ScrollContainer crash: Adding TextureRect grandchildren to a ScrollContainer (via BoxContainer child) causes editor or game to crash.

[kksgandhi]

Godot version

4.0.2.stable.official.7a0977ce2

System information

Ubuntu 22.04, Nvidia RTX 2060, Forward+

Issue description

The following tree hierarchy should produce a scrollable list of icons:

• PanelContainer
  • ScrollContainer
    • VBoxContainer (or HBoxContainer)
      • TextureRect
      • TextureRect2
      • etc...

Instead, the editor crashes when enough TextureRects are added to cause the ScrollBoxContainer's scrollbar to appear. If children are added programmatically, the game will crash.

This issue will occur:

• Whether using a VBoxContainer or an HBoxContainer

This issue will not occur:

• If the ScrollContainer's "Always Show Scrollbar" property is enabled.
• If the ScrollContainer's scrollbars are already visible.
• If the BoxContainer's "Theme Override > Constant > Seperator" property is set. (unless the BoxContainer is a child of a MarginContainer whose margin property is set)

Steps to reproduce

Use the minimal reproduction project uploaded below.

The folder "examples_that_crash" contains scenes that crash. The folder "examples_that_work" contains scenes that do not crash, and work as expected.

Minimal reproduction project

ScrollContainerCrash.zip

[Rindbee]

The following message is printed before crashing.

ERROR: Failed method: CanvasItem::_redraw_callback. Message queue out of memory. Try increasing 'memory/limits/message_queue/max_size_kb' in project settings.
   at: push_callablep (core/object/message_queue.cpp:120)
ERROR: Failed method: EditorToaster::_popup_str. Message queue out of memory. Try increasing 'memory/limits/message_queue/max_size_kb' in project settings.
   at: push_callablep (core/object/message_queue.cpp:120)

crash log

=================================================================
==24479==ERROR: AddressSanitizer: heap-use-after-free on address 0x6080016850b0 at pc 0x560ac16f79ef bp 0x7ffe1c182fd0 sp 0x7ffe1c182fc8
READ of size 8 at 0x6080016850b0 thread T0
    #0 0x560ac16f79ee in Callable::get_object() const /opt/godot/godot-editor-l10n/godot/core/variant/callable.cpp:132:41
    #1 0x560ac2bc4302 in MessageQueue::statistics() /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:154:38
    #2 0x560ac2bbfe56 in MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:121:3
    #3 0x560ac2bbf7c0 in MessageQueue::push_callp(ObjectID, StringName const&, Variant const**, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:45:9
    #4 0x560ac2bc7df5 in MessageQueue::push_callp(Object*, StringName const&, Variant const**, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:103:9
    #5 0x560ab12278b2 in Error MessageQueue::push_call<String, EditorToaster::Severity, String>(Object*, StringName const&, String, EditorToaster::Severity, String) /opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:112:10
    #6 0x560ab12182d9 in void Object::call_deferred<String, EditorToaster::Severity, String>(StringName const&, String, EditorToaster::Severity, String) /opt/godot/godot-editor-l10n/godot/./core/object/object.h:886:34
    #7 0x560ab11f9ff1 in EditorToaster::popup_str(String, EditorToaster::Severity, String) /opt/godot/godot-editor-l10n/godot/editor/editor_toaster.cpp:406:2
    #8 0x560ab11f9880 in EditorToaster::_error_handler(void*, char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/editor/editor_toaster.cpp:178:35
    #9 0x560ac2f5aaf8 in _err_print_error(char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:97:3
    #10 0x560ac2f5ad9f in _err_print_error(char const*, char const*, int, String const&, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:81:2
    #11 0x560ac2bbfdf7 in MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:120:3
    #12 0x560ab00b9e94 in Error MessageQueue::push_callable<>(Callable const&) /opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:101:10
    #13 0x560ab591fb55 in CanvasItem::queue_redraw() /opt/godot/godot-editor-l10n/godot/scene/main/canvas_item.cpp:368:33
    #14 0x560ab62463fa in Button::set_text(String const&) /opt/godot/godot-editor-l10n/godot/scene/gui/button.cpp:466:3
    #15 0x560ab05310de in EditorLog::LogFilter::set_message_count(int) /opt/godot/godot-editor-l10n/godot/editor/editor_log.h:112:19
    #16 0x560ab051d86f in EditorLog::_process_message(String const&, EditorLog::MessageType) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:223:27
    #17 0x560ab050cb09 in EditorLog::add_message(String const&, EditorLog::MessageType) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:235:3
    #18 0x560ab050c68e in EditorLog::_error_handler(void*, char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:64:9
    #19 0x560ac2f5aaf8 in _err_print_error(char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:97:3
    #20 0x560ac2f5ad9f in _err_print_error(char const*, char const*, int, String const&, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:81:2
    #21 0x560ac2bbfdf7 in MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:120:3
    #22 0x560ab00b9e94 in Error MessageQueue::push_callable<>(Callable const&) /opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:101:10
    #23 0x560ab591fb55 in CanvasItem::queue_redraw() /opt/godot/godot-editor-l10n/godot/scene/main/canvas_item.cpp:368:33
    #24 0x560ab6247b62 in Button::set_icon(Ref<Texture2D> const&) /opt/godot/godot-editor-l10n/godot/scene/gui/button.cpp:503:3
    #25 0x560ab051f0e9 in EditorLog::_add_log_line(EditorLog::LogMessage&, bool) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:302:17
    #26 0x560ab051d3c7 in EditorLog::_process_message(String const&, EditorLog::MessageType) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:219:3
    #27 0x560ab050cb09 in EditorLog::add_message(String const&, EditorLog::MessageType) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:235:3
    #28 0x560ab050c68e in EditorLog::_error_handler(void*, char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:64:9
    #29 0x560ac2f5aaf8 in _err_print_error(char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:97:3
    #30 0x560ac2f5ad9f in _err_print_error(char const*, char const*, int, String const&, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:81:2
    #31 0x560ac2bbfdf7 in MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:120:3
    #32 0x560ab00b9e94 in Error MessageQueue::push_callable<>(Callable const&) /opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:101:10
    #33 0x560ab591fb55 in CanvasItem::queue_redraw() /opt/godot/godot-editor-l10n/godot/scene/main/canvas_item.cpp:368:33
    #34 0x560ab6f03428 in RichTextLabel::_add_item(RichTextLabel::Item*, bool, bool) /opt/godot/godot-editor-l10n/godot/scene/gui/rich_text_label.cpp:2978:2
    #35 0x560ab6f13a59 in RichTextLabel::push_color(Color const&) /opt/godot/godot-editor-l10n/godot/scene/gui/rich_text_label.cpp:3247:2
    #36 0x560ab051e9b4 in EditorLog::_add_log_line(EditorLog::LogMessage&, bool) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:298:9
    #37 0x560ab051d3c7 in EditorLog::_process_message(String const&, EditorLog::MessageType) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:219:3
    #38 0x560ab050cb09 in EditorLog::add_message(String const&, EditorLog::MessageType) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:235:3
    #39 0x560ab050c68e in EditorLog::_error_handler(void*, char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:64:9
    #40 0x560ac2f5aaf8 in _err_print_error(char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:97:3
    #41 0x560ac2f5ad9f in _err_print_error(char const*, char const*, int, String const&, bool, ErrorHandlerType) /opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:81:2
    #42 0x560ac2bbfdf7 in MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:120:3
    #43 0x560ac2bbf7c0 in MessageQueue::push_callp(ObjectID, StringName const&, Variant const**, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:45:9
    #44 0x560ac2bc7df5 in MessageQueue::push_callp(Object*, StringName const&, Variant const**, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:103:9
    #45 0x560aa2b3d4fa in Error MessageQueue::push_call<>(Object*, StringName const&) /opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:112:10
    #46 0x560ab656b762 in Control::update_minimum_size() /opt/godot/godot-editor-l10n/godot/scene/gui/control.cpp:1576:33
    #47 0x560ab75417ea in TextureRect::_notification(int) /opt/godot/godot-editor-l10n/godot/scene/gui/texture_rect.cpp:114:4
    #48 0x560ab7552015 in TextureRect::_notificationv(int, bool) /opt/godot/godot-editor-l10n/godot/scene/gui/texture_rect.h:37:2
    #49 0x560ac2bdc7e3 in Object::notification(int, bool) /opt/godot/godot-editor-l10n/godot/core/object/object.cpp:790:2
    #50 0x560ab652ced2 in Control::_size_changed() /opt/godot/godot-editor-l10n/godot/scene/gui/control.cpp:1679:4
    #51 0x560ab656809b in Control::set_rect(Rect2 const&) /opt/godot/godot-editor-l10n/godot/scene/gui/control.cpp:1444:3
    #52 0x560ab650e091 in Container::fit_child_in_rect(Control*, Rect2 const&) /opt/godot/godot-editor-l10n/godot/scene/gui/container.cpp:129:11
    #53 0x560ab6209c58 in BoxContainer::_resort() /opt/godot/godot-editor-l10n/godot/scene/gui/box_container.cpp:239:3
    #54 0x560ab620be4c in BoxContainer::_notification(int) /opt/godot/godot-editor-l10n/godot/scene/gui/box_container.cpp:300:4
    #55 0x560aa5dfb7f5 in BoxContainer::_notificationv(int, bool) /opt/godot/godot-editor-l10n/godot/./scene/gui/box_container.h:37:2
    #56 0x560aa5def11c in VBoxContainer::_notificationv(int, bool) /opt/godot/godot-editor-l10n/godot/./scene/gui/box_container.h:92:2
    #57 0x560ac2bdc7e3 in Object::notification(int, bool) /opt/godot/godot-editor-l10n/godot/core/object/object.cpp:790:2
    #58 0x560ab650ba62 in Container::_sort_children() /opt/godot/godot-editor-l10n/godot/scene/gui/container.cpp:94:2
    #59 0x560ab651ba15 in void call_with_variant_args_helper<Container>(Container*, void (Container::*)(), Variant const**, Callable::CallError&, IndexSequence<>) /opt/godot/godot-editor-l10n/godot/./core/variant/binder_common.h:293:2
    #60 0x560ab651b64a in void call_with_variant_args<Container>(Container*, void (Container::*)(), Variant const**, int, Callable::CallError&) /opt/godot/godot-editor-l10n/godot/./core/variant/binder_common.h:407:2
    #61 0x560ab651aef9 in CallableCustomMethodPointer<Container>::call(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot-editor-l10n/godot/./core/object/callable_method_pointer.h:104:3
    #62 0x560ac16f4663 in Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot-editor-l10n/godot/core/variant/callable.cpp:50:11
    #63 0x560ac2bc897d in MessageQueue::_call_function(Callable const&, Variant const*, int, bool) /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:229:13
    #64 0x560ac2bc9e11 in MessageQueue::flush() /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:275:6
    #65 0x560ab5d2f9d5 in SceneTree::physics_process(double) /opt/godot/godot-editor-l10n/godot/scene/main/scene_tree.cpp:430:33
    #66 0x560aa1c8624a in Main::iteration() /opt/godot/godot-editor-l10n/godot/main/main.cpp:3131:45
    #67 0x560aa19c7b8f in OS_LinuxBSD::run() /opt/godot/godot-editor-l10n/godot/platform/linuxbsd/os_linuxbsd.cpp:889:7
    #68 0x560aa199da29 in main /opt/godot/godot-editor-l10n/godot/platform/linuxbsd/godot_linuxbsd.cpp:73:6
    #69 0x7fb3bded6d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #70 0x7fb3bded6e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #71 0x560aa18dcf64 in _start (/opt/godot/godot-editor-l10n/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san+0x1a39df64) (BuildId: 607e761c43c98a61009853b32250c60c04833f26)

0x6080016850b0 is located 16 bytes inside of 88-byte region [0x6080016850a0,0x6080016850f8)
freed by thread T0 here:
    #0 0x560aa195fb02 in free (/opt/godot/godot-editor-l10n/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san+0x1a420b02) (BuildId: 607e761c43c98a61009853b32250c60c04833f26)
    #1 0x560ac08ed23f in Memory::free_static(void*, bool) /opt/godot/godot-editor-l10n/godot/core/os/memory.cpp:168:3
    #2 0x560ac170aaae in void memdelete<CallableCustom>(CallableCustom*) /opt/godot/godot-editor-l10n/godot/./core/os/memory.h:112:2
    #3 0x560ac1704602 in Callable::~Callable() /opt/godot/godot-editor-l10n/godot/core/variant/callable.cpp:371:4
    #4 0x560ac2bcd238 in MessageQueue::Message::~Message() /opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:56:9
    #5 0x560ac2bca6ce in MessageQueue::flush() /opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:299:12
    #6 0x560ab5d2f9d5 in SceneTree::physics_process(double) /opt/godot/godot-editor-l10n/godot/scene/main/scene_tree.cpp:430:33
    #7 0x560aa1c8624a in Main::iteration() /opt/godot/godot-editor-l10n/godot/main/main.cpp:3131:45
    #8 0x560aa19c7b8f in OS_LinuxBSD::run() /opt/godot/godot-editor-l10n/godot/platform/linuxbsd/os_linuxbsd.cpp:889:7
    #9 0x560aa199da29 in main /opt/godot/godot-editor-l10n/godot/platform/linuxbsd/godot_linuxbsd.cpp:73:6
    #10 0x7fb3bded6d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

previously allocated by thread T0 here:
    #0 0x560aa195fdae in malloc (/opt/godot/godot-editor-l10n/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san+0x1a420dae) (BuildId: 607e761c43c98a61009853b32250c60c04833f26)
    #1 0x560ac08e8a7d in Memory::alloc_static(unsigned long, bool) /opt/godot/godot-editor-l10n/godot/core/os/memory.cpp:75:14
    #2 0x560ac08e88d2 in operator new(unsigned long, char const*) /opt/godot/godot-editor-l10n/godot/core/os/memory.cpp:40:9
    #3 0x560ab5f1111e in Callable create_custom_callable_function_pointer<Viewport>(Viewport*, char const*, void (Viewport::*)()) /opt/godot/godot-editor-l10n/godot/./core/object/callable_method_pointer.h:125:15
    #4 0x560ab5e53683 in Viewport::canvas_parent_mark_dirty(Node*) /opt/godot/godot-editor-l10n/godot/scene/main/viewport.cpp:961:48
    #5 0x560ab5923b7c in CanvasItem::_enter_canvas() /opt/godot/godot-editor-l10n/godot/scene/main/canvas_item.cpp:192:19
    #6 0x560ab592869a in CanvasItem::_notification(int) /opt/godot/godot-editor-l10n/godot/scene/main/canvas_item.cpp:293:4
    #7 0x560aa5dfc815 in CanvasItem::_notificationv(int, bool) /opt/godot/godot-editor-l10n/godot/./scene/main/canvas_item.h:45:2
    #8 0x560aa5dfc0bc in Control::_notificationv(int, bool) /opt/godot/godot-editor-l10n/godot/./scene/gui/control.h:47:2
    #9 0x560ab7551dfc in TextureRect::_notificationv(int, bool) /opt/godot/godot-editor-l10n/godot/scene/gui/texture_rect.h:37:2
    #10 0x560ac2bdc7e3 in Object::notification(int, bool) /opt/godot/godot-editor-l10n/godot/core/object/object.cpp:790:2
    #11 0x560ab5bca1f3 in Node::_propagate_enter_tree() /opt/godot/godot-editor-l10n/godot/scene/main/node.cpp:214:2
    #12 0x560ab5bec122 in Node::_set_tree(SceneTree*) /opt/godot/godot-editor-l10n/godot/scene/main/node.cpp:2612:3
    #13 0x560ab5beb58e in Node::_add_child_nocheck(Node*, StringName const&) /opt/godot/godot-editor-l10n/godot/scene/main/node.cpp:1120:12
    #14 0x560ab5bee138 in Node::add_child(Node*, bool, Node::InternalMode) /opt/godot/godot-editor-l10n/godot/scene/main/node.cpp:1141:2
    #15 0x560ab5bef9b1 in Node::add_sibling(Node*, bool) /opt/godot/godot-editor-l10n/godot/scene/main/node.cpp:1167:15
    #16 0x560ab5ca1bab in void call_with_variant_args_helper<__UnexistingClass, Node*, bool, 0ul, 1ul>(__UnexistingClass*, void (__UnexistingClass::*)(Node*, bool), Variant const**, Callable::CallError&, IndexSequence<0ul, 1ul>) /opt/godot/godot-editor-l10n/godot/./core/variant/binder_common.h:293:2
    #17 0x560ab5ca16e4 in void call_with_variant_args_dv<__UnexistingClass, Node*, bool>(__UnexistingClass*, void (__UnexistingClass::*)(Node*, bool), Variant const**, int, Callable::CallError&, Vector<Variant> const&) /opt/godot/godot-editor-l10n/godot/./core/variant/binder_common.h:440:2
    #18 0x560ab5c9fd76 in MethodBindT<Node*, bool>::call(Object*, Variant const**, int, Callable::CallError&) const /opt/godot/godot-editor-l10n/godot/./core/object/method_bind.h:324:3
    #19 0x560ac2bedfe9 in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) /opt/godot/godot-editor-l10n/godot/core/object/object.cpp:733:17
    #20 0x560ac16f580d in Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot-editor-l10n/godot/core/variant/callable.cpp:62:25
    #21 0x560ac170e3da in CallableCustomBind::call(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot-editor-l10n/godot/core/variant/callable_bind.cpp:140:11
    #22 0x560ac16f4663 in Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const /opt/godot/godot-editor-l10n/godot/core/variant/callable.cpp:50:11
    #23 0x560ac2cf8c48 in UndoRedo::_process_operation_list(List<UndoRedo::Operation, DefaultAllocator>::Element*) /opt/godot/godot-editor-l10n/godot/core/object/undo_redo.cpp:317:17
    #24 0x560ac2cf78bb in UndoRedo::_redo(bool) /opt/godot/godot-editor-l10n/godot/core/object/undo_redo.cpp:75:3
    #25 0x560ac2d040e7 in UndoRedo::commit_action(bool) /opt/godot/godot-editor-l10n/godot/core/object/undo_redo.cpp:296:2
    #26 0x560ab124e2cf in EditorUndoRedoManager::commit_action(bool) /opt/godot/godot-editor-l10n/godot/editor/editor_undo_redo_manager.cpp:241:21
    #27 0x560ab1ac2fb2 in SceneTreeDock::_tool_selected(int, bool) /opt/godot/godot-editor-l10n/godot/editor/scene_tree_dock.cpp:726:15
    #28 0x560ab1ab0d49 in SceneTreeDock::shortcut_input(Ref<InputEvent> const&) /opt/godot/godot-editor-l10n/godot/editor/scene_tree_dock.cpp:126:3
    #29 0x560ab5c24f91 in Node::_call_shortcut_input(Ref<InputEvent> const&) /opt/godot/godot-editor-l10n/godot/scene/main/node.cpp:2806:2

SUMMARY: AddressSanitizer: heap-use-after-free /opt/godot/godot-editor-l10n/godot/core/variant/callable.cpp:132:41 in Callable::get_object() const
Shadow bytes around the buggy address:
  0x0c10802c89c0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c10802c89d0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c10802c89e0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c10802c89f0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c10802c8a00: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
=>0x0c10802c8a10: fa fa fa fa fd fd[fd]fd fd fd fd fd fd fd fd fa
  0x0c10802c8a20: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c10802c8a30: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c10802c8a40: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c10802c8a50: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c10802c8a60: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==24479==ABORTING

After increasing the default value of memory/limits/message_queue/max_size_kb by 100 times, it still crashes.

crash log

================================================================
handle_crash: Program crashed with signal 11
Engine version: Godot Engine v4.1.dev.custom_build (132000f58d545cbf537cb751cb787d48c0b2085b)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] /opt/godot/godot-editor-l10n/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san(+0x1a45f4aa) [0x564b47a844aa] (/opt/godot/godot-editor-l10n/godot/platform/linuxbsd/crash_handler_linuxbsd.cpp:57)
[2] /lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7f5f45dd5520] (??:0)
[3] Callable::get_object() const (/opt/godot/godot-editor-l10n/godot/core/variant/callable.cpp:132)
[4] MessageQueue::statistics() (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:154)
[5] MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:121)
[6] MessageQueue::push_callp(ObjectID, StringName const&, Variant const**, int, bool) (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:45)
[7] MessageQueue::push_callp(Object*, StringName const&, Variant const**, int, bool) (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:103)
[8] Error MessageQueue::push_call<String, EditorToaster::Severity, String>(Object*, StringName const&, String, EditorToaster::Severity, String) (/opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:112)
[9] void Object::call_deferred<String, EditorToaster::Severity, String>(StringName const&, String, EditorToaster::Severity, String) (/opt/godot/godot-editor-l10n/godot/./core/object/object.h:886)
[10] EditorToaster::popup_str(String, EditorToaster::Severity, String) (/opt/godot/godot-editor-l10n/godot/editor/editor_toaster.cpp:406)
[11] EditorToaster::_error_handler(void*, char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/editor/editor_toaster.cpp:178)
[12] _err_print_error(char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:98)
[13] _err_print_error(char const*, char const*, int, String const&, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:81)
[14] MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:120)
[15] Error MessageQueue::push_callable<>(Callable const&) (/opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:101)
[16] CanvasItem::queue_redraw() (/opt/godot/godot-editor-l10n/godot/scene/main/canvas_item.cpp:368)
[17] Button::set_text(String const&) (/opt/godot/godot-editor-l10n/godot/scene/gui/button.cpp:466)
[18] EditorLog::LogFilter::set_message_count(int) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.h:112)
[19] EditorLog::_process_message(String const&, EditorLog::MessageType) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:223)
[20] EditorLog::add_message(String const&, EditorLog::MessageType) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:235)
[21] EditorLog::_error_handler(void*, char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:64)
[22] _err_print_error(char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:98)
[23] _err_print_error(char const*, char const*, int, String const&, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:81)
[24] MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:120)
[25] Error MessageQueue::push_callable<>(Callable const&) (/opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:101)
[26] CanvasItem::queue_redraw() (/opt/godot/godot-editor-l10n/godot/scene/main/canvas_item.cpp:368)
[27] Button::set_icon(Ref<Texture2D> const&) (/opt/godot/godot-editor-l10n/godot/scene/gui/button.cpp:503)
[28] EditorLog::_add_log_line(EditorLog::LogMessage&, bool) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:302)
[29] EditorLog::_process_message(String const&, EditorLog::MessageType) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:219)
[30] EditorLog::add_message(String const&, EditorLog::MessageType) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:235)
[31] EditorLog::_error_handler(void*, char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:64)
[32] _err_print_error(char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:98)
[33] _err_print_error(char const*, char const*, int, String const&, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:81)
[34] MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:120)
[35] Error MessageQueue::push_callable<>(Callable const&) (/opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:101)
[36] CanvasItem::queue_redraw() (/opt/godot/godot-editor-l10n/godot/scene/main/canvas_item.cpp:368)
[37] RichTextLabel::_add_item(RichTextLabel::Item*, bool, bool) (/opt/godot/godot-editor-l10n/godot/scene/gui/rich_text_label.cpp:2978)
[38] RichTextLabel::push_color(Color const&) (/opt/godot/godot-editor-l10n/godot/scene/gui/rich_text_label.cpp:3247)
[39] EditorLog::_add_log_line(EditorLog::LogMessage&, bool) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:298)
[40] EditorLog::_process_message(String const&, EditorLog::MessageType) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:219)
[41] EditorLog::add_message(String const&, EditorLog::MessageType) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:235)
[42] EditorLog::_error_handler(void*, char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/editor/editor_log.cpp:64)
[43] _err_print_error(char const*, char const*, int, char const*, char const*, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:98)
[44] _err_print_error(char const*, char const*, int, String const&, bool, ErrorHandlerType) (/opt/godot/godot-editor-l10n/godot/core/error/error_macros.cpp:81)
[45] MessageQueue::push_callablep(Callable const&, Variant const**, int, bool) (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:120)
[46] Error MessageQueue::push_callable<>(Callable const&) (/opt/godot/godot-editor-l10n/godot/./core/object/message_queue.h:101)
[47] CanvasItem::queue_redraw() (/opt/godot/godot-editor-l10n/godot/scene/main/canvas_item.cpp:368)
[48] Control::set_anchor(Side, float, bool, bool) (/opt/godot/godot-editor-l10n/godot/scene/gui/control.cpp:738)
[49] Control::set_anchor_and_offset(Side, float, float, bool) (/opt/godot/godot-editor-l10n/godot/scene/gui/control.cpp:764)
[50] ScrollContainer::update_scrollbars() (/opt/godot/godot-editor-l10n/godot/scene/gui/scroll_container.cpp:459)
[51] ScrollContainer::_reposition_children() (/opt/godot/godot-editor-l10n/godot/scene/gui/scroll_container.cpp:300)
[52] ScrollContainer::_notification(int) (/opt/godot/godot-editor-l10n/godot/scene/gui/scroll_container.cpp:366)
[53] ScrollContainer::_notificationv(int, bool) (/opt/godot/godot-editor-l10n/godot/./scene/gui/scroll_container.h:39)
[54] Object::notification(int, bool) (/opt/godot/godot-editor-l10n/godot/core/object/object.cpp:790)
[55] Container::_sort_children() (/opt/godot/godot-editor-l10n/godot/scene/gui/container.cpp:94)
[56] void call_with_variant_args_helper<Container>(Container*, void (Container::*)(), Variant const**, Callable::CallError&, IndexSequence<>) (/opt/godot/godot-editor-l10n/godot/./core/variant/binder_common.h:293)
[57] void call_with_variant_args<Container>(Container*, void (Container::*)(), Variant const**, int, Callable::CallError&) (??:?)
[58] CallableCustomMethodPointer<Container>::call(Variant const**, int, Variant&, Callable::CallError&) const (??:?)
[59] Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const (/opt/godot/godot-editor-l10n/godot/core/variant/callable.cpp:51)
[60] MessageQueue::_call_function(Callable const&, Variant const*, int, bool) (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:229)
[61] MessageQueue::flush() (/opt/godot/godot-editor-l10n/godot/core/object/message_queue.cpp:277)
[62] SceneTree::physics_process(double) (/opt/godot/godot-editor-l10n/godot/scene/main/scene_tree.cpp:430)
[63] Main::iteration() (/opt/godot/godot-editor-l10n/godot/main/main.cpp:3131)
[64] OS_LinuxBSD::run() (/opt/godot/godot-editor-l10n/godot/platform/linuxbsd/os_linuxbsd.cpp:889)
[65] /opt/godot/godot-editor-l10n/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san(main+0x83a) [0x564b47a83a2a] (/opt/godot/godot-editor-l10n/godot/platform/linuxbsd/godot_linuxbsd.cpp:73)
[66] /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f5f45dbcd90] (??:0)
[67] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f5f45dbce40] (??:0)
[68] /opt/godot/godot-editor-l10n/godot/bin/godot.linuxbsd.editor.dev.x86_64.llvm.san(_start+0x25) [0x564b479c2f65] (??:?)
-- END OF BACKTRACE --
================================================================

[Rindbee]

This is probably because the automatic display of the scrollbars causes the calculation result of get_minimum_size to become hesitant.

This causes size_changed to always be true and the following code is always called.

godot/scene/gui/control.cpp

Lines 1620 to 1622 in 132000f

	if (size_changed) {
	update_minimum_size();
	}

godot/scene/gui/control.cpp

Line 1576 in 132000f

MessageQueue::get_singleton()->push_call(this, "_update_minimum_size");

Probably due to using a non-default expand_mode on the TextureRect.

[YuriSizov]

Probably due to using a non-default expand_mode on the TextureRect.

Might be related to #73071 if so.

[Rindbee]

Might be related to #73071 if so.

Similar to it. Some containers' functions depend on the get_combined_minimum_size of the child control. If these functions affect the display space of the child control, and the minimum size of the child control depends on the size of the display space, this may produce an infinite loop.

There should be no problem with using one alone, and users should avoid using both at the same time, which can be explained in the documentation.

[kksgandhi]

@Rindbee You mention "users should avoid using both at the same time." Can you elaborate on this, I guess I'm confused on both of what?

Until the bug is fixed, do you have any suggestions for implementing the behavior I was looking for (a scrollable list of icons?) I could simply set the scrollbar to always show, but it looks a bit ugly then.

[Rindbee]

@Rindbee You mention "users should avoid using both at the same time." Can you elaborate on this, I guess I'm confused on both of what?

1. Currently, when *_scroll_mode is SCROLL_MODE_AUTO, the display of the scrollbar is determined by comparing the minimum size of the child control with the size of the ScrollContainer. When the scrollbar in the ScrollContainer is displayed, it will squeeze the display space of the child control, ;
2. When the expand_mode of TextureRect is EXPAND_FIT_*, its minimum size depends on its size. And its size is related to the above display space in the MRP. When the minimum size gets smaller, the scrollbar may not have to be shown, then the child control retakes the whole space and its minimum size gets bigger again.

So this is actually an infinite circular dependency. The ScrollContainer cannot determine the visibility of the scrollbar, and the child control cannot determine their own size. When one of them changes, the other will switch to another state.

Until the bug is fixed, do you have any suggestions for implementing the behavior I was looking for (a scrollable list of icons?) I could simply set the scrollbar to always show, but it looks a bit ugly then.

A temporary workaround is to adjust the custom_minimum_size of the PanelContainer to use a suitable value. The value currently used is (100, 600). When the number of TextureRects does not exceed 6, the width is 100. When there are more than 6, the width is 92 (minus the scrollbar width 8). When the number of visible TextureRects is n, the value between [92*n, 100*n] (this may vary due to other theme properties) is not safe. Don't use values that just change the visibility of the scrollbar, (100, 610) is OK.

[kksgandhi]

Thank you! I didn't realize that there were safe values, I just assumed that this bug would occur regardless.

In the example project, I guess that's why adding the separator theme override fixes the issue (and why adding the margin container breaks it again)

[Swarkin]

Still happening in 4.3.dev2

Weird observation with TextEdit:

This does not actually fully disable scroll, the scrollbar still appears if the Control's width is less than one letter wide, resulting in (I believe) this exact freeze.

explorer_7IL0ieJaro.mp4

[kvbc]

Also happens in 4.2.2. The engine crashes when resizing the scroll container or adding children to the hbox that would overflow it, unless the scrollbar is set to always show.

The error is either "Failed method: CanvasItem::_redraw_callback" or "Failed method: CanvasItem::_update_minimum_size"

Error-1.mp4