godotengine / godotengine/godot-cpp

Use after free and resource leakage during shutdown

Aperta
#2,004 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub
bug
Lingua principale
C++
Stelle
2.7k
Fork
809
Merge medio
1g 3h
PR unite (30g)
8

Descrizione

### Godot version

4.5.stable

### godot-cpp version

godot-4.5-stable

### System information

Linux (Debian 13.1)

### Issue description

I am using gdextension to work with customized physics code.

We observe every run two problematic symptoms:
* engine always complains during the shutdown about the resource leakage
* it oftens exits "with crash"

I compiled godot from source code with ubsan and asan to have a better understanding of what's going on.

```
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior thirdparty/harfbuzz/src/hb-buffer.hh:479:69
ERROR: 192 RID allocations of type 'P12GodotShape2D' were leaked at exit.
WARNING: 17 RIDs of type "CanvasItem" were leaked.
at: _free_rids (servers/rendering/renderer_canvas_cull.cpp:2678)
ERROR: 16 RID allocations of type 'N10RendererRD14TextureStorage7TextureE' were leaked at exit.
ERROR: 6 RID allocations of type 'N10RendererRD14TextureStorage13CanvasTextureE' were leaked at exit.
=================================================================
==18433==ERROR: AddressSanitizer: heap-use-after-free on address 0x50600095afb0 at pc 0x558ab0ad19b6 bp 0x7ffe244eafa0 sp 0x7ffe244eaf98
READ of size 8 at 0x50600095afb0 thread T0
#0 0x558ab0ad19b5 in LocalVector::begin() /home/alice/soft/godot/./core/templates/local_vector.h:254:19
#1 0x558ab0ad19b5 in RendererCanvasRenderRD::_canvas_texture_invalidation_callback(bool, void*) /home/alice/soft/godot/servers/rendering/renderer_rd/renderer_canvas_render_rd.cpp:2973:15
#2 0x558aaff14423 in RendererRD::TextureStorage::CanvasTexture::~CanvasTexture() /home/alice/soft/godot/servers/rendering/renderer_rd/storage_rd/texture_storage.cpp:53:3
#3 0x558aaff14423 in RID_Alloc::~RID_Alloc() /home/alice/soft/godot/./core/templates/rid_owner.h:449:65
#4 0x558aafe8b199 in RID_Owner::~RID_Owner() /home/alice/soft/godot/./core/templates/rid_owner.h:527:7
#5 0x558aafe8b199 in RendererRD::TextureStorage::~TextureStorage() /home/alice/soft/godot/servers/rendering/renderer_rd/storage_rd/texture_storage.cpp:564:1
#6 0x558aaf585354 in void memdelete(RendererRD::TextureStorage*) /home/alice/soft/godot/./core/os/memory.h:139:13
#7 0x558aaf585354 in RendererCompositorRD::finalize() /home/alice/soft/godot/servers/rendering/renderer_rd/renderer_compositor_rd.cpp:179:2
#8 0x558aaf18c02d in RenderingServerDefault::_finish() /home/alice/soft/godot/servers/rendering/rendering_server_default.cpp:245:19
#9 0x558a9ce77829 in finalize_display() /home/alice/soft/godot/main/main.cpp:404:20
#10 0x558a9cf0e4df in Main::cleanup(bool) /home/alice/soft/godot/main/main.cpp:5061:2
#11 0x558a9cc1f3a7 in main /home/alice/soft/godot/platform/linuxbsd/godot_linuxbsd.cpp:89:2
#12 0x7f9589c49ca7 (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
#13 0x7f9589c49d64 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29d64) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
#14 0x558a9cb3b690 in _start (/home/alice/soft/godot/bin/godot.linuxbsd.editor.x86_64.llvm.san+0xab8d690) (BuildId: d04aa1bb3047432769e682d01b15f0456528d423)

0x50600095afb0 is located 48 bytes inside of 56-byte region [0x50600095af80,0x50600095afb8)
freed by thread T0 here:
#0 0x558a9cbdb22a in free (/home/alice/soft/godot/bin/godot.linuxbsd.editor.x86_64.llvm.san+0xac2d22a) (BuildId: d04aa1bb3047432769e682d01b15f0456528d423)
#1 0x558ab0aea6b7 in void memdelete>>(HashMapElement>*) /home/alice/soft/godot/./core/os/memory.h:142:2
#2 0x558ab0aea6b7 in DefaultTypedAllocator>>::delete_allocation(HashMapElement>*) /home/alice/soft/godot/./core/os/memory.h:258:59
#3 0x558ab0aea6b7 in HashMap, HashMapHasherDefault, HashMapComparatorDefault, DefaultTypedAllocator>>>::clear() /home/alice/soft/godot/./core/templates/hash_map.h:257:15

previously allocated by thread T0 here:
#0 0x558a9cbdb4c3 in malloc (/home/alice/soft/godot/bin/godot.linuxbsd.editor.x86_64.llvm.san+0xac2d4c3) (BuildId: d04aa1bb3047432769e682d01b15f0456528d423)
#1 0x558ab120a91b in void* Memory::alloc_static(unsigned long, bool) /home/alice/soft/godot/core/os/memory.cpp:108:9
#2 0x000100000000 ()

SUMMARY: AddressSanitizer: heap-use-after-free /home/alice/soft/godot/./core/templates/local_vector.h:254:19 in LocalVector::begin()
Shadow bytes around the buggy address:
```

### Steps to reproduce

Combination of:
* Creating custom canvas items inherited from tilemap or node2d
* inspecting tree state using get_children() and godot::cast_to<>.

I have a suspicion godot::cast_to is problematic because it creates a wrapping reference to the object which I couldn't find where it is getting deleted.

### Minimal reproduction project

Sorry, crunch time right now, can prepare one later if requested.

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Inizia riproducendo il problema durante lo shutdown con i custom canvas items segnalati, get_children() e godot::cast_to<> sotto ASan/UBSan. Traccia RendererCanvasRenderRD::_canvas_texture_invalidation_callback() in servers/rendering/renderer_rd/renderer_canvas_render_rd.cpp insieme a CanvasTexture::~CanvasTexture() in servers/rendering/renderer_rd/storage_rd/texture_storage.cpp; il lavoro è completato quando lo shutdown termina senza le diagnostiche segnalate di use-after-free o resource leak.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
cpp
Ambito
computer-graphics
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Tranquilla
Chiarezza
Da chiarire
Idoneità per principianti
35/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.