector2(-4.208767, -2.832814), Vector2(-0.052412, -0.998626), Vector2(4.181714, -0.992297), Vector2(-4.254827, 2.184231), Vector2(-0.866002, -0.500041), Vector2(-0.685228, -0.728328), Vector2(0.511056, -0.859547), Vector2(-1.929567, -1.889083), Vector2(0.657092, 0.75381), Vector2(-0.519035, 0.854753)]), PoolVector2Array([]))
	temp_variable.deflate_polygon(PoolVector2Array([]), -4.064364)
	temp_variable.regular_polygon(-1, -3.519635)
	temp_variable.polyline_length(PoolVector2Array([Vector2(0.821733, 0.569872), Vector2(-0.922829, 0.38521), Vector2(0.567209, 0.823574), Vector2(1.489863, -2.884174), Vector2(0.794735, 0.606957), Vector2(-0.642562, -0.766234), Vector2(1.394489, -4.493158), Vector2(-0.990832, 0.135099), Vector2(1.389816, -3.419199), Vector2(-0.880176, 0.474648)]))
	temp_variable.circle(0.999348, -4.449945)
	temp_variable.polygon_area(PoolVector2Array([]))
	temp_variable.simplify_polyline(PoolVector2Array([Vector2(-2.182464, -3.504493), Vector2(-2.662979, -1.333622), Vector2(2.71501, 1.567903), Vector2(-0.114241, 0.993453), Vector2(-2.696927, 0.361799), Vector2(0.022928, -4.308574), Vector2(-0.626539, -0.77939), Vector2(1.906821, 2.482972), Vector2(-0.593834, -0.804588), Vector2(3.386199, -3.342588)]), -2.473549)

	var temp_variable = PolyDecomp2D.new()
	temp_variable.new_instance()
	temp_variable.triangulate_polygons(Array([]))
	temp_variable.decompose_polygons(Array([]), 4)

	var temp_variable = ClassDB.instance("_GodotSharp")
	temp_variable._reload_assemblies(false)
	temp_variable.is_domain_finalizing_for_unload(-1)

	var temp_variable = ClassDB.instance("_GodotSharp")
	temp_variable._reload_assemblies(false)
	temp_variable.is_domain_finalizing_for_unload(1)
	temp_variable.detach_thread()
	temp_variable.attach_thread()

	var temp_variable = ClassDB.instance("_GodotSharp")
	temp_variable.is_runtime_initialized()
	temp_variable.get_scripts_domain_id()
	temp_variable._reload_assemblies(false)
	temp_variable.get_scripts_domain_id()
	temp_variable._reload_assemblies(false)
	temp_variable.detach_thread()
	temp_variable.is_scripts_domain_loaded()
	temp_variable.detach_thread()

Tracker

The text was updated successfully, but these errors were encountered:

Xrayez · 2021-07-19T17:13:28Z

Thanks for reporting!

Linked list

I looked into some linked list issues, and I think most of them are caused by handling nodes which were not produced by the list itself (foreign).

Since Goost implementation of linked list is heavily based on Godot's List template, those crashes should also be reproducible in Godot via C++, by the way (haven't tested). I've even fixed some crashes in List::swap in Godot that way: godotengine/godot#42013.

Mixin

Those should not be instantiated directly, but it may be possible to prevent crashes.

C#

No idea for now. If it's only reproducible in Goost, then yeah that's certainly an issue to fix. But this may be caused by somewhat broken GitHub Actions compilation/integration with mono, those issues might not be reproducible in stable releases.

Geometry

Probably should validate ranges for polygon generators.

Xrayez · 2021-07-19T17:51:05Z

var temp_variable = ClassDB.instance("ListNode")
temp_variable.get_next()
temp_variable.erase() # This is probably cause of error from belov
temp_variable.set_value("1769126663") # GDScript error Attempted to run on null instance

I'd say this is expected, the method can be used to delete an existing element from the list via element itself (since we also have to update next/prev pointers in the list). The question is: should we forbid deleting the ListNode if it's foreign (not part of the list)? In this case, memdelete(this) could be removed and ERR_FAIL_COND be added checking if the node exists in the list.

Xrayez · 2021-07-19T21:28:50Z

var temp_variable = ClassDB.instance("Mixin")
temp_variable.free() # cause GDScript bug

Cannot reproduce. Maybe caused by other steps prior to this.

Xrayez · 2021-07-19T22:27:52Z

var temp_variable = ClassDB.instance("_GodotSharp")
temp_variable._reload_assemblies(false)
temp_variable.is_domain_finalizing_for_unload(1)
temp_variable.detach_thread()
temp_variable.attach_thread()

I've stumbled upon a crash while downloading and opening mono-enabled build from GitHub Actions on Linux, and the crash was apparently caused by Godot's icon.png import, and AFAIK import is threaded in Godot...

I haven't experienced this issue on Windows with stable release, but I have not tested stable mono releases on Linux. But I still suspect this is due to GitHub Actions setup, so this probably only affects CI builds.

If someone stumbles upon this as well, feel free to fix this or open dedicated bug report, since I've fixed most of the issues reported here.

Xrayez · 2021-07-20T17:48:02Z

var temp_variable = ClassDB.instance("_GodotSharp")
temp_variable.is_runtime_initialized()
temp_variable.get_scripts_domain_id()
temp_variable._reload_assemblies(false)
temp_variable.get_scripts_domain_id()
temp_variable._reload_assemblies(false)
temp_variable.detach_thread()
temp_variable.is_scripts_domain_loaded()
temp_variable.detach_thread()

Performing these steps crashes official stable Godot 3.3.2 builds as well:

[Xrayez@localhost Godot_v3.3.2-stable_mono_x11_64]$ ./Godot_v3.3.2-stable_mono_x11.64 --path /home/Xrayez/src/godot_test
Godot Engine v3.3.2.stable.mono.official - https://godotengine.org
OpenGL ES 3.0 Renderer: Mesa Intel(R) HD Graphics 620 (KBL GT2)
OpenGL ES Batching: ON
 
Mono: Log file is: '/home/Xrayez/.local/share/godot/mono/mono_logs/2021-07-20_20.35.29_145945.log'
ERROR: mono_log_callback: Mono: FATAL ERROR '* Assertion at threads.c:2128, condition `internal' not met
 (in domain , error)', ABORTING! Logfile: '/home/Xrayez/.local/share/godot/mono/mono_logs/2021-07-20_20.35.29_145945.log'.
   At: modules/mono/mono_gd/gd_mono_log.cpp:93.

=================================================================
	Native Crash Reporting
=================================================================
Got a SIGABRT while executing native code. This usually indicates
a fatal error in the mono runtime or one of the native libraries 
used by your application.
=================================================================

=================================================================
	Native stacktrace:
=================================================================
	0xef115b - ./Godot_v3.3.2-stable_mono_x11.64 : 
	0xef14e9 - ./Godot_v3.3.2-stable_mono_x11.64 : 
	0xee41af - ./Godot_v3.3.2-stable_mono_x11.64 : 
	0xef0734 - ./Godot_v3.3.2-stable_mono_x11.64 : 
	0x7f4c54455a20 - /lib64/libpthread.so.0 : 
	0x7f4c5415a2a2 - /lib64/libc.so.6 : gsignal
	0x7f4c541438a4 - /lib64/libc.so.6 : abort
	0xdbb92f - ./Godot_v3.3.2-stable_mono_x11.64 : 
	0x10fd7c1 - ./Godot_v3.3.2-stable_mono_x11.64 : 
	0x10fdd80 - ./Godot_v3.3.2-stable_mono_x11.64 : monoeg_assertion_message
	0x10fddba - ./Godot_v3.3.2-stable_mono_x11.64 : 
	0x1070630 - ./Godot_v3.3.2-stable_mono_x11.64 : mono_thread_current
	0x39274de - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN11GDMonoUtils21detach_current_threadEv
	0x3a87b09 - ./Godot_v3.3.2-stable_mono_x11.64 : 
	0x153c2f6 - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN6Object4callERK10StringNamePPK7VariantiRNS3_9CallErrorE
	0x147e4c9 - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN7Variant8call_ptrERK10StringNamePPKS_iPS_RNS_9CallErrorE
	0x3a5349c - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN16GDScriptFunction4callEP16GDScriptInstancePPK7VariantiRNS2_9CallErrorEPNS_9CallStateE
	0x3a8cd45 - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN16GDScriptInstance17_ml_call_reversedEP8GDScriptRK10StringNamePPK7Varianti
	0x2408e55 - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN4Node13_notificationEi
	0x1ffc4a1 - ./Godot_v3.3.2-stable_mono_x11.64 : 
	0x1501354 - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN6Object12notificationEib
	0x23ce42a - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN4Node16_propagate_readyEv
	0x23ce380 - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN4Node16_propagate_readyEv
	0x2406b27 - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN4Node9_set_treeEP9SceneTree
	0x240726f - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN9SceneTree4initEv
	0x3b91f60 - ./Godot_v3.3.2-stable_mono_x11.64 : _ZN6OS_X113runEv
	0xe1995e - ./Godot_v3.3.2-stable_mono_x11.64 : main
	0x7f4c54144b75 - /lib64/libc.so.6 : __libc_start_main
	0xe19c3e - ./Godot_v3.3.2-stable_mono_x11.64 : 

=================================================================
	Telemetry Dumper:
=================================================================
Pkilling 0x139965001971264x from 0x139965801237568x
Could not exec mono-hang-watchdog, expected on path '/home/Xrayez/Downloads/Godot_v3.3.2-stable_mono_x11_64/GodotSharp/Mono/etc/../bin/mono-hang-watchdog' (errno 2)
* Assertion at exceptions-amd64.c:906, condition `jit_tls' not met
* Assertion at exceptions-amd64.c:906, condition `jit_tls' not met
[Xrayez@localhost Godot_v3.3.2-stable_mono_x11_64]$

Some other snippets crash in Goost builds, but not in Godot builds. The reason for that is likely because of different configuration settings when compiling mono (and other modules), or even different run-time differences, and I suspect the results would be the same with official Goost 1.0-stable+3.3.2 builds as well, since I'm using Godot's build scripts to replicate everything.

The CI version of Goost builds from GitHub Actions could also be somewhat broken. But as evident above, this is likely something to be fixed upstream, apart from fixing mono glue generation (for which I've added CI runs recently), there's little that could be done on the module level.

They also have to apply some patches for building mono runtime: https://github.com/godotengine/godot-mono-builds, so that's probably another reason for other crashes.

That said, feel free to report this in Godot if you wish, referencing this issue. 🙂

Xrayez · 2021-07-20T18:13:58Z

Closing since most important issues are fixed now, the only thing I could not reproduce is Mixin.free() causing GDScript parser bug. C#/mono are likely separate issues unrelated to Goost functionality as seen above. If those issues are more specific to GitHub Actions builds, then it may be worth to create a separate issue for this.

If there are other issues/more clear reproduction steps, feel free to open a new bug report to keep things organized, thanks!

Xrayez · 2021-08-05T18:04:14Z

var temp_variable = ClassDB.instance("Mixin")
temp_variable.free() # cause GDScript bug

Cannot reproduce. Maybe caused by other steps prior to this.

I got to reproduce this, should be fixed in cb708de, see comments for rationale.

qarmin added the bug Something isn't working label Jul 19, 2021

Xrayez added component:geometry 📐 crash Engine crashes topic:core component:script 📃 component:image 🖼️ labels Jul 19, 2021

Xrayez mentioned this issue Jul 19, 2021

Fix LinkedList and ListNode crashes with invalid data #106

Merged

This was referenced Jul 19, 2021

Fix GoostGeometry2D and PolyDecomp2D crashes with invalid data #107

Merged

Fix ImageFrames.load_gif_from_buffer() crash with invalid data #108

Merged

Xrayez mentioned this issue Jul 20, 2021

[3.x] Add Engine.print_error_messages property to disable printing errors godotengine/godot#50640

Merged

Xrayez added the Waiting for Godot ⏳ The engine needs a fix or an enhancement to fix the issue label Jul 20, 2021

Xrayez closed this as completed Jul 20, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Multiple crashes when using invalid code #105

Multiple crashes when using invalid code #105

qarmin commented Jul 19, 2021 •

edited by Xrayez

Loading

Xrayez commented Jul 19, 2021 •

edited

Loading

Xrayez commented Jul 19, 2021 •

edited

Loading

Xrayez commented Jul 19, 2021

Xrayez commented Jul 19, 2021 •

edited

Loading

Xrayez commented Jul 20, 2021 •

edited

Loading

Xrayez commented Jul 20, 2021 •

edited

Loading

Xrayez commented Aug 5, 2021

Multiple crashes when using invalid code #105

Multiple crashes when using invalid code #105

Comments

qarmin commented Jul 19, 2021 • edited by Xrayez Loading

Tracker

Xrayez commented Jul 19, 2021 • edited Loading

Linked list

Mixin

C#

Geometry

Xrayez commented Jul 19, 2021 • edited Loading

Xrayez commented Jul 19, 2021

Xrayez commented Jul 19, 2021 • edited Loading

Xrayez commented Jul 20, 2021 • edited Loading

Xrayez commented Jul 20, 2021 • edited Loading

Xrayez commented Aug 5, 2021

qarmin commented Jul 19, 2021 •

edited by Xrayez

Loading

Xrayez commented Jul 19, 2021 •

edited

Loading

Xrayez commented Jul 19, 2021 •

edited

Loading

Xrayez commented Jul 19, 2021 •

edited

Loading

Xrayez commented Jul 20, 2021 •

edited

Loading

Xrayez commented Jul 20, 2021 •

edited

Loading