Bullet crashes when a RigidBody's collision shape is changed just before the RigidBody is removed from the scene.

[drwhut]

Godot version:
3.2.2

OS/device including version:
Linux/X11 (Linux Mint 20)

Issue description:
When changing a RigidBody's collision shape just before removing it from the scene, it crashes the engine.

Here is the backtrace:

handle_crash: Program crashed with signal 11
Dumping the backtrace. Please include this when reporting the bug on https://github.com/godotengine/godot/issues
[1] /lib/x86_64-linux-gnu/libc.so.6(+0x46210) [0x7fc9338be210] (??:0)
[2] SpaceBullet::get_gravity_magnitude() const (/home/drwhut/godot/modules/bullet/space_bullet.h:176)
[3] RigidBodyBullet::reload_space_override_modificator() (/home/drwhut/godot/modules/bullet/rigid_body_bullet.cpp:910)
[4] RigidBodyBullet::dispatch_callbacks() (/home/drwhut/godot/modules/bullet/rigid_body_bullet.cpp:385)
[5] SpaceBullet::flush_queries() (/home/drwhut/godot/modules/bullet/space_bullet.cpp:370 (discriminator 2))
[6] onBulletPreTickCallback(btDynamicsWorld*, float) (/home/drwhut/godot/modules/bullet/space_bullet.cpp:559)
[7] btDiscreteDynamicsWorld::internalSingleStepSimulation(float) (/home/drwhut/godot/thirdparty/bullet/BulletDynamics/Dynamics/btDiscreteDynamicsWorld.cpp:462)
[8] btSoftRigidDynamicsWorld::internalSingleStepSimulation(float) (/home/drwhut/godot/thirdparty/bullet/BulletSoftBody/btSoftRigidDynamicsWorld.cpp:91)
[9] btDiscreteDynamicsWorld::stepSimulation(float, int, float) (/home/drwhut/godot/thirdparty/bullet/BulletDynamics/Dynamics/btDiscreteDynamicsWorld.cpp:435 (discriminator 2))
[10] SpaceBullet::step(float) (/home/drwhut/godot/modules/bullet/space_bullet.cpp:378)
[11] BulletPhysicsServer::step(float) (/home/drwhut/godot/modules/bullet/bullet_physics_server.cpp:1565 (discriminator 2))
[12] Main::iteration() (/home/drwhut/godot/main/main.cpp:2086)
[13] OS_X11::run() (/home/drwhut/godot/platform/x11/os_x11.cpp:3265)
[14] /home/drwhut/godot/bin/godot.x11.tools.64(main+0x125) [0x14196db] (/home/drwhut/godot/platform/x11/godot_x11.cpp:57)
[15] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7fc93389f0b3] (??:0)
[16] /home/drwhut/godot/bin/godot.x11.tools.64(_start+0x2e) [0x14194fe] (??:?)
-- END OF BACKTRACE --

Cause: I was going to try and make a pull request to fix this, but I don't feel that I know the physics engine well enough to try and fix it. But I think I may have found the culprit for anyone who wishes to try and fix this themselves in the hopes it will help:

By changing the collision shape, the following series of functions are called:

1. ShapeBullet::notifyShapeChanged()
2. RigidCollisionObjectBullet::shape_changed(int p_shape_index)
3. RigidBodyBullet::reload_shapes()
4. RigidBodyBullet::reload_body()
5. SpaceBullet::add_rigid_body(RigidBodyBullet *p_body)
6. RigidBodyBullet::scratch_space_override_modificator()

The last function sets a property of the rigid body, isScratchedSpaceOverrideModificator, to true. Because of this property being set to true, at rigid_body_bullet.cpp:379 the if statement returns true and it runs reload_space_override_modificator(). But because the rigid body has been removed from the scene, I assume that is why the space property at this point is NULL, but reload_space_override_modificator() relies on space to work.

Steps to reproduce:

1. Get two rigid bodies to collide, and detect each other colliding with the _body_entered signal.
2. Upon collision, get one of them to change it's collision shape, then remove itself from the scene.

Minimal reproduction project:
RigidBodyBugMinimal.zip

[pouleyKetchoupp]

Confirmed in 3.2.2 and also 3.1 and 3.0.6 so it's not new.

[pouleyKetchoupp]

I can reproduce it on master too, with a different callstack:

 godot.windows.tools.64.exe!abort() Line 77	C++
 	[External Code]	
 godot.windows.tools.64.exe!btCollisionWorld::updateSingleAabb(btCollisionObject * colObj) Line 158	C++
 godot.windows.tools.64.exe!btCollisionWorld::updateAabbs() Line 212	C++
 godot.windows.tools.64.exe!btCollisionWorld::performDiscreteCollisionDetection() Line 229	C++
 godot.windows.tools.64.exe!btDiscreteDynamicsWorld::internalSingleStepSimulation(float timeStep) Line 475	C++
 godot.windows.tools.64.exe!btSoftRigidDynamicsWorld::internalSingleStepSimulation(float timeStep) Line 91	C++
 godot.windows.tools.64.exe!btDiscreteDynamicsWorld::stepSimulation(float timeStep, int maxSubSteps, float fixedTimeStep) Line 435	C++
 godot.windows.tools.64.exe!SpaceBullet::step(float p_delta_time) Line 363	C++
 godot.windows.tools.64.exe!BulletPhysicsServer3D::step(float p_deltaTime) Line 1553	C++
 godot.windows.tools.64.exe!Main::iteration() Line 2178	C++
 godot.windows.tools.64.exe!OS_Windows::run() Line 627	C++
 godot.windows.tools.64.exe!widechar_main(int argc, wchar_t * * argv) Line 161	C++
 godot.windows.tools.64.exe!_main() Line 183	C++
 godot.windows.tools.64.exe!main(int _argc, char * * _argv) Line 195	C++

Minimal repro project ported to 4.0:
RigidBodyBugMinimal-4.0.zip

[madmiraal]

@pouleyKetchoupp The crash on master is a separate issue (which looks like a Bullet issue not a Godot issue) and needs it own issue, because it happens even with #40308.

[pouleyKetchoupp]

@madmiraal Added #40311 for the crash on master.