Array modifier crash #47644

New Issue

Jason van Gumster · 2016-03-01T16:58:05+01:00

Jason van Gumster commented

2016-03-01 16:58:05 +01:00

System Information
Arch Linux, Quadro K5000M

Blender Version
Broken: Master (as of hash 50500a4)

Short description of error
In a specific file (attached) a with a chain of array modifiers, applying the second modifier causes a hard crash. The following is a GDB backtrace of the crash:

Thread 19 "blender" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffcb354700 (LWP 9094)]
0x00007fffeca592a8 in raise () from /usr/lib/libc.so.6
(gdb) bt
- 0  0x00007fffeca592a8 in raise () from /usr/lib/libc.so.6
- 1  0x00007fffeca5a72a in abort () from /usr/lib/libc.so.6
- 2  0x00007fffeca95369 in __libc_message () from /usr/lib/libc.so.6
- 3  0x00007fffeca9ad96 in malloc_printerr () from /usr/lib/libc.so.6
- 4  0x00007fffeca9b029 in malloc_consolidate () from /usr/lib/libc.so.6
- 5  0x00007fffeca9cc90 in _int_malloc () from /usr/lib/libc.so.6
- 6  0x00007fffeca9f41a in calloc () from /usr/lib/libc.so.6
- 7  0x00000000032c635b in MEM_lockfree_callocN (len=1864,
    str=0x51b4b38 <__func__.35137> "CDDM_from_mesh")
    at /home/jason_vangumster/src/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:286
#8  0x0000000002b910d4 in cdDM_create (
    desc=0x51b4b38 <__func__.35137> "CDDM_from_mesh")
    at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/cdderivedmesh.c:1967
#9  0x0000000002b91700 in CDDM_from_mesh (mesh=0x8d45968)
    at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/cdderivedmesh.c:2068
#10 0x0000000002b59e9d in mesh_calc_modifiers (scene=0x8d3bf18, ob=0x8d41198,
    inputVertexCos=0x0, useRenderParams=false, useDeform=1,
    need_mapping=false, dataMask=637779977, index=-1, useCache=true,
    build_shapekey_layers=false, allow_gpu=true, r_deform=0x8d416a8,
    r_final=0x8d416b0)
    at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/DerivedMesh.c:1831
#11 0x0000000002b5c658 in mesh_build_data (scene=0x8d3bf18, ob=0x8d41198,
    dataMask=637779977, build_shapekey_layers=false, need_mapping=false)
    at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/DerivedMesh.c:2576
#12 0x0000000002b5ca3b in makeDerivedMesh (scene=0x8d3bf18, ob=0x8d41198,
    em=0x0, dataMask=637779977, build_shapekey_layers=false)
    at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/DerivedMesh.c:2673
#13 0x0000000002cddedb in BKE_object_handle_data_update (eval_ctx=0x70624b8,
    scene=0x8d3bf18, ob=0x8d41198)
    at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/object_update.c:201
#14 0x0000000002cd47eb in BKE_object_handle_update_ex (eval_ctx=0x70624b8,
    scene=0x8d3bf18, ob=0x8d41198, rbw=0x0, do_proxy_update=false)
    at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/object.c:3163
#15 0x0000000002d37194 in scene_update_object_func (pool=0x8d419c8,
    taskdata=0x73f7308, threadid=6)
    at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/scene.c:1520
#16 0x00000000030bc500 in task_scheduler_thread_run (thread_p=0x8c40308)
    at /home/jason_vangumster/src/blender/blender/source/blender/blenlib/intern/task.c:196
- 17 0x00007fffecfd2424 in start_thread () from /usr/lib/libpthread.so.0
- 18 0x00007fffecb0dcbd in clone () from /usr/lib/libc.so.6

Exact steps for others to reproduce the error

Open attached file
Apply first array modifier (labeled "tile")
Apply second array modifier (labeled "x")

If Blender doesn't crash at 2, it should certainly crash at 3.
array_crash.blend

**System Information** Arch Linux, Quadro K5000M **Blender Version** Broken: Master (as of hash 50500a4) **Short description of error** In a specific file (attached) a with a chain of array modifiers, applying the second modifier causes a hard crash. The following is a GDB backtrace of the crash: ``` Thread 19 "blender" received signal SIGABRT, Aborted. [Switching to Thread 0x7fffcb354700 (LWP 9094)] 0x00007fffeca592a8 in raise () from /usr/lib/libc.so.6 (gdb) bt - 0 0x00007fffeca592a8 in raise () from /usr/lib/libc.so.6 - 1 0x00007fffeca5a72a in abort () from /usr/lib/libc.so.6 - 2 0x00007fffeca95369 in __libc_message () from /usr/lib/libc.so.6 - 3 0x00007fffeca9ad96 in malloc_printerr () from /usr/lib/libc.so.6 - 4 0x00007fffeca9b029 in malloc_consolidate () from /usr/lib/libc.so.6 - 5 0x00007fffeca9cc90 in _int_malloc () from /usr/lib/libc.so.6 - 6 0x00007fffeca9f41a in calloc () from /usr/lib/libc.so.6 - 7 0x00000000032c635b in MEM_lockfree_callocN (len=1864, str=0x51b4b38 <__func__.35137> "CDDM_from_mesh") at /home/jason_vangumster/src/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:286 #8 0x0000000002b910d4 in cdDM_create ( desc=0x51b4b38 <__func__.35137> "CDDM_from_mesh") at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/cdderivedmesh.c:1967 #9 0x0000000002b91700 in CDDM_from_mesh (mesh=0x8d45968) at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/cdderivedmesh.c:2068 #10 0x0000000002b59e9d in mesh_calc_modifiers (scene=0x8d3bf18, ob=0x8d41198, inputVertexCos=0x0, useRenderParams=false, useDeform=1, need_mapping=false, dataMask=637779977, index=-1, useCache=true, build_shapekey_layers=false, allow_gpu=true, r_deform=0x8d416a8, r_final=0x8d416b0) at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/DerivedMesh.c:1831 #11 0x0000000002b5c658 in mesh_build_data (scene=0x8d3bf18, ob=0x8d41198, dataMask=637779977, build_shapekey_layers=false, need_mapping=false) at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/DerivedMesh.c:2576 #12 0x0000000002b5ca3b in makeDerivedMesh (scene=0x8d3bf18, ob=0x8d41198, em=0x0, dataMask=637779977, build_shapekey_layers=false) at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/DerivedMesh.c:2673 #13 0x0000000002cddedb in BKE_object_handle_data_update (eval_ctx=0x70624b8, scene=0x8d3bf18, ob=0x8d41198) at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/object_update.c:201 #14 0x0000000002cd47eb in BKE_object_handle_update_ex (eval_ctx=0x70624b8, scene=0x8d3bf18, ob=0x8d41198, rbw=0x0, do_proxy_update=false) at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/object.c:3163 #15 0x0000000002d37194 in scene_update_object_func (pool=0x8d419c8, taskdata=0x73f7308, threadid=6) at /home/jason_vangumster/src/blender/blender/source/blender/blenkernel/intern/scene.c:1520 #16 0x00000000030bc500 in task_scheduler_thread_run (thread_p=0x8c40308) at /home/jason_vangumster/src/blender/blender/source/blender/blenlib/intern/task.c:196 - 17 0x00007fffecfd2424 in start_thread () from /usr/lib/libpthread.so.0 - 18 0x00007fffecb0dcbd in clone () from /usr/lib/libc.so.6 ``` **Exact steps for others to reproduce the error** 1. Open attached file 2. Apply first array modifier (labeled "tile") 3. Apply second array modifier (labeled "x") If Blender doesn't crash at 2, it should certainly crash at 3. [array_crash.blend](https://archive.blender.org/developer/F286521/array_crash.blend)

Jason van Gumster commented

2016-03-01 16:58:05 +01:00

Changed status to: 'Open'

Jason van Gumster commented

2016-03-01 16:58:05 +01:00

Added subscriber: @JasonvanGumster

blender-admin commented

2016-03-01 16:58:05 +01:00

#47678 was marked as duplicate of this issue

Kévin Dietrich commented

2016-03-01 17:25:52 +01:00

Added subscriber: @kevindietrich

Campbell Barton was assigned by Kévin Dietrich

2016-03-01 17:25:52 +01:00

Kévin Dietrich commented

2016-03-01 17:25:52 +01:00

According to asan, this is caused by 7a74738914. Issue seems to be that the mesh's boundbox is freed in DM_to_mesh, but it could be that the mesh already had a boundbox allocated, in which case we shouldn't free it since we're doing a local copy of the mesh and later on memcpy back (and thus mempcy an invalid pointer). Hopefully, my explanation makes sense :) Here's a quick patch, maybe the function needs a refactor:

diff --git a/source/blender/blenkernel/intern/DerivedMesh.c b/source/blender/blenkernel/intern/DerivedMesh.c
index 252cee9..94cf4fe 100644
--- a/source/blender/blenkernel/intern/DerivedMesh.c
+++ b/source/blender/blenkernel/intern/DerivedMesh.c
@@ -690,6 +690,11 @@ void DM_to_mesh(DerivedMesh *dm, Mesh *me, Object *ob, CustomDataMask mask, bool
 {
        /* dm might depend on me, so we need to do everything with a local copy */
        Mesh tmp = *me;
+
+       /* me->bb might get allocated here, so only free if it wasn't there it the
+        * first place. */
+       const bool bb_needs_free = (me->bb == NULL);
+
        int totvert, totedge /*, totface */ /* UNUSED */, totloop, totpoly;
        int did_shapekeys = 0;
        int alloctype = CD_DUPLICATE;
@@ -813,7 +818,7 @@ void DM_to_mesh(DerivedMesh *dm, Mesh *me, Object *ob, CustomDataMask mask, bool
        if (me->mselect) {
                MEM_freeN(me->mselect);
        }
-       if (me->bb) {
+       if (bb_needs_free && me->bb) {
                MEM_freeN(me->bb);
        }

And for completeness, here the asan ouput: http://www.pasteall.org/65567

According to asan, this is caused by 7a74738914. Issue seems to be that the mesh's boundbox is freed in `DM_to_mesh`, but it could be that the mesh already had a boundbox allocated, in which case we shouldn't free it since we're doing a local copy of the mesh and later on memcpy back (and thus mempcy an invalid pointer). Hopefully, my explanation makes sense :) Here's a quick patch, maybe the function needs a refactor: ``` diff --git a/source/blender/blenkernel/intern/DerivedMesh.c b/source/blender/blenkernel/intern/DerivedMesh.c index 252cee9..94cf4fe 100644 --- a/source/blender/blenkernel/intern/DerivedMesh.c +++ b/source/blender/blenkernel/intern/DerivedMesh.c @@ -690,6 +690,11 @@ void DM_to_mesh(DerivedMesh *dm, Mesh *me, Object *ob, CustomDataMask mask, bool { /* dm might depend on me, so we need to do everything with a local copy */ Mesh tmp = *me; + + /* me->bb might get allocated here, so only free if it wasn't there it the + * first place. */ + const bool bb_needs_free = (me->bb == NULL); + int totvert, totedge /*, totface */ /* UNUSED */, totloop, totpoly; int did_shapekeys = 0; int alloctype = CD_DUPLICATE; @@ -813,7 +818,7 @@ void DM_to_mesh(DerivedMesh *dm, Mesh *me, Object *ob, CustomDataMask mask, bool if (me->mselect) { MEM_freeN(me->mselect); } - if (me->bb) { + if (bb_needs_free && me->bb) { MEM_freeN(me->bb); } ``` ----- And for completeness, here the asan ouput: http://www.pasteall.org/65567

Ray molenkamp commented

2016-03-01 17:28:01 +01:00

Added subscriber: @LazyDodo

Ray molenkamp commented

2016-03-01 17:28:01 +01:00

It's a use after free bug,

https://git.blender.org/gitweb/gitweb.cgi/blender.git/blob/HEAD:/source/blender/blenkernel/intern/DerivedMesh.c#l817

me->bb gets freed here, but not set to null , later bits in the code check for null and access the fields

Same might apply to me->mselect at line 814?

It's a use after free bug, https://git.blender.org/gitweb/gitweb.cgi/blender.git/blob/HEAD:/source/blender/blenkernel/intern/DerivedMesh.c#l817 me->bb gets freed here, but not set to null , later bits in the code check for null and access the fields Same might apply to me->mselect at line 814?

Ray molenkamp commented

2016-03-01 17:31:13 +01:00

kevindietrich beat me by a good minute :)

Bastien Montagne commented

2016-03-01 17:52:52 +01:00

Added subscriber: @mont29

Bastien Montagne commented

2016-03-01 17:52:52 +01:00

Hmmm… odd, with current master here, cannot reproduce the crash (linux64, using debug build with asan enabled), can apply the three modifiers with no problem.