Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Executing ShaderMaterial.property_get_revert crashes Godot #71863

Closed
qarmin opened this issue Jan 22, 2023 · 0 comments · Fixed by #87603
Closed

Executing ShaderMaterial.property_get_revert crashes Godot #71863

qarmin opened this issue Jan 22, 2023 · 0 comments · Fixed by #87603

Comments

@qarmin
Copy link
Contributor

qarmin commented Jan 22, 2023

Godot version

4.0.beta.custom_build. c3539b4

System information

Ubuntu 22.04 CI

Issue description

When executing

extends Node
func _process(delta):

	var temp_variable11072 = ShaderMaterial.new()
	temp_variable11072.set_shader(VisualShader.new())
	temp_variable11072.set_indexed(NodePath("3766133513"), Array([Array([]), Array([]), 60, 74, Array([]), 11, 28, Array([]), Array([]), Array([]), Array([]), Array([]), Array([]), Array([]), Array([]), 99, Array([]), Array([]), Array([]), Array([]), Array([]), Array([]), Array([]), Array([]), Array([])]))
	temp_variable11072.property_get_revert(StringName("5555"))

Godot crashes:

 scene/resources/material.cpp:323:10: runtime error: member call on null pointer of type 'const struct StringName'
core/string/string_name.h:100:42: runtime error: member access within null pointer of type 'const struct StringName'

================================================================
handle_crash: Program crashed with signal 11
Engine version: Godot Engine v4.0.beta.custom_build (c3539b4561f9b4d7dc4ba1c5859217e7fbf9c6fe)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] ./godot.linuxbsd.editor.dev.x86_64.san(+0x3a0e835c) [0x557b0fca135c] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/crash_handler_linuxbsd.cpp:57)
[2] /lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7fe8ec5ed520] (??:0)
[3] StringName::operator void const*() const (/home/runner/work/Qarminer/Qarminer/godot/./core/string/string_name.h:100)
[4] ShaderMaterial::_property_get_revert(StringName const&, Variant&) const (/home/runner/work/Qarminer/Qarminer/godot/scene/resources/material.cpp:323)
[5] ShaderMaterial::_property_get_revertv(StringName const&, Variant&) const (/home/runner/work/Qarminer/Qarminer/godot/scene/resources/material.h:82 (discriminator 9))
[6] Object::property_get_revert(StringName const&) const (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:570)
[7] void call_with_variant_args_retc_helper<__UnexistingClass, Variant, StringName const&, 0ul>(__UnexistingClass*, Variant (__UnexistingClass::*)(StringName const&) const, Variant const**, Variant&, Callable::CallError&, IndexSequence<0ul>) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:762 (discriminator 6))
[8] void call_with_variant_args_retc_dv<__UnexistingClass, Variant, StringName const&>(__UnexistingClass*, Variant (__UnexistingClass::*)(StringName const&) const, Variant const**, int, Variant&, Callable::CallError&, Vector<Variant> const&) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:528)
[9] MethodBindTRC<Variant, StringName const&>::call(Object*, Variant const**, int, Callable::CallError&) const (/home/runner/work/Qarminer/Qarminer/godot/./core/object/method_bind.h:544)
[10] Object::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:733 (discriminator 1))
[11] Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/variant/variant_call.cpp:1161)
[12] GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript_vm.cpp:1584)
[13] GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript.cpp:1842)
[14] bool Node::_gdvirtual__process_call<false>(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.h:238 (discriminator 5))
[15] Node::_notification(int) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.cpp:58)
[16] Node::_notificationv(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/./scene/main/node.h:46 (discriminator 14))
[17] Object::notification(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:792)
[18] SceneTree::_notify_group_pause(StringName const&, int) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:874)
[19] SceneTree::process(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:466 (discriminator 4))
[20] Main::iteration() (/home/runner/work/Qarminer/Qarminer/godot/main/main.cpp:3089)
[21] OS_LinuxBSD::run() (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/os_linuxbsd.cpp:878)
[22] ./godot.linuxbsd.editor.dev.x86_64.san(main+0x58f) [0x557b0fca0d08] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/godot_linuxbsd.cpp:75)
[23] /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7fe8ec5d4d90] (??:0)
[24] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7fe8ec5d4e40] (??:0)
[25] ./godot.linuxbsd.editor.dev.x86_64.san(_start+0x25) [0x557b0fca06b5] (??:?)
-- END OF BACKTRACE --
================================================================
Aborted (core dumped)

This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visibe when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

Steps to reproduce

Above

Minimal reproduction project

N/A

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants