I believe the crash is a stale-lifetime bug in 3D picking.
Viewport::_process_picking() caches last_object / last_id for multiple queued
input events at the same pointer position. If the first _input_event callback
removes the picked CollisionObject3D or current Camera3D from the tree, the next
queued event can still reuse that cached target and call
_collision_object_3d_input_event(), which immediately does get_global_transform
on an object that is no longer safe to query.
The patch does four things:
1. It rejects captured 3D pick targets that are no longer is_inside_tree()
before reuse at viewport.cpp (similar changes exist in the code):
2. It re-fetches the cached same-position object from ObjectDB, verifies it
still matches the cached pointer, and verifies it is still in the tree before
dispatching.
3. It skips _mouse_exit() for a hovered 3D object that has already left the tree
at viewport.cpp.
4. It adds a final guard inside _collision_object_3d_input_event() so even a
future caller cannot query transforms on removed nodes or cameras at
viewport.cpp.
Miguel de Icaza
8a9fd16112