Silent crash while using a SubViewport

[ryi3r]

Godot version

4.2.rc1

System information

Godot v4.2.rc1 - Linux Mint 21.2 (Victoria) - X11 - Vulkan (Forward+) - dedicated AMD Unknown (RADV ICELAND) () - AMD Ryzen 5 3500U with Radeon Vega Mobile Gfx (8 Threads)

Issue description

The code used on the minimal reproduction project, may crash randomly the game while starting to run on Debug mode
While developing the game, I saw these two kinds of crashes on the Godot logs

Steps to reproduce

Rerun the minimal reproduction project until it crashes

Minimal reproduction project

GodotCrash.zip

[akien-mga]

I could reproduce the crash on Linux with the MRP, running the project multiple times in gdb.

Thread 1 "godot-git" received signal SIGSEGV, Segmentation fault.
0x0000000000000001 in ?? ()
(gdb) bt
#0  0x0000000000000001 in ?? ()
#1  0x0000000009e5339b in Object::notification (this=0xd56df40, p_notification=17, p_reversed=false) at ./core/object/object.cpp:842
#2  0x0000000007e038ec in SceneTree::_process_group (this=0xd40f7a0, p_group=0xd40f9f8, p_physics=false) at ./scene/main/scene_tree.cpp:951
#3  0x0000000007e03e65 in SceneTree::_process (this=0xd40f7a0, p_physics=false) at ./scene/main/scene_tree.cpp:1028
#4  0x0000000007e01da4 in SceneTree::process (this=0xd40f7a0, p_time=0.13333333333333341) at ./scene/main/scene_tree.cpp:508
#5  0x0000000005793ecc in Main::iteration () at main/main.cpp:3636
#6  0x000000000570d64e in OS_LinuxBSD::run (this=0x7fffffffcfc0) at platform/linuxbsd/os_linuxbsd.cpp:933
#7  0x00000000057060c0 in main (argc=1, argv=0x7fffffffd5a8) at platform/linuxbsd/godot_linuxbsd.cpp:74

It seems to be caused by the background_scene.gd constantly reloading itself in _process with Singleton.change_scene("res://background_scene2.tscn").

But this MRP still does a lot of things, would be good to split it further to only keep what's needed for the crash to happen. For example background_scene.gd does a bunch of non-deterministic stuff which just gets in the way of reproducing this, and singleton.gd is 245 lines long.

[akien-mga]

It's crashing on this line in object.cpp:

godot/core/object/object.cpp

Line 842 in fa1fb2a

_extension->notification2(_extension_instance, p_notification, static_cast<GDExtensionBool>(p_reversed));

Which doesn't make much sense as the MRP doesn't use any GDExtension.

I added a test print around there, most of the time it's not printed, but when it crashes it does get printed (so _extension != nullptr).

#1  0x0000000009e53388 in Object::notification (this=0xd5b14a0, p_notification=17, p_reversed=false) at ./core/object/object.cpp:843
843                             _extension->notification2(_extension_instance, p_notification, static_cast<GDExtensionBool>(p_reversed));
(gdb) print _extension
$1 = (ObjectGDExtension *) 0xd5b1480
(gdb) print _extension_instance
$2 = (GDExtensionClassInstancePtr) 0x0

Data corruption?

CC @dsnopek @Sauermann

[Sauermann]

I have tested the MRP on Debian Linux X11

• v4.0.stable.official [92bee43]: script errors, unable to run
• v4.1.dev1.official [db13026]: causes randomly segfault
• v4.2.dev1.official [0c2144d]: causes randomly segfault

So it crashes in Godot even before #78634 was merged.
I'm not sure, if the regression-label is fitting.

[ryi3r]

GodotCrash.zip
New project sample, tested it on 4.0.stable and it crashes there too.