Presence of Material with GradientTexture assigned will immediately crash the editor

[SaracenOne]

Godot version

a01ea50

System information

Windows 10

Issue description

There was an issue reported about GradientTexture crashing being resolved earlier, but testing again today, this issue still appears to be present. If you have a material with a GradientTexture assigned to it (in my example case, a ParticleMaterial), the editor will immediately crash on the _flush() function of command_queue_mt.h.

Steps to reproduce

Simply open the example project provided.

Minimal reproduction project

gradient_textures_crash.zip

[SaracenOne]

This may be related to #49684 since it crashes at the same place

[SaracenOne]

I'm still not sure of the exact problem, but after running a bisect, I can confirm that this commit c66b265 introduced the regression, at least as far as this specific issue goes.

[qarmin]

It crash with this info

pure virtual method called
terminate called without an active exception
Aborted

GDB backtrace

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  0x00007ffff7ae6864 in __GI_abort () at abort.c:79
#2  0x0000000002042ae9 in __gnu_cxx::__verbose_terminate_handler() [clone .cold] ()
#3  0x00000000062b037c in __cxxabiv1::__terminate(void (*)()) ()
#4  0x00000000062b03e7 in std::terminate() ()
#5  0x00000000062b0aa5 in __cxa_pure_virtual ()
#6  0x00000000022457b9 in CommandQueueMT::_flush (this=0xa9e2f18) at ./core/templates/command_queue_mt.h:373
#7  0x0000000005443e20 in CommandQueueMT::flush_if_pending (this=0xa9e2f18) at ./core/templates/command_queue_mt.h:404
#8  0x0000000005545d7a in RenderingServerDefault::free (this=0xa9e2d70, p_rid=...) at servers/rendering/rendering_server_default.h:909
#9  0x00000000050423ee in GradientTexture::~GradientTexture (this=0x7fff54002f80, __in_chrg=<optimized out>) at scene/resources/texture.cpp:1517
#10 0x0000000002291621 in memdelete<RefCounted> (p_class=0x7fff54002f80) at ./core/os/memory.h:115
#11 0x0000000005c61368 in Variant::_clear_internal (this=0x1f4da438) at core/variant/variant.cpp:1309
#12 0x000000000204658d in Variant::clear (this=0x1f4da438) at ./core/variant/variant.h:257
#13 0x00000000020465b6 in Variant::~Variant (this=0x1f4da438, __in_chrg=<optimized out>) at ./core/variant/variant.h:670
#14 0x00000000024aecee in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element::~Element (this=0x1f4da400, __in_chrg=<optimized out>) at ./core/templates/map.h:49
#15 0x00000000024aed31 in memdelete_allocator<Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element, DefaultAllocator> (p_class=0x1f4da400) at ./core/os/memory.h:127
#16 0x00000000024a882c in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree (this=0x1f08ca50, p_element=0x1f4da400) at ./core/templates/map.h:487
#17 0x00000000024a8820 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree (this=0x1f08ca50, p_element=0x1f4d7d40) at ./core/templates/map.h:486
#18 0x00000000024a8820 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree (this=0x1f08ca50, p_element=0x1f53e0f0) at ./core/templates/map.h:486
#19 0x00000000024a8820 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree (this=0x1f08ca50, p_element=0x1f539a20) at ./core/templates/map.h:486
#20 0x00000000024a8820 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree (this=0x1f08ca50, p_element=0x1f50fff0) at ./core/templates/map.h:486
#21 0x00000000024a8809 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree (this=0x1f08ca50, p_element=0x1f4ebc80) at ./core/templates/map.h:485
#22 0x000000000249fc2e in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::clear (this=0x1f08ca50) at ./core/templates/map.h:647
#23 0x0000000002498600 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::~Map (this=0x1f08ca50, __in_chrg=<optimized out>) at ./core/templates/map.h:664
#24 0x00000000056064f2 in RendererStorageRD::Material::~Material (this=0x1f08ca20, __in_chrg=<optimized out>) at servers/rendering/renderer_rd/renderer_storage_rd.h:374
#25 0x00000000056214ca in RID_Alloc<RendererStorageRD::Material, true>::free (this=0xaa2acb0, p_rid=...) at ./core/templates/rid_owner.h:274
#26 0x000000000560d297 in RID_Owner<RendererStorageRD::Material, true>::free (this=0xaa2acb0, p_rid=...) at ./core/templates/rid_owner.h:467
#27 0x00000000055fde48 in RendererStorageRD::free (this=0xaa2aa10, p_rid=...) at servers/rendering/renderer_rd/renderer_storage_rd.cpp:8683
#28 0x000000000552ac52 in RenderingServerDefault::_free (this=0xa9e2d70, p_rid=...) at servers/rendering/rendering_server_default.cpp:68
#29 0x000000000556ff45 in CommandQueueMT::Command1<RenderingServerDefault, void (RenderingServerDefault::*)(RID), RID>::call (this=0x7fff5400bfe8) at ./core/templates/command_queue_mt.h:322
#30 0x00000000022457b9 in CommandQueueMT::_flush (this=0xa9e2f18) at ./core/templates/command_queue_mt.h:373
#31 0x0000000005443e20 in CommandQueueMT::flush_if_pending (this=0xa9e2f18) at ./core/templates/command_queue_mt.h:404
#32 0x000000000554171c in RenderingServerDefault::canvas_item_set_visible (this=0xa9e2d70, p1=..., p2=false) at servers/rendering/rendering_server_default.h:786
#33 0x000000000455f35c in CanvasItem::hide (this=0x1212b750) at scene/main/canvas_item.cpp:398
#34 0x0000000003bac15e in SceneTreeDock::_notification (this=0x120cf260, p_what=17) at editor/scene_tree_dock.cpp:1294
#35 0x0000000003bc9cea in SceneTreeDock::_notificationv (this=0x120cf260, p_notification=17, p_reversed=false) at editor/scene_tree_dock.h:54
#36 0x0000000005ee4201 in Object::notification (this=0x120cf260, p_notification=17, p_reversed=false) at core/object/object.cpp:825
#37 0x00000000045dc82f in SceneTree::_notify_group_pause (this=0xaca4f70, p_group=..., p_notification=17) at scene/main/scene_tree.cpp:839
#38 0x00000000045da910 in SceneTree::process (this=0xaca4f70, p_time=0.144530296) at scene/main/scene_tree.cpp:446
#39 0x0000000002089f1a in Main::iteration () at main/main.cpp:2523
#40 0x000000000204870e in OS_LinuxBSD::run (this=0x7fffffffda60) at platform/linuxbsd/os_linuxbsd.cpp:278
#41 0x000000000204551c in main (argc=2, argv=0x7fffffffdf68) at platform/linuxbsd/godot_linuxbsd.cpp:58

[bruvzg]

I can confirm this issue on macOS, but it's getting stuck in the recursive lock instead of crashing.

Full Backtrace

std::__1::atomic_flag::test_and_set(std::__1::memory_order) (/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/c++/v1/atomic:2502)
SpinLock::lock() (/godot/core/os/spin_lock.h:43)
RID_Alloc<RendererStorageRD::Material, true>::getornull(RID const&, bool) (/godot/core/templates/rid_owner.h:157)
RID_Alloc<RendererStorageRD::Material, true>::initialize_rid(RID, RendererStorageRD::Material const&) (/godot/core/templates/rid_owner.h:211)
RID_Owner<RendererStorageRD::Material, true>::initialize_rid(RID, RendererStorageRD::Material const&) (/godot/core/templates/rid_owner.h:455)
RendererStorageRD::material_initialize(RID) (/godot/servers/rendering/renderer_rd/renderer_storage_rd.cpp:1542)
CommandQueueMT::Command1<RendererStorage, void (RendererStorage::*)(RID), RID>::call() (/godot/core/templates/command_queue_mt.h:322)
CommandQueueMT::_flush() (/godot/core/templates/command_queue_mt.h:373)
CommandQueueMT::flush_if_pending() (/godot/core/templates/command_queue_mt.h:404)
RenderingServerDefault::free(RID) (/godot/servers/rendering/rendering_server_default.h:909)
GradientTexture::~GradientTexture() (/godot/scene/resources/texture.cpp:1517)
GradientTexture::~GradientTexture() (/godot/scene/resources/texture.cpp:1515)
void memdelete<RefCounted>(RefCounted*) (/godot/core/os/memory.h:115)
Variant::_clear_internal() (/godot/core/variant/variant.cpp:1309)
Variant::clear() (/godot/core/variant/variant.h:257)
Variant::~Variant() (/godot/core/variant/variant.h:672)
Variant::~Variant() (/godot/core/variant/variant.h:671)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element::~Element() (/godot/core/templates/map.h:49)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element::~Element() (/godot/core/templates/map.h:49)
void memdelete_allocator<Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element, DefaultAllocator>(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) (/godot/core/os/memory.h:127)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) (/godot/core/templates/map.h:487)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) (/godot/core/templates/map.h:486)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) (/godot/core/templates/map.h:486)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) (/godot/core/templates/map.h:486)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) (/godot/core/templates/map.h:486)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_cleanup_tree(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) (/godot/core/templates/map.h:485)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::clear() (/godot/core/templates/map.h:647)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::~Map() (/godot/core/templates/map.h:664)
Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::~Map() (/godot/core/templates/map.h:663)
RendererStorageRD::Material::~Material() (/godot/servers/rendering/renderer_rd/renderer_storage_rd.h:374)
RendererStorageRD::Material::~Material() (/godot/servers/rendering/renderer_rd/renderer_storage_rd.h:374)
RID_Alloc<RendererStorageRD::Material, true>::free(RID const&) (/godot/core/templates/rid_owner.h:274)
RID_Owner<RendererStorageRD::Material, true>::free(RID const&) (/godot/core/templates/rid_owner.h:467)
RendererStorageRD::free(RID) (/godot/servers/rendering/renderer_rd/renderer_storage_rd.cpp:8683)
RenderingServerDefault::_free(RID) (/godot/servers/rendering/rendering_server_default.cpp:68)
CommandQueueMT::Command1<RenderingServerDefault, void (RenderingServerDefault::*)(RID), RID>::call() (/godot/core/templates/command_queue_mt.h:322)
CommandQueueMT::_flush() (/godot/core/templates/command_queue_mt.h:373)
CommandQueueMT::flush_if_pending() (/godot/core/templates/command_queue_mt.h:404)
RenderingServerDefault::canvas_item_add_triangle_array(RID, Vector<int> const&, Vector<Vector2> const&, Vector<Color> const&, Vector<Vector2> const&, Vector<int> const&, Vector<float> const&, RID, int) (/godot/servers/rendering/rendering_server_default.h:810)
StyleBoxFlat::draw(RID, Rect2 const&) const (/godot/scene/resources/style_box.cpp:774)
Tree::_notification(int) (/godot/scene/gui/tree.cpp:3441)
Tree::_notificationv(int, bool) (/godot/scene/gui/tree.h:355)
Object::notification(int, bool) (/godot/core/object/object.cpp:841)
CanvasItem::_update_callback() (/godot/scene/main/canvas_item.cpp:427)
void call_with_variant_args_helper<__UnexistingClass>(__UnexistingClass*, void (__UnexistingClass::*)(), Variant const**, Callable::CallError&, IndexSequence<>) (/godot/core/variant/binder_common.h:218)
void call_with_variant_args_dv<__UnexistingClass>(__UnexistingClass*, void (__UnexistingClass::*)(), Variant const**, int, Callable::CallError&, Vector<Variant> const&) (/godot/core/variant/binder_common.h:365)
MethodBindT<>::call(Object*, Variant const**, int, Callable::CallError&) (/godot/core/object/method_bind.h:285)
Object::call(StringName const&, Variant const**, int, Callable::CallError&) (/godot/core/object/object.cpp:832)
Callable::call(Variant const**, int, Variant&, Callable::CallError&) const (/godot/core/variant/callable.cpp:62)
MessageQueue::_call_function(Callable const&, Variant const*, int, bool) (/godot/core/object/message_queue.cpp:258)
MessageQueue::flush() (/godot/core/object/message_queue.cpp:304)
SceneTree::process(float) (/godot/scene/main/scene_tree.cpp:449)
Main::iteration() (/godot/main/main.cpp:2541)
OS_OSX::run() (/godot/platform/osx/os_osx.mm:339)
main (/godot/platform/osx/godot_main_osx.mm:79)
start (@start:4)

1. RID_Owner<RendererStorageRD::Material> spinlock is locked for the first time:

RID_Owner<RendererStorageRD::Material, true>::free(RID const&) (/godot/core/templates/rid_owner.h:467)
RendererStorageRD::free(RID) (/godot/servers/rendering/renderer_rd/renderer_storage_rd.cpp:8683)

2. chunks[idx_chunk][idx_element].~T(); is called from the ::free, before releasing spinlock.
3. Bunch of stuff happens.
4. Same RID_Owner<RendererStorageRD::Material> spinlock is locked again:

RID_Owner<RendererStorageRD::Material, true>::initialize_rid(RID, RendererStorageRD::Material const&) (/godot/core/templates/rid_owner.h:455)
RendererStorageRD::material_initialize(RID) (/godot/servers/rendering/renderer_rd/renderer_storage_rd.cpp:1542)

Seems like recursive dependency somewhere.