Crash with target=release in CSGBrushOperation::merge_brushes

[slapin]

With latest master when I use a few CSGBoxes I see this crash:
(Linux, latest master)

Thread 1 "godot.x11.opt.6" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51	../sysdeps/unix/sysv/linux/raise.c: Нет такого файла или каталога.
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff50a4231 in __GI_abort () at abort.c:79
#2  0x00007ffff50e57b7 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff51ee0f3 "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007ffff50ebd5a in malloc_printerr (str=str@entry=0x7ffff51efd70 "free(): invalid next size (fast)") at malloc.c:5350
#4  0x00007ffff50ed608 in _int_free (av=0x7ffff5422c40 <main_arena>, p=0x926fc00, have_lock=<optimized out>) at malloc.c:4213
#5  0x000000000073dd1c in merge_brushes () at modules/csg/csg.cpp:1333
#6  0x00000000004a1c42 in _get_brush () at modules/csg/csg_shape.cpp:129
#7  0x00000000004aeb5f in _update_shape () at modules/csg/csg_shape.cpp:172
#8  0x0000000000482789 in call () at ./core/method_bind.gen.inc:54
#9  0x000000000175e5ec in call () at core/object.cpp:918
#10 0x00000000017f9444 in _call_function () at core/message_queue.cpp:260
#11 0x00000000017f982f in flush () at core/message_queue.cpp:305
#12 0x0000000000baccbc in iteration () at scene/main/scene_tree.cpp:476
#13 0x00000000004323ac in iteration () at main/main.cpp:1776
#14 0x000000000041e611 in run () at platform/x11/os_x11.cpp:2632
#15 0x000000000041076d in main () at platform/x11/godot_x11.cpp:55

[akien-mga]

Can you build with target=release debug_symbols=full (and make sure not to strip the binary of course) to get more details in the stacktrace?

[slapin]

Did that:

Thread 1 "godot.x11.opt.6" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51	../sysdeps/unix/sysv/linux/raise.c: Нет такого файла или каталога.
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff50a4231 in __GI_abort () at abort.c:79
#2  0x00007ffff50e57b7 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff51ee0f3 "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007ffff50ebd5a in malloc_printerr (str=str@entry=0x7ffff51efd70 "free(): invalid next size (fast)") at malloc.c:5350
#4  0x00007ffff50ed608 in _int_free (av=0x7ffff5422c40 <main_arena>, p=0x926e720, have_lock=<optimized out>) at malloc.c:4213
#5  0x000000000073dd1c in CSGBrushOperation::merge_brushes (this=this@entry=0x7fffffffd590, p_operation=p_operation@entry=CSGBrushOperation::OPERATION_UNION, p_A=..., p_B=..., result=..., p_snap=<optimized out>) at modules/csg/csg.cpp:1333
#6  0x00000000004a1c42 in CSGShape::_get_brush (this=this@entry=0x5df02f0) at modules/csg/csg_shape.cpp:129
#7  0x00000000004aeb5f in CSGShape::_update_shape (this=0x5df02f0) at modules/csg/csg_shape.cpp:172
#8  0x0000000000482789 in MethodBind0::call (this=<optimized out>, p_object=<optimized out>, p_args=<optimized out>, p_arg_count=<optimized out>, r_error=...) at ./core/method_bind.gen.inc:54
#9  0x000000000175e60c in Object::call (this=0x5df02f0, p_method=..., p_args=0x0, p_argcount=0, r_error=...) at core/object.cpp:918
#10 0x00000000017f9464 in MessageQueue::_call_function (this=this@entry=0x23997e0, p_target=0x5df02f0, p_func=..., p_args=p_args@entry=0x7ffff7e8a050, p_argcount=0, p_show_error=<optimized out>) at core/message_queue.cpp:260
#11 0x00000000017f984f in MessageQueue::flush (this=0x23997e0) at core/message_queue.cpp:305
#12 0x0000000000baccbc in SceneTree::iteration (this=0x35fc9b0, p_time=0.0166666675) at scene/main/scene_tree.cpp:476
#13 0x00000000004323ac in Main::iteration () at main/main.cpp:1776
#14 0x000000000041e611 in OS_X11::run (this=this@entry=0x7fffffffdb80) at platform/x11/os_x11.cpp:2632
#15 0x000000000041076d in main (argc=1, argv=0x7fffffffe178) at platform/x11/godot_x11.cpp:55

[slapin]

I need to mention if it was not clear, that if I build with target=release_debug (and tools not disabled) this problem does not occur.