Skip to content

Crash on reimport when applying AnimatedValueBackups from an Apply Reset #85233

Closed
@lyuma

Description

Godot version

4.2.rc 7022271

System information

Godot v4.2.rc (7022271) - Windows 10.0.19045 - Vulkan (Forward+) - dedicated NVIDIA GeForce RTX 3090 (NVIDIA; 31.0.15.3713) - Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz (16 Threads)

Issue description

Godot crashes due to a complicated chain of events in the stack trace involving reimport_files, reload_scene and a synchronous clear_history which memdeletes several dangling TrackCache pointers in this RefCounted AnimatedValuesBackup ?!

Critical error detected c0000374
A breakpoint instruction (__debugbreak() statement or a similar call) was executed in godot.windows.editor.x86_64.exe.

image

Something feels very wrong about holding raw pointers to an AnimationMixer TrackCache in AnimatedValuesBackup. I can't follow the flow at all of how values get stored in AnimatedValuesBackup.

To maintain single-free semantics, these TrackCache* values must be moved and owned by the AnimatedValuesBackup.

TrackCache pointers must never be shared by other objects, otherwise a use-after-free or double-delete is likely to happen

Steps to reproduce

  1. Follow the steps in Animation window Edit -> Apply Reset fails because AnimationMixer::_reset is not exposed #85232 to Apply Reset on an opened gltf
  2. Select the gltf in the filesystem (it will already be selected if you followed the steps)
  3. Open the Import dock and click Reimport
  4. Godot will crash.

Minimal reproduction project

ApplyReset.zip

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    • Status

      No status

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions