Missing null check in outliner_draw.c leads to crash with old userpref.blend #48830

New Issue

Ralf Hölzemer · 2016-07-11T21:40:38+02:00

Ralf Hölzemer commented

2016-07-11 21:40:38 +02:00

System Information
system-info.txt

Blender Version
Broken: c06d3b6
Worked: unknown

Short description of error
When using my own userpref.blend, blender crashes when running the "purge all" operator.

Exact steps for others to reproduce the error

replace your own userpref with the one attached above
open blender, create a cube and then delete it so we have a datablock with no user
switch the display type in the outliner to Orphan Data
press the Purge All button in the header

outliner_purge_crash.diff
Checking tselem->id before that line as in the patch above seems to work fine in my tests, but I am unsure if this is the correct way to deal with this. Maybe the root of the problem lies somewhere else.

Backtrace

Thread 1 "blender" received signal SIGSEGV, Segmentation fault.
tselem_draw_icon (block=block@entry=0x7fffc321c008, xmax=xmax@entry=167, x=111.099998, y=-43.7999992, te=te@entry=0x7fffc2f71b08, alpha=alpha@entry=0.5, tselem=0x7fffcef56070, tselem=0x7fffcef56070, 
    tselem=0x7fffcef56070) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1243
1243		else if (GS(tselem->id->name) == ID_OB) {
(gdb) bt
#0  tselem_draw_icon (block=block@entry=0x7fffc321c008, xmax=xmax@entry=167, x=111.099998, y=-43.7999992, te=te@entry=0x7fffc2f71b08, alpha=alpha@entry=0.5, tselem=0x7fffcef56070, tselem=0x7fffcef56070, 
    tselem=0x7fffcef56070) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1243
#1  0x0000000000a7a6b2 in outliner_draw_iconrow (C=C@entry=0x7fffd20fae88, block=block@entry=0x7fffc321c008, scene=scene@entry=0x7fffc3151008, soops=soops@entry=0x7fffd1668388, level=level@entry=0, xmax=167, 
    offsx=0x7fffffffde40, ys=-46, lb=0x7fffc2f71570) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1395
#2  0x0000000000a7aeb6 in outliner_draw_tree_element (C=C@entry=0x7fffd20fae88, block=block@entry=0x7fffc321c008, fstyle=fstyle@entry=0x7fffcef80db8, scene=scene@entry=0x7fffc3151008, 
    ar=ar@entry=0x7fffcef3d948, soops=soops@entry=0x7fffd1668388, te=0x7fffc2f71558, startx=0, starty=0x7fffffffdef4, te_edit=0x7fffffffdef8)
    at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1625
#3  0x0000000000a7cd65 in outliner_draw_tree (te_edit=0x7fffffffdef8, soops=0x7fffd1668388, ar=0x7fffcef3d948, scene=0x7fffc3151008, block=0x7fffc321c008, C=0x7fffd20fae88)
    at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1762
- 4  draw_outliner (C=C@entry=0x7fffd20fae88) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1882
- 5  0x0000000000a77bd7 in outliner_main_region_draw (C=0x7fffd20fae88, ar=0x7fffcef3d948) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/space_outliner.c:278
- 6  0x0000000000cac7a7 in ED_region_do_draw (C=C@entry=0x7fffd20fae88, ar=ar@entry=0x7fffcef3d948) at /home/ralf/Source/blender/blender/source/blender/editors/screen/area.c:518
- 7  0x00000000009eccb4 in wm_method_draw_triple (win=0x7fffceec9288, C=0x7fffd20fae88) at /home/ralf/Source/blender/blender/source/blender/windowmanager/intern/wm_draw.c:557
- 8  wm_draw_update (C=C@entry=0x7fffd20fae88) at /home/ralf/Source/blender/blender/source/blender/windowmanager/intern/wm_draw.c:959
- 9  0x00000000009e8478 in WM_main (C=C@entry=0x7fffd20fae88) at /home/ralf/Source/blender/blender/source/blender/windowmanager/intern/wm.c:495
#10 0x00000000009c61c9 in main (argc=1, argv=0x7fffffffe1d8) at /home/ralf/Source/blender/blender/source/creator/creator.c:521
(gdb) list
1238					break;
1239				default:
1240					UI_icon_draw(x, y, ICON_DOT); break;
1241			}
1242		}
1243		else if (GS(tselem->id->name) == ID_OB) {
1244			Object *ob = (Object *)tselem->id;
1245			switch (ob->type) {
1246				case OB_LAMP:
1247					tselem_draw_icon_uibut(&arg, ICON_OUTLINER_OB_LAMP); break;
(gdb) print tselem->id
$1 = (struct ID *) 0x0
(gdb) print tselem->id->name
Cannot access memory at address 0x20

**System Information** [system-info.txt](https://archive.blender.org/developer/F321689/system-info.txt) **Blender Version** Broken: c06d3b6 Worked: unknown **Short description of error** When using my own [userpref.blend](https://archive.blender.org/developer/F321690/userpref.blend), blender crashes when running the "purge all" operator. **Exact steps for others to reproduce the error** - replace your own userpref with the one attached above - open blender, create a cube and then delete it so we have a datablock with no user - switch the display type in the outliner to **Orphan Data** - press the **Purge All** button in the header [outliner_purge_crash.diff](https://archive.blender.org/developer/F321696/outliner_purge_crash.diff) Checking tselem->id before that line as in the patch above seems to work fine in my tests, but I am unsure if this is the correct way to deal with this. Maybe the root of the problem lies somewhere else. **Backtrace** ``` Thread 1 "blender" received signal SIGSEGV, Segmentation fault. tselem_draw_icon (block=block@entry=0x7fffc321c008, xmax=xmax@entry=167, x=111.099998, y=-43.7999992, te=te@entry=0x7fffc2f71b08, alpha=alpha@entry=0.5, tselem=0x7fffcef56070, tselem=0x7fffcef56070, tselem=0x7fffcef56070) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1243 1243 else if (GS(tselem->id->name) == ID_OB) { (gdb) bt #0 tselem_draw_icon (block=block@entry=0x7fffc321c008, xmax=xmax@entry=167, x=111.099998, y=-43.7999992, te=te@entry=0x7fffc2f71b08, alpha=alpha@entry=0.5, tselem=0x7fffcef56070, tselem=0x7fffcef56070, tselem=0x7fffcef56070) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1243 #1 0x0000000000a7a6b2 in outliner_draw_iconrow (C=C@entry=0x7fffd20fae88, block=block@entry=0x7fffc321c008, scene=scene@entry=0x7fffc3151008, soops=soops@entry=0x7fffd1668388, level=level@entry=0, xmax=167, offsx=0x7fffffffde40, ys=-46, lb=0x7fffc2f71570) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1395 #2 0x0000000000a7aeb6 in outliner_draw_tree_element (C=C@entry=0x7fffd20fae88, block=block@entry=0x7fffc321c008, fstyle=fstyle@entry=0x7fffcef80db8, scene=scene@entry=0x7fffc3151008, ar=ar@entry=0x7fffcef3d948, soops=soops@entry=0x7fffd1668388, te=0x7fffc2f71558, startx=0, starty=0x7fffffffdef4, te_edit=0x7fffffffdef8) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1625 #3 0x0000000000a7cd65 in outliner_draw_tree (te_edit=0x7fffffffdef8, soops=0x7fffd1668388, ar=0x7fffcef3d948, scene=0x7fffc3151008, block=0x7fffc321c008, C=0x7fffd20fae88) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1762 - 4 draw_outliner (C=C@entry=0x7fffd20fae88) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/outliner_draw.c:1882 - 5 0x0000000000a77bd7 in outliner_main_region_draw (C=0x7fffd20fae88, ar=0x7fffcef3d948) at /home/ralf/Source/blender/blender/source/blender/editors/space_outliner/space_outliner.c:278 - 6 0x0000000000cac7a7 in ED_region_do_draw (C=C@entry=0x7fffd20fae88, ar=ar@entry=0x7fffcef3d948) at /home/ralf/Source/blender/blender/source/blender/editors/screen/area.c:518 - 7 0x00000000009eccb4 in wm_method_draw_triple (win=0x7fffceec9288, C=0x7fffd20fae88) at /home/ralf/Source/blender/blender/source/blender/windowmanager/intern/wm_draw.c:557 - 8 wm_draw_update (C=C@entry=0x7fffd20fae88) at /home/ralf/Source/blender/blender/source/blender/windowmanager/intern/wm_draw.c:959 - 9 0x00000000009e8478 in WM_main (C=C@entry=0x7fffd20fae88) at /home/ralf/Source/blender/blender/source/blender/windowmanager/intern/wm.c:495 #10 0x00000000009c61c9 in main (argc=1, argv=0x7fffffffe1d8) at /home/ralf/Source/blender/blender/source/creator/creator.c:521 (gdb) list 1238 break; 1239 default: 1240 UI_icon_draw(x, y, ICON_DOT); break; 1241 } 1242 } 1243 else if (GS(tselem->id->name) == ID_OB) { 1244 Object *ob = (Object *)tselem->id; 1245 switch (ob->type) { 1246 case OB_LAMP: 1247 tselem_draw_icon_uibut(&arg, ICON_OUTLINER_OB_LAMP); break; (gdb) print tselem->id $1 = (struct ID *) 0x0 (gdb) print tselem->id->name Cannot access memory at address 0x20 ```

Ralf Hölzemer commented

2016-07-11 21:40:38 +02:00

Changed status to: 'Open'