godotengine / godotengine/godot-cpp
Random crashes in realloc downstack from Object::get_instance_binding()
- Dominant language
- C++
- Stars
- 2.7k
- Forks
- 809
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 8
Description
### Godot version
4.4.1
### godot-cpp version
6388e26
### System information
Windows 11
### Issue description
I have the following self-contained code running in a thread in the editor:
```
PackedByteArray bitmap;
// ...filling the bitmap...
Ref image = Image::create_from_data(width, height, false, Image::FORMAT_R8, bitmap);
Ref image_textre = ImageTexture::create_from_image(image); // <-- crash here
```
Nothing in this thread accesses external state until after the line with the crash.
Most of the time it works fine. However, sometimes it randomly crashes with a heap corruption with the following stack:
```
ntdll.dll!RtlReAllocateHeap()
Godot_v4.4.1-stable_win64.exe!_realloc_base(void * block, unsigned __int64 size) Line 46
Godot_v4.4.1-stable_win64.exe!Memory::realloc_static(void * p_memory, unsigned __int64 p_bytes, bool p_pad_align) Line 161
Godot_v4.4.1-stable_win64.exe!CowData::_realloc(__int64 p_alloc_size) Line 424
Godot_v4.4.1-stable_win64.exe!CowData::resize<0>(__int64 p_size) Line 382
[Inline Frame] Godot_v4.4.1-stable_win64.exe!Vector::resize(__int64) Line 100
[Inline Frame] Godot_v4.4.1-stable_win64.exe!Vector::push_back(ObjectID p_elem) Line 321
[Inline Frame] Godot_v4.4.1-stable_win64.exe!GDExtension::track_instance_binding(Object *) Line 927
Godot_v4.4.1-stable_win64.exe!GDExtensionManager::track_instance_binding(void * p_token, Object * p_object) Line 256
Godot_v4.4.1-stable_win64.exe!Object::get_instance_binding(void * p_token, const GDExtensionInstanceBindingCallbacks * p_callbacks) Line 2026
~libwutw-gdext.windows.template_debug.x86_64.dll!godot::internal::get_object_instance_binding(void * p_engine_object) Line 60
[Inline Frame] ~libwutw-gdext.windows.template_debug.x86_64.dll!godot::internal::_call_native_mb_ret_obj(const void * const) Line 54
~libwutw-gdext.windows.template_debug.x86_64.dll!godot::ImageTexture::create_from_image(const godot::Ref & p_image) Line 46
```
This is a hot-reloadable extension, but I have observed the crash before it is ever hot-reloaded. I have observed other crashes related to `instance_bindings` during hot-reload, seemingly due to signals referencing replaced instances (https://github.com/godotengine/godot/issues/105802), but that's a separate issue.
### Steps to reproduce
Run the code above in multiple threads repeatedly.
### Minimal reproduction project
N/A
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.