Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Executing Shader.set_code function crashes Godot (Headless) #87812

Closed
qarmin opened this issue Feb 1, 2024 · 0 comments · Fixed by #88581
Closed

Executing Shader.set_code function crashes Godot (Headless) #87812

qarmin opened this issue Feb 1, 2024 · 0 comments · Fixed by #88581

Comments

@qarmin
Copy link
Contributor

qarmin commented Feb 1, 2024

Tested versions

4.3.dev.custom_build.9adb7c7d1

System information

Ubuntu 22.04 CI

Issue description

When executing (this code was automatically minimized, so it is possible, that an even more "minimal" project can be created)

extends Node
func _process(delta):
	for i in get_children():
		i.queue_free()
	var temp_variable431 = Shader.new()
	temp_variable431.set_default_texture_parameter(StringName("127.0.0.1"), NoiseTexture2D.new(), -12)
	temp_variable431.set_code("2812479390")

Godot crashes:

Godot Engine v4.3.dev.custom_build.9adb7c7d1 - https://godotengine.org
servers/rendering/shader_compiler.h:89:9: runtime error: load of value 2442890258, which is not a valid value for type 'TextureFilter'
servers/rendering/shader_compiler.h:89:9: runtime error: load of value 22080, which is not a valid value for type 'TextureRepeat'
servers/rendering/shader_compiler.h:89:9: runtime error: load of value 2442890258, which is not a valid value for type 'TextureFilter'
servers/rendering/shader_compiler.h:89:9: runtime error: load of value 22080, which is not a valid value for type 'TextureRepeat'
Time set to: 0 seconds.
Loaded settings:
modules/gdscript/gdscript_vm.cpp:719:13: runtime error: store to misaligned address 0x62100015236c for type '<unknown> *', which requires 8 byte alignment
0x62100015236c: note: pointer points here
  04 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  15 00 00 00 10 00 00 01  14 00 00 00 06 00 00 00
              ^ 
'add_arguments_to_tree' with value 'true'
modules/gdscript/gdscript_vm.cpp:726:42: runtime error: load of misaligned address 0x62100015236c for type '<unknown> *', which requires 8 byte alignment
0x62100015236c: note: pointer points here
  04 00 00 00 97 41 30 91  40 56 00 00 00 00 00 00  15 00 00 00 10 00 00 01  14 00 00 00 06 00 00 00
              ^ 
'delay_removing_added_arguments_to_next_frame' with value 'true'
######################## Ending test ########################
ERROR: FATAL: Condition "!exists" is true.
   at: operator[] (./core/templates/hash_map.h:538)
================================================================
handle_crash: Program crashed with signal 4
Engine version: Godot Engine v4.3.dev.custom_build (9adb7c7d130c6d4eb0e80b92d6eebd71fac3384d)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] ./godot.linuxbsd.editor.dev.x86_64.san(+0x3b375999) [0x56407653c999] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/crash_handler_linuxbsd.cpp:61)
[2] /lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7fe72a242520] (??:0)
[3] HashMap<RenderingServer::ShaderMode, ShaderTypes::Type, HashMapHasherDefault, HashMapComparatorDefault<RenderingServer::ShaderMode>, DefaultTypedAllocator<HashMapElement<RenderingServer::ShaderMode, ShaderTypes::Type> > >::operator[](RenderingServer::ShaderMode const&) const (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/hash_map.h:538 (discriminator 1))
[4] ShaderTypes::get_functions(RenderingServer::ShaderMode) const (/home/runner/work/Qarminer/Qarminer/godot/servers/rendering/shader_types.cpp:35)
[5] ShaderCompiler::compile(RenderingServer::ShaderMode, String const&, ShaderCompiler::IdentifierActions*, String const&, ShaderCompiler::GeneratedCode&) (/home/runner/work/Qarminer/Qarminer/godot/servers/rendering/shader_compiler.cpp:1460)
[6] RendererDummy::MaterialStorage::shader_set_code(RID, String const&) (/home/runner/work/Qarminer/Qarminer/godot/servers/rendering/dummy/storage/material_storage.cpp:89)
[7] RenderingServerDefault::shader_set_code(RID, String const&) (/home/runner/work/Qarminer/Qarminer/godot/servers/rendering/rendering_server_default.h:235)
[8] Shader::set_code(String const&) (/home/runner/work/Qarminer/Qarminer/godot/scene/resources/shader.cpp:110)
[9] void call_with_variant_args_helper<__UnexistingClass, String const&, 0ul>(__UnexistingClass*, void (__UnexistingClass::*)(String const&), Variant const**, Callable::CallError&, IndexSequence<0ul>) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:304 (discriminator 4))
[10] void call_with_variant_args_dv<__UnexistingClass, String const&>(__UnexistingClass*, void (__UnexistingClass::*)(String const&), Variant const**, int, Callable::CallError&, Vector<Variant> const&) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:422)
[11] MethodBindT<String const&>::call(Object*, Variant const**, int, Callable::CallError&) const (/home/runner/work/Qarminer/Qarminer/godot/./core/object/method_bind.h:335)
[12] Object::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:775)
[13] Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/variant/variant_call.cpp:1208)
[14] GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript_vm.cpp:1735)
[15] GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript.cpp:1905)
[16] bool Node::_gdvirtual__process_call<false>(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.h:318 (discriminator 1))
[17] Node::_notification(int) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.cpp:58)
[18] Node::_notificationv(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/./scene/main/node.h:49 (discriminator 14))
[19] Object::notification(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:840)
[20] SceneTree::_process_group(SceneTree::ProcessGroup*, bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:951)
[21] SceneTree::_process(bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:1023 (discriminator 2))
[22] SceneTree::process(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:510)
[23] Main::iteration() (/home/runner/work/Qarminer/Qarminer/godot/main/main.cpp:3852)
[24] OS_LinuxBSD::run() (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/os_linuxbsd.cpp:945)
[25] ./godot.linuxbsd.editor.dev.x86_64.san(main+0x583) [0x56407653c40c] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/godot_linuxbsd.cpp:76)
[26] /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7fe72a229d90] (??:0)
[27] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7fe72a229e40] (??:0)
[28] ./godot.linuxbsd.editor.dev.x86_64.san(_start+0x25) [0x56407653bdc5] (??:?)
-- END OF BACKTRACE --
================================================================
Aborted (core dumped)

This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visible when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

Steps to reproduce

Above

Minimal reproduction project (MRP)

Above

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants