Calling Tween.custom_step() from within a tween freezes the game and produces an unclear fatal C++ error

[HeySora]

Tested versions

• Reproducible in v4.3.stable.mono.official [77dcf97]

System information

Godot v4.3.stable.mono - macOS 15.0.1 - Vulkan (Forward+) - integrated Apple M3 Max - Apple M3 Max (14 Threads)

Issue description

While I'm aware that calling CustomStep() from within a tween can be undefined behavior (I would understand if that particular edge case would be a wontfix!), I still think that a clearer error should be printed, and the game should definitely not freeze.

When CustomStep() is called, this gets printed right before the program crashes:

ERROR: FATAL: Index p_index = 4 is out of bounds (((Vector<T> *)(this))->_cowdata.size() = 3).
   at: operator[] (./core/templates/vector.h:52)

("3" is the amount of tweeners, so it may vary depending on the amount of queued tweens)

Avoiding this issue is as easy as wrapping the CustomStep() call inside a Callable + with CallDeferred().

Steps to reproduce

The smallest code that can crash the game and trigger the above error is:

bool finished = false;
Tween tween = GetTree().CreateTween();
tween.TweenCallback(Callable.From(() =>
{
    if (finished) return;
    finished = true;

    tween.CustomStep(1e9);
}));

(the finished bool is to prevent a stack overflow which would be happening because of that particular tween being called again over and over)

Replacing tween.CustomStep(1e9); with Callable.From(() => { tween.CustomStep(1e9); }).CallDeferred() is enough to fix the issue.

Minimal reproduction project (MRP)

MRP-TweenCrash.zip
(Please note that the error might not even be visible from the Godot editor; you might need to run the game via the terminal or an editor like e.g. Jetbrains Rider)

[timothyqiu]

GDScript version of the MRP: tween.zip

[rsubtil]

Still happening on v4.4.1.stable.mono

The GDScript version reports a stack overflow:

So maybe that's also what's happening from C#, and it isn't being reported properly.

[raulsntos]

It looks like the crash is caused by calling _start_tweeners with a current_step value that goes over tweeners.size(). It looks like the tween finishes, and then I guess the Tween::custom_step API is forcing it to continue past that step limit?

Here's the stack trace:

VectorWriteProxy<List<Ref<Tweener>, DefaultAllocator>>::operator[](long) (/godot/core/templates/vector.h:54)
Tween::_start_tweeners() (/godot/scene/animation/tween.cpp:84)
Tween::step(double) (/godot/scene/animation/tween.cpp:401)
SceneTree::process_tweens(double, bool) (/godot/scene/main/scene_tree.cpp:822)
SceneTree::process(double) (/godot/scene/main/scene_tree.cpp:708)
Main::iteration() (/godot/main/main.cpp:4771)
OS_LinuxBSD::run() (/godot/platform/linuxbsd/os_linuxbsd.cpp:989)
main (/godot/platform/linuxbsd/godot_linuxbsd.cpp:85)
__libc_start_call_main (@__libc_start_call_main:29)
__libc_start_main_impl (@__libc_start_main@@GLIBC_2.34:43)
_start (@_start:15)

The issue seems to be on this code:

godot/scene/animation/tween.cpp

Lines 374 to 403 in 30456ba

	if (!step_active) {
	emit_signal(SNAME("step_finished"), current_step);
	current_step++;
	if (current_step == tweeners.size()) {
	loops_done++;
	if (loops_done == loops) {
	running = false;
	dead = true;
	emit_signal(SceneStringName(finished));
	break;
	} else {
	emit_signal(SNAME("loop_finished"), loops_done);
	current_step = 0;
	_start_tweeners();
	#ifdef DEBUG_ENABLED
	if (loops <= 0 && Math::is_equal_approx(rem_delta, initial_delta)) {
	if (!potential_infinite) {
	potential_infinite = true;
	} else {
	// Looped twice without using any time, this is 100% certain infinite loop.
	ERR_FAIL_V_MSG(false, "Infinite loop detected. Check set_loops() description for more info.");
	}
	}
	#endif
	}
	} else {
	_start_tweeners();
	}
	}

As I'm not familiar with this part of the codebase, it's not clear to me what the proper solution would be.

Maybe we're missing current_step = 0; before the _start_tweeners(); in line 401. Making this change seems to be enough to prevent the crash.

Alternatively, maybe we just need to change one or both of these conditions:

godot/scene/animation/tween.cpp

Line 378 in 30456ba

if (current_step == tweeners.size()) {

godot/scene/animation/tween.cpp

Line 380 in 30456ba

if (loops_done == loops) {

To use >= instead of ==.

cc @KoBeWi

[KoBeWi]

I think the main issue here is that you are stepping the Tween while it's already processing. Since it happens mid-step, the Tween will repeat it infinitely, trying to call the same callback that steps it again.