"Previously Freed Instance" Error when loading Custom Resource from File.

[AureaFUNSoft]

Godot version:

Godot 3.3 rc 7

OS/device including version:

Issue description:

This project produces error when loading file.
Note: This project was working perfectly on latest stable (Godot 3.2.3)

Steps to reproduce:

1. Open the project folder, then Run it.
2. Type something on Line Edit
3. Press save, and wait a second for godot to save the file.
4. Press clear to clear the line edit
5. Press load to load the file
6. Error.

Minimal reproduction project:

CustomResourceSave.zip

[qarmin]

Crash shows this errors

pure virtual method called
terminate called without an active exception
Aborted (core dumped)

or this with address sanitizer

==61648==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000030cc8 at pc 0x000011574728 bp 0x7ffe3c72c960 sp 0x7ffe3c72c950
WRITE of size 8 at 0x614000030cc8 thread T0
    #0 0x11574727 in Object::set_script(RefPtr const&) core/object.cpp:1027
    #1 0x11561c93 in Object::set(StringName const&, Variant const&, bool*) core/object.cpp:433
    #2 0x11e11998 in decode_variant(Variant&, unsigned char const*, int, int*, bool) core/io/marshalls.cpp:446
    #3 0x120db643 in _File::get_var(bool) const core/bind/core_bind.cpp:2312
    #4 0x121dbe08 in MethodBind1RC<Variant, bool>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:1333
    #5 0x11571289 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:919
    #6 0x117f789f in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1149
    #7 0x1d997c6 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1083
    #8 0x1bc9fd5 in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1208
    #9 0x11570df9 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:898
    #10 0x1157b0ea in Object::emit_signal(StringName const&, Variant const**, int) core/object.cpp:1246
    #11 0x1157d120 in Object::emit_signal(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) core/object.cpp:1303
    #12 0xc3ad357 in BaseButton::_pressed() scene/gui/base_button.cpp:135
    #13 0xc3b1169 in BaseButton::on_action_event(Ref<InputEvent>) scene/gui/base_button.cpp:169
    #14 0xc3a9c8d in BaseButton::_gui_input(Ref<InputEvent>) scene/gui/base_button.cpp:64
    #15 0x90730c2 in MethodBind1<Ref<InputEvent> >::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:775
    #16 0x1156cd76 in Object::call_multilevel(StringName const&, Variant const**, int) core/object.cpp:761
    #17 0x1156fe72 in Object::call_multilevel(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) core/object.cpp:861
    #18 0xc293336 in Viewport::_gui_call_input(Control*, Ref<InputEvent> const&) scene/main/viewport.cpp:1716
    #19 0xc2a22ed in Viewport::_gui_input_event(Ref<InputEvent>) scene/main/viewport.cpp:2103
    #20 0xc2c777a in Viewport::input(Ref<InputEvent> const&) scene/main/viewport.cpp:2923
    #21 0xc286e3d in Viewport::_vp_input(Ref<InputEvent> const&) scene/main/viewport.cpp:1481
    #22 0x270543e in MethodBind1<Ref<InputEvent> const&>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:775
    #23 0x11571289 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:919
    #24 0x1156f8a3 in Object::call(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) core/object.cpp:845
    #25 0xc1714d1 in SceneTree::call_group_flags(unsigned int, StringName const&, StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) scene/main/scene_tree.cpp:276
    #26 0xc17697b in SceneTree::input_event(Ref<InputEvent> const&) scene/main/scene_tree.cpp:432
    #27 0x1836c65 in InputDefault::_parse_input_event_impl(Ref<InputEvent> const&, bool) main/input_default.cpp:455
    #28 0x182c2b7 in InputDefault::parse_input_event(Ref<InputEvent> const&) main/input_default.cpp:272
    #29 0x18405fb in InputDefault::flush_accumulated_events() main/input_default.cpp:691
    #30 0x17a9582 in OS_X11::process_xevents() platform/x11/os_x11.cpp:2896
    #31 0x17c0a51 in OS_X11::run() platform/x11/os_x11.cpp:3637
    #32 0x172cefb in main platform/x11/godot_x11.cpp:56
    #33 0x7f3dfdba60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #34 0x172cb1d in _start (/usr/bin/godots+0x172cb1d)

0x614000030cc8 is located 136 bytes inside of 400-byte region [0x614000030c40,0x614000030dd0)
freed by thread T0 here:
    #0 0x7f3dfed1f1b7 in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xb01b7)
    #1 0x11ab5cbc in Memory::free_static(void*, bool) core/os/memory.cpp:178
    #2 0x17f1493 in void memdelete<Reference>(Reference*) core/os/memory.h:119
    #3 0x17e231c in Ref<Reference>::unref() core/reference.h:279
    #4 0x1163cef6 in RefPtr::unref() core/ref_ptr.cpp:90
    #5 0x1178b122 in Variant::clear() core/variant.cpp:1129
    #6 0x172d3df in Variant::~Variant() core/variant.h:444
    #7 0x1dab788 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:271
    #8 0x1ba6464 in GDScript::_create_instance(Variant const**, int, Object*, bool, Variant::CallError&) modules/gdscript/gdscript.cpp:108
    #9 0x1baccba in GDScript::instance_create(Object*) modules/gdscript/gdscript.cpp:324
    #10 0x115746aa in Object::set_script(RefPtr const&) core/object.cpp:1027
    #11 0x11561c93 in Object::set(StringName const&, Variant const&, bool*) core/object.cpp:433
    #12 0x11e11998 in decode_variant(Variant&, unsigned char const*, int, int*, bool) core/io/marshalls.cpp:446
    #13 0x120db643 in _File::get_var(bool) const core/bind/core_bind.cpp:2312
    #14 0x121dbe08 in MethodBind1RC<Variant, bool>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:1333
    #15 0x11571289 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:919
    #16 0x117f789f in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1149
    #17 0x1d997c6 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1083
    #18 0x1bc9fd5 in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1208
    #19 0x11570df9 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:898
    #20 0x1157b0ea in Object::emit_signal(StringName const&, Variant const**, int) core/object.cpp:1246
    #21 0x1157d120 in Object::emit_signal(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) core/object.cpp:1303
    #22 0xc3ad357 in BaseButton::_pressed() scene/gui/base_button.cpp:135
    #23 0xc3b1169 in BaseButton::on_action_event(Ref<InputEvent>) scene/gui/base_button.cpp:169
    #24 0xc3a9c8d in BaseButton::_gui_input(Ref<InputEvent>) scene/gui/base_button.cpp:64
    #25 0x90730c2 in MethodBind1<Ref<InputEvent> >::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:775
    #26 0x1156cd76 in Object::call_multilevel(StringName const&, Variant const**, int) core/object.cpp:761
    #27 0x1156fe72 in Object::call_multilevel(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) core/object.cpp:861
    #28 0xc293336 in Viewport::_gui_call_input(Control*, Ref<InputEvent> const&) scene/main/viewport.cpp:1716
    #29 0xc2a22ed in Viewport::_gui_input_event(Ref<InputEvent>) scene/main/viewport.cpp:2103

previously allocated by thread T0 here:
    #0 0x7f3dfed1f517 in malloc (/lib/x86_64-linux-gnu/libasan.so.6+0xb0517)
    #1 0x11ab4c7d in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:82
    #2 0x11ab4b8e in operator new(unsigned long, char const*) core/os/memory.cpp:42
    #3 0x11681ce2 in Object* ClassDB::creator<Resource>() core/class_db.h:143
    #4 0x112f3a4c in ClassDB::instance(StringName const&) core/class_db.cpp:559
    #5 0x11e11170 in decode_variant(Variant&, unsigned char const*, int, int*, bool) core/io/marshalls.cpp:415
    #6 0x120db643 in _File::get_var(bool) const core/bind/core_bind.cpp:2312
    #7 0x121dbe08 in MethodBind1RC<Variant, bool>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:1333
    #8 0x11571289 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:919
    #9 0x117f789f in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1149
    #10 0x1d997c6 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1083
    #11 0x1bc9fd5 in GDScriptInstance::call(StringName const&, Variant const**, int, Variant::CallError&) modules/gdscript/gdscript.cpp:1208
    #12 0x11570df9 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:898
    #13 0x1157b0ea in Object::emit_signal(StringName const&, Variant const**, int) core/object.cpp:1246
    #14 0x1157d120 in Object::emit_signal(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) core/object.cpp:1303
    #15 0xc3ad357 in BaseButton::_pressed() scene/gui/base_button.cpp:135
    #16 0xc3b1169 in BaseButton::on_action_event(Ref<InputEvent>) scene/gui/base_button.cpp:169
    #17 0xc3a9c8d in BaseButton::_gui_input(Ref<InputEvent>) scene/gui/base_button.cpp:64
    #18 0x90730c2 in MethodBind1<Ref<InputEvent> >::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:775
    #19 0x1156cd76 in Object::call_multilevel(StringName const&, Variant const**, int) core/object.cpp:761
    #20 0x1156fe72 in Object::call_multilevel(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) core/object.cpp:861
    #21 0xc293336 in Viewport::_gui_call_input(Control*, Ref<InputEvent> const&) scene/main/viewport.cpp:1716
    #22 0xc2a22ed in Viewport::_gui_input_event(Ref<InputEvent>) scene/main/viewport.cpp:2103
    #23 0xc2c777a in Viewport::input(Ref<InputEvent> const&) scene/main/viewport.cpp:2923
    #24 0xc286e3d in Viewport::_vp_input(Ref<InputEvent> const&) scene/main/viewport.cpp:1481
    #25 0x270543e in MethodBind1<Ref<InputEvent> const&>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:775
    #26 0x11571289 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:919
    #27 0x1156f8a3 in Object::call(StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) core/object.cpp:845
    #28 0xc1714d1 in SceneTree::call_group_flags(unsigned int, StringName const&, StringName const&, Variant const&, Variant const&, Variant const&, Variant const&, Variant const&) scene/main/scene_tree.cpp:276
    #29 0xc17697b in SceneTree::input_event(Ref<InputEvent> const&) scene/main/scene_tree.cpp:432

SUMMARY: AddressSanitizer: heap-use-after-free core/object.cpp:1027 in Object::set_script(RefPtr const&)

I'm curious if fixing #46120 will fix this either

[AureaFUNSoft]

Hello, how is this bug going? I still can reproduce it on the latest version (3.3.2)

I'm having problem upgrading my project to 3.3.x because of this bug, now I still release my game Demo with 3.2.3

Am I missing something to save custom resource as file? Or is there any workaround to fix this?

[AureaFUNSoft]

@qarmin Or maybe label this as regression because the example project is running without problem on version 3.2.3

[Calinou]

Remember that since Godot 3.3, freed objects no longer decay to null in debug builds (as stated in the changelog). You may have to change your code accordingly.

[akien-mga]

Tested still reproducible in 3.5.3-stable and 3.x fe7ed98.

I'm curious if fixing #46120 will fix this either

Good hunch, but backporting that patch didn't solve it in my tests.