[3.x] Scene tree dock crashes when using filter in large scenes

[lawnjelly]

Tested versions

3.6 dev 354404d

not present in:
3.6 beta 4
3.6 beta 3
3.6 beta 1
3.5.3
3.5.2

System information

Linux Mint 21.1

Issue description

Using the filter in the editor scene tree dock can cause crashes in large scenes.

Call stack:

1   TreeItem::get_children             tree.cpp              356  0x437fe9c 
2   SceneTreeEditor::_update_filter    scene_tree_editor.cpp 597  0x3b6528b 
3   SceneTreeEditor::_update_filter    scene_tree_editor.cpp 599  0x3b652b2 
4   SceneTreeEditor::_update_filter    scene_tree_editor.cpp 599  0x3b652b2 
5   SceneTreeEditor::_update_tree      scene_tree_editor.cpp 582  0x3b5f655 
6   SceneTreeEditor::set_filter        scene_tree_editor.cpp 994  0x3b568e3 
7   SceneTreeDock::_filter_changed     scene_tree_dock.cpp   3003 0x3b56758 

Steps to reproduce

Load TPS demo.
Open level/geometry/scenes/structure.tscn.
Type 3 or 4 letters into the filter box at the top of the scene tree dock.

Minimal reproduction project (MRP)

N/A

[lawnjelly]

Still bisecting, but likely due to this PR, only one in that area:
#67347

@Mickeon

UPDATE: Confirmed and bisected to #67347

[Mickeon]

heck

Not exactly sure why it does this, even glancing at the code

[AThousandShips]

I'm not sure what's causing this specific issue but there is a possible reference after free, memdelete(p_parent) followed by accessing it later, unsure if !(keep_for_children || keep) also means editor_selection == nullptr

Edit: This is the part I'm referring to, unsure if it's related but it doesn't look safe:

godot/editor/scene_tree_editor.cpp

Lines 621 to 625 in 354404d

	memdelete(p_parent);
	}
	if (editor_selection) {
	Node *n = get_node_or_null(p_parent->get_metadata(0));

[Mickeon]

It's worth noting that the only major difference between 3.x and 4.x is that tree items are freed instead of just hidden, so... Something along those lines may be the cause.

[Mickeon]

I'm trying to reproduce this issue on the latest 3.x (Windows 10 debug build) and TPS demo to no avail.
As a matter of fact I cannot even open structure.tscn, same goes for structure.glb.

 Class 'Material3D' or its base class cannot be instantiated.
 res://level/geometry/models/structure.glb:Resource of unrecognized type in file: Material3D.
 Failed to load resource 'res://.import/structure.glb-21fe3543c920768091702bd640720751.scn'.
 Failed loading resource: res://.import/structure.glb-21fe3543c920768091702bd640720751.scn. Make sure resources have been imported by opening the project in the editor at least once.
 Failed loading resource: res://level/geometry/models/structure.glb. Make sure resources have been imported by opening the project in the editor at least once.
 Class 'Material3D' or its base class cannot be instantiated.
 res://level/geometry/models/structure.glb:Resource of unrecognized type in file: Material3D.
 Failed to load resource 'res://.import/structure.glb-21fe3543c920768091702bd640720751.scn'.
 Failed loading resource: res://.import/structure.glb-21fe3543c920768091702bd640720751.scn. Make sure resources have been imported by opening the project in the editor at least once.
 Failed loading resource: res://level/geometry/models/structure.glb. Make sure resources have been imported by opening the project in the editor at least once.
 scene\resources\resource_format_text.cpp:157 - Couldn't load external resource: res://level/geometry/models/structure.glb
 scene\resources\packed_scene.cpp:165 - Condition "!sdata.is_valid()" is true. Returned: nullp

For any other scene, no issues seem to occur.

[lawnjelly]

This is waiting on #88287 to be merged, which fixes the glb bug (introduced by ORM PR).

You could apply that or work on version before #76023 . I'll see if I can poke akien / hp to merge the fix.

[Mickeon]

Good to know. Honestly I still am not exactly sure on what would cause the crash here.

[akien-mga]

Fixed by #88943.