Project crashes when using CSGBox and calculating tangents

[qarmin]

Godot version:
4.0.dev.custom_build. 9e34ba4

OS/device including version:
Ubuntu 20.04

Issue description:
Two backtraces - one when running code in _physics() function and one inside _physics_process()

[1] /lib/x86_64-linux-gnu/libc.so.6(+0x46210) [0x7f4c997ad210] (??:0)
[2] btCollisionWorld::updateSingleAabb(btCollisionObject*) (/mnt/Miecz/mojgodot/thirdparty/bullet/BulletCollision/CollisionDispatch/btCollisionWorld.cpp:156)
[3] btCollisionWorld::updateAabbs() (/mnt/Miecz/mojgodot/thirdparty/bullet/BulletCollision/CollisionDispatch/btCollisionWorld.cpp:202 (discriminator 2))
[4] btCollisionWorld::performDiscreteCollisionDetection() (/mnt/Miecz/mojgodot/thirdparty/bullet/BulletCollision/CollisionDispatch/btCollisionWorld.cpp:229)
[5] btDiscreteDynamicsWorld::internalSingleStepSimulation(float) (/mnt/Miecz/mojgodot/thirdparty/bullet/BulletDynamics/Dynamics/btDiscreteDynamicsWorld.cpp:475)
[6] btSoftRigidDynamicsWorld::internalSingleStepSimulation(float) (/mnt/Miecz/mojgodot/thirdparty/bullet/BulletSoftBody/btSoftRigidDynamicsWorld.cpp:91)
[7] btDiscreteDynamicsWorld::stepSimulation(float, int, float) (/mnt/Miecz/mojgodot/thirdparty/bullet/BulletDynamics/Dynamics/btDiscreteDynamicsWorld.cpp:435 (discriminator 2))
[8] SpaceBullet::step(float) (/mnt/Miecz/mojgodot/modules/bullet/space_bullet.cpp:363)
[9] BulletPhysicsServer3D::step(float) (/mnt/Miecz/mojgodot/modules/bullet/bullet_physics_server.cpp:1551 (discriminator 2))
[10] Main::iteration() (/mnt/Miecz/mojgodot/main/main.cpp:2180)
[11] OS_LinuxBSD::run() (/mnt/Miecz/mojgodot/platform/linuxbsd/os_linuxbsd.cpp:238)
[12] /usr/bin/godot4(main+0x125) [0x19d6f2b] (/mnt/Miecz/mojgodot/platform/linuxbsd/godot_linuxbsd.cpp:57)
[13] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f4c9978e0b3] (??:0)
[14] /usr/bin/godot4(_start+0x2e) [0x19d6d4e] (??:?)

and

[1] /lib/x86_64-linux-gnu/libc.so.6(+0x46210) [0x7f6f824c2210] (??:0)
[2] btCollisionWorld::refreshBroadphaseProxy(btCollisionObject*) (/mnt/Miecz/mojgodot/thirdparty/bullet/BulletCollision/CollisionDispatch/btCollisionWorld.cpp:110)
[3] SpaceBullet::reload_collision_filters(RigidBodyBullet*) (/mnt/Miecz/mojgodot/modules/bullet/space_bullet.cpp:532)
[4] RigidBodyBullet::on_collision_filters_change() (/mnt/Miecz/mojgodot/modules/bullet/rigid_body_bullet.cpp:400)
[5] CollisionObjectBullet::set_collision_layer(unsigned int) (/mnt/Miecz/mojgodot/modules/bullet/collision_object_bullet.h:176)
[6] BulletPhysicsServer3D::body_set_collision_layer(RID, unsigned int) (/mnt/Miecz/mojgodot/modules/bullet/bullet_physics_server.cpp:596)
[7] CSGShape3D::set_collision_layer(unsigned int) (/mnt/Miecz/mojgodot/modules/csg/csg_shape.cpp:73)
[8] MethodBind1<unsigned int>::call(Object*, Variant const**, int, Callable::CallError&) (/mnt/Miecz/mojgodot/./core/method_bind.gen.inc:775 (discriminator 12))
[9] Object::call(StringName const&, Variant const**, int, Callable::CallError&) (/mnt/Miecz/mojgodot/core/object.cpp:890 (discriminator 1))
[10] Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Callable::CallError&) (/mnt/Miecz/mojgodot/core/variant_call.cpp:1255 (discriminator 1))
[11] GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) (/mnt/Miecz/mojgodot/modules/gdscript/gdscript_function.cpp:1047)
[12] GDScriptInstance::call_multilevel(StringName const&, Variant const**, int) (/mnt/Miecz/mojgodot/modules/gdscript/gdscript.cpp:1306)
[13] Node::_notification(int) (/mnt/Miecz/mojgodot/scene/main/node.cpp:57)
[14] Node::_notificationv(int, bool) (/mnt/Miecz/mojgodot/./scene/main/node.h:46 (discriminator 14))
[15] Node3D::_notificationv(int, bool) (/mnt/Miecz/mojgodot/./scene/3d/node_3d.h:52 (discriminator 3))
[16] VisualInstance3D::_notificationv(int, bool) (/mnt/Miecz/mojgodot/./scene/3d/visual_instance_3d.h:40 (discriminator 3))
[17] GeometryInstance3D::_notificationv(int, bool) (/mnt/Miecz/mojgodot/./scene/3d/visual_instance_3d.h:83 (discriminator 3))
[18] CSGShape3D::_notificationv(int, bool) (/mnt/Miecz/mojgodot/modules/csg/csg_shape.h:42 (discriminator 3))
[19] CSGPrimitive3D::_notificationv(int, bool) (/mnt/Miecz/mojgodot/modules/csg/csg_shape.h:169 (discriminator 3))
[20] CSGBox3D::_notificationv(int, bool) (/mnt/Miecz/mojgodot/modules/csg/csg_shape.h:239 (discriminator 3))
[21] Object::notification(int, bool) (/mnt/Miecz/mojgodot/core/object.cpp:901)
[22] SceneTree::_notify_group_pause(StringName const&, int) (/mnt/Miecz/mojgodot/scene/main/scene_tree.cpp:826)
[23] SceneTree::idle(float) (/mnt/Miecz/mojgodot/scene/main/scene_tree.cpp:455 (discriminator 2))
[24] Main::iteration() (/mnt/Miecz/mojgodot/main/main.cpp:2194)
[25] OS_LinuxBSD::run() (/mnt/Miecz/mojgodot/platform/linuxbsd/os_linuxbsd.cpp:238)
[26] /usr/bin/godot4(main+0x125) [0x19d6f2b] (/mnt/Miecz/mojgodot/platform/linuxbsd/godot_linuxbsd.cpp:57)
[27] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f6f824a30b3] (??:0)
[28] /usr/bin/godot4(_start+0x2e) [0x19d6d4e] (??:?)

Steps to reproduce:

1. Run project

Minimal reproduction project:
TheWorstGodotTestProject.zip

Code

extends CSGBox3D

# First crash
func _physics_process(delta):
	if randi() % 2 == 1:
		set_calculate_tangents(get_bool())
	if randi() % 2 == 1:
		set_use_collision(get_bool())
	if randi() % 2 == 1:
		set_collision_layer(get_int())

# Second Crash
func _process(delta) -> void:
	if randi() % 2 == 1:
		set_calculate_tangents(get_bool())
	if randi() % 2 == 1:
		set_use_collision(get_bool())
	if randi() % 2 == 1:
		set_collision_layer(get_int())
		
const RANGE : int = 100

func get_bool() -> bool:
	return bool(randi()%2)
	
func get_int() -> int:
	return randi() % RANGE - RANGE / 2

[AndreaCatania]

Fixed with: #40252

[AndreaCatania]

Just re-tested this code, now it crashes elsewhere:

handle_crash: Program crashed with signal 11
Dumping the backtrace. Please include this when reporting the bug on https://github.com/godotengine/godot/issues
[1] /lib64/libc.so.6(+0x3ca70) [0x7fcc0c9b5a70] (??:0)
[2] GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) (/home/andrea/Workspace/godot/modules/gdscript/gdscript_function.cpp:953 (discriminator 2))
[3] GDScriptInstance::call(StringName const&, Variant const**, int, Callable::CallError&) (/home/andrea/Workspace/godot/modules/gdscript/gdscript.cpp:1321)
[4] Object::call(StringName const&, Variant const**, int, Callable::CallError&) (/home/andrea/Workspace/godot/core/object.cpp:778 (discriminator 1))
[5] Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Callable::CallError&) (/home/andrea/Workspace/godot/core/variant_call.cpp:1330 (discriminator 1))
[6] GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) (/home/andrea/Workspace/godot/modules/gdscript/gdscript_function.cpp:1052)
[7] GDScriptInstance::call(StringName const&, Variant const**, int, Callable::CallError&) (/home/andrea/Workspace/godot/modules/gdscript/gdscript.cpp:1321)
[8] ScriptInstance::call(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) (/home/andrea/Workspace/godot/core/script_language.cpp:315)
[9] Node::_notification(int) (/home/andrea/Workspace/godot/scene/main/node.cpp:64)
[10] Node::_notificationv(int, bool) (/home/andrea/Workspace/godot/./scene/main/node.h:46 (discriminator 14))
[11] Node3D::_notificationv(int, bool) (/home/andrea/Workspace/godot/./scene/3d/node_3d.h:52 (discriminator 3))
[12] VisualInstance3D::_notificationv(int, bool) (/home/andrea/Workspace/godot/./scene/3d/visual_instance_3d.h:40 (discriminator 3))
[13] GeometryInstance3D::_notificationv(int, bool) (/home/andrea/Workspace/godot/./scene/3d/visual_instance_3d.h:83 (discriminator 3))
[14] CSGShape3D::_notificationv(int, bool) (/home/andrea/Workspace/godot/modules/csg/csg_shape.h:42 (discriminator 3))
[15] CSGPrimitive3D::_notificationv(int, bool) (/home/andrea/Workspace/godot/modules/csg/csg_shape.h:169 (discriminator 3))
[16] CSGBox3D::_notificationv(int, bool) (/home/andrea/Workspace/godot/modules/csg/csg_shape.h:239 (discriminator 3))
[17] Object::notification(int, bool) (/home/andrea/Workspace/godot/core/object.cpp:808)
[18] SceneTree::_notify_group_pause(StringName const&, int) (/home/andrea/Workspace/godot/scene/main/scene_tree.cpp:818)
[19] SceneTree::iteration(float) (/home/andrea/Workspace/godot/scene/main/scene_tree.cpp:412 (discriminator 2))
[20] Main::iteration() (/home/andrea/Workspace/godot/main/main.cpp:2400)
[21] OS_LinuxBSD::run() (/home/andrea/Workspace/godot/platform/linuxbsd/os_linuxbsd.cpp:240)
[22] ./bin/godot.linuxbsd.tools.64(main+0x135) [0x1a1197b] (/home/andrea/Workspace/godot/platform/linuxbsd/godot_linuxbsd.cpp:60)
[23] /lib64/libc.so.6(__libc_start_main+0xf2) [0x7fcc0c9a0042] (??:0)
[24] ./bin/godot.linuxbsd.tools.64(_start+0x2e) [0x1a1178e] (??:?)
-- END OF BACKTRACE --
Aborted (core dumped)

The above backtrace was obtained with: 899b900 that doesn't contains the code that caused this regression: #42639.

@qarmin feel free to open a new issue.

[qarmin]

For now in master almost all projects with GDscript crashes with this backtrace, because there is a memory corruption.
It is reported here - #41705

[AndreaCatania]

Ok ty