Crash when opening project with glb mesh with external meshes

[QbieShay]

Godot version

v4.2.beta.custom_build [09946f7]

System information

Fedora, RX 590

Issue description

I was using my VFX project and I am not able to use any mesh imported from a glb file. Godot hangs and crashes in different ways in my project. Sometimes with double free or corruption (out) sometimes with free(): invalid next size (normal)

mrp crashes with

WARNING: Mesh uses old surface format, which is deprecated (and loads slower). Consider re-importing or re-saving the scene. Path: "res://Billboard/BillboardHemisphereUVFront.mesh"
     at: _set (scene/resources/mesh.cpp:1331)
ERROR: Size of vertex data provided (3084) does not match expected (5140)
   at: mesh_add_surface (servers/rendering/renderer_rd/storage_rd/mesh_storage.cpp:333)
corrupted double-linked list

Debug build output:

handle_crash: Program crashed with signal 11
Engine version: Godot Engine v4.2.beta.custom_build (09946f79bd8215b2c6332de8821737580909a91c)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] /lib64/libc.so.6(+0x3ea00) [0x7fa89f23ea00] (??:0)
[2] /lib64/libc.so.6(+0x9a453) [0x7fa89f29a453] (??:0)
[3] /lib64/libc.so.6(free+0x73) [0x7fa89f29d133] (??:0)
[4] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x33ea7ea] (/run/media/qbie/WorkData/Projects/godot/./core/templates/cowdata.h:221)
[5] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x33abea9] (/run/media/qbie/WorkData/Projects/godot/./core/templates/command_queue_mt.h:368)
[6] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x33d5998] (/run/media/qbie/WorkData/Projects/godot/./core/templates/command_queue_mt.h:404)
[7] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x222ead8] (/run/media/qbie/WorkData/Projects/godot/scene/main/canvas_item.cpp:137)
[8] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x3fc321d] (/run/media/qbie/WorkData/Projects/godot/core/object/message_queue.cpp:220)
[9] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x3fc6741] (/run/media/qbie/WorkData/Projects/godot/core/object/message_queue.cpp:324)
[10] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x22cdd74] (/run/media/qbie/WorkData/Projects/godot/scene/main/scene_tree.cpp:473)
[11] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x49bb3c] (/run/media/qbie/WorkData/Projects/godot/main/main.cpp:3575)
[12] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x435101] (/run/media/qbie/WorkData/Projects/godot/platform/linuxbsd/os_linuxbsd.cpp:933)
[13] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x425bcb] (/run/media/qbie/WorkData/Projects/godot/platform/linuxbsd/godot_linuxbsd.cpp:74)
[14] /lib64/libc.so.6(+0x29510) [0x7fa89f229510] (??:0)
[15] /lib64/libc.so.6(__libc_start_main+0x89) [0x7fa89f2295c9] (??:0)
[16] /run/media/qbie/WorkData/Projects/godot/bin/godot.linuxbsd.editor.x86_64() [0x432a85] (??:?)
-- END OF BACKTRACE --

NOTE: I tried to clear the .godot folder. Issue persists.

Steps to reproduce

Open mrp

Minimal reproduction project

mesh-crash.zip

[QbieShay]

Already broken in e8d57afaeccf0d9f9726746f49936eb93aa0039b

[fire]

WARNING: Mesh uses old surface format, which is deprecated (and loads slower). Consider re-importing or re-saving the scene. Path: "res://Billboard/BillboardHemisphereUVFront.mesh"

This line is suspcious, didn't @clayjohn make a upgrade tool?

Edited:

#83613

[QbieShay]

Unfortunately it seems the the external mesh files generated by beta 3 are corrupt and will stay corrupt. Just wasted a bunch of time bisecting

[QbieShay]

Closing this one since it's redundant with the already linked and reported issues.

I wasn't able to narrow down the commit where this happened. I think someone that understands better how importers work perhaps could help on this. I think my test were not "clean enough" to pinpiont where this bug was introduced. I tried going back to 4.1 and generating a mesh with it and opening it with 4.2 but it works fine. I'll go to bed and hand this over.

[akien-mga]

Well this one has a MRP and a better defined scope, so it seems useful to me as the main bug report to debug the issue.

[bitsawer]

Tested on current master at 09946f7 with ASAN and I can see the crash. Running a non-ASAN build gives different crash locations as often happens with heap corruption. A heap buffer overflow happens here when writing to dst[0]:

godot/scene/resources/mesh.cpp

Line 1109 in 09946f7

dst[0] = (uint16_t)CLAMP(res.x * 65535, 0, 65535);

In the loop p_elements is 257 and current loop index i is 127 when crashing, so possibly some surface offset or data calculation issue? It seems like it is updating an older Godot 3.x mesh format in ArrayMesh::_set().

Full stack trace:

_fix_array_compatibility(Vector<unsigned char> const&, unsigned long long, unsigned long long, unsigned int, Vector<unsigned char>&, Vector<unsigned char>&, Vector<unsigned char>&) (e:\Repositories\godot\scene\resources\mesh.cpp:1109)
ArrayMesh::_set(StringName const&, Variant const&) (e:\Repositories\godot\scene\resources\mesh.cpp:1405)
ArrayMesh::_setv(StringName const&, Variant const&) (e:\Repositories\godot\scene\resources\mesh.h:292)
Object::set(StringName const&, Variant const&, bool*) (e:\Repositories\godot\core\object\object.cpp:300)
ResourceLoaderBinary::load() (e:\Repositories\godot\core\io\resource_format_binary.cpp:832)
ResourceFormatLoaderBinary::load(String const&, String const&, Error*, bool, float*, ResourceFormatLoader::CacheMode) (e:\Repositories\godot\core\io\resource_format_binary.cpp:1196)
ResourceLoader::_load(String const&, String const&, String const&, ResourceFormatLoader::CacheMode, Error*, bool, float*) (e:\Repositories\godot\core\io\resource_loader.cpp:261)
ResourceLoader::_thread_load_function(void*) (e:\Repositories\godot\core\io\resource_loader.cpp:319)
ResourceLoader::_load_start(String const&, String const&, ResourceLoader::LoadThreadMode, ResourceFormatLoader::CacheMode) (e:\Repositories\godot\core\io\resource_loader.cpp:498)
ResourceLoader::load(String const&, String const&, ResourceFormatLoader::CacheMode, Error*) (e:\Repositories\godot\core\io\resource_loader.cpp:415)
EditorResourcePreviewGenerator::generate_from_path(String const&, Vector2 const&, Dictionary&) const (e:\Repositories\godot\editor\editor_resource_preview.cpp:68)
EditorResourcePreview::_generate_preview(Ref<ImageTexture>&, Ref<ImageTexture>&, EditorResourcePreview::QueueItem const&, String const&, Dictionary&) (e:\Repositories\godot\editor\editor_resource_preview.cpp:159)
EditorResourcePreview::_iterate() (e:\Repositories\godot\editor\editor_resource_preview.cpp:245)
EditorResourcePreview::_thread() (e:\Repositories\godot\editor\editor_resource_preview.cpp:338)
EditorResourcePreview::_thread_func(void*) (e:\Repositories\godot\editor\editor_resource_preview.cpp:102)
Thread::callback(unsigned long long, Thread::Settings const&, void (*)(void*), void*) (e:\Repositories\godot\core\os\thread.cpp:61)
decltype(std::declval<void (*)(unsigned long long, Thread::Settings const&, void (*)(void*), void*)>()(std::declval<unsigned long long>(), std::declval<Thread::Settings>(), std::declval<void (*)(void*)>(), std::declval<void*>())) std::__1::__invoke[abi:v160005]<void (*)(unsigned long long, Thread::Settings const&, void (*)(void*), void*), unsigned long long, Thread::Settings, void (*)(void*), void*>(void (*&&)(unsigned long long, Thread::Settings const&, void (*)(void*), void*), unsigned long long&&, Thread::Settings&&, void (*&&)(void*), void*&&) (c:\Ohjelmointi\llvm-mingw-20230603-ucrt-x86_64\include\c++\v1\__functional\invoke.h:394)
void std::__1::__thread_execute[abi:v160005]<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (*)(unsigned long long, Thread::Settings const&, void (*)(void*), void*), unsigned long long, Thread::Settings, void (*)(void*), void*, 2ull, 3ull, 4ull, 5ull>(std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (*)(unsigned long long, Thread::Settings const&, void (*)(void*), void*), unsigned long long, Thread::Settings, void (*)(void*), void*>&, std::__1::__tuple_indices<2ull, 3ull, 4ull, 5ull>) (c:\Ohjelmointi\llvm-mingw-20230603-ucrt-x86_64\include\c++\v1\thread:282)
void* std::__1::__thread_proxy[abi:v160005]<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (*)(unsigned long long, Thread::Settings const&, void (*)(void*), void*), unsigned long long, Thread::Settings, void (*)(void*), void*>>(void*) (c:\Ohjelmointi\llvm-mingw-20230603-ucrt-x86_64\include\c++\v1\thread:293)
_configthreadlocale (@_configthreadlocale:58)
::ThreadStart() (@__asan::AsanThread::ThreadStart(unsigned long long):37)
BaseThreadInitThunk (@BaseThreadInitThunk:9)
RtlUserThreadStart (@RtlUserThreadStart:12)