Clearing followed by setting a listbox created by UILayout.prop_search while keeping the mouse on the listbox crashes Blender #53845

New Issue

Elias Vanderstuyft · 2018-01-20T17:03:06+01:00

2018-01-20 17:03:06 +01:00

System Information
OS: Ubuntu 16.04 x86_64
Gfx: Intel HD Graphics 530 (Skylake GT2) (driver: GL 4.5 (Core Profile) Mesa 17.3.0-devel)

Blender Version
Broken:

2.79-42a562496b5-linux-glibc219-x86_64 (latest build)
2.79-5bd8ac9abfa-linux-glibc219-x86_64
2.76b

Short description of error
Clearing followed by setting a listbox created by UILayout.prop_search while keeping the mouse on the listbox either crashes Blender or leads to unexpected behaviour.

Exact steps for others to reproduce the error
Consistently reproducible.

Open the default startup blender file
Open a textblock and paste and run the code provided in Appendix A
In the 3D viewport, press SPACE and type "Crashable", then select "Crashable Operator" => at the right an operator panel will be drawn
In the operator panel, click on the field next to "Obj:" and select e.g., "Camera" from the list
Click the X sign right to "Camera" while keeping the mouse pointer pointed at the field
Click again on the field

Expected behaviour of step 6.
Step 6 should be able to behave as step 4, i.e., one should be able to again select something from a non-empty list

Observed behaviour after step 6
One of following, probably depending on how Blender's memory was allocated:

Crash
The list is empty

Appendix A

import bpy


class CrashableOperator(bpy.types.Operator):
    bl_idname = "object.crashable_operator"
    bl_label = "Crashable Operator"
    bl_options = {'REGISTER', 'UNDO'}

    obj = bpy.props.StringProperty(name="Obj")

    def draw(self, context):
        self.layout.prop_search(self, "obj", context.scene, "objects")

    def execute(self, context):
        return {'FINISHED'}


def register():
    bpy.utils.register_class(CrashableOperator)


def unregister():
    bpy.utils.unregister_class(CrashableOperator)


if __name__ == "__main__":
    register()

Terminal output upon crash

$ blender
Read new prefs: /home/elias/.config/blender/2.76/config/userpref.blend
Writing: /tmp/blender.crash.txt
Segmentation fault (core dumped)

Contents of "blender.crash.txt"

# Blender 2.76 (sub 0), Commit date: 1970-01-01 00:00, Hash unknown
bpy.context.area.type = 'TEXT_EDITOR'  # Property
bpy.ops.text.run_script()  # Operator
bpy.ops.object.crashable_operator()  # Operator
bpy.ops.object.crashable_operator(obj="Camera")  # Operator
bpy.ops.object.crashable_operator(obj="")  # Operator
bpy.ops.object.crashable_operator(obj="")  # Operator

# backtrace
blender(BLI_system_backtrace+0x30) [0x1361b10]
blender() [0x97a98e]
/lib/x86_64-linux-gnu/libc.so.6(+0x354b0) [0x7f242a7894b0]
blender(rna_ID_refine+0x4) [0x11bac84]
blender(rna_pointer_inherit_refine+0x66) [0x11a9af6]
blender() [0x1273ae2]
blender(RNA_property_collection_begin+0x15c) [0x11b161c]
blender() [0xb654ae]
blender(ui_searchbox_update+0x6a) [0xb7514a]
blender() [0xb57089]
blender() [0xb59f6d]
blender() [0xb5a027]
blender() [0xb5d7ad]
blender() [0xb5ebe6]
blender() [0xb5f433]
blender() [0x985e81]
blender() [0x986251]
blender(wm_event_do_handlers+0x5f6) [0x9868e6]
blender(WM_main+0x18) [0x97cfd8]
blender(main+0xef4) [0x95ce04]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0) [0x7f242a774830]
blender(_start+0x29) [0x97a2b9]

**System Information** OS: Ubuntu 16.04 x86_64 Gfx: Intel HD Graphics 530 (Skylake GT2) (driver: GL 4.5 (Core Profile) Mesa 17.3.0-devel) **Blender Version** Broken: - 2.79-42a562496b5-linux-glibc219-x86_64 (latest build) - 2.79-5bd8ac9abfa-linux-glibc219-x86_64 - 2.76b **Short description of error** Clearing followed by setting a listbox created by UILayout.prop_search while keeping the mouse on the listbox either crashes Blender or leads to unexpected behaviour. **Exact steps for others to reproduce the error** Consistently reproducible. 1. Open the default startup blender file 2. Open a textblock and paste and run the code provided in Appendix A 3. In the 3D viewport, press SPACE and type "Crashable", then select "Crashable Operator" => at the right an operator panel will be drawn 4. In the operator panel, click on the field next to "Obj:" and select e.g., "Camera" from the list 5. Click the X sign right to "Camera" while keeping the mouse pointer pointed at the field 6. Click again on the field **Expected behaviour of step 6.** Step 6 should be able to behave as step 4, i.e., one should be able to again select something from a non-empty list **Observed behaviour after step 6** One of following, probably depending on how Blender's memory was allocated: - Crash - The list is empty **Appendix A** ``` import bpy class CrashableOperator(bpy.types.Operator): bl_idname = "object.crashable_operator" bl_label = "Crashable Operator" bl_options = {'REGISTER', 'UNDO'} obj = bpy.props.StringProperty(name="Obj") def draw(self, context): self.layout.prop_search(self, "obj", context.scene, "objects") def execute(self, context): return {'FINISHED'} def register(): bpy.utils.register_class(CrashableOperator) def unregister(): bpy.utils.unregister_class(CrashableOperator) if __name__ == "__main__": register() ``` **Terminal output upon crash** ``` $ blender Read new prefs: /home/elias/.config/blender/2.76/config/userpref.blend Writing: /tmp/blender.crash.txt Segmentation fault (core dumped) ``` **Contents of "blender.crash.txt"** ``` # Blender 2.76 (sub 0), Commit date: 1970-01-01 00:00, Hash unknown bpy.context.area.type = 'TEXT_EDITOR' # Property bpy.ops.text.run_script() # Operator bpy.ops.object.crashable_operator() # Operator bpy.ops.object.crashable_operator(obj="Camera") # Operator bpy.ops.object.crashable_operator(obj="") # Operator bpy.ops.object.crashable_operator(obj="") # Operator # backtrace blender(BLI_system_backtrace+0x30) [0x1361b10] blender() [0x97a98e] /lib/x86_64-linux-gnu/libc.so.6(+0x354b0) [0x7f242a7894b0] blender(rna_ID_refine+0x4) [0x11bac84] blender(rna_pointer_inherit_refine+0x66) [0x11a9af6] blender() [0x1273ae2] blender(RNA_property_collection_begin+0x15c) [0x11b161c] blender() [0xb654ae] blender(ui_searchbox_update+0x6a) [0xb7514a] blender() [0xb57089] blender() [0xb59f6d] blender() [0xb5a027] blender() [0xb5d7ad] blender() [0xb5ebe6] blender() [0xb5f433] blender() [0x985e81] blender() [0x986251] blender(wm_event_do_handlers+0x5f6) [0x9868e6] blender(WM_main+0x18) [0x97cfd8] blender(main+0xef4) [0x95ce04] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0) [0x7f242a774830] blender(_start+0x29) [0x97a2b9] ```

Elias Vanderstuyft commented

2018-01-20 17:03:06 +01:00

Added subscriber: @Eliasvan

Philipp Oeser commented

2018-01-20 17:35:58 +01:00

Added subscriber: @lichtwerk

Philipp Oeser commented

2018-01-20 17:35:58 +01:00

can confirm list is empty in master (cant get it to crash here), sometimes theres an entry with a garbled name [accessing bad memory?]
2.79 and below crash. will have a closer look later.

can confirm list is empty in master (cant get it to crash here), sometimes theres an entry with a garbled name [accessing bad memory?] 2.79 and below crash. will have a closer look later.

Campbell Barton commented

2018-01-22 13:26:57 +01:00

Added subscriber: @ideasman42

Campbell Barton commented

2018-01-22 13:26:57 +01:00

@lichtwerk do you have address sanitizer setup? - it shows the cause fairly clearly the cause of the error, though exactly how to fix isn't obvious.

Philipp Oeser commented

2018-01-22 13:37:53 +01:00

@ideasman42 : thx for the tip, will do in 3hrs and check again

Philipp Oeser commented

2018-01-22 20:29:32 +01:00

OK, that ASAN is really useful! (already have a couple of other reports in mind on where to use it...)
In this particular case/report I'm still examining those two codepaths (where allocated and where freed) in more depth. Lots of (new) stuff to read for me and wrap my head around, but I'm on it...

OK, that ASAN is really useful! (already have a couple of other reports in mind on where to use it...) In this particular case/report I'm still examining those two codepaths (where allocated and where freed) in more depth. Lots of (new) stuff to read for me and wrap my head around, but I'm on it...

Richard Antalik commented

2020-02-10 18:07:15 +01:00

Added subscriber: @iss

Richard Antalik commented

2020-02-10 18:07:15 +01:00

Not sure if this is somehow reproducible in 2.8, but haven't tested with ASAN yet.

Sybren A. Stüvel commented

2020-02-11 12:05:58 +01:00

Added subscriber: @dr.sybren

Sybren A. Stüvel commented

2020-02-11 12:05:58 +01:00

Changed status from 'Confirmed' to: 'Needs User Info'

Sybren A. Stüvel commented

2020-02-11 12:05:58 +01:00

I can't reproduce this issue in 2.79b or latest master (be8879718e). This is the blend file I used: #53845-clear-listbox-ui-crash.blend

@Eliasvan Please check that the latest Blender build from https://builder.blender.org/ still crashes on this. If it does, please give us the exact steps to reproduce the issue.

I can't reproduce this issue in 2.79b or latest master (be8879718e24e417d299eb298b8a9d4d2ca324ee). This is the blend file I used: [#53845-clear-listbox-ui-crash.blend](https://archive.blender.org/developer/F8334556/T53845-clear-listbox-ui-crash.blend) @Eliasvan Please check that the latest Blender build from https://builder.blender.org/ still crashes on this. If it does, please give us the exact steps to reproduce the issue.

Campbell Barton commented

2020-02-20 06:34:33 +01:00

Changed status from 'Needs User Info' to: 'Confirmed'

Campbell Barton commented

2020-02-20 06:34:33 +01:00

The crash is being blocked by #69200 (Resetting default value does not work in popovers or menus), with this fix applied, the error can still be redone:

A naive fix to redo the error.

diff --git a/source/blender/editors/interface/interface_handlers.c b/source/blender/editors/interface/interface_handlers.c
index 7332f3ee776..7134cc189e0 100644
--- a/source/blender/editors/interface/interface_handlers.c
+++ b/source/blender/editors/interface/interface_handlers.c
@@ -8227,12 +8227,28 @@ static bool ui_context_rna_button_active_test(uiBut *but)
 }
 static uiBut *ui_context_rna_button_active(const bContext *C)
 {
-  return ui_context_button_active(CTX_wm_region(C), ui_context_rna_button_active_test);
+  ARegion *ar_array[] = {CTX_wm_menu(C), CTX_wm_region(C)};
+  uiBut *but = NULL;
+  for (int i = 0; i < ARRAY_SIZE(ar_array); i++) {
+    but = ui_context_button_active(ar_array[i], ui_context_rna_button_active_test);
+    if (but) {
+      break;
+    }
+  }
+  return but;
 }
 
 uiBut *UI_context_active_but_get(const struct bContext *C)
 {
-  return ui_context_button_active(CTX_wm_region(C), NULL);
+  ARegion *ar_array[] = {CTX_wm_menu(C), CTX_wm_region(C)};
+  uiBut *but = NULL;
+  for (int i = 0; i < ARRAY_SIZE(ar_array); i++) {
+    but = ui_context_button_active(ar_array[i], NULL);
+    if (but) {
+      break;
+    }
+  }
+  return but;
 }
 
 uiBut *UI_region_active_but_get(ARegion *ar)

The crash is being blocked by #69200 (Resetting default value does not work in popovers or menus), with this fix applied, the error can still be redone: A naive fix to redo the error. ``` diff --git a/source/blender/editors/interface/interface_handlers.c b/source/blender/editors/interface/interface_handlers.c index 7332f3ee776..7134cc189e0 100644 --- a/source/blender/editors/interface/interface_handlers.c +++ b/source/blender/editors/interface/interface_handlers.c @@ -8227,12 +8227,28 @@ static bool ui_context_rna_button_active_test(uiBut *but) } static uiBut *ui_context_rna_button_active(const bContext *C) { - return ui_context_button_active(CTX_wm_region(C), ui_context_rna_button_active_test); + ARegion *ar_array[] = {CTX_wm_menu(C), CTX_wm_region(C)}; + uiBut *but = NULL; + for (int i = 0; i < ARRAY_SIZE(ar_array); i++) { + but = ui_context_button_active(ar_array[i], ui_context_rna_button_active_test); + if (but) { + break; + } + } + return but; } uiBut *UI_context_active_but_get(const struct bContext *C) { - return ui_context_button_active(CTX_wm_region(C), NULL); + ARegion *ar_array[] = {CTX_wm_menu(C), CTX_wm_region(C)}; + uiBut *but = NULL; + for (int i = 0; i < ARRAY_SIZE(ar_array); i++) { + but = ui_context_button_active(ar_array[i], NULL); + if (but) { + break; + } + } + return but; } uiBut *UI_region_active_but_get(ARegion *ar) ```

Mysteryem commented

2022-09-16 23:22:42 +02:00

Added subscriber: @Mysteryem-2

Mysteryem commented

2022-09-16 23:22:42 +02:00

It looks like some updates to Blender in 2.81.x altered the effect of this issue. Testing on 2.81.16, 2.82.7, 2.83.19, 2.90.1, 2.91.0, 2.93.7 and 3.3.0 on Windows 10 (with the same script, except defining the StringProperty as an annotation instead of using assignment), no crash occurs, instead, the 'redo toolbar panel' closes itself when the 'x' of the property is clicked. 2.80.75 is the newest version that crashed for me, though I didn't test any older versions of 2.81.x.

Philipp Oeser removed the

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Clearing followed by setting a listbox created by UILayout.prop_search while keeping the mouse on the listbox crashes Blender #53845