Crash in GLTFDocument::_parse_meshes when importing TPS demo

[akien-mga]

Tested versions

• Reproducible in 4.3.dev (a586e86)
• Not reproducible in 4.2.1.stable and 4.3.dev3 (36e943b)

System information

Fedora Linux 39 (KDE Plasma) - Wayland - Vulkan (Forward+) - dedicated AMD Radeon RX 7600M XT (RADV NAVI33) () - AMD Ryzen 7 7840HS w/ Radeon 780M Graphics (16 Threads)

Issue description

When importing Godot's own TPS demo in current 4.3 master, I get a crash in the GLTF importer:

ERROR: FATAL: Index p_index = 26 is out of bounds (size() = 24).
   at: get (./core/templates/cowdata.h:205)

================================================================
handle_crash: Program crashed with signal 4
Engine version: Godot Engine v4.3.dev.custom_build (a586e860e5fc382dec4ad9a0bec72f7c6684f020)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] /lib64/libc.so.6(+0x3e9a0) [0x7f7b3677f9a0] (??:0)
[2] CowData<Vector3>::get(long) const (/home/akien/Godot/godot/./core/templates/cowdata.h:205 (discriminator 3))
[3] Vector<Vector3>::operator[](long) const (/home/akien/Godot/godot/./core/templates/vector.h:97)
[4] GLTFDocument::_parse_meshes(Ref<GLTFState>) (/home/akien/Godot/godot/./modules/gltf/gltf_document.cpp:2799 (discriminator 1))
[5] GLTFDocument::_parse_gltf_state(Ref<GLTFState>, String const&) (/home/akien/Godot/godot/./modules/gltf/gltf_document.cpp:6944 (discriminator 1))
[6] GLTFDocument::_parse(Ref<GLTFState>, String, Ref<FileAccess>) (/home/akien/Godot/godot/./modules/gltf/gltf_document.cpp:6599 (discriminator 1))
[7] GLTFDocument::append_from_file(String, Ref<GLTFState>, unsigned int, String) (/home/akien/Godot/godot/./modules/gltf/gltf_document.cpp:7117 (discriminator 4))
[8] EditorSceneFormatImporterGLTF::import_scene(String const&, unsigned int, HashMap<StringName, Variant, HashMapHasherDefault, HashMapComparatorDefault<StringName>, DefaultTypedAllocator<HashMapElement<StringName, Variant> > > const&, List<String, DefaultAllocator>*, Error*) (/home/akien/Godot/godot/./modules/gltf/editor/editor_scene_importer_gltf.cpp:62 (discriminator 4))
[9] ResourceImporterScene::import(String const&, String const&, HashMap<StringName, Variant, HashMapHasherDefault, HashMapComparatorDefault<StringName>, DefaultTypedAllocator<HashMapElement<StringName, Variant> > > const&, List<String, DefaultAllocator>*, List<String, DefaultAllocator>*, Variant*) (/home/akien/Godot/godot/./editor/import/3d/resource_importer_scene.cpp:2500 (discriminator 1))
[10] EditorFileSystem::_reimport_file(String const&, HashMap<StringName, Variant, HashMapHasherDefault, HashMapComparatorDefault<StringName>, DefaultTypedAllocator<HashMapElement<StringName, Variant> > > const&, String const&, Variant*) (/home/akien/Godot/godot/./editor/editor_file_system.cpp:2132 (discriminator 1))
[11] EditorFileSystem::reimport_files(Vector<String> const&) (/home/akien/Godot/godot/./editor/editor_file_system.cpp:2406 (discriminator 4))
[12] EditorFileSystem::_update_scan_actions() (/home/akien/Godot/godot/./editor/editor_file_system.cpp:700)
[13] EditorFileSystem::_notification(int) (/home/akien/Godot/godot/./editor/editor_file_system.cpp:1299)
[14] EditorFileSystem::_notificationv(int, bool) (/home/akien/Godot/godot/./editor/editor_file_system.h:146 (discriminator 14))
[15] Object::notification(int, bool) (/home/akien/Godot/godot/./core/object/object.cpp:849)
[16] SceneTree::_process_group(SceneTree::ProcessGroup*, bool) (/home/akien/Godot/godot/./scene/main/scene_tree.cpp:955)
[17] SceneTree::_process(bool) (/home/akien/Godot/godot/./scene/main/scene_tree.cpp:1027 (discriminator 2))
[18] SceneTree::process(double) (/home/akien/Godot/godot/./scene/main/scene_tree.cpp:512)
[19] Main::iteration() (/home/akien/Godot/godot/main/main.cpp:3992 (discriminator 3))
[20] OS_LinuxBSD::run() (/home/akien/Godot/godot/platform/linuxbsd/os_linuxbsd.cpp:938 (discriminator 1))
[21] /home/akien/Godot/godot/bin/godot.linuxbsd.editor.dev.x86_64(main+0x15a) [0x2abfb10] (/home/akien/Godot/godot/platform/linuxbsd/godot_linuxbsd.cpp:88)
[22] /lib64/libc.so.6(+0x2814a) [0x7f7b3676914a] (??:0)
[23] /lib64/libc.so.6(__libc_start_main+0x8b) [0x7f7b3676920b] (??:0)
[24] /home/akien/Godot/godot/bin/godot.linuxbsd.editor.dev.x86_64(_start+0x25) [0x2abf8f5] (??:?)
-- END OF BACKTRACE --
================================================================
Aborted (core dumped)

It seems to choke on this file in particular: res://level/geometry/models/props.glb, so I'm making a MRP with just that file.

In 4.2.1, the file imports fine, with this warning:

WARNING: Ignoring face with non-finite normal in LOD generation.
     at: generate_lods (scene/resources/importer_mesh.cpp:518)

In 4.3-dev3, the file also imports fine, but this time with a ton of warnings spammed along the lines of these ones:

WARNING: Adding 'scificar_wheeldet3_001' as child to 'Cube_012' will make owner 'props' inconsistent. Consider unsetting the owner beforehand.
     at: add_child (scene/main/node.cpp:1432)
WARNING: Adding 'scificarwheel3_001' as child to 'Cube_012' will make owner 'props' inconsistent. Consider unsetting the owner beforehand.
     at: add_child (scene/main/node.cpp:1432)
WARNING: Adding 'scificar_wheeldet4_001' as child to 'Cube_013' will make owner 'props' inconsistent. Consider unsetting the owner beforehand.
     at: add_child (scene/main/node.cpp:1432)
WARNING: Adding 'scificarwheel4_001' as child to 'Cube_013' will make owner 'props' inconsistent. Consider unsetting the owner beforehand.
     at: add_child (scene/main/node.cpp:1432)

(Might be unrelated to the crash and worth a separate bug report once this is fixed.)

Steps to reproduce

• Download MRP
• Open in Godot

Minimal reproduction project (MRP)

gltf-mesh-crash.zip

[akien-mga]

Bisected to commit 781cd27 / #88738 @clayjohn