godotengine / godotengine/godot-cpp

Random crashes in realloc downstack from Object::get_instance_binding()

Open
#1,782 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
2.7k
Forks
809
Avg merge
1d 3h
Merged PRs (30d)
8

Description

### Godot version

4.4.1

### godot-cpp version

6388e26

### System information

Windows 11

### Issue description

I have the following self-contained code running in a thread in the editor:
```
PackedByteArray bitmap;
// ...filling the bitmap...
Ref image = Image::create_from_data(width, height, false, Image::FORMAT_R8, bitmap);
Ref image_textre = ImageTexture::create_from_image(image); // <-- crash here
```

Nothing in this thread accesses external state until after the line with the crash.

Most of the time it works fine. However, sometimes it randomly crashes with a heap corruption with the following stack:
```
ntdll.dll!RtlReAllocateHeap()
Godot_v4.4.1-stable_win64.exe!_realloc_base(void * block, unsigned __int64 size) Line 46
Godot_v4.4.1-stable_win64.exe!Memory::realloc_static(void * p_memory, unsigned __int64 p_bytes, bool p_pad_align) Line 161
Godot_v4.4.1-stable_win64.exe!CowData::_realloc(__int64 p_alloc_size) Line 424
Godot_v4.4.1-stable_win64.exe!CowData::resize<0>(__int64 p_size) Line 382
[Inline Frame] Godot_v4.4.1-stable_win64.exe!Vector::resize(__int64) Line 100
[Inline Frame] Godot_v4.4.1-stable_win64.exe!Vector::push_back(ObjectID p_elem) Line 321
[Inline Frame] Godot_v4.4.1-stable_win64.exe!GDExtension::track_instance_binding(Object *) Line 927
Godot_v4.4.1-stable_win64.exe!GDExtensionManager::track_instance_binding(void * p_token, Object * p_object) Line 256
Godot_v4.4.1-stable_win64.exe!Object::get_instance_binding(void * p_token, const GDExtensionInstanceBindingCallbacks * p_callbacks) Line 2026
~libwutw-gdext.windows.template_debug.x86_64.dll!godot::internal::get_object_instance_binding(void * p_engine_object) Line 60
[Inline Frame] ~libwutw-gdext.windows.template_debug.x86_64.dll!godot::internal::_call_native_mb_ret_obj(const void * const) Line 54
~libwutw-gdext.windows.template_debug.x86_64.dll!godot::ImageTexture::create_from_image(const godot::Ref & p_image) Line 46
```

This is a hot-reloadable extension, but I have observed the crash before it is ever hot-reloaded. I have observed other crashes related to `instance_bindings` during hot-reload, seemingly due to signals referencing replaced instances (https://github.com/godotengine/godot/issues/105802), but that's a separate issue.

### Steps to reproduce

Run the code above in multiple threads repeatedly.

### Minimal reproduction project

N/A

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.