godot: queue_free crashing physics server

Operating system or device - Godot version: Linux (Arch) x64 - Godot master

Issue description (what happened, and what was expected): When using queue_free in _integrate_forces or anywhere else on a RigidBody2D/KinematicBody2D (even if it is set to MODE_STATIC, with layer/collision mask == 0), the game would crash from time to time… seemingly without reason. This is pretty much a blocker for “me”, since it makes bullets nearly impossible to do properly.

Steps to reproduce: Run https://github.com/KOBUGE-Incubator/ringed (https://github.com/KOBUGE-Incubator/ringed/commit/7fecca7fb54c8635cb30ea83fe13440c4b488e9a in case something changes), and start shooting… at some point in time, the game would crash (you might have to die a few zillion times before, but it is granted to happen). Now, retry with an older version, and see it doesn’t happen there (good luck 😉)

GDB backtraces:

#0  0x00000000015e655c in Space2DSW::get_body_angular_velocity_sleep_treshold (this=0x0) at servers/physics_2d/space_2d_sw.h:162
#1  0x00000000015e4c63 in Body2DSW::sleep_test (this=0x5b99040, p_step=0.0166666675) at servers/physics_2d/body_2d_sw.cpp:642
#2  0x00000000015ee3e2 in Step2DSW::_check_suspend (this=0x341c270, p_island=0x5b99040, p_delta=0.0166666675) at servers/physics_2d/step_2d_sw.cpp:110
#3  0x00000000015eeacc in Step2DSW::step (this=0x341c270, p_space=0x3946120, p_delta=0.0166666675, p_iterations=8) at servers/physics_2d/step_2d_sw.cpp:308
#4  0x00000000015da3f5 in Physics2DServerSW::step (this=0x34204e0, p_step=0.0166666675) at servers/physics_2d/physics_2d_server_sw.cpp:1277
#5  0x0000000001664df5 in Physics2DServerWrapMT::step (this=0x7fffe8265030, p_step=0.0166666675) at servers/physics_2d/physics_2d_server_wrap_mt.cpp:86
#6  0x00000000004327bf in Main::iteration () at main/main.cpp:1587
#7  0x0000000000416311 in OS_X11::run (this=0x7fffffffe020) at platform/x11/os_x11.cpp:1921
#8  0x000000000040e9f0 in main (argc=1, argv=0x7fffffffe538) at platform/x11/godot_x11.cpp:41

Or:

#0  0x00000000015edbfb in Comparator<Constraint2DSW*>::operator() (this=0x7fffffffd927, p_a=@0x7fffffffd9b0: 0x4acb980, p_b=@0xc4a3b5dc00000030: <error reading variable>)
    at core/typedefs.h:268
#1  0x00000000015ed40c in Map<Constraint2DSW*, int, Comparator<Constraint2DSW*>, DefaultAllocator>::_find (this=0x52d7960, p_key=@0x7fffffffd9b0: 0x4acb980) at core/map.h:248
#2  0x00000000015ed072 in Map<Constraint2DSW*, int, Comparator<Constraint2DSW*>, DefaultAllocator>::find (this=0x52d7960, p_key=@0x7fffffffd9b0: 0x4acb980) at core/map.h:560
#3  0x00000000015eceeb in Map<Constraint2DSW*, int, Comparator<Constraint2DSW*>, DefaultAllocator>::operator[] (this=0x52d7960, p_key=@0x7fffffffd9b0: 0x4acb980) at core/map.h:627
#4  0x00000000015eccdd in Body2DSW::add_constraint (this=0x52d77f0, p_constraint=0x4acb980, p_pos=1) at servers/physics_2d/body_2d_sw.h:188
#5  0x000000000168bb42 in BodyPair2DSW::BodyPair2DSW (this=0x4acb980, p_A=0x42f18a0, p_shape_A=0, p_B=0x52d77f0, p_shape_B=0) at servers/physics_2d/body_pair_2d_sw.cpp:537
#6  0x00000000016868b6 in Space2DSW::_broadphase_pair (A=0x42f18a0, p_subindex_A=0, B=0x52d77f0, p_subindex_B=0, p_self=0x3945f90) at servers/physics_2d/space_2d_sw.cpp:1129
#7  0x000000000167bcfc in BroadPhase2DHashGrid::_check_motion (this=0x3911fc0, p_elem=0x41c1398) at servers/physics_2d/broad_phase_2d_hash_grid.cpp:89
#8  0x000000000167cd82 in BroadPhase2DHashGrid::move (this=0x3911fc0, p_id=2793, p_aabb=...) at servers/physics_2d/broad_phase_2d_hash_grid.cpp:384
#9  0x00000000015e88c4 in CollisionObject2DSW::_update_shapes (this=0x42f18a0) at servers/physics_2d/collision_object_2d_sw.cpp:158
#10 0x00000000015e54f8 in CollisionObject2DSW::_set_transform (this=0x42f18a0, p_transform=..., p_update_shapes=true) at servers/physics_2d/collision_object_2d_sw.h:80
#11 0x00000000015e47f1 in Body2DSW::integrate_velocities (this=0x42f18a0, p_step=0.0166666675) at servers/physics_2d/body_2d_sw.cpp:562
#12 0x00000000015eea86 in Step2DSW::step (this=0x341c170, p_space=0x3945f90, p_delta=0.0166666675, p_iterations=8) at servers/physics_2d/step_2d_sw.cpp:298
#13 0x00000000015da3f5 in Physics2DServerSW::step (this=0x34203e0, p_step=0.0166666675) at servers/physics_2d/physics_2d_server_sw.cpp:1277
#14 0x0000000001664df5 in Physics2DServerWrapMT::step (this=0x7fffe8265030, p_step=0.0166666675) at servers/physics_2d/physics_2d_server_wrap_mt.cpp:86
#15 0x00000000004327bf in Main::iteration () at main/main.cpp:1587
#16 0x0000000000416311 in OS_X11::run (this=0x7fffffffe020) at platform/x11/os_x11.cpp:1921
#17 0x000000000040e9f0 in main (argc=1, argv=0x7fffffffe538) at platform/x11/godot_x11.cpp:41

Or:

#0  0x0000000001687290 in CollisionObject2DSW::get_type (this=0x13e013600) at servers/physics_2d/collision_object_2d_sw.h:98
#1  0x0000000001686734 in Space2DSW::_broadphase_pair (A=0x461f640, p_subindex_A=0, B=0x13e013600, p_subindex_B=-1057153242, p_self=0x3945ed0) at servers/physics_2d/space_2d_sw.cpp:1099
[didn't save rest :/]

Bisect output:

$ git bisect log
git bisect start 'servers'
# bad: [dabcabe9815612c7ef1c99909b14d632f13df165] Merge pull request #6658 from Faless/fix_bo_network
git bisect bad dabcabe9815612c7ef1c99909b14d632f13df165
# good: [9e2b9f8cb1c34fe7c3aa91bdd7f40ebb6a1a318f] bump to stable, congratulations everyone
git bisect good 9e2b9f8cb1c34fe7c3aa91bdd7f40ebb6a1a318f
# good: [64b4253dbfe3fdfc4efa405086d23765a9774d91] changed visual server free() to free_rid() like in the other servers. Fixes #4917
git bisect good 64b4253dbfe3fdfc4efa405086d23765a9774d91
# bad: [3725114a1658337d6de21bb7a5b6fde5f8a74d1f] Merge pull request #5383 from Ovnuniarchos/OptimizeOneWay
git bisect bad 3725114a1658337d6de21bb7a5b6fde5f8a74d1f
# bad: [b4b80625d175a151f05403c9dcbc5f13be652289] Change hash grid in 2D physics to contemplate large objects as separate cases, to avoid huge memory and performance penalty. Fixes #4662
git bisect bad b4b80625d175a151f05403c9dcbc5f13be652289
# good: [b7dbf9207abf9fb9e4cc46e8e1d67f3d6d40d58c] Drop empty files that are not used anywhere
git bisect good b7dbf9207abf9fb9e4cc46e8e1d67f3d6d40d58c
# good: [c3bf11d4d48c0499460dc294c6836acedbfd46cb] Drop fully commented-out files
git bisect good c3bf11d4d48c0499460dc294c6836acedbfd46cb
# first bad commit: [b4b80625d175a151f05403c9dcbc5f13be652289] Change hash grid in 2D physics to contemplate large objects as separate cases, to avoid huge memory and performance penalty. Fixes #4662

(I might have done something wrong with the bisect, since some of the good might be bad, or some of the bad might be some other bug…)

Anyway. it seems like b4b80625d175a151f05403c9dcbc5f13be652289 is the culprit here, though I have no idea why…