Random crashes when switching scenes only on release builds

[LRFLEW]

Godot version

4.1.stable

System information

Windows 10 22H2

Issue description

When exporting my game as a release build and testing it, I noticed a weird game crash that was not occurring in the editor or in debug builds. It wasn't consistent, but if I went back and forth between my title scene and main game scene a bunch, I could replicate the crash. I built the export template with debug symbols and ran it through a debugger, and the results were strange.

From what I can tell, the issue starts in CallQueue::flush() where it's looping through the message pages. I'm not sure why, but sometimes it ends up reading a message with a callable that causes the issue when it tries to execute message->callable.get_object(). It sees the callable as custom, and calls custom->get_object(). and in that function (CallableCustomMethodPointer::get_object()) calls data.instance->get_instance_id(). The problem is that data.instance is not a valid pointer, and results in a read access violation when reading data.instance->_instance_id. The address for data.instance is fairly close to loaded memory, which makes me think it's most likely freed memory, but that is only conjecture. The reason this doesn't happen in Debug builds is almost certainly because of the debug check just before getting the instance ID in CallableCustomMethodPointer::get_object() catches this issue before it crashes the game.

Side note: the call stack shows that it's calling specifically CallableCustomMethodPointer<CSGPolygon3D>::get_object(), but I'm not using any CSG in the project. I assume this is because, since the compiled instructions should be the same for different template types, the compiler / linker merged multiple instances of the function and is only showing one of the template parameters that results in that function.

Steps to reproduce

In my game, this crash occurs when switching between scenes (most often when switching from the Main scene to the Menu scene, but I've seen crashes going the other direction). I've also seen the crash when closing the game, but it's less visible there. The crash is also not reliable. Sometimes I can switch scenes a dozen time without issues, and other times it crashes the first time I try to return to the menu. I've found that if it doesn't crash the first couple of scene switches, restarting the game makes it more likely to happen.

For my example, you can switch scenes by pressing Play on the main menu, or Menu in the game, either on the pause screen from pressing ESC or P, or on the win / lose screen. Repeat it a few times, and it will likely crash. If it doesn't, relaunch the game and try again. The issue isn't reliable, but it happens consistently enough that it is reproducible.

Minimal reproduction project

I wasn't able to make a minimum reproduction, possibly due to the nature of the crash. (I conjectured the issue was related to my game having a bunch of nodes that call queue_free(), but my minimum reproduction to test that didn't produce this crash.) In place of a minimum reproduction, here's the whole project, which was my submission to the GMTK Game Jam (this is a slightly modified version that I made to demonstrate another issue, but it works here too).

Testing.zip

[akien-mga]

Related to:

• Exported Version of Game Crashes at Random When Switching Scenes/Levels (slot >= slotmax) #75802
• VideoStreamPlayer causes random crashes on a Windows export without "Export with Debug" #78788
• Error spam (and/or crash) in release template / exported builds: "slot >= slot_max" is true. Returning: nullptr #70910

Didn't test to confirm if it would be a duplicate of any of those.

#78988 may fix them / this issue too.

[LRFLEW]

It could be related to those other issues, but notably, I couldn't get the slot >= slot_max debug message to appear with my game, even in debug builds. That doesn't mean that it can't related, just that it seemed like a different issue to me (hence why I made a report instead of just commenting on one of the other issues).

[Lippanon]

Related (or duplicate?) #75422

[Calinou]

Thanks for the report! Consolidating in #75422.