Repository: godot
Issue: Crash in editor if tool uses PackedScene.instance() from a thread
Labels: bug,topic:core,topic:editor,crash

<!-- Please search existing issues for potential duplicates before filing yours:
https://github.com/godotengine/godot/issues?q=is%3Aissue
-->

**Godot version:**
<!-- Specify commit hash if using non-official build. -->
3.2.3-stable

**OS/device including version:**
<!-- Specify GPU model, drivers, and the backend (GLES2, GLES3, Vulkan) if graphics-related. -->
OpenGL ES 3.0 Renderer: GeForce GTX 1070 with Max-Q Design/PCIe/SSE2
 Pop!_OS 20.04 LTS
nvidia-driver-440.100

**Issue description:**
<!-- What happened, and what was expected. -->
Editor crashes when loading some scenes which contain nodes that use `tool` scripts to concurrently run `PackedScene.instance()` and then add them to the tree.

Compiled with `use_asan=yes use_lsan=yes` and got this:

```
READ of size 4 at 0x6080009f6de8 thread T18 (_thread_load)
    #0 0x724c084 in Variant::evaluate(Variant::Operator const&, Variant const&, Variant const&, Variant&, bool&) core/variant_op.cpp:463
    #1 0x713c98e in Variant::operator==(Variant const&) const core/variant.cpp:679
    #2 0x70ddc25 in PlaceHolderScriptInstance::update(List<PropertyInfo, DefaultAllocator> const&, Map<StringName, Variant, Comparator<StringName>, DefaultAllocator> const&) core/script_language.cpp:573
    #3 0x162bc6a in GDScript::_update_exports(bool*, bool) modules/gdscript/gdscript.cpp:523

0x6080009f6de8 is located 72 bytes inside of 96-byte region [0x6080009f6da0,0x6080009f6e00)
freed by thread T20 (_thread_load) here:
    #0 0x7ffff767a7cf in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    #1 0x731b88a in Memory::free_static(void*, bool) core/os/memory.cpp:178
    #2 0x1436bce in DefaultAllocator::free(void*) core/os/memory.h:66
    #3 0x166f154 in void memdelete_allocator<Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element, DefaultAllocator>(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) core/os/memory.h:130
    #4 0x1663842 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_erase(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) core/map.h:481
    #5 0x1656c8d in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::erase(StringName const&) core/map.h:586
    #6 0x70ddcd0 in PlaceHolderScriptInstance::update(List<PropertyInfo, DefaultAllocator> const&, Map<StringName, Variant, Comparator<StringName>, DefaultAllocator> const&) core/script_language.cpp:581
    #7 0x162bc6a in GDScript::_update_exports(bool*, bool) modules/gdscript/gdscript.cpp:523

0x6080009f6de8 is located 72 bytes inside of 96-byte region [0x6080009f6da0,0x6080009f6e00)
freed by thread T20 (_thread_load)

previously allocated by thread T20 (_thread_load) here:
    #0 0x7ffff767abc8 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x731afb1 in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:82
    #2 0x143b73c in DefaultAllocator::alloc(unsigned long) core/os/memory.h:65
    #3 0x731aeeb in operator new(unsigned long, void* (*)(unsigned long)) core/os/memory.cpp:47
    #4 0x166cdae in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_insert(StringName const&, Variant const&) core/map.h:347
    #5 0x165e577 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::insert(StringName const&, Variant const&) core/map.h:564
    #6 0x16535a6 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::operator[](StringName const&) core/map.h:607
    #7 0x70dda59 in PlaceHolderScriptInstance::update(List<PropertyInfo, DefaultAllocator> const&, Map<StringName, Variant, Comparator<StringName>, DefaultAllocator> const&) core/script_language.cpp:558
    #8 0x162bc6a in GDScript::_update_exports(bool*, bool) modules/gdscript/gdscript.cpp:523
```

Full Dump
```
=================================================================
==3370563==ERROR: AddressSanitizer: heap-use-after-free on address 0x6080009f6de8 at pc 0x00000724c085 bp 0x7fffa2fc5100 sp 0x7fffa2fc50f0
READ of size 4 at 0x6080009f6de8 thread T18 (_thread_load)
    #0 0x724c084 in Variant::evaluate(Variant::Operator const&, Variant const&, Variant const&, Variant&, bool&) core/variant_op.cpp:463
    #1 0x713c98e in Variant::operator==(Variant const&) const core/variant.cpp:679
    #2 0x70ddc25 in PlaceHolderScriptInstance::update(List<PropertyInfo, DefaultAllocator> const&, Map<StringName, Variant, Comparator<StringName>, DefaultAllocator> const&) core/script_language.cpp:573
    #3 0x162bc6a in GDScript::_update_exports(bool*, bool) modules/gdscript/gdscript.cpp:523
    #4 0x16297b5 in GDScript::placeholder_instance_create(Object*) modules/gdscript/gdscript.cpp:337
    #5 0x70281a6 in Object::set_script(RefPtr const&) core/object.cpp:1033
    #6 0x701f2f8 in Object::set(StringName const&, Variant const&, bool*) core/object.cpp:433
    #7 0x5fe8d04 in SceneState::instance(SceneState::GenEditState) const scene/resources/packed_scene.cpp:212
    #8 0x600047c in PackedScene::instance(PackedScene::GenEditState) const scene/resources/packed_scene.cpp:1698
    #9 0x60154d2 in MethodBind1RC<Node*, PackedScene::GenEditState>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:1333
    #10 0x7026b35 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:922
    #11 0x7180f2b in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1128
    #12 0x1708f59 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1099
    #13 0x16372fa in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
    #14 0x7026886 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
    #15 0x75f8bea in _Thread::_start_func(void*) core/bind/core_bind.cpp:2733
    #16 0x30ef71d in ThreadPosix::thread_callback(void*) drivers/unix/thread_posix.cpp:74
    #17 0x7ffff7001608 in start_thread /build/glibc-YYA7BZ/glibc-2.31/nptl/pthread_create.c:477
    #18 0x7ffff6bd5102 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122102)

0x6080009f6de8 is located 72 bytes inside of 96-byte region [0x6080009f6da0,0x6080009f6e00)
freed by thread T20 (_thread_load) here:
    #0 0x7ffff767a7cf in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    #1 0x731b88a in Memory::free_static(void*, bool) core/os/memory.cpp:178
    #2 0x1436bce in DefaultAllocator::free(void*) core/os/memory.h:66
    #3 0x166f154 in void memdelete_allocator<Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element, DefaultAllocator>(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) core/os/memory.h:130
    #4 0x1663842 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_erase(Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::Element*) core/map.h:481
    #5 0x1656c8d in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::erase(StringName const&) core/map.h:586
    #6 0x70ddcd0 in PlaceHolderScriptInstance::update(List<PropertyInfo, DefaultAllocator> const&, Map<StringName, Variant, Comparator<StringName>, DefaultAllocator> const&) core/script_language.cpp:581
    #7 0x162bc6a in GDScript::_update_exports(bool*, bool) modules/gdscript/gdscript.cpp:523
    #8 0x16297b5 in GDScript::placeholder_instance_create(Object*) modules/gdscript/gdscript.cpp:337
    #9 0x70281a6 in Object::set_script(RefPtr const&) core/object.cpp:1033
    #10 0x701f2f8 in Object::set(StringName const&, Variant const&, bool*) core/object.cpp:433
    #11 0x5fe8d04 in SceneState::instance(SceneState::GenEditState) const scene/resources/packed_scene.cpp:212
    #12 0x600047c in PackedScene::instance(PackedScene::GenEditState) const scene/resources/packed_scene.cpp:1698
    #13 0x60154d2 in MethodBind1RC<Node*, PackedScene::GenEditState>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:1333
    #14 0x7026b35 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:922
    #15 0x7180f2b in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1128
    #16 0x1708f59 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1099
    #17 0x16372fa in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
    #18 0x7026886 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
    #19 0x75f8bea in _Thread::_start_func(void*) core/bind/core_bind.cpp:2733
    #20 0x30ef71d in ThreadPosix::thread_callback(void*) drivers/unix/thread_posix.cpp:74
    #21 0x7ffff7001608 in start_thread /build/glibc-YYA7BZ/glibc-2.31/nptl/pthread_create.c:477

previously allocated by thread T20 (_thread_load) here:
    #0 0x7ffff767abc8 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x731afb1 in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:82
    #2 0x143b73c in DefaultAllocator::alloc(unsigned long) core/os/memory.h:65
    #3 0x731aeeb in operator new(unsigned long, void* (*)(unsigned long)) core/os/memory.cpp:47
    #4 0x166cdae in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::_insert(StringName const&, Variant const&) core/map.h:347
    #5 0x165e577 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::insert(StringName const&, Variant const&) core/map.h:564
    #6 0x16535a6 in Map<StringName, Variant, Comparator<StringName>, DefaultAllocator>::operator[](StringName const&) core/map.h:607
    #7 0x70dda59 in PlaceHolderScriptInstance::update(List<PropertyInfo, DefaultAllocator> const&, Map<StringName, Variant, Comparator<StringName>, DefaultAllocator> const&) core/script_language.cpp:558
    #8 0x162bc6a in GDScript::_update_exports(bool*, bool) modules/gdscript/gdscript.cpp:523
    #9 0x16297b5 in GDScript::placeholder_instance_create(Object*) modules/gdscript/gdscript.cpp:337
    #10 0x70281a6 in Object::set_script(RefPtr const&) core/object.cpp:1033
    #11 0x701f2f8 in Object::set(StringName const&, Variant const&, bool*) core/object.cpp:433
    #12 0x5fe8d04 in SceneState::instance(SceneState::GenEditState) const scene/resources/packed_scene.cpp:212
    #13 0x600047c in PackedScene::instance(PackedScene::GenEditState) const scene/resources/packed_scene.cpp:1698
    #14 0x60154d2 in MethodBind1RC<Node*, PackedScene::GenEditState>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:1333
    #15 0x7026b35 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:922
    #16 0x7180f2b in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1128
    #17 0x1708f59 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1099
    #18 0x16372fa in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
    #19 0x7026886 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
    #20 0x75f8bea in _Thread::_start_func(void*) core/bind/core_bind.cpp:2733
    #21 0x30ef71d in ThreadPosix::thread_callback(void*) drivers/unix/thread_posix.cpp:74
    #22 0x7ffff7001608 in start_thread /build/glibc-YYA7BZ/glibc-2.31/nptl/pthread_create.c:477

Thread T18 (_thread_load) created by T0 here:
    #0 0x7ffff75a7805 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
    #1 0x30ef832 in ThreadPosix::create_func_posix(void (*)(void*), void*, Thread::Settings const&) drivers/unix/thread_posix.cpp:90
    #2 0x7326339 in Thread::create(void (*)(void*), void*, Thread::Settings const&) core/os/thread.cpp:51
    #3 0x75f9d53 in _Thread::start(Object*, StringName const&, Variant const&, _Thread::Priority) core/bind/core_bind.cpp:2779
    #4 0x7655f30 in MethodBind4R<Error, Object*, StringName const&, Variant const&, _Thread::Priority>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:3325
    #5 0x7026b35 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:922
    #6 0x7180f2b in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1128
    #7 0x1708fe2 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1102
    #8 0x16372fa in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
    #9 0x7026886 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
    #10 0x7180f2b in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1128
    #11 0x1708f59 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1099
    #12 0x16372fa in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
    #13 0x7026886 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
    #14 0x7180f2b in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1128
    #15 0x1708f59 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1099
    #16 0x16372fa in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
    #17 0x7026886 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
    #18 0x700fe3a in MessageQueue::_call_function(Object*, StringName const&, Variant const*, int, bool) core/message_queue.cpp:250
    #19 0x70105e5 in MessageQueue::flush() core/message_queue.cpp:297
    #20 0x4d1b1e7 in SceneTree::iteration(float) scene/main/scene_tree.cpp:483
    #21 0x14e1ab1 in Main::iteration() main/main.cpp:2084
    #22 0x14643d9 in OS_X11::run() platform/x11/os_x11.cpp:3233
    #23 0x1436a55 in main platform/x11/godot_x11.cpp:56
    #24 0x7ffff6ada0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

Thread T20 (_thread_load) created by T0 here:
    #0 0x7ffff75a7805 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
    #1 0x30ef832 in ThreadPosix::create_func_posix(void (*)(void*), void*, Thread::Settings const&) drivers/unix/thread_posix.cpp:90
    #2 0x7326339 in Thread::create(void (*)(void*), void*, Thread::Settings const&) core/os/thread.cpp:51
    #3 0x75f9d53 in _Thread::start(Object*, StringName const&, Variant const&, _Thread::Priority) core/bind/core_bind.cpp:2779
    #4 0x7655f30 in MethodBind4R<Error, Object*, StringName const&, Variant const&, _Thread::Priority>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:3325
    #5 0x7026b35 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:922
    #6 0x7180f2b in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1128
    #7 0x1708fe2 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1102
    #8 0x16372fa in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
    #9 0x7026886 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
    #10 0x7180f2b in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1128
    #11 0x1708f59 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1099
    #12 0x16372fa in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
    #13 0x7026886 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
    #14 0x7180f2b in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1128
    #15 0x1708f59 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1099
    #16 0x16372fa in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1237
    #17 0x7026886 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:901
    #18 0x700fe3a in MessageQueue::_call_function(Object*, StringName const&, Variant const*, int, bool) core/message_queue.cpp:250
    #19 0x70105e5 in MessageQueue::flush() core/message_queue.cpp:297
    #20 0x4d1b1e7 in SceneTree::iteration(float) scene/main/scene_tree.cpp:483
    #21 0x14e1ab1 in Main::iteration() main/main.cpp:2084
    #22 0x14643d9 in OS_X11::run() platform/x11/os_x11.cpp:3233
    #23 0x1436a55 in main platform/x11/godot_x11.cpp:56
    #24 0x7ffff6ada0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free core/variant_op.cpp:463 in Variant::evaluate(Variant::Operator const&, Variant const&, Variant const&, Variant&, bool&)
Shadow bytes around the buggy address:
  0x0c1080136d60: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1080136d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080136d80: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1080136d90: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1080136da0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c1080136db0: fa fa fa fa fd fd fd fd fd fd fd fd fd[fd]fd fd
  0x0c1080136dc0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c1080136dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080136de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080136df0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080136e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3370563==ABORTING
```

**Steps to reproduce:**
Create a `tool` script where you instance a packed scene using a background thread. The map used to store exports is not thread safe.

**Minimal reproduction project:**
<!-- A small Godot project which reproduces the issue. Drag and drop a zip archive to upload it. -->
[tool_threads_repro.zip](https://github.com/godotengine/godot/files/5296058/tool_threads_repro.zip)