Memory corruption when freeing custom bone shape objects #37709

New Issue

Tom Edwards · 2013-12-05T16:22:34+01:00

Tom Edwards commented

2013-12-05 16:22:34 +01:00

System Information
Win7 x64, GTX 560

Blender Version
Broken: git latest (193dd134)
Worked: unknown

There are memory corruption errors when freeing the custom bone object ("smd_bone_vis") in the attached blend file. They doesn't actually crash Blender, but do cause the Windows debug CRT to raise an exception.

Exact steps for others to reproduce the error

Open the attached file with a debug build, or with the MSVC 11 or 12 debugger attached
Unload the blend (e.g. re-open the file)

Observe console warnings and/or CRT breakpoint

Running the script in the blend to remove the bone shapes eliminates the problem.

**System Information** Win7 x64, GTX 560 **Blender Version** Broken: git latest (193dd134) Worked: unknown There are memory corruption errors when freeing the custom bone object ("smd_bone_vis") in the attached blend file. They doesn't actually crash Blender, but do cause the Windows debug CRT to raise an exception. **Exact steps for others to reproduce the error** - Open the attached file with a debug build, or with the MSVC 11 or 12 debugger attached - Unload the blend (e.g. re-open the file) # Observe console warnings and/or CRT breakpoint Running the script in the blend to remove the bone shapes eliminates the problem.

Tom Edwards commented

2013-12-05 16:22:34 +01:00

Changed status to: 'Open'

Tom Edwards commented

2013-12-05 16:22:34 +01:00

Added subscriber: @artfunkel

Sergey Sharybin commented

2013-12-05 17:56:21 +01:00

Added subscriber: @Sergey

Sergey Sharybin commented

2013-12-05 17:56:21 +01:00

I don't see any issues with the attached file. Also don't see smd_bone_vis object there. Is it that exact file you've been intending to share? :)

Sergey Sharybin commented

2013-12-05 18:00:24 +01:00

Ah, found the object now. It's in "Blend FIle" of outliner but not in "datablocks", which seems a bit strange for me. Also, what does it exactly means "freeing custom bone object"? Just removing it?

Tom Edwards commented

2013-12-05 18:03:13 +01:00

By "freeing custom bone object" I mean that the error occurs while freeing the scene if there are custom bones present. I missed out the all-important repro step #2 of opening a new file, sorry!

Edit: I can't edit the report, even though the error message says that the bug owner always can..?

By "freeing custom bone object" I mean that the error occurs while freeing the scene if there are custom bones present. I missed out the all-important repro step #2 of opening a new file, sorry! Edit: I can't edit the report, even though the error message says that the bug owner always can..?

Tom Edwards commented

2013-12-05 18:19:12 +01:00

Weird that it's not in Datablocks too, it's right there for me.

Campbell Barton commented

2013-12-06 00:42:11 +01:00

Added subscriber: @ideasman42

Campbell Barton commented

2013-12-06 00:42:11 +01:00

Cant redo the bug, tried running the script in bone_shape_crash.blend then removing the scene. No error printed.

Cant redo the bug, tried running the script in `bone_shape_crash.blend` then removing the scene. No error printed.

Tom Edwards commented

2013-12-06 13:07:09 +01:00

Removing the scene won't repro, you need to unload the whole blend file.

Tom Edwards commented

2013-12-06 14:12:31 +01:00

It turns out that the appearance of console errors differs between builds, but the bug remains. Add a breakpoint at action.c:720 (the id_us_min call in BKE_pose_channel_free) and you'll see that pchan->custom has already been freed.

It turns out that the appearance of console errors differs between builds, but the bug remains. Add a breakpoint at action.c:720 (the `id_us_min` call in `BKE_pose_channel_free`) and you'll see that `pchan->custom` has already been freed.

Sergey Sharybin commented

2013-12-06 14:31:20 +01:00

Can indeed see an error in valgrind. We had such kind of issues before, but still not sure what would be the proper way to solve this.