Crash on reimport when applying AnimatedValueBackups from an Apply Reset #85233
Description
Godot version
4.2.rc 7022271
System information
Godot v4.2.rc (7022271) - Windows 10.0.19045 - Vulkan (Forward+) - dedicated NVIDIA GeForce RTX 3090 (NVIDIA; 31.0.15.3713) - Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz (16 Threads)
Issue description
Godot crashes due to a complicated chain of events in the stack trace involving reimport_files
, reload_scene
and a synchronous clear_history
which memdeletes several dangling TrackCache pointers in this RefCounted AnimatedValuesBackup ?!
Critical error detected c0000374
A breakpoint instruction (__debugbreak() statement or a similar call) was executed in godot.windows.editor.x86_64.exe.
Something feels very wrong about holding raw pointers to an AnimationMixer TrackCache in AnimatedValuesBackup. I can't follow the flow at all of how values get stored in AnimatedValuesBackup.
To maintain single-free semantics, these TrackCache*
values must be moved and owned by the AnimatedValuesBackup.
TrackCache pointers must never be shared by other objects, otherwise a use-after-free or double-delete is likely to happen
Steps to reproduce
- Follow the steps in Animation window Edit -> Apply Reset fails because
AnimationMixer::_reset
is not exposed #85232 to Apply Reset on an opened gltf - Select the gltf in the filesystem (it will already be selected if you followed the steps)
- Open the Import dock and click Reimport
- Godot will crash.
Minimal reproduction project
Metadata
Assignees
Type
Projects
Status
No status